All I saw posted were 3 small strings which WOULD not protect against SQL injections, sorry (and would trigger some massive false positives).

An IPS is the same thing as an IDS but with the 'magic' buzzword of being inline. The same pattern based technology is still being utilized.

agreed. In the vast majority of cases, IDS isn't "good enough" to be IPS. For me, IPS is policy/security enforcement and belongs on a firewall. IDS is policy/security monitoring, which doesn't necessarily need to be inline.

back to the topic...I'm not really looking at detecting/preventing [insert flavor of the day] SQL injection worm. I'm looking at detecting a user using the typical patterns used to test for SQL vulnerabilities. They will almost certainly be easy to evade, but we do what we can.

We're working on improved coverage for SQL injection attacks.

Martin

IPS Signature Team

That would be awesome. Do you mean, "we're thinking about it" or, "we're sorting out the proper engines and regex's to use now"?? ;-)

It means "We're sorting out the proper engines and regex's to use".

SQL injection is quite a problem to catch though, as you basically hand something like source code to an interpreter, which means an attack can be encoded and vary in a thousand different ways. As we do try to create intelligent signatures, instead of simply hunting for fixed and most often easily change strings in a stream, this makes writing signatures for sql injection attacks kind of hard.

Don't be sorry. It doesn't sound like you have a clue what you are taking about anyways. These signatures were pulled from a leading IPS vendors device. Just so you know IPS and IDS are not the same thing. Can I take your star away...

oH whoops.

Let's not get into a squabble about IDS versus IPS, they're market driven terms that mean different things to different people.

You don't provide any context for the regex you provided. What is it specifically designed to detect/protect? It looks like Snort regex, is it? Why not post the whole rule to give some context? I need more than just a regex to create a useful signature.

TradeSecrets:

Please provide the full signature so we can discuss it.