Re: scanning for emoticons in MSN messenger?

[Eric Zheng <zhengeric () hotmail com>]

Would it be possible to detect when an emoticon is being used without looking at the format of the image being sent?  
Doing so of course without 10 different string check rules for 10 different emoticons.  Basically a single rule to 
acknowledge that an emoticon has been sent.  I'm not sure if it's possible since snort treats an emoticon as plain text 
(ie, a smiley face is read as ":)" ).

Date: Mon, 3 May 2010 08:38:48 -0400
Subject: Re: [Snort-sigs] scanning for emoticons in MSN messenger?
From: jesler () sourcefire com
To: zhengeric () hotmail com
CC: snort-sigs () lists sourceforge net

Eric,
You'd have to grab a pcap of traffic to see what format the emoticon is in.  Then you could write a simple content 
signature.
Joel

On Mon, May 3, 2010 at 3:07 AM, Eric Zheng <zhengeric () hotmail com> wrote:






I want to see if it's possible to make a rule to look for any custom emoticon being sent over MSN messenger.  I believe 
this is possible since a custom emoticon image has to be sent over the network, but I'm not sure how to look for it 
(file type matching? but I don't know what format custom emoticons are in).  I'm new to snort rules but I have been 
familiarizing myself with their syntax and usage.


I believe it would be along the lines of:

alert tcp $EXTERNAL_NET 1863 -> $HOME_NET any (msg:"Emoticon detected"; <emoticon signature>;)

Where <emoticon signature> are the requisites to trigger the alert.  Port 1863 is used for MSN messenger.


Any help would be appreciated, thanks!
                                          
The New Busy is not the too busy. Combine all your e-mail accounts with Hotmail. Get busy.


------------------------------------------------------------------------------


_______________________________________________

Snort-sigs mailing list

Snort-sigs () lists sourceforge net

https://lists.sourceforge.net/lists/listinfo/snort-sigs



                                          
_________________________________________________________________
Hotmail is redefining busy with tools for the New Busy. Get more from your inbox.
http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:WL:en-US:WM_HMP:042010_2

------------------------------------------------------------------------------

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs