Tag Info

Hot answers tagged

33

If you want it analysed for business reasons then you need to find an appropriately skilled forensic incident response consultant (excuse the jargon: 'A log analysis guy'). These generally cost money, lots of it. Bear in mind though that most botnet deployments aren't targeted and are very wide-spread. There probably isn't much to learn about it that isn't ...


28

Stack Exchange has multiple layers of security preventing this. Captchas and email addresses are required. The email check is easy to beat with a script, but the captchas aren't; you'd need a Captcha breaking service to even get this off the ground. None of your bots can vote at the start, so you can't accumulate rep just by posting questions; human eyes ...


25

These logins might be the result of spambots outwitting each other. This scenario doesn't seem that implausible to me: Webmaster sets up a web forum for testing purpose Webmaster forgets that he even did and lets it keep running on some forgotten webspace SpambotA finds the forum, and decides to have some fun with it. It creates tons of accounts with ...


15

Zeus Trojan steals $1 million from U.K. bank accounts. Harmless? But wait, there's more. This was just a single instance. The Zeus trojan captures your keystrokes and implements 'form grabbing' (taking the contents of a form before submission and uploading them to the attacker) in an effort to steal sensitive information (passwords, credit cards, social ...


15

Analysis I downloaded the first URL (http://something.example.com/xx) and ran $ file xx xx: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.15, not stripped So, it's an executable program meant to run on a Linux machine. I assume you are running a Linux server. Next, we want to see what the program does, ...


14

The simple answer is that these are likely to be actual username/password combinations extracted from attacks on other sites. Password lists contain all sorts of weird and wonderful characters and words you might not expect, but the very fact they are on there usually means they are in use, or at least have been in use. These spam bots are simply trying to ...


11

C6C server are often servers that got hacked, not servers rented by the attacker. Security support contracts For public organisations there are often CERTs (computer emergency response team) responsible for them. For example there is the DFN Cert for all Germany universities. Large companies tend to have support contracts with companies specialized in ...


11

I guess something should be noted on the botnet and DDoS. The main interest of the distributed system of the botnet, is that you cannot identify a bot from a genuine client. Think of it like this: Scenario Someone infects many computers by sending a virus. Each tricked user is now part of the so-called botnet. Let's say you have 100M bots. Consequences ...


11

There are so many possibilities for the random-looking passwords, any single explanation will be pure speculation. However, it's safe to assume they were most likely harvested from accounts on various compromised servers. Based on the example passwords you listed in your original question, I'm inclined to think they are either base64-encoded hashes or ...


11

Yes, you are correct. The administrators running reCAPTCHA could request a CAPTCHA from your site and then perform a look-up to see which CAPTCHA was generated for your site and therefore the expected string which validates. The trade-off is that 1) they are probably trustworthy not to be doing this because of the potential damage to reputation if/when ...


10

Contact the FBI, or whoever has jurisdiction over this sort of computer crime where you live. What's being done on your system is a pretty serious crime, and in many places, knowingly failing to report a crime is itself a crime. The last thing you want is for the innocent victims (yourself and your client who you're hosting) to be exposed to legal ...


8

The tricky part is to distinguish between requests from the botnet, and requests from humans who actually want to read the pages. There is no 100% reliable way to do that in all generality, because some DDoS tools are quite good at imitating humans, and also because most humans appear to be quite good at behaving like mindless drones. Nevertheless, that's ...


8

The "user agent" is a string sent by whoever connects to your system -- the antisocial individual. Therefore, you cannot really trust it. Which means that you cannot assume that this client really uses Java. Actually, if the Java version is "all over the map", then this is a strong indication that the client is not using Java. A real Java-based standard HTTP ...


7

My first thought is that if it's a DDoS attack, the source is most likely going to be infected zombie machines that the operator could care less whether they're traceable because they won't lead back to him. I'm sure a good number of black hat users use Tor to try and cover their tracks, but I'm also willing to bet there are more legitimate users on Tor than ...


7

There's no easy way to detect whether your machine is part of a botnet. Instead, the best defense is prevention: avoid getting infected in the first place. There is lots and lots written on how to avoid security breaches, too much to repeat here. For a starter, you could read, e.g., a security guide for non-technical users, Windows hardening, Hardening ...


6

It's unlikely to find open resources that will give you this information in the format you are looking for. However, you may be able to mine that information out of annual reports published by major Antivirus vendors like Microsoft, Symantec, etc. As an example, Microsoft publishes all its findings in its Security Intelligence Reports every 6 months which ...


6

I agree, websites are easier and Conficker, for one, proved that a scheme of random domain name creation can be used to set up C&C servers, where each of the domain names is valid only for a day (or whatever the period is that the code defines). But in my opinion the killer argument for IRC as opposed to a website is that IRC allows interactive control ...


6

Analyzing kernels and executables before they are run is usually a safe practice, but it is best combined with a strong OS access control model, such as SELinux. While it is difficult to locate backdoors in self-modifying or self-checking code, usually the presence of self-modifying or self-checking code themselves are an indicator of malware. For example, ...


6

A really good bot will hide itself from the kernel. The only way to detect it would be to sniff the traffic between the machine and the internet, using an external, known-good machine. Even then there would be no way to know if the bot was just dormant at the time you looked for it. Another option is to boot the machine from known-good (preferably ...


6

Some researchers will not let the public download malware, for obvious reasons, but you might be looking for things like: php shells java shells bots Metasploit You also have Metasploit as a resource of open-source HTTP/S shells, stagers, and 'malware' to play with: http://www.metasploit.com/modules/payload/windows/shell/reverse_http ...


6

It's not a very convincing page. Even the links it provides off to the removal tools (such as this one) state that "Zeus is one of the most dangerous Trojan parasites in existence". I also had trouble getting that page to show up in the top ten results. A search for "zeus trojan wiki" did it, but even then it's below the Wikipedia entry and several others. ...


6

Set up a honeypot, let it get infected with some malware and log where this malware connects to. Pros: You might discover some interesting botnets. You'll uncover more than google will. I guess that their control pages are not indexed! Cons: You need to get a machine infected with malware. You might have to get a lot of infections before you find a ...


6

Do a little bit of work to figure out if there are commonalities - common headers that uniquely identify the bots, etc.. Don't forget to look for things the bots don't have - a number leave out fields like Host and Accept-Encoding because they concentrate on the minimum HTTP request to maximise their effectiveness. You're either going to hit a bandwidth or ...


6

You have two questions in there, and these are well documented in various places, but let me have a quick stab at it: you don't want your bot taking commands from the wrong place, so you need an authentication mechanism. Public/Private key pairs provide an easy, scalable mechanism it helps to be able to keep unique id's for all bots so you can address them ...


5

I would like to encourage you to take a look at the following links: The TOR project has an entire FAQ page concerning abuse including a section called "I want to ban the Tor network from my service." where they elaborate on how to identify and block TOR exit nodes and what alternatives there might be to doing so. Also there are currently 400k people using ...


5

A darknet is also a good way to help discover infected machines on your network. It is essentially a subnet on your LAN that shouldn't normally have traffic routed to it, with logging machines in it, which detect which machines aren't obeying your normal network setup, e.g. scanning for nodes on the network to infect. Since you should know what behaviour is ...


5

Generally speaking, we haven't seen large, long-lived botnets formed by compromising smartphones, in the same way as we've seen for desktops. (There are small-scale exceptions, but this is is a good first approximation.) There certainly has been no shortage of malware targeting smartphones, but what it does once it compromises your machine looks a bit ...


5

As @HendrikBrummermann already pointed out in the comments, it was an attempt to exploit register_globals on a PHP enabled web server. The server making the request that ended up in your web server's logs, so it turned out, was merely an infected web server running in zombie mode, running a stealth bot checking for possible attack vectors on unsuspecting ...


5

First, you can look at the abuse.ch zeustracker list. Second, note that the abuse.ch list is the primary source for the iblocklist.com zeus list. You may also wish to look through some of the many other malware lists on iblocklist.com to check for other malware sites. Separately, you can check to see on what basis your security appliance is making the ...


5

Providing that you are looking for information already analyzed, and your question is not about the technical ways to identify a Zeus C&C Server, you can look at the following places: malwaredomainlist.com malwaredb.malekal.com exposedbotnets.com scumware.org malc0de.com cybercrime-tracker.net vxvault.siri-urz.net nothink.org botnet-tracker.blogspot.ch ...



Only top voted, non community-wiki answers of a minimum length are eligible