CheckPoint Acquires Snort

bobdehnhardt writes "The Snort-announce list was burning with the news that CheckPoint has signed an agreement to acquire Sourcefire, the commercial arm of the Snort community. As part of the agreement, CheckPoint will "continue to develop and distribute Snort under the GPL, improve and document the program to stay on the cutting edge and expand the snort.org web site." Here is a message from Snort creator Marty Roesch."

" Here is a message from Snort creator Marty Roesc

[b1gk1tty (670514)]

" Here is a message from Snort creator Marty Roesch."

I'm rich I'm rich I'm filthy f*ckin rich!

Re:" Here is a message from Snort creator Marty Ro

[Stephen Samuel (106962)]

I can hear this loud sniffing sound coming from.....

(not that I'd suggest that Marty uses cocaine, just that his company is being snorted up, so to speak)

Re:" Here is a message from Snort creator Marty Ro

[Chris Mattern (191822)]

And, of course, the classic.

"Do you like my hat? It's made of money! Would you like to stay for lunch? I think we're having MONEY!"

Loopholes

[diogenesx (580716)]

Even with such language, does that stop them from forking the sources and creating a new closed source program with a new name?

Re:Loopholes

[0racle (667029)]

You might want to look into something called dual-licensing. The owner of the copyright can do whatever they please with what they own.

Re:Loopholes

[monkeydo (173558)]

No, it doesn't. The owner of the copyright can stop releasing new versions under the GPL. Any code already licensed under the GPL would remain so, but nothing stops them from making all new versions closed, or something in between.

Re:Loopholes

[FidelCatsro (861135)]

Unless they accepted patches from a third party not directly involved in the project , They would need to track down each and every person that had (and acquire their blessing) or each and every code snippet and remove it .
This is the same problem which faces the linux Kernel if they wished to move it to the GPL3

Re:Loopholes

[temojen (678985)]

Except having to chase down every person who ever submitted code, to ask for permission.

makes sense

[spurious cowherd (104353)]

"We believe Sourcefire has world-class solutions for internal security through their Intrusion Sensor, Real-time Network Awareness (RNA), and Defense Center product lines.

Checkpoint needs this type of network awareness technology to keep up with Cisco
I know they lost my company's contract because the network admins like the way Cisco stuff integrates

I'll start by stating again what I've stated in the past, Snort is now and will continue to be free to end-users. We will continue to develop and distribute the Snort engine under the GPL, improve and document the program to stay on the cutting edge and expand the snort.org web site. The community continues, as always, to be important to us as a group of people who use the code pervasively throughout the entire Internet, report on problems and make suggestions and contributions to the project.

This is critical to me for many reason. It's good to see. Marty is a man of integrity & I'll bet this is in the aquisition contract

Check Point to acquire privately held Sourcefire for a total consideration of approximately $225 million.

Who says you can't make money from FOSS?
Marty deserves the fiduciary rewards he'll get for all his hard work over the years

Snort... hrmm

[Lucractius (649116)]

So CheckPoint is Snorting now is it... Do the cops now, have the DEA been called in to raid their offices.

Oh no!

[wootest (694923)]

Does that mean my father will have to pay for permission when he chuckles?

no big deal

[qwertphobia (825473)]

This is no big deal. Snort will continue to be GPL and freely available to the world.

I'm more worried about the recent Nessus changes, have you heard about this?
Nessus License Change Announcement [nessus.org]

Nessus 2 will continue to be free
Nessus 3 will be a free of charge, binary only release

Re:no big deal

[Kevin Burtch (13372)]

Closed-source penetration testing software?
I sure won't be using that version... and I love nessus!

My friend was acquired by a Checkpoint

[DrugCheese (266151)]

when he tried to cross the border with snort.

in other news...

[portscan (140282)]

checkpoint has had yet another security breach. this time, instead of all of their background records being released onto the internet, the source code of their newly acquired security tool, "snort" was released onto the internet. many have already downloaded this and started using free of charge, not to mention modifying it as they see fit and redistributing it also free of charge. this is a truly embarassing second offense for the security company.

CheckPoint bought ZoneAlarm and screwed it up

[loggia (309962)]

I see nothing positive about Snort being acquired by CheckPoint.

CheckPoint bought Zone Labs a couple of years ago and Zone Alarm went from being a rock solid firewall to an absolute mess. There are so many problems with the new version of Zone Alarm that their forums are filled with complaints.

Kate Moss

[by Anonymous Coward]

Kate Moss unavailable for comment.

Re:while snort is a fine piece of software ...

[j_kenpo (571930)]

Which is why you run Snort with full packet logging mode in addition to alert mode. This way, if an alert is missed, you can still see all packets sent in an attack and build an alert from that. Just make sure you have enough storage space.

Re:while snort is a fine piece of software ...

[b0r1s (170449)]

It's worth mentioning that it's possible to trigger on known attack VECTORS rather than just known attacks - that is, on some vulnerabilities, all possible attacks will have a single signature at some point in the packet, which WILL be triggered. Moreover, some PROTOCOLS will always have the same signature, which may be hit as byproducts of the attack (ie: if I see an IRC packet coming from a webserver, I'm going to alert no matter what port it's on, or where it's going, because it shouldn't be there, period).

Snort can be bypassed in many scenarios, but it's still very useful.

Umm

[temojen (678985)]

Since most attacks are based on known techniques, it can detect a lot of new attacks, such as anything that includes:

(lots of nulls)

const char * what = "/bin/sh";

where: push what;
push EXEC;
call syscall;

(some junk)
&where

On a whole lot of architectures, regardless of port. Which means it catches just about any stack-smashing attack that's not SSL encapsulated, regardless of service and whether it's known.

Re:while snort is a fine piece of software ...

[PGillingwater (72739)]

Plus you might find that a shellcode exploit requires a shellcode sled, which can be detected. And many of the people who use Snort might not know that Sourcefire has made a major innovation with RNA -- a passive traffic analysis system which tells you what hosts are in your LAN, and what ports are being used -- kind of like NTOP, but with better consolidation and reporting.

You also need a benchmark of legit activity.

[khasim (1285)]

Everything happening on your network should be authorized by you. If you're worried about security, then you need to get some benchmarks of the legitimate traffic on your network so you can have the system watch for different patterns.

Re:You also need a benchmark of legit activity.

[Tom (822)]

so you can have the system watch for different patterns.

Like someone reading a different e-mail than yesterday? ;-)

Sorry, half-joking there. The problem still is that for any somewhat complicated (i.e. real-life) network, there will be a huge volume of different patterns. You end up doing one of two things:

* Spending huge amounts of time setting up the initial patterns and then updating them every time something small changes

* Going to a level of abstraction where attacks can slip through, so you're no bett

Re:More info from Checkpoint

[monkeydo (173558)]

Since when does copying a link from the article summary qualify as "more information" and get modded informative?

Re:Checkpoint and Linux

[mpathetiq (726625)]

Checkpoint built their own version of Linux called SecurePlatform specifically for running their firewall, management tools, and other software. Quite often, the GUI and end user tools only ran on Windows, but the real meat-and-potatoes was usually supported on Linux.