Re: BROWSER-OTHER TRUFFLEHUNTER SFVRT-1024 attack attempt (3:42014:1) alerts

["Joel Esler (jesler)" <jesler () cisco com>]

Charlie,

Can you submit that to us with a pcap so we can take a look?

http://blog.snort.org/2016/11/reporting-false-positives-with-snortorg.html<http://blog.snort.org/2016/11/reporting-false-positives-with-snortorg.html?m=1>

--
Sent from my iPhone

On Mar 17, 2017, at 03:09, Charlie Dyer <charlierwdyer () gmail com<mailto:charlierwdyer () gmail com>> wrote:

Following on from the previous message, the repeating http://<host> in the URI is only present in the 
http.request.full_uri, it does not repeat when using http.request.uri.
It also repeats in the Sourcefire GUI under Full Request URI.

Was this a hastily released rule as I cannot see the SID in any recent release.

On Fri, Mar 17, 2017 at 7:47 AM, Charlie Dyer <charlierwdyer () gmail com<mailto:charlierwdyer () gmail com>> wrote:
Hello

Below are a list of hosts that are the destination of HTTP GETs that are triggering the above rule, obviously not much 
detail on why, can't really post all the URI data but here are a few:

http://media.rightmove.co.ukhttp://media.rightmove.co.uk/dir/1k/505/58618708/505_BAI170129_IMG_06_0000_max_656x437.JPG<http://media.rightmove.co.uk/dir/1k/505/58618708/505_BAI170129_IMG_06_0000_max_656x437.JPG>

http://ib.adnxs.comhttp://ib.adnxs.com/setuid?entity=43&code=4044211960863159294<http://ib.adnxs.com/setuid?entity=43&code=4044211960863159294>

http://sync.adaptv.advertising.comhttp://sync.adaptv.advertising.com/turn_user_sync<http://sync.adaptv.advertising.com/turn_user_sync>?

Weird how the URI has two 'http://&apos; prefixes, in fact all the URIs have this.

Any ideas?

Below are the hosts.

a.tribalfusion.com<http://a.tribalfusion.com>
aax-eu.amazon-adsystem.com<http://aax-eu.amazon-adsystem.com>
ads.stickyadstv.com<http://ads.stickyadstv.com>
ads.yahoo.com<http://ads.yahoo.com>
b.scorecardresearch.com<http://b.scorecardresearch.com>
bat.bing.com<http://bat.bing.com>
bat.r.msn.com<http://bat.r.msn.com>
bcp.crwdcntrl.net<http://bcp.crwdcntrl.net>
beacon-eu-ams3.rubiconproject.com<http://beacon-eu-ams3.rubiconproject.com>
bh.contextweb.com<http://bh.contextweb.com>
cdn.adacado.com<http://cdn.adacado.com>
choices-or.truste.com<http://choices-or.truste.com>
ckm-m.xp1.ru4.com<http://ckm-m.xp1.ru4.com>
dsum.casalemedia.com<http://dsum.casalemedia.com>
dt.adsafeprotected.com<http://dt.adsafeprotected.com>
evtvpaid.bfmio.com<http://evtvpaid.bfmio.com>
ib.adnxs.com<http://ib.adnxs.com>
image2.pubmatic.com<http://image2.pubmatic.com>
impression.mediaiqdigital.com<http://impression.mediaiqdigital.com>
match.adsrvr.org<http://match.adsrvr.org>
media.rightmove.co.uk<http://media.rightmove.co.uk>
ox-d.justpremium.com<http://ox-d.justpremium.com>
p.rfihub.com<http://p.rfihub.com>
pix04.revsci.net<http://pix04.revsci.net>
pixel.adsafeprotected.com<http://pixel.adsafeprotected.com>
pixel.mathtag.com<http://pixel.mathtag.com>
pixel.quantserve.com<http://pixel.quantserve.com>
pixel.rubiconproject.com<http://pixel.rubiconproject.com>
pixel-eu.rubiconproject.com<http://pixel-eu.rubiconproject.com>
sp.adbrn.com<http://sp.adbrn.com>
srv-2017-03-17-07.pixel.parsely.com<http://srv-2017-03-17-07.pixel.parsely.com>
ssum.casalemedia.com<http://ssum.casalemedia.com>
su.addthis.com<http://su.addthis.com>
sync.adaptv.advertising.com<http://sync.adaptv.advertising.com>
sync.mathtag.com<http://sync.mathtag.com>
sync.search.spotxchange.com<http://sync.search.spotxchange.com>
tamil.oneindia.com<http://tamil.oneindia.com>
tapestry.tapad.com<http://tapestry.tapad.com>
tca-115.tca-rtb1.rfihub.net<http://tca-115.tca-rtb1.rfihub.net>
tps20204.doubleverify.com<http://tps20204.doubleverify.com>
tps611.doubleverify.com<http://tps611.doubleverify.com>
trc.taboola.com<http://trc.taboola.com>
w88.espn.com<http://w88.espn.com>
www.google-analytics.com<http://www.google-analytics.com>
www.rightmove.co.uk<http://www.rightmove.co.uk>
www.wtp101.co<http://www.wtp101.co>

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org<http://Slashdot.org>! http://sdm.link/slashdot
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net<mailto:Snort-sigs () lists sourceforge net>
https://lists.sourceforge.net/lists/listinfo/snort-sigs

http://www.snort.org

Please visit http://blog.snort.org for the latest news about Snort!

Visit the Snort.org<http://Snort.org> to subscribe to the official Snort ruleset, make sure to stay up to date to catch 
the most <a href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs

http://www.snort.org

Please visit http://blog.snort.org for the latest news about Snort!

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!