Tagged Questions
2
votes
2answers
141 views
Example of malware that spreads via USB? [closed]
I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware ...
4
votes
1answer
76 views
Integrity check against package repository?
I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates.
From time to time I want to boot from a clean boot ...
2
votes
2answers
277 views
Where can I find worm traffic sample?
I have a program that has to detect scanning activity of worms.
I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running ...
2
votes
4answers
341 views
Detecting malware hidden in P2P traffic
Consider a network situation involving (only) Peer to Peer traffic in medium sized network.
For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
1
vote
1answer
157 views
SNMP trap by legitimate program?
Is there any way to tell if this SNMP trap is something created by a legitimate program?
Update: Hex Dump
0000000: 30 82 00 ec 02 01 00 04 06 70 75 62 6c 69 63 a4 82 00 dd 06 82 00 09 2b 06 ...
4
votes
2answers
382 views
Has anyone else seen commands embedded in an ICMP echo request?
My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload.
The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP ...
