Custom IPS signature for TeamViewer

[Andy_G]

Article

Description	Custom IPS signature for TeamViewer
Components	FortiOS 4.0 includes already this capability in the Application Control. Teamviewer client version 2.44, 3.6, 4.1.6507 verified
Steps or Commands	To add a custom IPS signature, go to IPS> Signature>Custom and select Create New. Teamviewer (www.teamviewer.com) is an application for remote-access. It opens big holes especially as it uses dynamic ports (similar to skype) to bypass Firewalls and traverse NAT Devices. As it uses encryption the Signature will trigger the Startup (Login) F-SBID( --name "TeamViewer.RegServer.Login"; --protocol tcp; --dst_port 5938; --flow from_client; --seq =,1,relative; --pattern "|17 24 10 04|"; --within 4,packet; --data_size =9; ) F-SBID( --name "TeamViewer.RegServer.HTTP"; --protocol tcp; --service HTTP; --flow from_client; --pattern "/din.aspx?"; --context uri; --pattern "&client="; --context uri; --no_case; --within 50; --pcre "/s=\d{8}&/i"; --context uri; --distance -70; --within 70; ) You will find additional information about IPS signatures in the related article.