I am trying to do a Snort demo and I though it would be nice to detect a real threat. I picked the sasser worm and the jolt/teardrop dos attacks for the demo; no particular reason. Out of the three ...
Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the ...
I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware ...
I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates. From time to time I want to boot from a clean boot ...
I have a program that has to detect scanning activity of worms. I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running ...
Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
Is there any way to tell if this SNMP trap is something created by a legitimate program? Update: Hex Dump 0000000: 30 82 00 ec 02 01 00 04 06 70 75 62 6c 69 63 a4 82 00 dd 06 82 00 09 2b 06 ...
My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload. The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP ...