Holiday Stream - BOOO TO YOU!

mindflipper · Post by **mindflipper** » Oct Wed 07, 2009 8:39 pm

I'm glad all of that made sense to someone....

can we get a plain english translation of all that?

figment2341 · Post by **figment2341** » Oct Sat 10, 2009 1:17 pm

thanx

Post by **rdeacon** » Oct Sat 10, 2009 11:20 pm

jgarmer wrote:Its possible the host streaming system on a fios network has a exploit on it that is attacking VLC and MPlayer media Players I'm still looking into it. made our intrusion detection system (SNORT) go ape S--t. I have played other streams from this site at work without any issues but this seems to be a redirect to a different source. joe

Joe,

Can you forward that to jcodirewolf. He is running that stream.

Thanks

Rich

jcodirewolf · Post by **jcodirewolf** » Oct Mon 12, 2009 11:31 am

So based on what you posted. It was snort rule 15436 that was hit.

I'm not sure what rules database you are using but the "standard" database says that rule is ....

15436 <-> EXPLOIT IBM Tivoli Storage Manager Express Backup counter heap corruption attempt (exploit.rules, High)

I won't have time today to look into it more. But if you can verify based on your rule set what "exploit" your IDS system thinks is being hit, that would be huge. But on the quick once over, it appears to be a hash collision, and not a real attack.

Update:
Unless the OP has some additional data. This whole thread seems to be a false alarm.

Snort Rule 15436, in the public rule set refers to the following issue. (I had to download the current rules since the OP failed to post the links describing the problem.)

http://www.securityfocus.com/bid/34077
http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-4563
http://www-01.ibm.com/support/docview.w ... wg21377388

Which is enough for me to call this closed.

Looking at all three postings it appears there isn't even an exploit for the problem, it's just a known buffer overflow in TSM. And it's been fixed since since March of this year.

johno

jcodirewolf · Post by **jcodirewolf** » Oct Mon 12, 2009 11:57 am

mindflipper wrote:I'm glad all of that made sense to someone....

can we get a plain english translation of all that?

So the as simple english as I can muster summary is.

Someone (Joe?) has an Intrusion Dectection System (IDS). It's basically a big pattern matching engine. Looking for patterns of either packets or contents of packets which indicate someone has or is trying to break into your equipment (or infect it or whatever...)

His IDS saw something that it says this is matching a pattern I know about and he posted here.

I went and looked up the pattern based on the information he provided. Unless I looked up the wrong pattern/rule. It's an attack against an IBM product called Tivoli Storage Manager, and the attack is not launched for a MP3 stream.

So it's simply a collision between his rules and what happens to be in the stream. A collision in this case means bad guy pattern happens to match a non-bad pattern. There is a real art to writing the patterns, so they match what you are looking for but not so much other stuff that your IDS goes off all the time, but you don't want to set the pattern so tight that all a bad guy has to do is put one random byte at the end of the packet so it no longer matches.

Is that simple/plain enough?

I will try to keep an eye on this thread.

johno

Jacca5660 · Post by **Jacca5660** » Oct Mon 12, 2009 1:45 pm

Now that's a very good explanation of something that can get very complicated.

jcodirewolf · Post by **jcodirewolf** » Oct Mon 12, 2009 2:00 pm

Jacca5660 wrote:Now that's a very good explanation or something that can get very complicated.

Thank you.

Go Gators...

You going to ride in the century in 2 weeks?

http://gccfla.org/gcf/

johno

Jacca5660 · Post by **Jacca5660** » Oct Mon 12, 2009 2:10 pm

If I stilled lived in Florida I'd be there!!

GO GATORS!!

Esmeralda · Post by **Esmeralda** » Oct Fri 30, 2009 9:02 am

It's a bit late now, but next year it'd be great to hear Tower of Terror tracks (including lobby) and Haunted Mansion Holiday on this station!

I've loved hearing Haunted Mansion tracks from other parks (is that Tokyo?! Wish I could go there!) and all the other spooky fun!

jcodirewolf · Post by **jcodirewolf** » Oct Sat 31, 2009 6:17 pm

Okay halloween stream is backup. We lost power this afternoon.

johno

natatomic · Post by **natatomic** » Nov Mon 02, 2009 3:23 pm

Do you have a date set for when the Holiday stream will switch from Halloween to Christmas?

Nicc513 · Post by **Nicc513** » Nov Wed 04, 2009 9:47 am

natatomic wrote:Do you have a date set for when the Holiday stream will switch from Halloween to Christmas?

...and do you know if it will have some of the new Christmas track additions (i.e. the Wilderness Lodge Christmas area loop)?

mindflipper · Post by **mindflipper** » Nov Wed 04, 2009 11:28 am

What happened to "please"?

Hey, Jcodirewolf, can you PLEASE change the holiday stream to Christmas? We all would very much appreciate it. Thanks.

natatomic · Post by **natatomic** » Nov Thu 05, 2009 5:22 pm

^Aw, well I wasn't demanding (or even asking!) FOR it to be changed. I was simply curious as to when!

Nicc513 · Post by **Nicc513** » Nov Fri 06, 2009 1:12 pm

natatomic wrote:^Aw, well I wasn't demanding (or even asking!) FOR it to be changed. I was simply curious as to when!

Ditto. It was a simple inquiry, not a request.