fix(yara): replace prose-colliding webshell strings with family markers (fixes #487) - #488
Open
stefanoamorelli wants to merge 2 commits into
Open
fix(yara): replace prose-colliding webshell strings with family markers (fixes #487)#488stefanoamorelli wants to merge 2 commits into
stefanoamorelli wants to merge 2 commits into
Conversation
`php_webshell_known` matched the bare substrings "behinder" and "WSO " under `any of them`, so ordinary prose produced a CRITICAL YR2 finding at 0.9 confidence with a remediation telling the reader to remove a webshell. The German words "behindert" and "Behinderung" contain the first string, and the product name "WSO 2 Micro Integrator" contains the second, as reported in NVIDIA#487. Behinder is now identified by its hardcoded AES key, md5("rebeyond") truncated to 16 characters, which its PHP, ASP and JSP shells share and which signature-base [1] uses for the same purpose. The key is written as a YARA hex string so the packaged rule file does not carry the indicator in plaintext, in the spirit of the encoded malware rules. WSO is identified by the helper names oRb introduced in 2.x: `wsoEx(`, `WSO_VERSION` and `wsoSecParam`. I checked a WSO 2.5 source against the old and new rule: the old one hit only the banner and the bare "WSO " string, the new one hits the banner and all three helpers, so no known sample is lost. I preferred narrowing the strings over a `fullword` modifier because a document that names the Behinder family would still have scored CRITICAL, and "WSO 2" would still have matched. Fixes NVIDIA#487 [1]: https://github.com/Neo23x0/signature-base Signed-off-by: Stefano Amorelli <stefano@amorelli.tech>
The benign cases are the two reproductions from NVIDIA#487 plus a document that names the Behinder and WSO families without shipping them. The malicious cases are a Behinder PHP shell, a Behinder JSP shell and a WSO fragment carrying `WSO_VERSION` and `wsoEx(`. All six fail against the previous rule: the prose cases fired and the samples were missed, so the tests guard both directions. The samples are base64-encoded like the existing reverse shell fixture so the indicators do not sit in the repository in plaintext. Signed-off-by: Stefano Amorelli <stefano@amorelli.tech>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Skills written in German that include the words "behindert" or "Behinderung" are flagged even if legit, with a CRITICAL
php_webshell_knownfinding, because the rule matched the bare substring "behinder", and "WSO 2 Micro Integrator" hits the same way through "WSO ". I map the two families with Behinder's hardcoded AES key and with WSO'swsoEx(,WSO_VERSIONandwsoSecParamrespectively, and I added tests for both cases.fixes #487