📸 Photo

KINGPIN

Max was excited by Snort. The software was similar to BRO, the Lawrence Berkeley lab project that had helped sniff out Max's BIND attack, and Max knew it could be a game changer for online security. Now white hats could watch in real time for anyone trying to exploit the vulnerabilities discussed on Bugtraq and elsewhere. Snort was like an early-warning system for a network—the computer equivalent of the NORAD radar mesh that monitors America's airspace. All it was lacking was a comprehensive and up-to-date list of attack signatures, so the software would know what to look for.

In the first few months after Snort's release, a disorganized trickle of user-created signatures put the total number at about 200. In a single sleepless night, Max more than doubled the count, whipping up 490 signatures. Some were original, others were improved versions of the existing rules or ports from Dragon IDS, a popular proprietary system. Writing a rule meant identifying unique characteristics in the network traffic produced by a particular attack, like the port number or a string of bytes. For instance, the incantation alert udp any any -> $INTERNAL 31337 (msg: "BackOrifice1-scan"; content: "|ce63 d1d2 16e7 13cf 38a5 a586|"; ) detected black hats trying to use the Cult of the Dead Cow's Back Orifice malware that had so transfixed the crowd at Def Con 6.0. It told Snort that an incoming connection to port 31337, with a particular string of twelve bytes in the network traffic, was someone trying to exploit the back door.

Max put the signatures online as a single file on Whitehats.com, crediting a handful of other security geeks for their contributions, including Ghost23—a nod to his alter ego. Later, he converted the file to a full-fledged database and invited other experts to contribute their own rules. He gave the project the catchy name arachNIDS, for Advanced Reference Archive of Current Heuristics for Network Intrusion Detection Systems.

ArachNIDS was a hit and helped Snort surge to new levels of popularity in the security community, with Max Vision riding the swell to security stardom. As more white hats contributed to the project, it became