Re: Cyberkit signature

[Patrick Dolan <dolan () cc admin unt edu>]

The signature for the Cyberkit ping looks for an ICMP ping packet with hex AA 
characters as the payload.

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING CyberKit 2.2 
Windows"; content:"|aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa|";itype:8;depth:32; 
reference:arachnids,154; sid:483;  classtype:misc-activity; rev:2;)

This conveniently is also the payload of the Nachi worm's ping:

0000  00 02 b3 98 eb 43 00 04  c0 f8 29 e4 08 00 45 00   .....C.. ..)...E.
0010  00 5c 5c c1 00 00 7f 01  da 5b 81 78 ca 5e 81 78   .\\..... .[.x.^.x
0020  37 35 08 00 a1 73 02 00  ff 36 aa aa aa aa aa aa   75...s.. .6......
0030  aa aa aa aa aa aa aa aa  aa aa aa aa aa aa aa aa   ........ ........
0040  aa aa aa aa aa aa aa aa  aa aa aa aa aa aa aa aa   ........ ........
0050  aa aa aa aa aa aa aa aa  aa aa aa aa aa aa aa aa   ........ ........
0060  aa aa aa aa aa aa aa aa  aa aa                     ........ ..      


On Thursday 21 August 2003 09:46 am, djmurd () cox net wrote:
> Hey there - can any of you please point me to some reliable information
> that says the "cyberkit 2.2" signature is really the Nachia / Welchia worm?
>
> I need some more ammo in order to block ICMP for our network...
> thanks
> - djm
>
> Don Murdoch, Systems Engineer
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: VM Ware
> With VMware you can run multiple operating systems on a single machine.
> WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
> at the same time. Free trial click
> here:http://www.vmware.com/wl/offer/358/0
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
Patrick Dolan
UNT Information Security

PGP ID: E5571154
Primary key fingerprint: 5681 25E4 6BE6 298E 9CF0  6F8D B13B 2456 E557 1154



-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users