Hello, > SmurfLog 1.0 by Bug Lord. A program to assist logging of smurf attacks. Nice.., but from a quick look at the source, there're a few problems: 1. Are you sure that reading from a raw ICMP socket strips the IP options out, and does that on all the operating systems you're trying to support? (I'm not even sure if there's at least one that does so.) If the packets were sent directly by the attacker (and not by the smurf amplifiers), it looks like an attacker might at least avoid detection by sending packets with IP options to change the offset of ICMP header in the data you get from the socket. While this doesn't seem to be a problem for detecting smurf attacks, it probably is a problem if you try to detect direct ping floods also. 2. The code fails to drop its group privileges, because of the wrong order of setuid() and setgid() calls. This doesn't look too dangerous in this case, but still isn't what you meant to code. It's also a bad idea to not check the return value from syscalls, especially ones like setgid(). 3. There're also several "generic" IDS problems in your code, including things pointed out by SNI in their paper (like the fact that this might miss packets under heavy load; probably not really important in the smurf case, but still should be realized), and things I mentioned in my Phrack 53 article (coming "soon", I hope), like the usage of qsort(3) and dynamic memory allocation being dangerous in such applications. There're obviously log flood issues also. Now, why this goes to BugTraq. I would normally reply privately (or even be too lazy to reply at all), but since there was a port scan detection patch mentioned on BugTraq recently, which had some similar problems (the "generic" ones), I thought it's worth pointing people to my little article (too bad it's not out yet), so that they read it before making such tools. BTW, the article uses port scans as an example, and discusses all parts of such a simplified IDS. (Note: I'm not into IDS development, but am tired of seeing broken tools out there, especially Abacus Sentry, which made me finally write this. Your SmurfLog is in fact not that bad.;-) Signed, Solar Designer
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:02:15 PDT