DOCSLIB.ORG

Kelihos Botnet: a Never-Ending Saga

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Kelihos Botnet: a Never-Ending Saga 2017 Annual ADFSL Conference on Digital Forensics, Security and Law Proceedings May 15th, 10:00 AM Kelihos Botnet: A Never-Ending Saga Arsh Arora University of Alabama, Birmingham, [email protected] Max Gannon University of Alabama, Birmingham, [email protected] Gary Warner University of Alabama, Birmingham, [email protected] Follow this and additional works at: https://commons.erau.edu/adfsl Part of the Defense and Security Studies Commons, Forensic Science and Technology Commons, Information Security Commons, OS and Networks Commons, Other Computer Sciences Commons, and the Science and Technology Studies Commons Scholarly Commons Citation Arora, Arsh; Gannon, Max; and Warner, Gary, "Kelihos Botnet: A Never-Ending Saga" (2017). Annual ADFSL Conference on Digital Forensics, Security and Law. 4. https://commons.erau.edu/adfsl/2017/papers/4 This Peer Reviewed Paper is brought to you for free and open access by the Conferences at Scholarly Commons. It has been accepted for inclusion in Annual ADFSL Conference on Digital Forensics, Security and Law by an (c)ADFSL authorized administrator of Scholarly Commons. For more information, please contact [email protected]. Kelihos Botnet: A Never-Ending Saga CDFSL Proceedings 2017 KELIHOS BOTNET: A NEVER-ENDING SAGA Arsh Arora, Max Gannon, Gary Warner University of Alabama at Birmingham 1201 University Blvd, Birmingham, AL 35233 fararora, gannonm, [email protected] ABSTRACT This paper investigates the recent behavior of the Kelihos botnet, a spam-sending botnet that accounts for many millions of emails sent each day. The paper demonstrates how a team of students are able to perform a longitudinal malware study, making significant observations and contributions to the understanding of a major botnet using tools and techniques taught in the classroom. From this perspective, the paper has two objectives: encouragement and observation. First, by providing insight into the methodology and tools used by student researchers to document and understand a botnet, the paper strives to embolden other academic programs to follow a similar path and to encourage such discovery. Second, the paper shares observations and insights gathered about the botnet's recent spam activity showing evidence of the \spam as a service" model and demonstrating a variety of unique and dangerous spam campaigns conducted via the Kelihos botnet, including banking trojans, credential phishing, and ransomware attacks. Keywords: Kelihos, Botnet, Malware, Spam, Ransomware, Banking Trojan, Pharma, Pump and Dump, Geo-Targeting 1. INTRODUCTION CrowdStrike, Dell Secureworks, Kaspersky, and others sinkholed 100,000 nodes of the While the Kelihos botnet first debuted in Kelihos.B malware [Kerkers et al., 2014]. At 2009, the current botnet is a functional deriva- RSA Conference 2013, CrowdStrike demon- tive of two other famous botnets, Waledac, strated a repeat performance, targeted Ke- and the Storm Worm [Adair, 2012, Bureau, lihos.C [Rossow et al., 2013, Werner, 2013]. 2011]. The Kelihos botnet is known by a Despite these admirable attempts, Kelihos number of aliases in the community includ- continues to send significant volumes of spam ing Hlux and Slenfbot [Singh et al., 2014]. on a daily basis [Stringhini et al., 2014]. Even Kelihos evolved and became sophisticated after all of the takedown attempts, Kelihos over time, but no interruption could stop the was still ranked as the top spam-sending bot- working of Kelihos. Two widely celebrated net in 2015 and continues to yield a signifi- takedowns of Kelihos have been performed by cant spam volume today [McAfee, 2016, Tech, security companies. The first was Operation 2016]. b79, conducted by Microsoft in September of 2009 [Nadji et al., 2013]. In March of 2012, The Kelihos botnet utilizes a peer to peer c 2017 ADFSL Page 9 CDFSL Proceedings 2017 Kelihos Botnet: A Never-Ending Saga network infrastructure that hides the loca- ilies. tion of the true command and control server Another addition to the spam campaign [Dietrich et al., 2013]. Kelihos-infected com- is sending links to a Word document that puters communicate with one another and will drop a variant of Zeus, specifically, geo- are used in two primary ways, depending targeting for German and United Kingdom on whether they have a publicly reachable banks. In the current iteration, it uses stolen IP address or not. Nodes which cannot be SMTP credentials to login as a legitimate addressed from the Internet just send spam. user to a large number of mail servers and Internet addressable nodes help to anonymize sends spam. the location of the C&C server by acting as a multi-tiered proxy, receiving requests for 2. NETWORK spam details from spamming nodes, and re- questing those same details from other nodes, eventually leading to a job server which is leased infrastructure and communicates with the C&C server, as documented by Fortinet's Kyle Yang at BlackHat [Yang, 2012]. The most unique aspect of Kelihos is the di- versity in its spam and its delivery mechanism. The spam diversity is primarily because Keli- hos provides \spam as a service" offering the use of its spamming infrastructure for hire to deliver any messages for a sender who is will- ing to pay their fees. The spam messages are Figure 1. Courtesy: Kyle Yang outlining Kelihos dominated by pharmaceutical spam, but are distribution network [Yang, 2012] not limited to it. Pharma spam seems to be Although the division of the botnet's oper- the fall-back position, when other higher pay- ation appears to be clear in Figure 1, the path ing customers have not hired the botnet to is actually complex. Starting from the bot- deliver something else. Kelihos has been ob- tom, the chart displays the worker or client served sending spam for pump and dump ma- nodes, which sends spam to the end user and nipulation of different stock symbols, money only communicate to the servers at the proxy mule job applications, and credential phish- level. The proxy level is the most interesting ing for Polish and French financial institu- one as it connects with other proxies, clients, tions. In the summer of 2016, Kelihos began and job servers. This 3-way communication geo-targeting for email delivery sending dif- makes it the most attractive and the one that ferent messages and payloads based on the contains maximum information. The proxy country-code Top Level Domain (ccTLD) of level receives templates from other proxies the email recipient ('.pl','.uk'). Malware, in- and also communicates with the job servers. cluding ransomware and Zeus banking tro- While Kelihos-infected Windows computers jans, were delivered only to certain geogra- serve as the proxy and worker nodes, job phies using this technique. Kelihos has been servers are leased hardware controlled by the seen spamming ransomware, sending Wild- criminals. Job servers are the ones that serve Fire [Arora & Warner, 2016b], CryptFile2 as the main operators to the command and [Arora & Warner, 2016a] and Troldesh [Arora control center. Job servers are often in dis- & Warner, 2016f] encryption ransomware fam- guise and try to be invisible under the shadow Page 10 c 2017 ADFSL Kelihos Botnet: A Never-Ending Saga CDFSL Proceedings 2017 of different proxies; thus, making detection extremely complex and difficult. Lastly, the command and control center is handled by the bot herder and provides the information, spam templates, and updates needed to be distributed across the botnet. 3. INITIALIZATION In this section, researchers will describe the pattern that is followed by the Kelihos bi- nary to initiate, then communicate to its command and control center and eventually send spam. The process will be illustrated with screen captures from OllyDbg and Wire- shark. The details are shared so that they can be easily replicated by any individual Figure 2. Architecture of Kelihos Malware who has expertise with OllyDbg. The fol- lowing analysis was performed in a virtual 3.1.1 Parent Process environment (VMWare) operating in NAT In the following sub-section, researchers will network mode. demonstrate some breakpoints in OllyDbg 3.1 Processes that are helpful in performing the analysis. To attain optimum results, the following steps In the subsequent section, researchers will should be followed in the order mentioned. describe the process of how a Kelihos binary After introducing a Kelihos binary into performs when we try to self-infect. The pre- the virtual environment, start Process Hacker liminary observations can be viewed with the and OllyDbg as an administrator. Next, open help of programs such as Wireshark, Process the Kelihos binary in OllyDbg. Now, one Hacker, and OllyDbg 2.0 version. Next, we can see a process being activated in Process will explain the process of self-infecting with Hacker. The following breakpoints should a complete description of the process as de- be enabled under the Executables (E) tab of picted in Figure 2. As soon as we launch the OllyDbg: binary, it initiates and starts a child process. 1. Ntdll.dll Once the child process gets fully activated, it terminates the parent process and starts the (a) RtlReportSilentProcessExit communication process. Initially, it tries to (b) NtTeminateProcess make a TCP connection with several Internet (c) NtResumeThread Protocol (IP) addresses which are hard-coded 2. kernel32.dll in the binary. There is a unique identifier in the message that helps to authenticate the (a) Resume Thread communication coming from the Kelihos bi- nary. Once a connection is established, it makes a request for configuration (config) files. The config files contain the information Figure 3. Breakpoints for Parent Process about the spam template and the email ad- The researchers provide the specific break- dresses to be used for sending spam messages. points in Figure 3, so that the results may be c 2017 ADFSL Page 11 CDFSL Proceedings 2017 Kelihos Botnet: A Never-Ending Saga easily replicated. Once we start debugging the program, it will stop at the breakpoints in the following manner: 1.
Load more

Recommended publications
  • Éric FREYSSINET Lutte Contre Les Botnets
    THÈSE DE DOCTORAT DE L’UNIVERSITÉ PIERRE ET MARIE CURIE Spécialité Informatique École doctorale Informatique, Télécommunications et Électronique (Paris) Présentée par Éric FREYSSINET Pour obtenir le grade de DOCTEUR DE L’UNIVERSITÉ PIERRE ET MARIE CURIE Sujet de la thèse : Lutte contre les botnets : analyse et stratégie Présentée et soutenue publiquement le 12 novembre 2015 devant le jury composé de : Rapporteurs : M. Jean-Yves Marion Professeur, Université de Lorraine M. Ludovic Mé Enseignant-chercheur, CentraleSupélec Directeurs : M. David Naccache Professeur, École normale supérieure de thèse M. Matthieu Latapy Directeur de recherche, UPMC, LIP6 Examinateurs : Mme Clémence Magnien Directrice de recherche, UPMC, LIP6 Mme Solange Ghernaouti-Hélie Professeure, Université de Lausanne M. Vincent Nicomette Professeur, INSA Toulouse Cette thèse est dédiée à M. Celui qui n’empêche pas un crime alors qu’il le pourrait s’en rend complice. — Sénèque Remerciements Je tiens à remercier mes deux directeurs de thèse. David Naccache, officier de réserve de la gendarmerie, contribue au développement de la recherche au sein de notre institution en poussant des personnels jeunes et un peu moins jeunes à poursuivre leur passion dans le cadre académique qui s’impose. Matthieu Latapy, du LIP6, avec qui nous avions pu échanger autour d’une thèse qu’il encadrait dans le domaine difficile des atteintes aux mineurs sur Internet et qui a accepté de m’accueillir dans son équipe. Je voudrais remercier aussi, l’ensemble de l’équipe Réseaux Complexes du LIP6 et sa responsable d’équipe actuelle, Clémence Magnien, qui m’ont accueilli à bras ouverts, accom- pagné à chaque étape et dont j’ai pu découvrir les thématiques et les méthodes de travail au fil des rencontres et des discussions.
    [Show full text]
  • Large-Scale Malware Experiments
    LARGE-SCALE MALWARE EXPERIMENTS ... CALVET ET AL. LARGE-SCALE MALWARE • Unlike with in-the-wild experiments [1], there are fewer ethical or legal issues to deal with than when performing EXPERIMENTS: WHY, HOW, AND arbitrary attacks against infected computers. SO WHAT? • Having an in vitro environment provides us with a way to Joan Calvet, Jose M. Fernandez conduct computer security research in a scientifi c way: we École Polytechnique de Montréal, Montréal, Canada can reproduce experiments and test the effect of various independent variables. Email {joan.calvet, jose.fernandez}@polymtl.ca We decided to use the Waledac botnet as a fi rst experiment for the following reasons: Pierre-Marc Bureau ESET, Montréal, Canada • Thanks to prior reverse engineering [2], we had in-depth knowledge of this threat family. Email [email protected] • This malware does not replicate, thus limiting the risk of running an experiment that might get out of control. Jean-Yves Marion LORIA, Nancy, France • There exists a set of vulnerabilities in Waledac’s peer-to- peer protocol that were worth investigating. We wanted to Email [email protected] evaluate the impact of a mitigation scheme against the botnet. ABSTRACT 1.1 The Waledac case study One of the most popular research areas in the anti-malware The architecture of the Waledac botnet is split into four layers. industry (second only to detection) is to document malware The fi rst layer contains infected hosts with private IP addresses characteristics and understand their operations. Most initiatives that are referred to as spammers. They are essentially the are based on reverse engineering of malicious binaries so as to ‘worker’ bots and constitute approximately 80% of the botnet.
    [Show full text]
  • An Introduction to Malware
    Downloaded from orbit.dtu.dk on: Sep 24, 2021 An Introduction to Malware Sharp, Robin Publication date: 2017 Document Version Publisher's PDF, also known as Version of record Link back to DTU Orbit Citation (APA): Sharp, R. (2017). An Introduction to Malware. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. Users may download and print one copy of any publication from the public portal for the purpose of private study or research. You may not further distribute the material or use it for any profit-making activity or commercial gain You may freely distribute the URL identifying the publication in the public portal If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. An Introduction to Malware Robin Sharp DTU Compute Spring 2017 Abstract These notes, written for use in DTU course 02233 on Network Security, give a short introduction to the topic of malware. The most important types of malware are described, together with their basic principles of operation and dissemination, and defenses against malware are discussed. Contents 1 Some Definitions............................2 2 Classification of Malware........................2 3 Vira..................................3 4 Worms................................
    [Show full text]
  • Modeling and Evaluating the Resilience of Peer-To-Peer Botnets
    P2PWNED: Modeling and Evaluating the Resilience of Peer-to-Peer Botnets Christian Rossow∗‡, Dennis Andriesse‡, Tillmann Werner¶, Brett Stone-Gross†, Daniel Plohmann§, Christian J. Dietrich∗, Herbert Bos‡ ∗ Institute for Internet Security, Gelsenkirchen, Germany {rossow,dietrich}@internet-sicherheit.de ‡ VU University Amsterdam, The Netherlands {d.a.andriesse,h.j.bos}@vu.nl § Fraunhofer FKIE, Bonn, Germany, [email protected] † Dell SecureWorks, [email protected] ¶ CrowdStrike, Inc. Abstract—Centralized botnets are easy targets for takedown disrupted using the traditional approach of attacking critical efforts by computer security researchers and law enforcement. centralized infrastructure. Thus, botnet controllers have sought new ways to harden the Even though active P2P botnets such as the Zeus P2P infrastructures of their botnets. In order to meet this objective, some botnet operators have (re)designed their botnets to use variant, Sality, ZeroAccess and Kelihos have survived in the Peer-to-Peer (P2P) infrastructures. Many P2P botnets are far wild for as long as five years, relatively little is known about more resilient to takedown attempts than centralized botnets, the sizes of these botnets. It is difficult to estimate a P2P because they have no single points of failure. However, P2P botnets are subject to unique classes of attacks, such as node botnet’s size, for a number of reasons. P2P botnets often enumeration and poisoning. In this paper, we introduce a use custom protocols, so that researchers must first reverse formal graph model to capture the intrinsic properties and engineer the protocol and encryption before they can track fundamental vulnerabilities of P2P botnets. We apply our the botnet’s population.
    [Show full text]
  • The Exceptionalist's Approach to Private Sector Cybersecurity
    The Exceptionalist’s Approach to Private Sector Cybersecurity: A Marque and Reprisal Model By Michael Todd Hopkins B.A., June 2000, University of Nevada, Reno J.D., May 2003, Southern Methodist University A Thesis submitted to The Faculty of The George Washington University Law School in partial satisfaction of the requirements for the degree of Master of Laws August 15, 2011 Thesis directed by Gregory E. Maggs Interim Dean; Professor of Law Acknowledgement I wish to thank Interim Dean Gregory E. Maggs for his feedback and comments in this endeavor. Any errors or omissions are solely that of the author. ii Disclaimer Major Michael T. Hopkins serves in the U.S. Air Force Judge Advocate General’s Corps. This paper was submitted in partial satisfaction of the requirements for the degree of Master of Laws in National Security and U.S. Foreign Relations at The George Washington University Law School. The views expressed in this paper are solely those of the author and do not reflect the official policy or position of the United States Air Force, Department of Defense or United States Government. iii Abstract The Exceptionalist’s Approach to Private Sector Cybersecurity: A Marque and Reprisal Model As practitioners and academics debate our nation’s cybersecurity policy the focus remains upon our national security interests as the federal government lacks the resources and people to protect all areas of society. However, this approach largely ignores the private sector despite an estimated global loss of one trillion dollars annually to cyberattacks and exploitations. Moreover, current domestic and international law do little to provide self-defense options for the private sector.
    [Show full text]
  • Download Slides
    Scott Wu Point in time cleaning vs. RTP MSRT vs. Microsoft Security Essentials Threat events & impacts More on MSRT / Security Essentials MSRT Microsoft Windows Malicious Software Removal Tool Deployed to Windows Update, etc. monthly since 2005 On-demand scan on prevalent malware Microsoft Security Essentials Full AV RTP Inception in Oct 2009 RTP is the solution One-off cleaner has its role Quiikck response Workaround Baseline ecosystem cleaning Industrypy response & collaboration Threat Events Worms (some are bots) have longer lifespans Rogues move on quicker MarMar 2010 2010 Apr Apr 2010 2010 May May 2010 2010 Jun Jun 2010 2010 Jul Jul 2010 2010 Aug Aug 2010 2010 1,237,15 FrethogFrethog 979,427 979,427 Frethog Frethog 880,246880,246 Frethog Frethog465,351 TaterfTaterf 5 1,237,155Taterf Taterf 797,935797,935 TaterfTaterf 451,561451,561 TaterfTaterf 497,582 497,582 Taterf Taterf 393,729393,729 Taterf Taterf447,849 FrethogFrethog 535,627535,627 AlureonAlureon 493,150 493,150 AlureonAlureon 436,566 436,566 RimecudRimecud 371,646 371,646 Alureon Alureon 308,673308,673 Alureon Alureon 441,722 RimecudRimecud 341,778341,778 FrethogFrethog 473,996473,996 BubnixBubnix 348,120 348,120 HamweqHamweq 289,603 289,603 Rimecud Rimecud289,629 289,629 Rimecud Rimecud318,041 AlureonAlureon 292,810 292,810 BubnixBubnix 471,243 471,243 RimecudRimecud 287,942287,942 ConfickerConficker 286,091286, 091 Hamwe Hamweqq 250,286250, 286 Conficker Conficker220,475220, 475 ConfickerConficker 237237,348, 348 RimecudRimecud 280280,440, 440 VobfusVobfus 251251,335, 335
    [Show full text]
  • Zerohack Zer0pwn Youranonnews Yevgeniy Anikin Yes Men
    Zerohack Zer0Pwn YourAnonNews Yevgeniy Anikin Yes Men YamaTough Xtreme x-Leader xenu xen0nymous www.oem.com.mx www.nytimes.com/pages/world/asia/index.html www.informador.com.mx www.futuregov.asia www.cronica.com.mx www.asiapacificsecuritymagazine.com Worm Wolfy Withdrawal* WillyFoReal Wikileaks IRC 88.80.16.13/9999 IRC Channel WikiLeaks WiiSpellWhy whitekidney Wells Fargo weed WallRoad w0rmware Vulnerability Vladislav Khorokhorin Visa Inc. Virus Virgin Islands "Viewpointe Archive Services, LLC" Versability Verizon Venezuela Vegas Vatican City USB US Trust US Bankcorp Uruguay Uran0n unusedcrayon United Kingdom UnicormCr3w unfittoprint unelected.org UndisclosedAnon Ukraine UGNazi ua_musti_1905 U.S. Bankcorp TYLER Turkey trosec113 Trojan Horse Trojan Trivette TriCk Tribalzer0 Transnistria transaction Traitor traffic court Tradecraft Trade Secrets "Total System Services, Inc." Topiary Top Secret Tom Stracener TibitXimer Thumb Drive Thomson Reuters TheWikiBoat thepeoplescause the_infecti0n The Unknowns The UnderTaker The Syrian electronic army The Jokerhack Thailand ThaCosmo th3j35t3r testeux1 TEST Telecomix TehWongZ Teddy Bigglesworth TeaMp0isoN TeamHav0k Team Ghost Shell Team Digi7al tdl4 taxes TARP tango down Tampa Tammy Shapiro Taiwan Tabu T0x1c t0wN T.A.R.P. Syrian Electronic Army syndiv Symantec Corporation Switzerland Swingers Club SWIFT Sweden Swan SwaggSec Swagg Security "SunGard Data Systems, Inc." Stuxnet Stringer Streamroller Stole* Sterlok SteelAnne st0rm SQLi Spyware Spying Spydevilz Spy Camera Sposed Spook Spoofing Splendide
    [Show full text]
  • Downloading and Running
    City Research Online City, University of London Institutional Repository Citation: Meng, X. (2018). An integrated networkbased mobile botnet detection system. (Unpublished Doctoral thesis, City, Universtiy of London) This is the accepted version of the paper. This version of the publication may differ from the final published version. Permanent repository link: https://openaccess.city.ac.uk/id/eprint/19840/ Link to published version: Copyright: City Research Online aims to make research outputs of City, University of London available to a wider audience. Copyright and Moral Rights remain with the author(s) and/or copyright holders. URLs from City Research Online may be freely distributed and linked to. Reuse: Copies of full items can be used for personal research or study, educational, or not-for-profit purposes without prior permission or charge. Provided that the authors, title and full bibliographic details are credited, a hyperlink and/or URL is given for the original metadata page and the content is not changed in any way. City Research Online: http://openaccess.city.ac.uk/ [email protected] AN INTEGRATED NETWORK- BASED MOBILE BOTNET DETECTION SYSTEM Xin Meng Department of Computer Science City, University of London This dissertation is submitted for the degree of Doctor of Philosophy City University London June 2017 Declaration I hereby declare that except where specific reference is made to the work of others, the contents of this dissertation are original and have not been submitted in whole or in part for consideration for any other degree or qualification in this, or any other University. This dissertation is the result of my own work and includes nothing which is the outcome of work done in collaboration, except where specifically indicated in the text.
    [Show full text]
  • Mcafee Labs Threats Report August 2015 Ransomware Continues to Grow Very Rapidly— with the Number of New Samples Rising 58% in Q2
    Report McAfee Labs Threats Report August 2015 Ransomware continues to grow very rapidly— with the number of new samples rising 58% in Q2. About McAfee Labs Introduction McAfee Labs is one of the world’s leading sources for threat This month marks the five-year anniversary of Intel’s research, threat intelligence, and cybersecurity thought announcement that the company would acquire McAfee. leadership. With data from millions of sensors across key Much has changed in the security space since then, so we threats vectors—file, web, message, and network—McAfee decided to look back on these years and compare what we Labs delivers real-time threat intelligence, critical analysis, thought would happen with what actually happened. and expert thinking to improve protection and reduce risks. We interviewed a dozen key people who have been with McAfee is now part of Intel Security. Intel or McAfee since the acquisition to get their views on the major developments of the past five years around the www.mcafee.com/us/mcafee-labs.aspx cyber threat landscape, including how the types of threat actors have changed, how attackers’ behaviors and targets Follow McAfee Labs have changed, how the economics of cybercrime have changed, and how the industry has responded. We also wanted to know what they didn’t anticipate or what truly surprised them. We hope you enjoy the retrospective. This quarter, we also discuss two very interesting Key Topics. In McAfee Labs Threats Reports, we spend a lot of time examining ways in which attackers enter a trusted network or system, but we spend little time looking at how they exfiltrate the information they want to steal once they have successfully breached the network or system.
    [Show full text]
  • CONTENTS in THIS ISSUE Fighting Malware and Spam
    APRIL 2010 Fighting malware and spam CONTENTS IN THIS ISSUE 2 COMMENT A FUTILE BATTLE? Are takedowns an exercise in futility? Mary Landesman evaluates recent botnet takedown efforts. 3 NEWS page 2 VB2010 programme announced CYBER WARFARE All star superstars Terry Zink looks at the increasingly common Dangerous places to be online phenomenon of hacktivism and details three recent cyber warfare attacks. 3 VIRUS PREVALENCE TABLE page 11 FEATURES EXPLOIT KIT EXPLOSION 4 Evasions in Intrusion Prevention/ In the fi rst of a two-part series introducing exploit Detection Systems kits Mark Davis outlines the basic details of the dime-a-dozen kits used in drive-by browser-based 11 Botnets, politics and hacktivism – an interesting partnership attacks. page 21 15 ‘Signatures are dead.’ ‘Really? And what about pattern matching?’ RECORD VB100 ON XP In VB’s largest ever VB100 21 TUTORIAL comparative review, a total of 60 Exploit kit explosion – part one products are put to the test on April 2010 Windows XP. John Hawes has all 23 COMPARATIVE REVIEW the details. page 23 VB100 – Windows XP SP3 68 END NOTES & NEWS ISSN 1749-7027 COMMENT ‘There is often little Troyak-AS resumed service under a new upstream provider, and this pattern was repeated numerous times. incentive for domain These less than dramatic results beg the registrars or hosting (multi)-million-dollar question: are such takedown providers to make efforts an exercise in futility? it more diffi cult for Certainly if one focuses only on short-term statistics, the answer would appear to be ‘yes’. However, if one criminals to obtain focuses on some of the precedents set during the fi rst services.’ quarter, tangible long-term impact may become a reality.
    [Show full text]
  • [Recognising Botnets in Organisations] Barry Weymes Number
    [Recognising Botnets in Organisations] Barry Weymes Number: 662 A thesis submitted to the faculty of Computer Science, Radboud University in partial fulfillment of the requirements for the degree of Master of Science Eric Verheul, Chair Erik Poll Sander Peters (Fox-IT) Department of Computer Science Radboud University August 2012 Copyright © 2012 Barry Weymes Number: 662 All Rights Reserved ABSTRACT [Recognising Botnets in Organisations] Barry WeymesNumber: 662 Department of Computer Science Master of Science Dealing with the raise in botnets is fast becoming one of the major problems in IT. Their adaptable and dangerous nature makes detecting them difficult, if not impossible. In this thesis, we present how botnets function, how they are utilised and most importantly, how to limit their impact. DNS Dynamic Reputations Systems, among others, are an innovative new way to deal with this threat. By indexing individual DNS requests and responses together we can provide a fuller picture of what computer systems on a network are doing and can easily provide information about botnets within the organisation. The expertise and knowledge presented here comes from the IT security firm Fox-IT in Delft, the Netherlands. The author works full time as a security analyst there, and this rich environment of information in the field of IT security provides a deep insight into the current botnet environment. Keywords: [Botnets, Organisations, DNS, Honeypot, IDS] ACKNOWLEDGMENTS • I would like to thank my parents, whom made my time in the Netherlands possible. They paid my tuition, and giving me the privilege to follow my ambition of getting a Masters degree. • My dear friend Dave, always gets a mention in my thesis for asking the questions other dont ask.
    [Show full text]
  • North Dakota Homeland Security Anti-Terrorism Summary
    UNCLASSIFIED North Dakota Homeland Security Anti-Terrorism Summary The North Dakota Open Source Anti‐Terrorism Summary is a product of the North Dakota State and Local Intelligence Center (NDSLIC). It provides open source news articles and information on terrorism, crime, and potential destructive or damaging acts of nature or unintentional acts. Articles are placed in the Anti‐Terrorism Summary to provide situational awareness for local law enforcement, first responders, government officials, and private/public infrastructure owners. If you have any comments to improve this summary or local information you would like to see in the summary please send the information to; [email protected] UNCLASSIFIED UNCLASSIFIED Quick links North Dakota Energy Regional Food and Agriculture National Government Sector (including Schools and Universities) International Information Technology and Banking and Finance Industry Telecommunications Chemical and Hazardous National Monuments and Icons Materials Sector Postal and Shipping Commercial Facilities Public Health Communications Sector Transportation Critical Manufacturing Water and Dams Defense Industrial Base Sector North Dakota Homeland Security Emergency Services Contacts North Dakota (North Dakota) Fargo fix takes on water. Some 100,000 volunteers from around the upper Midwest came together in a massive sand‐bagging operation last spring to save this city from a record flood of the Red River. Now, that unity is starting to show cracks. Planning is moving ahead for a more than $1 billion channel‐building project that is designed to protect the Fargo and Moorhead, Minnesota, metropolitan area from even the most severe floods. But the huge ditch could worsen the problem for people living downstream and has drawn opposition from those in its proposed path.
    [Show full text]