Re: Dectecting Social Security Numbers?

[Adam Levy <grand.admiral () gmail com>]

Without digging in to the structure of the rule, a simple worry that I
had is this:
> alert tcp any any -> any any (msg:"Socail Security Number Clear
Text"; pcre:"m!(\d\d\d[-/]\d\d[-/]\d\d\d\d)\Z!";)

Please note that "Socail" is a potential problem.

Other technical answers forthcoming for sure...

Adam

----- Original Message -----
From: Lyons, Jon <jon_lyons () enh org>
Date: Fri, 10 Sep 2004 13:01:44 -0500
Subject: [Snort-users] Dectecting Social Security Numbers?
To: snort-users () lists sourceforge net

 
 

  

I'm trying to get snort to generate an alert for SS#'s, I've tried the
rule below but no alerts are generated. I tested this with pcretest
and it works…am I missing something?

alert tcp any any -> any any (msg:"Socail Security Number Clear Text";
pcre:"m!(\d\d\d[-/]\d\d[-/]\d\d\d\d)\Z!";)


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users