«
Expand/Collapse
72 items tagged "botnet"
Related tags:
microsoft [+],
black hat [+],
zeus [+],
volk [+],
tor [+],
resilient [+],
framework [+],
dennis brown tags [+],
dennis brown [+],
authors [+],
zeus botnet [+],
web servers [+],
usa [+],
tor event [+],
telnet [+],
takedown [+],
storm botnet [+],
ssh [+],
slides [+],
rustock [+],
read [+],
multithread [+],
mitigation [+],
joe stewart tags [+],
joe stewart [+],
host [+],
grum [+],
framework 4 [+],
cross site scripting [+],
chaos communication congress [+],
washington [+],
video [+],
tracking tools [+],
texas man [+],
texas [+],
suspect [+],
security researchers [+],
routers [+],
researchers [+],
norman sandbox [+],
norman [+],
mariposa [+],
malaysia [+],
jose nazario [+],
jose [+],
hack in the box [+],
georg wicherski [+],
fbi [+],
d.c. [+],
chuck norris botnet [+],
chuck norris [+],
carsten willems [+],
bugtraq [+],
botnet detection [+],
audio [+],
zemra [+],
weather [+],
vodafone [+],
vietnamese dissidents [+],
video protocols [+],
variant [+],
two pints [+],
two men [+],
two [+],
turn [+],
tracking [+],
tequila [+],
tdss [+],
tdl [+],
targets [+],
targeted [+],
survey result [+],
survey [+],
stricken [+],
storm [+],
stolen [+],
spammers [+],
spam [+],
spain [+],
sought [+],
smartphones [+],
show [+],
shifts [+],
shift [+],
servers [+],
sends [+],
security authors [+],
security [+],
sean paul correll [+],
sean paul [+],
scottish [+],
russia [+],
rsa [+],
researcher [+],
rent [+],
pwned [+],
protocols [+],
price [+],
plead [+],
percent [+],
pdf [+],
paper [+],
panda security [+],
operators [+],
online [+],
nitol [+],
names [+],
mobile [+],
million [+],
microsoft targets [+],
master [+],
management authors [+],
management [+],
man [+],
major websites [+],
mail [+],
luis corrons [+],
lose [+],
legal [+],
kneber [+],
kelios [+],
kelihos [+],
justive [+],
junk mail [+],
junk [+],
jumps [+],
job [+],
infector [+],
infected [+],
infect [+],
infamous [+],
industry [+],
indestructible [+],
identity [+],
how [+],
hourly [+],
host back [+],
hire springs [+],
herder [+],
hacking [+],
hacker [+],
guilty [+],
google [+],
game servers [+],
from [+],
fraud [+],
foiling [+],
floods [+],
flicks [+],
firms [+],
faq [+],
fake [+],
facebook [+],
eve online [+],
eastern europe [+],
eastern [+],
design flaw [+],
design [+],
department [+],
ddos attacks [+],
ddos [+],
day [+],
david anthony edwards [+],
data [+],
darknet [+],
cybercrooks [+],
crooks [+],
crime spree [+],
create [+],
correll [+],
coreflood [+],
command execution [+],
command [+],
clueless [+],
click [+],
clean [+],
china [+],
catch [+],
broadband routers [+],
broadband [+],
briefly [+],
boxes [+],
botnets [+],
blueprint [+],
beats [+],
battlefield [+],
based [+],
authorities [+],
asia [+],
arrests [+],
army [+],
anthony edwards [+],
android [+],
aka alureon [+],
after [+],
accusations [+],
Issues [+],
Hardware [+],
64 bit windows [+],
malware [+]
-
-
21:46
»
SecDocs
Authors:
Georg Wicherski Tags:
malware botnet Event:
Chaos Communication Congress 23th (23C3) 2006 Abstract: Botnets are one of the most buzzy buzzwords out there today in the computer security world. The presented approach allows us to take reliably care of these, such that managers hopefully will not react on ``botnet'' in 2008 any more. This technology allows for automated catching of malware with the now somewhat known nepenthes daemon, automated analysis with CWSandbox and other sandboxes, automated botnet snooping with the botsnoopd daemon and finally (semi-)automated mitigation using various weapons. Hopefully, our autonomous approach will never turn against the human race and begin the final war... This presentation explains the various components of our approach to botnet detection and mitigation from the beginning to the end in detail. First, we will have a look at nepenthes; see how it has evolved, works and also point out some weaknesses. nepenthes is a versatile tool for malware collection and available under the GPL license at . Although, people have presented on it on various conferences, this tool is still not known by a lot of malware researchers. Additionally, most presentation focus on the results you can achive with nepenthes, whereas this presentation will show you how it really works. The next step in botnet mitigation then is to sandbox the malware to gather information about the botnet itself, e.g. server hostname, channel names or for other types of botnet, the other relevant information for connecting to it. Our current approach is based on the CWSandbox developed by Carsten Willems at the RWTH Aachen, not available to the public. We however also work with the Chinese Honeynet Project's work (MWSniffer), experiment with Norman's work (Norman Sandbox) and plan to include Emsi's work in the future (CodeKnigge). After sandboxing the malware, we automatically connect into the botnet and snoop all relevant commands, traffic and generate statistics (some fancy charts that is). This allows us to generate statistics about DDoS attacks carried out throug monitored botnets, gather intelligences about identity theft and provide LEOs with relevant information (the most reliable way to mitigate botnets). We closely cooperate with the ShadowServer crew for botnet monitoring. Once a botnet has been identified as a severe threat to the Internet, it can be shut down (semi-) automatically. Since we wanted to stay away from a solely automated atomar weapon, which might be fooled to be autonomously fired at Washington, D.C., we still have to confirm the mitigation process. Mitigation involves notification of involved ASNs, botnet sinkholing and DNS poisoning. Additionally, cooperation with some German ISPs will hopefully enable us to cut off infected clients from the Internet in the future.
-
21:46
»
SecDocs
Authors:
Georg Wicherski Tags:
malware botnet Event:
Chaos Communication Congress 23th (23C3) 2006 Abstract: Botnets are one of the most buzzy buzzwords out there today in the computer security world. The presented approach allows us to take reliably care of these, such that managers hopefully will not react on ``botnet'' in 2008 any more. This technology allows for automated catching of malware with the now somewhat known nepenthes daemon, automated analysis with CWSandbox and other sandboxes, automated botnet snooping with the botsnoopd daemon and finally (semi-)automated mitigation using various weapons. Hopefully, our autonomous approach will never turn against the human race and begin the final war... This presentation explains the various components of our approach to botnet detection and mitigation from the beginning to the end in detail. First, we will have a look at nepenthes; see how it has evolved, works and also point out some weaknesses. nepenthes is a versatile tool for malware collection and available under the GPL license at . Although, people have presented on it on various conferences, this tool is still not known by a lot of malware researchers. Additionally, most presentation focus on the results you can achive with nepenthes, whereas this presentation will show you how it really works. The next step in botnet mitigation then is to sandbox the malware to gather information about the botnet itself, e.g. server hostname, channel names or for other types of botnet, the other relevant information for connecting to it. Our current approach is based on the CWSandbox developed by Carsten Willems at the RWTH Aachen, not available to the public. We however also work with the Chinese Honeynet Project's work (MWSniffer), experiment with Norman's work (Norman Sandbox) and plan to include Emsi's work in the future (CodeKnigge). After sandboxing the malware, we automatically connect into the botnet and snoop all relevant commands, traffic and generate statistics (some fancy charts that is). This allows us to generate statistics about DDoS attacks carried out throug monitored botnets, gather intelligences about identity theft and provide LEOs with relevant information (the most reliable way to mitigate botnets). We closely cooperate with the ShadowServer crew for botnet monitoring. Once a botnet has been identified as a severe threat to the Internet, it can be shut down (semi-) automatically. Since we wanted to stay away from a solely automated atomar weapon, which might be fooled to be autonomously fired at Washington, D.C., we still have to confirm the mitigation process. Mitigation involves notification of involved ASNs, botnet sinkholing and DNS poisoning. Additionally, cooperation with some German ISPs will hopefully enable us to cut off infected clients from the Internet in the future.
-
-
17:05
»
Packet Storm Security Recent Files
This program uses multithreading to scan a range of IP addresses (IPv4) to find telnet/ssh and web servers. It then brute forces credentials against the host and upon success, will detect the type of host and execute commands.
-
17:05
»
Packet Storm Security Tools
This program uses multithreading to scan a range of IP addresses (IPv4) to find telnet/ssh and web servers. It then brute forces credentials against the host and upon success, will detect the type of host and execute commands.
-
17:05
»
Packet Storm Security Misc. Files
This program uses multithreading to scan a range of IP addresses (IPv4) to find telnet/ssh and web servers. It then brute forces credentials against the host and upon success, will detect the type of host and execute commands.
-
-
21:04
»
SecDocs
Tags:
botnet DDoS DoS Event:
Chaos Communication Congress 26th (26C3) 2009 Abstract: Many years of hosting BBS's, ISP's, websites, game servers, forums, irc networks, and online communities. I've accrued experience dealing with the negative influences of DoS/DDoS, botnets, trolls, flooders, spammers, phishers, and the whole lot. I want to talk about the challenges, and victories. Using whatever tools necessary to achieve the goal, basically keeping services up for the users while maintaining security, secrecy/privacy, and balance. Tracking & Attacking/Reporting Botnets, Social Engineering, Dealing with Trolls, Flooders and other negative influences.