New answers tagged

3

This is probably correct in a statistical sense. A legitimate e-mail will probably (but not certainly) go through several hops not only on the destination side (which are mostly always the same for a given recipient, so that number is not interesting) but also on the sending side, and these will be recorded in Received headers. A spam, however, while sent ...


1

Does Conficker really needs 50000 workings domains in order to contact the C&C server? Certainly not, a handful is sufficient. Conficker will try 50000 domains knowing that, somewhere in this list, it will find a responsive C&C server. On the other side can the authorities buy 50000 domains per day to block Conficker? Certainly not, here it would be ...


3

I assume you are referencing this Wikipedia article for your info. Basically, the malware does not register the domain names, it just generates a list of possible domain names. The attacker registers domain names that are "possible" outputs of the DGA. For example, if the DGA is something like: x = rand(10) domain = "xyz" + x + ".com" contact(...


3

It seems surprising because crypto libraries are available on all (major) platforms. But it sounds often simpler than it is. For example accessing the Crypto API on Windows takes a lot of additional code to do it properly. But the amount of malware authors being very familiar with cryptography is rather small. Therefore they tend to focus on functionality ...


1

First off, let me start with an important fact: Regex on reverse IP lookups is a bad idea for blocking incoming requests. Reverse DNS is an informational function. Unlike DNS where it is critical for the domain to point to the correct IP address there is little consequence for having the reverse lookup of an IP point to an arbitrary domain. Thus it would be ...



Top 50 recent answers are included