Been working on a Snort sig to track the big malvertising campaigns responsible for most of our favorite FakeAV installs. The servers return a common form of JavaScript ompression commonly used by jquery and also used by Google and others. Luckily, the servers from google and others are not normally ngix and the ones that are ngix are serving up the javascript with the correct Content-Type instead of text/html. So based on that we created this sig and have had a pretty low FP rate for the
last day or so that has helped us identify the malvertising servers and add them to the egress filters.
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALVERTISING eval(function(p,a,c,k,e,d) JavaScript from ngix Detected"; flow:established,to_client; content:"Server\: nginx"; nocase; offset:15; depth:15; content:"Content-Type\: text/html"; nocase; distance:20; content:"eval(function(p,a,c,k,e,d)"; nocase; distance:50; classtype:bad-unknown; sid:5600046; rev:1;)
Sample packet payload:
00000245 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d HTTP/1.1 200 OK.
00000255 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 30 .Server: nginx/0
00000265 2e 37 2e 36 35 0d 0a 44 61 74 65 3a 20 4d 6f 6e .7.65..D ate: Mon
00000275 2c 20 32 31 20 4a 75 6e 20 32 30 31 30 20 31 33 , 21 Jun 2010 13
00000285 3a 32 39 3a 34 35 20 47 4d 54 0d 0a 43 6f 6e 74 :29:45 G MT..Cont
00000295 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 ent-Type : text/h
000002A5 74 6d 6c 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e tml..Tra nsfer-En
000002B5 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d coding: chunked.
000002C5 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 .Connect ion: kee
000002D5 70 2d 61 6c 69 76 65 0d 0a 58 2d 50 6f 77 65 72 p-alive. .X-Power
000002E5 65 64 2d 42 79 3a 20 50 48 50 2f 35 2e 32 2e 31 ed-By: P HP/5.2.1
000002F5 33 0d 0a 0d 0a 66 37 32 0d 0a 65 76 61 6c 28 66 3....f72 ..eval(f
00000305 75 6e 63 74 69 6f 6e 28 70 2c 61 2c 63 2c 6b 2c unction( p,a,c,k,
00000315 65 2c 64 29 7b 65 3d 66 75 6e 63 74 69 6f 6e 28 e,d){e=f unction(
00000325 63 29 7b 72 65 74 75 72 6e 28 63 3c 61 3f 27 27 c){retur n(c<a?''
00000335 3a 65 28 70 61 72 73 65 49 6e 74 28 63 2f 61 29 :e(parse Int(c/a)
00000345 29 29 2b 28 28 63 3d 63 25 61 29 3e 33 35 3f 53 ))+((c=c %a)>35?S
00000355 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f tring.fr omCharCo
00000365 64 65 28 63 2b 32 39 29 3a 63 2e 74 6f 53 74 72 de(c+29) :c.toStr
00000375 69 6e 67 28 33 36 29 29 7d 3b 69 66 28 21 27 27 ing(36)) };if(!''
00000385 2e 72 65 70 6c 61 63 65 28 2f 5e 2f 2c 53 74 72 .replace (/^/,Str
00000395 69 6e 67 29 29 7b 77 68 69 6c 65 28 63 2d 2d 29 ing)){wh ile(c--)
000003A5 7b 64 5b 65 28 63 29 5d 3d 6b 5b 63 5d 7c 7c 65 {d[e(c)] =k[c]||e
000003B5 28 63 29 7d 6b 3d 5b 66 75 6e 63 74 69 6f 6e 28 (c)}k=[f unction(
000003C5 65 29 7b 72 65 74 75 72 6e 20 64 5b 65 5d 7d 5d e){retur n d[e]}]
Submitted it over to the guys over at ET (EmergingThreats) so it may be in future releases if it is deemed worthy.
Topic: adnet.media.*.com domains - NEW TITLE (Read 48680 times)
