Re: Vulnerability & Exploit Signatures

[MadHat <madhat () unspecific com>]

On Jun 16, 2005, at 7:25 AM, Kelly Dowd wrote:
> I doubt there is any licensing of base signatures between vendors
> (signature engines vary greatly between products, you can't just 'use'
> another products sigs).   You will find that some developers look at
> existing signature sets to get 'ideas', but it's far from a
> one-for-one copy.  Companies must develop their own sigs just like
> they develop their own appliances... it's a total package.

I think he might have meant signature data.  Like does every vendor  
research every attack and vulnerability to create every signature or  
is there a company that sells the data to allow you to create your  
own signatures based on someone else's research.

> -Kelly D.
>
> On 6/14/05, Jackson Yu <jackson.yu () earthlink net> wrote:
>
> > Hi, I'm new to this list, so please bear with my question:
> >
> > ASIC/FPGA/Software/detection techniques aside, I sense that a huge  
> > value of IPS
> > vendors are the lab-type organizations that are constantly  
> > developing new filters
> > in response to new vulnerabilities and exploits.  However, there's  
> > no way that such
> > vendors can "hit the market" if you will with 2000+ filters out on  
> > day
> > one.
> >
> > Do all these vendors license the same set of "base" filters from,  
> > say,
> > Sourcefire / Snort derived rule source in the back?  Is there a  
> > commonality there?  At the end of the day, can I say that "Gee,  
> > most vendors' base set of 1500 IPS signatures are the same, its  
> > just the 300 or so that the vendors have additionally developed on  
> > top of that 1500 that are different!"
> >
> >
> > Thanks
> >
> > Jackson
> >
> >
> >
> > --------------------------------------------------------------------- 
> > -----
> > Test Your IDS
> >
> > Is your IDS deployed correctly?
> > Find out quickly and easily by testing it with real-world attacks  
> > from
> > CORE IMPACT.
> > Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus- 
> > ids_040708
> > to learn more.
> > --------------------------------------------------------------------- 
> > -----
>
> ---------------------------------------------------------------------- 
> ----
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus- 
> ids_040708
> to learn more.
> ---------------------------------------------------------------------- 
> ----


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------