Reputation
3,458
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
1 14 20
Newest
 Curious
Impact
~408k people reached

  • 0 posts edited
  • 0 helpful flags
  • 282 votes cast
Jan
18
answered Am I experiencing a brute force attack?
Dec
21
comment What exactly does “Nation-State” code look like?
I believe that "just fearmongering" is probably closest to reality. I'm surprised at how much attribution of motive and origin there is to malware, given how poorly coded most of it is. Maybe the backdoor code is actually well-coded. That would go a long ways toward attributing the code to someone other than the usual spammers and script kiddies.
Nov
18
revised What is the typical computer setup and hosting arrangement of malicious bots?
Add another paper and link.
Nov
18
reviewed Approve What is the typical computer setup and hosting arrangement of malicious bots?
Nov
18
comment Computer Virus Phylogenies algorithms - pseudocode?
@A.L - I've used Normalized Compression Distance, and Neighbor Joinging to find phylogenies. Unfortunately, due to code chunks appearing in multiple versions, WSO doesn't have a perfect phylogeny. The biological assumptions of a single common ancestor don't hold, so if you look at actual code, Neighbor Joining based on NCD gives a false phylogeny.
Nov
18
answered What is the typical computer setup and hosting arrangement of malicious bots?
Nov
13
asked Computer Virus Phylogenies algorithms - pseudocode?
Oct
2
asked Extra p0f v3 fingerprints files?
Sep
14
revised Wordpress infected with Trojan
Add results of research, which are key string that decrypts header.php encrypted text, and other info about the malware so encrypted.
Sep
1
answered Wordpress infected with Trojan
Aug
24
comment Automatic detection of a compromised web server
@RuchirGodura - no, but I haven't tried. Earlier experiences with "just checking if the website is up", and monitoring other networked services has led me to conclude this is such a hard problem as to have no good solution.
Aug
24
answered Automatic detection of a compromised web server
Aug
23
comment Thousands of 404s from various search engines
@QuestionOverflow - I knew that my 404.php was doing redirects all along, I just missed the fact that someone would actually try those fake URLs against my server. My initial response to the fake porn URLs was to redirect them to real porn URLs, in hopes of making everyone go away. I think my question is relevant here: if there's some way to submit URLs to multiple search engines, you get them to do your DDoS work for you.
Aug
23
revised Thousands of 404s from various search engines
Add paragraph about maximum reqs per second, and who did it.
Aug
22
revised Thousands of 404s from various search engines
added 404 characters in body
Aug
22
comment Thousands of 404s from various search engines
@schroeder - still looking for why Google, Yandex, Yahoo, Baidu and MJ12Bot all decide to ask for the same porno URLs more or less on the same day. Is this revenge for the honeypot or some kind of DDoS? Also, how does one get at least 4 or 5 search engines to all crank up and hit a site on the same day?
Aug
22
revised Thousands of 404s from various search engines
Add apology and explanation.
Aug
22
comment Thousands of 404s from various search engines
Thanks for the in-depth answer, but the porn redirects are on purpose. I put code in my 404.php file to redirect requests for those files to "shock porn". I'm not running WordPerfect or Joomla, I've got a WordPerfect honey pot going to tarpit all those password guessers, and collect malware files.
Aug
22
comment Thousands of 404s from various search engines
@schroeder- this is embarassing, my 404.php file does those redirects - my site isn't compromised. I got fed up with the constant stream of requests for non-existent files, and decided to redirect people to "shock porn", like goatse. You could ask for any URL that has one of the 14 components I listed, and you'd get redirected. I've taken that feature out.. Ask for index.php, wp-login.ph you'll get a WordPerfect honey pot. Ask for index.html, and you'll get the real web site. Apologies for redirecting you to shock porn.
Aug
22
awarded  Curious