Mission 1: The Bot Hunter
|
|
|
- Laurel Roxanne Sherman
- 10 years ago
- Views:
Transcription
1 Mission 1: The Bot Hunter Mission: Interpol have asked the BSidesLondon Unhackable Mission Force to penetrate and shut down a notorious botnet. Our only clue is a recovered bot executable which we hope can be reverse engineered. Briefing: Download (BOT File): === Go! We have downloaded the exe file and then analyze some strings inside. First we notice a suspect URL ( with some appended text, maybe USer-Agent String: $ strings bot.exe... km($i AppleMachttp ://ghowen.me/malfor/cnc.php?id= Another strings to guess that maybe the malware is trying to connect to some IRC server ( ) irc.efjlswepipe? h.220.3hcnfjt@6w_y{l Next step, notice the file is packed with UPX, so let s unpack it. imac:downloads pedro$ strings bot.exe grep UPX UPX0 UPX1 UPX!
2 * TimeforunpackingwithUPX Analyse both files with Anubis online service original file: t=txt unpacked file: Our first file bot.exe 28k has been analyze with anubis, an excellent online service to get most of information and get a previous analysis. We can see that we suspect in bold letters: [#############################################################################] Analysis Report for bot.exe MD5: f6ea10f719885fbcfb faa94f7 [#############################################################################] Table of Contents General information bot.exe a) Registry Activities b) File Activities c) Network Activities 1. General Information Information about Anubis' invocation
3 Time needed: 246 s Report created: 02/13/14, 12:41:19 UTC Termination reason: Timeout Program version: [=============================================================================] Global Network Activities [=============================================================================] [= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =] Unknown TCP Traffic: [= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =] From ANUBIS:1031 to :53 State: [ Normal establishment and termination ], Outbound Bytes: [ 33 ], Inbound Bytes: [ 542 ] Data sent: 001f ddc i e e rc.efnet.net Data received: 021c ddc d i e e rc.efnet.net... 01c0 0c e d MCe 65c0 0c e d d5ee e... fcc0 0c e c1 a3dc... 03c0 0c e c2 6d81...m. dcc0 0c e c3 8cca... 8ec0 0c e c6 03a c0 0c e c6 2f63.../c 63c0 0c e c6 fc90 c... 02c0 0c e cd bcea... 79c0 0c e cd d291 y... 03c0 0c e d ( 02c0 0c e d1 f9f9... 7ec0 0c e d ~...! 0ac0 0c e e9... e9c0 0c e ed22...@." 96c0 0c e e1e1...b.. e1c0 0c e d2ea...c.. 12c0 0c e ac...E.. 02c c...r...b c64 2d c016 c016 gtld servers b c14d c016...r...k.m c14d c016...r...c.m c14d c016...r...a.m c14d c016...r...g.m a c14d c016...r...j.m c14d c016...r...e.m c c14d c016...r...l.m c14d c016...r...f.m c14d c016...r...h.m d c14d c016...r...m.m c14d c016...r...i.m c14d...r...d.m
![= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =] Unknown TCP Traffic: [= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =] From ANUBIS:1031 to 192.168.](/docs-images/55/8525006/images/page_3.jpg "0.1:53 State: [ Normal establishment and termination ], Outbound Bytes: [ 33 ], Inbound Bytes: [ 542 ] Data sent: 001f ddc4 0100 0001 0000 0000 0000 0369...i 7263 0565 666e 6574 036e 6574 0000 0100 rc.")
4 2.c) bot.exe Network Activities DNS Queries: Name: [ ghowen.me ], Query Type: [ DNS_TYPE_A ], Query Result: [ ], Successful: [ YES ], Protocol: [ udp ] Name: [ irc.efnet.fr ], Query Type: [ DNS_TYPE_A ], Query Result: [ ], Successful: [ YES ], Protocol: [ udp ] Name: [ irc.swepipe.se ], Query Type: [ DNS_TYPE_A ], Query Result: [ ], Successful: [ YES ], Protocol: [ udp ] Name: [ irc.efnet.net ], Query Type: [ DNS_TYPE_A ], Query Result: [ ], Successful: [ YES ], Protocol: [ udp ] HTTP Conversations: From ANUBIS:1028 to :80 [ ghowen.me ] Request: [ GET /malfor/cnc.php?id=pc&uid=administrator ], Response: [ 200 "OK" ] TCP Connection Attempts: From ANUBIS:1029 to :6667 From ANUBIS:1030 to :6667 From ANUBIS:1032 to :6667 The second file, interesting parts: Analysis Report for bot.exe MD5: 4688e6e a5d2a6e5aad7d0e78a Table of Contents General information bot.exe a) Registry Activities b) File Activities c) Network Activities 1. General Information [#############################################################################] Information about Anubis' invocation Time needed: 248 s Report created: 02/13/14, 16:04:36 UTC Termination reason: Timeout Program version:
![41 ], Successful: [ YES ], Protocol: [ udp ] Name: [ irc.efnet.net ], Query Type: [ DNS_TYPE_A ], Query Result: [ 141.213.238.252 193.163.220.3 194.109.129.220 195.140.202.142 198.3.160.3 198.47.99.](/docs-images/55/8525006/images/page_4.jpg "99 198.252.144.2 205.188.234.121 205.210.145.3 208.51.40.2 209.249.249.126 217.17.33.10 8.7.233.233 64.237.34.150 66.225.225.225 67.210.234.18 69.16.172.2 77.67.101.101 77.67.101.101 141.213.238.")
5 [#############################################################################] 2. bot.exe [#############################################################################] General information about this executable Analysis Reason: Primary Analysis Subject Filename: bot.exe MD5: 4688e6e a5d2a6e5aad7d0e78a SHA 1: a0641e31744e03969efcec000aa3b3b0f3 File Size: Bytes Command Line: "C:\bot.exe" Process status at analysis end: alive Exit Code: 0 [= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =] IRC Conversations: [= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =] From ANUBIS:1029 to :6667 Nick: [ uop102 ] Username: [ uop102 ] Joined Channel: [ #malfor oz bubblegum ] Channel Topic for Channel [ #malfor oz ]: [ Resistance is futile ] Private Message to User [ uop102 ]: [ VERSION ] From ANUBIS:1030 to :6667 Nick: [ uop230 ] Username: [ uop230 ] Joined Channel: [ #malfor oz bubblegum ] Channel Topic for Channel [ #malfor oz ]: [ Resistance is futile ] Viewing network trace we can join into IRC channel with key bubblegum. This the password is plaintext visible on binary too. So the first impression is infected binary doing IRC operations joining bots to the #malfor-oz IRC channel: Server: irc.swepipe.se & irc.efnet.fr MODE uop230 +i JOIN #malfor-oz bubblegum MODE #malfor-oz +k bubblegum TOPIC #malfor-oz :Resistance is futile We can join now on #malfor-oz channel and debug binary with OllyDbg 1.0. First step in the binary is bypass the isdebuggerpresent technique used to avoid debug over it.
6 This can be achieved in several ways, we can fill with NOPs carefully to bypass it and setting breaks or just install isdebuggerpresent plugin to bypass it.
7 So now we are ready to debug the last and interesting part of the binary making interactive with IRC channel to discover how is possible to shutdown the entire botnet. First in the binary we analyze the code to see PRIVMSG, SHUTDOWN and some interesting IRC communication strings. We have see that is possible to rip a probably password mechanism from the memory. Need to do some reversing to realize what crypto-mechanism is involved. So, the command to shutdown is SHUTDOWN+PASSWORD., and username is a part of this crypto mechanism with the key iamborg We try SHUTDOWN TEST to see what happens and server replies with wrong pw and SHUTDOWN iamborg as so close yet so far... wrong pw!.
8 The password is created on this ASM loop and looks very similar to a vignere-key cipher. We can READ password from memory and try to understand the crypto mechanism. Anyway, password is generated with username and in ASM looks like this part: EB > 8BC3 /MOV EAX,EBX ED. 99 CDQ EE. F7FE IDIV ESI === > char nick=inc % len(nick) F0. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] === > NICK LOADED F3. 6A 1A PUSH 1A F5. 0FBE3402 MOVSX ESI,BYTE PTR DS:[EDX+EAX] ===> Nick char F9. 8BC3 MOV EAX,EBX FB. 99 CDQ FC. F7F9 IDIV ECX === > KEY char = inc % len(key) FE. 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C] === > KEY is 'iamborg' POP ECX FBE0402 MOVSX EAX,BYTE PTR DS:[EDX+EAX] ===> key char C6 ADD EAX,ESI ===> ADD CDQ F7F9 IDIV ECX ===> % B. 8B75 F8 MOV ESI,DWORD PTR SS:[EBP 8] E. 8B4D FC MOV ECX,DWORD PTR SS:[EBP 4] C2 41 ADD DL,41 ===> ADD 0x D F8FEFFF> MOV BYTE PTR SS:[EBP+EBX 108],DL B. 43 INC EBX ===> INC inc C. 3BDF CMP EBX,EDI ===> CMP E.^7C CB \JL SHORT bot eb > 8D85 F8FEFFFF LEA EAX,DWORD PTR SS:[EBP 108] ===> READ password in memory
![8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] === > NICK LOADED 004014F3. 6A 1A PUSH 1A 004014F5. 0FBE3402 MOVSX ESI,BYTE PTR DS:[EDX+EAX] ===> Nick char 004014F9. 8BC3 MOV EAX,EBX 004014FB. 99 CDQ 004014FC.](/docs-images/55/8525006/images/page_8.jpg "F7F9 IDIV ECX === > KEY char = inc % len(key) 004014FE. 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C] === > KEY is 'iamborg' 00401501. 59 POP ECX 00401502.")
9 Automate the task: Solver in Python. Now that we are understand the mechanism have to develop some auto-shutdown python solver for any user (restrict to 7 chars like key :)) === botnet_solver.py #!/usr/bin/python from math import * import sys import struct import socket import string import time #challenge channel='#malfor-russia' channel_key = 'bubblegum' nickname = sys.argv[1] key = 'iamborg' password='' #bot irc HOST="irc.swepipe.se" PORT=6667 IDENT='tunelko' REALNAME='Dummy' # Limit size of nickname due key len. Only 7 chars, enough. if (len(nickname)<7): print 'Error: Nickname must be greater than %i chars' %(len(nickname)) exit(0) if (len(nickname)>7): print 'Error: Nickname must be lower than %i chars'%(len(nickname)) exit(0) for posx, nickchar in enumerate(nickname): n = ord(nickchar) #print 'We need pos #',posx, nickchar for posy, keychar in enumerate(key): k = ord(keychar) x = ((k+n) % 26) + 0x41 if(posx==0): if(keychar=='i'): elif(posx==1): if(keychar=='a'): elif(posx==2):
![argv[1] key = 'iamborg' password='' #bot irc HOST="irc.swepipe.se" PORT=6667 IDENT='tunelko' REALNAME='Dummy' # Limit size of nickname due key len. Only 7 chars, enough.](/docs-images/55/8525006/images/page_9.jpg "if (len(nickname)<7): print 'Error: Nickname must be greater than %i chars' %(len(nickname)) exit(0) if (len(nickname)>7): print 'Error: Nickname must be lower than %i chars'%(len(nickname)) exit(0)")
10 if(keychar=='m'): elif(posx==3): if(keychar=='b'): elif(posx==4): if(keychar=='o'): elif(posx==5): if(keychar=='r'): elif(posx==6): if(keychar=='g'): else: print '' print 'Connecting... SHUTDOWN', password message = 'SHUTDOWN ' message += password s = socket.socket(socket.af_inet,socket.sock_stream) s.connect((host, PORT)) s.send("nick %s\r\n" % nickname) s.send("user %s %s Imborg for the real work:%s\r\n" % (IDENT, HOST, REALNAME)) while 1: buff=s.recv(1024) print buff if buff.find('ping')!= -1: s.send('pong ' + buff.split()[1] + '\r\n') s.send("join %s %s \r\n" % (channel, channel_key)) s.send("privmsg %s :%s \r\n" % (channel,message)) s.send ("PART %s\r\n" %(channel)) #s.send('quit bye\r\n') So the shutdown command for tunelko IRC nickname is SHUTDOWN NGLRLNG and with this solver we can automate the task for any user with a seven chars given nickname.
![send("user %s %s Imborg for the real work:%s\r\n" % (IDENT, HOST, REALNAME)) while 1: buff=s.recv(1024) print buff if buff.find('ping')!= -1: s.send('pong ' + buff.split()[1] + '\r\n') s.](/docs-images/55/8525006/images/page_10.jpg "send(\"join %s %s \r\n\" % (channel, channel_key)) s.send(\"privmsg %s :%s \r\n\" % (channel,message)) s.send (\"PART %s\r\n\" %(channel)) #s.")
11 <botmstr> well done :-) <tunelkop> :) <tunelkop> very interesting <tunelkop> nice challenge <botmstr> glad you enjoyed it! === Comments Thank you all for this interesting challenge. The channel change with a city suffix ( russia, japan...) and we can notice in the binary file. * 2014, February 14: they have prepare a flux to change yesterday s bot channel so channel is now #malfor-japan. * 2014, February 15: #malfor-russia.
TitanMist: Your First Step to Reversing Nirvana TitanMist. mist.reversinglabs.com
TitanMist: Your First Step to Reversing Nirvana TitanMist mist.reversinglabs.com Contents Introduction to TitanEngine.. 3 Introduction to TitanMist 4 Creating an unpacker for TitanMist.. 5 References and
Inside a killer IMBot. Wei Ming Khoo University of Cambridge 19 Nov 2010
Do you? or Inside a killer IMBot Wei Ming Khoo University of Cambridge 19 Nov 2010 Background Tracking a botnet propagating over Skype & Yahoo IM. Bait is Foto Exploits social connectivity (friend
Networks and Security Lab. Network Forensics
Networks and Security Lab Network Forensics Network Forensics - continued We start off from the previous week s exercises and analyze each trace file in detail. Tools needed: Wireshark and your favorite
1. General function and functionality of the malware
1. General function and functionality of the malware The malware executes in a command shell, it begins by checking to see if the executing file contains the MZP file extension, and then continues to access
Heap-based Buffer Overflow Vulnerability in Adobe Flash Player
Analysis of Zero-Day Exploit_Issue 03 Heap-based Buffer Overflow Vulnerability in Adobe Flash Player CVE-2014-0556 20 December 2014 Table of Content Overview... 3 1. CVE-2014-0556 Vulnerability... 3 2.
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A [email protected]
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A [email protected] A number of devices are running Linux due to its flexibility and open source nature. This has made Linux platform
Introduction to Reverse Engineering
Introduction to Reverse Engineering Inbar Raz Malware Research Lab Manager December 2011 What is Reverse Engineering? Reverse engineering is the process of discovering the technological principles of a
Format string exploitation on windows Using Immunity Debugger / Python. By Abysssec Inc WwW.Abysssec.Com
Format string exploitation on windows Using Immunity Debugger / Python By Abysssec Inc WwW.Abysssec.Com For real beneficiary this post you should have few assembly knowledge and you should know about classic
Violating Database - Enforced Security Mechanisms
Violating Database - Enforced Security Mechanisms Runtime Patching Exploits in SQL Server 2000: a case study Chris Anley [[email protected]] 18/06/2002 An NGSSoftware Insight Security Research (NISR)
Operation Liberpy : Keyloggers and information theft in Latin America
Operation Liberpy : Keyloggers and information theft in Latin America Diego Pérez Magallanes Malware Analyst Pablo Ramos HEAD of LATAM Research Lab 7/7/2015 version 1.1 Contents Introduction... 3 Operation
Fighting malware on your own
Fighting malware on your own Vitaliy Kamlyuk Senior Virus Analyst Kaspersky Lab [email protected] Why fight malware on your own? 5 reasons: 1. Touch 100% of protection yourself 2. Be prepared
[ X OR DDoS T h r e a t A d v i sory] akamai.com
![[ X OR DDoS T h r e a t A d v i sory] akamai.com](/thumbs/37/17731982.jpg "[ X OR DDoS T h r e a t A d v i sory] akamai.com")
[ X OR DDoS T h r e a t A d v i sory] akamai.com What is the XOR DDoS threat The XOR DDoS botnet has produced DDoS attacks from a few Gbps to 150+ Gbps The gaming sector has been the primary target, followed
Absolute Backdoor Revisited. Vitaliy Kamlyuk, Kaspersky Lab Sergey Belov, Kaspersky Lab Anibal Sacco, Cubica Labs
Absolute Backdoor Revisited Vitaliy Kamlyuk, Kaspersky Lab Sergey Belov, Kaspersky Lab Anibal Sacco, Cubica Labs BlackHat, Las Vegas August, 2014 What is Computrace? Computrace is an Anti-Theft software
Storm Worm & Botnet Analysis
Storm Worm & Botnet Analysis Jun Zhang Security Researcher, Websense Security Labs June 2008 Introduction This month, we caught a new Worm/Trojan sample on ours labs. This worm uses email and various phishing
Multifaceted Approach to Understanding the Botnet Phenomenon
Multifaceted Approach to Understanding the Botnet Phenomenon Christos P. Margiolas University of Crete A brief presentation for the paper: Multifaceted Approach to Understanding the Botnet Phenomenon Basic
TFTP TRIVIAL FILE TRANSFER PROTOCOL OVERVIEW OF TFTP, A VERY SIMPLE FILE TRANSFER PROTOCOL FOR SIMPLE AND CONSTRAINED DEVICES
TFTP - Trivial File TFTP Transfer Protocol TRIVIAL FILE TRANSFER PROTOCOL OVERVIEW OF TFTP, A VERY SIMPLE FILE TRANSFER PROTOCOL FOR SIMPLE AND CONSTRAINED DEVICES Peter R. Egli INDIGOO.COM 1/10 Contents
IDS and Penetration Testing Lab IIIa
IDS and Penetration Testing Lab IIIa Dissecting a Botnet C&C - rbot Triggering Lab Malware operation Upon execution malware connects to botirc.net server and establishes standard IRC session with #test
The Value of Physical Memory for Incident Response
The Value of Physical Memory for Incident Response MCSI 3604 Fair Oaks Blvd Suite 250 Sacramento, CA 95864 www.mcsi.mantech.com 2003-2015 ManTech Cyber Solutions International, All Rights Reserved. Physical
Radware Security Research. Reverse Engineering a Sophisticated DDoS Attack Bot. Author: Zeev Ravid
Reverse Engineering a Sophisticated DDoS Attack Bot Author: Zeev Ravid July 2015 Introduction In July 2015, Radware s Emergency Response Team (ERT) noticed a significant increased usage of the Tsunami
Quectel Cellular Engine
Cellular Engine GSM FTP AT Commands GSM_FTP_ATC_V1.1 Document Title GSM FTP AT Commands Version 1.1 Date 2010-12-28 Status Document Control ID Release GSM_FTP_ATC_V1.1 General Notes offers this information
Configuring Health Monitoring
CHAPTER4 Note The information in this chapter applies to both the ACE module and the ACE appliance unless otherwise noted. The features that are described in this chapter apply to both IPv6 and IPv4 unless
Automatic Network Protocol Analysis
Gilbert Wondracek, Paolo M ilani C omparetti, C hristopher Kruegel and E ngin Kirda {gilbert,pmilani}@ seclab.tuwien.ac.at chris@ cs.ucsb.edu engin.kirda@ eurecom.fr Reverse Engineering Network Protocols
Shellshock. Oz Elisyan & Maxim Zavodchik
Shellshock By Oz Elisyan & Maxim Zavodchik INTRODUCTION Once a high profile vulnerability is released to the public, there will be a lot of people who will use the opportunity to take advantage on vulnerable
McAfee Labs Threat Advisory W32/Autorun.worm.aaeb-h
Summary McAfee Labs Threat Advisory W32/Autorun.worm.aaeb-h August 9, 2013 W32/Autorun.worm.aaeb-h has the ability to infect removable media devices, as well as mounted network shares. Infection starts
Volume SYSLOG JUNCTION. User s Guide. User s Guide
Volume 1 SYSLOG JUNCTION User s Guide User s Guide SYSLOG JUNCTION USER S GUIDE Introduction I n simple terms, Syslog junction is a log viewer with graphing capabilities. It can receive syslog messages
[AthenaIRC v2.3.4] coded by _Stoner ----- -Documentation- -----
![[AthenaIRC v2.3.4] coded by _Stoner ----- -Documentation- -----](/thumbs/26/8523956.jpg "[AthenaIRC v2.3.4] coded by _Stoner ----- -Documentation- -----")
[AthenaIRC v2.3.4] coded by _Stoner ----- -Documentation- ----- Athena IRC Bot Commands: Miscellaneous Commands!decrypt Decrypts a previously encrypted command(prevents IRC lurkers from seeing/interpreting
Chapter 8 Router and Network Management
Chapter 8 Router and Network Management This chapter describes how to use the network management features of your ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN. These features can be found by
OCS Training Workshop LAB14. Email Setup
OCS Training Workshop LAB14 Email Setup Introduction The objective of this lab is to provide the skills to develop and trouble shoot email messaging. Overview Electronic mail (email) is a method of exchanging
Software Fingerprinting for Automated Malicious Code Analysis
Software Fingerprinting for Automated Malicious Code Analysis Philippe Charland Mission Critical Cyber Security Section October 25, 2012 Terms of Release: This document is approved for release to Defence
Agenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka
Taxonomy of Botnet Threats Trend Micro Inc. Presented by Tushar Ranka Agenda Summary Background Taxonomy Attacking Behavior Command & Control Rallying Mechanisms Communication Protocols Evasion Techniques
1 Attack Top Attackers Report, Top Targets Report, Top Protocol Used by Attack Report, Top Attacks Report, Top Internal Attackers Report, Top External Attackers Report, Top Internal Targets Report, Top
esrever gnireenigne tfosorcim seiranib
esrever gnireenigne tfosorcim seiranib Alexander Sotirov [email protected] CanSecWest / core06 Reverse Engineering Microsoft Binaries Alexander Sotirov [email protected] CanSecWest / core06 Overview
Napster and Gnutella: a Comparison of two Popular Peer-to-Peer Protocols. Anthony J. Howe Supervisor: Dr. Mantis Cheng University of Victoria
Napster and Gnutella: a Comparison of two Popular Peer-to-Peer Protocols Anthony J Howe Supervisor: Dr Mantis Cheng University of Victoria February 28, 2002 Abstract This article presents the reverse engineered
2014 ASE BIGDATA/SOCIALCOM/CYBERSECURITY Conference, Stanford University, May 27-31, 2014 ASE 2014 ISBN: 978-1-62561-000-3 1
ASE 2014 ISBN: 978-1-62561-000-3 1 Network Traffic Analysis of ZeroAccess Bot Shree Garg, Anil K. Sarje, Sateesh K. Peddoju Department of Computer Science & Engineering Indian Institute of Technology Roorkee,
User s Manual Network Management Card
User s Manual Network Management Card RMCARD202 Intelligent Network Management Card allows a UPS system to be managed, monitored, and configured Version 1.0 E-K01-SNMP005-0 TABLE OF CONTENTS Introduction
Management, Logging and Troubleshooting
CHAPTER 15 This chapter describes the following: SNMP Configuration System Logging SNMP Configuration Cisco NAC Guest Server supports management applications monitoring the system over SNMP (Simple Network
Reverse Engineering Malware Part 1
Reverse Engineering Malware Part 1 Author :Arunpreet Singh Blog : https://reverse2learn.wordpress.com MD5 Hash : 1d8ea40a41988b9c3db9eff5fce3abe5 This is First Part of 2 Part Series.This Malware Drops
Efficient Program Exploration by Input Fuzzing
Efficient Program Exploration by Input Fuzzing towards a new approach in malcious code detection Guillaume Bonfante Jean-Yves Marion Ta Thanh Dinh Université de Lorraine CNRS - INRIA Nancy First Botnet
User s Manual PowerPanel Shutdown Service Graceful Shutdown and Notification service to ensure power protection of your computer
User s Manual PowerPanel Shutdown Service Graceful Shutdown and Notification service to ensure power protection of your computer Revision 1.1 TABLE OF CONTENTS INTRODUCTION... 1 INSTALLATION GUIDE... 2
Proxies. Chapter 4. Network & Security Gildas Avoine
Proxies Chapter 4 Network & Security Gildas Avoine SUMMARY OF CHAPTER 4 Generalities Forward Proxies Reverse Proxies Open Proxies Conclusion GENERALITIES Generalities Forward Proxies Reverse Proxies Open
FILE TRANSFER PROTOCOL INTRODUCTION TO FTP, THE INTERNET'S STANDARD FILE TRANSFER PROTOCOL
FTP FILE TRANSFER PROTOCOL INTRODUCTION TO FTP, THE INTERNET'S STANDARD FILE TRANSFER PROTOCOL Peter R. Egli INDIGOO.COM 1/22 Contents 1. FTP versus TFTP 2. FTP principle of operation 3. FTP trace analysis
The HoneyNet Project Scan Of The Month Scan 27
The HoneyNet Project Scan Of The Month Scan 27 23 rd April 2003 Shomiron Das Gupta [email protected] 1.0 Scope This month's challenge is a Windows challenge suitable for both beginning and intermediate
Symptoms Based Detection and Removal of Bot Processes
Symptoms Based Detection and Removal of Bot Processes 1 T Ravi Prasad, 2 Adepu Sridhar Asst. Prof. Computer Science and engg. Vignan University, Guntur, India 1 [email protected], 2 [email protected]
Title: Bugger The Debugger - Pre Interaction Debugger Code Execution
White Paper Title: Bugger The Debugger Pre Interaction Debugger Code Execution Prepared by: Brett Moore Network Intrusion Specialist, CTO SecurityAssessment.com Date: April 2005 Abstract The use of debuggers
Architecture and Data Flow Overview. BlackBerry Enterprise Service 10 721-08877-123 Version: 10.2. Quick Reference
Architecture and Data Flow Overview BlackBerry Enterprise Service 10 721-08877-123 Version: Quick Reference Published: 2013-11-28 SWD-20131128130321045 Contents Key components of BlackBerry Enterprise
AutoDownload: SQL Server and Network Trouble Shooting
AutoDownload: SQL Server and Network Trouble Shooting AutoDownload uses Microsoft s SQL Server database software. Since 2005 when AutoDownload was first released Microsoft have also released new versions
EMV (Chip-and-PIN) Protocol
EMV (Chip-and-PIN) Protocol Märt Bakhoff December 15, 2014 Abstract The objective of this report is to observe and describe a real world online transaction made between a debit card issued by an Estonian
pyownet Documentation
pyownet Documentation Release 0.10.0 Stefano Miccoli March 30, 2016 Contents 1 Contents 3 1.1 Introduction............................................. 3 1.2 Installation..............................................
TFTP Usage and Design. Diskless Workstation Booting 1. TFTP Usage and Design (cont.) CSCE 515: Computer Network Programming ------ TFTP + Errors
CSCE 515: Computer Network Programming ------ TFTP + Errors Wenyuan Xu Department of Computer Science and Engineering University of South Carolina TFTP Usage and Design RFC 783, 1350 Transfer files between
Setup Guide Revision A. WDS Connector
Setup Guide Revision A WDS Connector COPYRIGHT Copyright 2013 McAfee, Inc. Do not copy without permission. TRADEMARK ATTRIBUTIONS McAfee, the McAfee logo, McAfee Active Protection, McAfee CleanBoot, McAfee
Inside the Storm: Protocols and Encryption of the Storm Botnet
Inside the Storm: Protocols and Encryption of the Storm Botnet Joe Stewart, GCIH Director of Malware Research, SecureWorks To be covered in this talk: Quick-and-dirty unpacking of Storm Structure of the
Net Protector Admin Console
Net Protector Admin Console USER MANUAL www.indiaantivirus.com -1. Introduction Admin Console is a Centralized Anti-Virus Control and Management. It helps the administrators of small and large office networks
File Transfer Protocol (FTP) & SSH
http://xkcd.com/949/ File Transfer Protocol (FTP) & SSH Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Some materials copyright 1996-2012 Addison-Wesley J.F Kurose and K.W.
SANS: The 2010 European Digital Forensics and Incident Response Summit. Retrieving Information... Then what? 8 September 2010. Righard J.
SANS: The 2010 European Digital Forensics and Incident Response Summit Page 1 Retrieving Information... Then what? Righard J. Zwienenberg Abstract Page 2 While combating cybercrime, you may gather lots
Removing Sentinel SuperPro dongle from Applications and details on dongle way of cracking Shub-Nigurrath of ARTeam Version 1.
Removing Sentinel SuperPro dongle from Applications Shub-Nigurrath of ARTeam Version 1.0 September 2006 1. Abstract... 2 2. Possible approaches: emulations vs simulation... 3 2.1. How a dongle works...
HIDING THE NETWORK BEHIND THE NETWORK. BOTNET PROXY BUSINESS MODEL Alexandru Maximciuc, Cristina Vatamanu & Razvan Benchea Bitdefender, Romania
HIDING THE NETWORK BEHIND THE NETWORK. BOTNET PROXY BUSINESS MODEL Alexandru Maximciuc, Cristina Vatamanu & Razvan Benchea Bitdefender, Romania Email {amaximciuc, cvatamanu, rbenchea}@ bitdefender.com
File transfer and login using IPv6, plus What to do when things don t work
File transfer and login using IPv6, plus What to do when things don t work Introduction Usually file transfers to remote computers and logins just work. But sometimes they don t. This article reviews the
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
Detecting Botnets with NetFlow
Detecting Botnets with NetFlow V. Krmíček, T. Plesník {vojtec plesnik}@ics.muni.cz FloCon 2011, January 12, Salt Lake City, Utah Presentation Outline NetFlow Monitoring at MU Chuck Norris Botnet in a Nutshell
Using fuzzing to detect security vulnerabilities
Using fuzzing to detect security vulnerabilities INFIGO-TD-01-04-2006 25-04-2006 Leon Juranić [email protected] Infigo IS. All rights reserved. This document contains information, which is protected
Scan Report Executive Summary. Part 2. Component Compliance Summary IP Address : 69.43.165.11
Scan Report Executive Summary Part 1. Scan Information Scan Customer Company: Date scan was completed: rsync.net ASV Company: Comodo CA Limited 06-02-2015 Scan expiration date: 08-31-2015 Part 2. Component
IxLoad - Layer 4-7 Performance Testing of Content Aware Devices and Networks
IxLoad - Layer 4-7 Performance Testing of Content Aware Devices and Networks IxLoad is a highly scalable solution for accurately assessing the performance of content-aware devices and networks. IxLoad
Report. Takeover of Virut domains
Report Takeover of Virut domains February 25, CONTENTS Contents 1 Executive summary 2 2 Introduction 2 2.1 What is Virut?................................ 2 2.2 Takeover of Virut domains..........................
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam Version 4.1 QUESTION NO: 1 Which of the following devices would be used to gain access to a secure network without affecting network connectivity? A. Router
INTRODUCTION TO MALWARE & MALWARE ANALYSIS
INTRODUCTION TO MALWARE & MALWARE ANALYSIS by Quick Heal R&D lab Security Simplified INTRODUCTION Very often people call everything that corrupts their system a virus without being aware about what it
Introduction. Application Security. Reasons For Reverse Engineering. This lecture. Java Byte Code
Introduction Application Security Tom Chothia Computer Security, Lecture 16 Compiled code is really just data which can be edit and inspected. By examining low level code protections can be removed and
Quick Note 040. Create an SSL Tunnel with Certificates on a Digi TransPort WR router using Protocol Switch.
Quick Note 040 Create an SSL Tunnel with Certificates on a Digi TransPort WR router using Protocol Switch. Digi Support January 2014 1 Contents 1 Introduction... 2 1.1 Outline... 2 1.2 Assumptions... 2
SSL... 2 2.1. 3 2.2. 2.2.1. 2.2.2. SSL VPN
1. Introduction... 2 2. Remote Access via SSL... 2 2.1. Configuration of the Astaro Security Gateway... 3 2.2. Configuration of the Remote Client...10 2.2.1. Astaro User Portal: Getting Software and Certificates...10
Introduction. How does FTP work?
Introduction The µtasker supports an optional single user FTP. This operates always in active FTP mode and optionally in passive FTP mode. The basic idea of using FTP is not as a data server where a multitude
Implementation of Botcatch for Identifying Bot Infected Hosts
Implementation of Botcatch for Identifying Bot Infected Hosts GRADUATE PROJECT REPORT Submitted to the Faculty of The School of Engineering & Computing Sciences Texas A&M University-Corpus Christi Corpus
/helpop <command> you can get the detailed help for one single command.
These are the Commands you need, to enter or leave a channel or to change your nick. You can use some of these commands every day or maybe more often. They control how you appear in IRC, and allow you
Evolution of the WWW. Communication in the WWW. WWW, HTML, URL and HTTP. HTTP - Message Format. The Client/Server model is used:
Evolution of the WWW Communication in the WWW World Wide Web (WWW) Access to linked documents, which are distributed over several computers in the History of the WWW Origin 1989 in the nuclear research
RSA Security Anatomy of an Attack Lessons learned
RSA Security Anatomy of an Attack Lessons learned Malcolm Dundas Account Executive John Hurley Senior Technology Consultant 1 Agenda Advanced Enterprise/ Threats The RSA Breach A chronology of the attack
Botnet Analysis Leveraging Domain Ratio Analysis Uncovering malicious activity through statistical analysis of web log traffic
The Leader in Cloud Security RESEARCH REPORT Botnet Analysis Leveraging Domain Ratio Analysis Uncovering malicious activity through statistical analysis of web log traffic ABSTRACT Zscaler is a cloud-computing,
A Critical Investigation of Botnet
Global Journal of Computer Science and Technology Network, Web & Security Volume 13 Issue 9 Version 1.0 Year 2013 Type: Double Blind Peer Reviewed International Research Journal Publisher: Global Journals
REpsych. : psycholigical warfare in reverse engineering. def con 2015 // domas
REpsych : psycholigical warfare in reverse engineering { def con 2015 // domas Warning This serves no purpose Taking something apart to figure out how it works With software Interfacing Documentation Obsolescence
File Transfer Protocol (FTP) Chuan-Ming Liu Computer Science and Information Engineering National Taipei University of Technology Fall 2007, TAIWAN
File Transfer Protocol (FTP) Chuan-Ming Liu Computer Science and Information Engineering National Taipei University of Technology Fall 2007, TAIWAN 1 Contents CONNECTIONS COMMUNICATION COMMAND PROCESSING
List of FTP commands for the Microsoft command-line FTP client
You are on the nsftools.com site This is a list of the commands available when using the Microsoft Windows command-line FTP client (requires TCP/IP to be installed). All information is from the Windows
Monitoring Software Services registered with science.canarie.ca
Monitoring Software Services registered with.canarie.ca Introduction The software registry at.canarie.ca monitors each of the contributed services via the API defined in Research Service Support for the
Cyber Essentials. Test Specification
Cyber Essentials Test Specification Contents Scope of the Audit...2 Assumptions...3 Success Criteria...3 External systems...4 Required tests...4 Test Details...4 Internal systems...7 Tester pre-requisites...8
Measuring the performance of a Wired network
Measuring the performance of a Wired network slide 1 note throughout the following tutorial the courier font indicates the terminal output whereas the courier bold indicates keyboard input. and italic
Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation
Computer Forensics and Digital Investigation Computer Security EDA263, lecture 14 Ulf Larson Lecture outline! Introduction to Computer Forensics! Digital investigation! Conducting a Digital Crime Scene
How To Monitor Attackers On A Network On A Computer Or Network On An Uniden Computer (For Free) (For A Limited Time) (Czechian) (Cybercrime) (Uk) (Cek) (Kolomot
Recent development of tools to monitor attackers Daniel Kouril, Jan Vykopal lastname @ics.muni.cz 43 rd TF-CSIRT meeting 18 September, 2014, Rome, Italy About C4e project Single point of contact in Czech
1 Introduction: Network Applications
1 Introduction: Network Applications Some Network Apps E-mail Web Instant messaging Remote login P2P file sharing Multi-user network games Streaming stored video clips Internet telephone Real-time video
NSA/DHS CAE in IA/CD 2014 Mandatory Knowledge Unit Checklist 4 Year + Programs
Mandatory Knowledge Units 1.0 Core2Y 1.1 Basic Data Analysis The intent of this Knowledge Unit is to provide students with basic abilities to manipulate data into meaningful information. 1.1.1 Topics Summary
CQG/NET Technical Specifications. September 16, 2014 Version 2014-05
CQG/NET Technical Specifications September 16, 2014 Version 2014-05 2014 CQG Inc. Information in this document is subject to change without notice. Windows XP, Windows Vista, Windows, ActiveX, Excel, and
SMTP-32 Library. Simple Mail Transfer Protocol Dynamic Link Library for Microsoft Windows. Version 5.2
SMTP-32 Library Simple Mail Transfer Protocol Dynamic Link Library for Microsoft Windows Version 5.2 Copyright 1994-2003 by Distinct Corporation All rights reserved Table of Contents 1 Overview... 5 1.1
WIZnet S2E (Serial-to-Ethernet) Device s Configuration Tool Programming Guide
WIZnet S2E (Serial-to-Ethernet) Device s Configuration Tool Programming Guide Rev 0.2 This document describes how to make your own Configuration Tool for WIZ100SR, WIZ105SR and WIZ110SR of WIZnet. And
Kaseya Server Instal ation User Guide June 6, 2008
Kaseya Server Installation User Guide June 6, 2008 About Kaseya Kaseya is a global provider of IT automation software for IT Solution Providers and Public and Private Sector IT organizations. Kaseya's
IRC Forensic Basics. by: James Guess. Internet Relay Chat (IRC) first met the world in the late 1980 s. It was the first
IRC Forensic Basics by: James Guess Origins of IRC Internet Relay Chat (IRC) first met the world in the late 1980 s. It was the first globally accessible chat network. The designers originally intended
Introduction to Computer Security Benoit Donnet Academic Year 2015-2016
Introduction to Computer Security Benoit Donnet Academic Year 2015-2016 1 Agenda Networking Chapter 1: Firewalls Chapter 2: Proxy Chapter 3: Intrusion Detection System Chapter 4: Network Attacks Chapter
Protecting DNS Critical Infrastructure Solution Overview. Radware Attack Mitigation System (AMS) - Whitepaper
Protecting DNS Critical Infrastructure Solution Overview Radware Attack Mitigation System (AMS) - Whitepaper Table of Contents Introduction...3 DNS DDoS Attacks are Growing and Evolving...3 Challenges
Malware Analysis Quiz 6
Malware Analysis Quiz 6 1. Are these files packed? If so, which packer? The file is not packed, as running the command strings shelll reveals a number of interesting character sequences, such as: irc.ircnet.net
150-420. Brocade Certified Layer 4-7 Professional 2010. Version: Demo. Page <<1/8>>
150-420 Brocade Certified Layer 4-7 Professional 2010 Version: Demo Page QUESTION NO: 1 Given the command shown below, which statement is true? aaa authentication enable default radius local A.
Configuring Server Load Balancing
CHAPTER 6 This chapter describes how to configure server load balancing (SLB) on the Cisco Application Control Engine (ACE) module. This chapter contains the following sections: Information About Server
IPPBX FAQ. For Firmware Version: V2.0/V3.0 2013-12-11
For Firmware Version: V2.0/V3.0 2013-12-11 Contents 1. IPPBX Access... 3 1.1 How to access IPPBX via SSH?... 3 1.2 How to access IPPBX if I forget the IP of WAN?... 4 1.3 How to retrieve WEB password via