topic Re: How to create custom vulnerability signature for SIP packets? in General Topics

How to create custom vulnerability signature for SIP packets?

lzolotonos — Thu, 01 Aug 2013 10:02:19 GMT

Hi,

we are trying to create custom vulnerability signature for triggering on the specific string in the udp packet payload with destination port 5060. Unfortunately there is no context for SIP. We used "Pattern Match" and chose "unknown -req-udp-payload" as a context. We applied a Vulnerability protection profile to the security policy (a rule allowing everything) but for some reason this didn't work as we expected. I mean we didn't receive any alert in the Threat log.

Is it possible to use "unknown -req-udp-payload" context for such purpose or it is intended only for the "unknown-udp" applications? Any other idea for creating such signature?

Thanks.

Leonid

Re: How to create custom vulnerability signature for SIP packets?

UhMayYeah — Thu, 01 Aug 2013 12:46:12 GMT

Following Tech note explains usage a each context for creating a Custom Threat Signature

Creating Custom Threat Signatures

Re: How to create custom vulnerability signature for SIP packets?

kprakash — Thu, 01 Aug 2013 12:51:11 GMT

Good Morning,

We have a couple of avenues that you can check for assistance with custom signatures. You can post on the DevCenter (found on our support portal under communities - https://live.paloaltonetworks.com/community/devcenter) or you can request that an official signature be made through Applipedia (http://researchcenter.paloaltonetworks.com/submit-an-application/)

Best regards,

Karthik

Re: How to create custom vulnerability signature for SIP packets?

jvalentine — Thu, 01 Aug 2013 16:48:54 GMT

You'll need to contact TAC and ask for them to open up SIP contexts in custom vulnerability signatures. The SIP contexts are not open to the public today, but could be made available through a content update. The "unknown" contexts you refer to are only applicable to "unknown-tcp" and "unknown-udp" App-IDs. Since your traffic is identified as SIP, your existing custom signature will not match.

Re: How to create custom vulnerability signature for SIP packets?

mikand — Thu, 01 Aug 2013 19:52:21 GMT

By the way, how come that for example the SIP context is closed by default?

Seems like an neverending stream of feature requests to the SE's 😃

Re: How to create custom vulnerability signature for SIP packets?

jvalentine — Thu, 01 Aug 2013 20:16:51 GMT

These aren't the same as Feature Requests that have to be rolled-up to your SE and then coded into the next version of PAN-OS. The contexts already exist and just need to be a.) QA'd for public consumption, and then b.) opened to the public via the weekly content update. I hear you, though. I'd love to see all of the contexts opened up. Then again, in my day-to-day I've been able to create all of the custom App-ID and Vulnerability signatures with the contexts that have already been published.