SHELLCODE x86 NOOP, Snort alert, what would you do?

david lang_2 — Wed, 19 Jan 2005 19:51:45 GMT

Hello,
I have an entry in my Snort log that looks like this:

SHELLCODE x86 NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 207.218.97.235:3415 -> My_IP_Address:80

Beside the obvious like keeping software up-to-date, what would you do to respond to these kinds of activities?

Would you block 207.218.97.0/22 ?

What else?

Thanks.

Re: SHELLCODE x86 NOOP, Snort alert, what would you do?

Dave Falloon — Thu, 20 Jan 2005 20:17:46 GMT

Snort is telling you that someone connected and sent you a NOOP sled to shellcode, used in buffer overflow exploits. The thing I would do is look up where the IP address is registed, in this case:

styx:~$ whois 207.218.97.235

OrgName: Global Crossing
OrgID: GBLX
Address: 14605 South 50th Street
City: Phoenix
StateProv: AZ
PostalCode: 85044-6471
Country: US

Then I'd give them a call/email and tell them about the logs, usually they drop the hammer for you. If you see a lot of traffic from this IP you'll wanna deep six it at your perimeter router.

--Dave

topic Re: SHELLCODE x86 NOOP, Snort alert, what would you do? in Secure OS Software for Linux

SHELLCODE x86 NOOP, Snort alert, what would you do?

Re: SHELLCODE x86 NOOP, Snort alert, what would you do?