Re: Detecting exploits/shellcode

[zav () uni pt (Marco Vaz)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au

Jonas Eriksson wrote:

> Is it possible to detect buffer-overflow exploits beeing sent
> over the network, execpt for having a database of shellcode?
>
> Should it be possible somehow to decode the assembler code
> beeing sent, or am i wrong?
>
> --
> Jonas Eriksson

A database is not a good approach.
machine code sent to a vulnerable machine can be self modifying code (since the
area attacked must be writeble), it can pass on the wire 'encrypted' and
'decrypt' in run-time.

It is possible to analyze the machine code but not just comparing strings.
 shell code can have some key points (like getting the address where code is,
and some system calls) but this can vary a lot.
If the attacker has some brainware he/she can make his own code, diferent from
the more used ones.

Marco Vaz