Here are my updated MyDoom/MIMAIL.R and Variant signatures for Snort

[sam () neuroflux com]

Yes.  I posted an updated set of signatures that match against the three
different body contents yesterday, I believe.

Please note that I have tested these on our perimeter IDS and it has
successfully triggered against infected emails coming in.  I've changed
the destination on these rules to be $EXTERNAL_NET so that it will trigger
if any infected machines inside a network are sending outbound.

As always, YMMV with these signatures.

-Sam

Here they are again:

alert tcp any any -> $EXTERNAL_NET 25 (msg: "VIRUS - MyDoom/MIMAIL.R
Outbound 1"; \
content: "represented in 7-bit ASCII"; \
content: "Content-Type\: application/octet-stream"; \
content: "Content-Transfer-Encoding\: base64"; \
nocase; rev: 4; sid:1000569;)

alert tcp any any -> $EXTERNAL_NET 25 \
(msg: "VIRUS - MyDoom/MIMAIL.R Outbound 2"; content: "Mail transaction
failed"; \
content: "Content-Type\: application/octet-stream"; \
content: "Content-Transfer-Encoding\: base64"; \
nocase; rev: 4; sid:1000570;)

alert tcp any any -> $EXTERNAL_NET 25 (msg: "VIRUS - MyDoom/MIMAIL.R
Outbound 3"; \
content: "The message contains Unicode characters"; \
content: "Content-Type\: application/octet-stream"; \
content: "Content-Transfer-Encoding\: base64"; \
nocase; rev: 4; sid:1000571;)


alert tcp any any -> $EXTERNAL_NET 25 (msg: "VIRUS - MyDoom/MIMAIL.R
Variant Outbound";
 content: "We are sorry your UTF-8 encoding is not supported by the
server"; nocase; rev: 1; sid:1000572;)


> The MyDoom/Novarg virus won't start utilizing port 80 until February 1st
> when it attempts the denial of service on SCO.com.  (See other related
> email.)  But that does, however, pose an interesting question...
>
> Does anyone have a signature for detected the actual infection of
> systems?
>
> I have seen this one:
> alert tcp any any -> any any (msg:"MyDoom"; content: "respresented in
> 7-bit ASCII"; nocase; sid: 1000569; classtype: Possible-VIRUS;)
>
> BUT, according to NAI (http://vil.nai.com/vil/content/v_100983.htm) and
> Symantec
> (http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm
> .html) there are many variations on the infection algorithm.  This one
> apparently only looks for SMTP traffic with "represented in 7-bit ASCII"
> in the packet.
>
> Suggestions?
>
>
> D. Michael Martin, Jr.
> Network Administrator
> University of Montevallo
>
> -----Original Message-----
> From: sam () neuroflux com [mailto:sam () neuroflux com]
> Sent: Monday, January 26, 2004 4:48 PM
> To: Joe Stewart
> Cc: sam () neuroflux com; snort-sigs () lists sourceforge net;
> snort-users () lists sourceforge net
> Subject: [Snort-users] Re: [Snort-sigs] New Worm / Virus -
> WORM_MIMAIL.R?
>
> Interesting.  None of our machines so far that have been infected are
> trying to contact sco.com on port 80.  I'm curious if there are multiple
> varients??
>
> We have identified this virus as the MyDoom/Novarg, and Symantec did
> confirm our submission as such.
>
>
> > On Monday 26 January 2004 4:42 pm, sam () neuroflux com wrote:
> > > All:
> > >
> > > We are experiencing what appears to be a new varient of the MIMAIL
> > > virus. We've had several machines infected now, and I've created a
> > > quick signature:
> >
> > Although Mimail.Q did also come out today, what you're describing is
> > Mydoom/Novarg, which is spreading more rapidly than Mimail from the
> > looks of it. Details from the AV companies are sketchy at this point,
> > but, aside from spreading via SMTP and KaZaA, the copy I looked at
> > appears to start up 63 threads all requesting the index page of
> > www.sco.com every 300 milliseconds.
> >
> > -Joe
> >
> > --
> > Joe Stewart, GCIH
> > Senior Security Researcher
> > LURHQ http://www.lurhq.com/
>
>
>
> -------------------------------------------------------
> The SF.Net email is sponsored by EclipseCon 2004
> Premiere Conference on Open Tools Development and Integration
> See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
> http://www.eclipsecon.org/osdn
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users