<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
    <channel>
        <title>Labgeek&apos;s Bl0g</title>
        <link>http://www.labgeek.net/labgeeks_blog/</link>
        <description>Botnet&apos;s will eventually rule the world...</description>
        <language>en-us</language>
        <copyright>Copyright 2009</copyright>
        <lastBuildDate>Mon, 06 Jul 2009 20:53:07 -0500</lastBuildDate>
        <generator>http://www.sixapart.com/movabletype/</generator>
        <docs>http://www.rssboard.org/rss-specification</docs>
        
        <item>
            <title>Computer Incident Responders Course (CIRC)</title>
            <description><![CDATA[Down at DC3 (<a href="http://www.dc3.mil">dc3.mil</a>) taking the CIRC course for two weeks in Linthicum, MD - ugggg.  Class is full of Fort Bragg Army MI peeps who are barely old enough to drink beer.  Apparently, after this class we are classified as Certified Digital Media Collector (CDMC), but we all know what certs really mean, nada - but I am not complaining... ]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2009/07/computer-incident-responders-c.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2009/07/computer-incident-responders-c.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Forensics</category>
            
            
            <pubDate>Mon, 06 Jul 2009 20:53:07 -0500</pubDate>
        </item>
        
        <item>
            <title>Analysis of Conficker worm</title>
            <description><![CDATA[<p>Saw this on the Arbor networks blog and thought I would post it as a link, excellent analysis of the conficker worm.</p>

<p><a href="http://mtc.sri.com/Conficker/">http://mtc.sri.com/Conficker/</a></p><div><br /></div>

<p>Below is the abstract....</p>]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2009/04/analysis-of-conficker-worm.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2009/04/analysis-of-conficker-worm.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Botnets</category>
            
                <category domain="http://www.sixapart.com/ns/types#category">Malware</category>
            
            
            <pubDate>Tue, 14 Apr 2009 20:14:18 -0500</pubDate>
        </item>
        
        <item>
            <title>Cell phone forensics training at DC3</title>
            <description><![CDATA[I am at Cell phone forensics training this week at DC3 in Linthicum, MD.&nbsp; The class looks really interesting and will be focusing on the operating systems associated with the main PDA devices - Palm, Windows, CE, RIM Blackberry, common cellular handsets, and a basic understanding of SIM cards.&nbsp; In addition, they will be talking about the hybrid versions of these devices for acquisitions and analysis.&nbsp; Should be a fun week....<br /> ]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2009/03/cell-phone-forensics-training.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2009/03/cell-phone-forensics-training.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Forensics</category>
            
            
            <pubDate>Sun, 15 Mar 2009 13:57:47 -0500</pubDate>
        </item>
        
        <item>
            <title>Create statically linked dc3dd for linux</title>
            <description><![CDATA[Dowload dc3dd from <a href="http://dc3dd.sourceforge.net/">HERE</a> and to your /tmp dir or whatever dir you want.&nbsp; <br /><b>cd /tmp/dc3dd-6.12.2<br />env CFLAGS=-static</b><br /><b>./configure<br />make clean<br />make<br />cd src</b><br /><b>ls -la</b><br />(You should see a dc3dd file in green along with the object files that were created during the compiling process)<br /><b>strip dc3dd </b>(this removes the debugging information that was created during the compilation process<br />file ./dc3dd&nbsp;&nbsp; - just tells you that the exe is statically linked<br /> ]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2009/02/create-statically-linked-dc3dd.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2009/02/create-statically-linked-dc3dd.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">programming</category>
            
            
            <pubDate>Thu, 12 Feb 2009 21:46:03 -0500</pubDate>
        </item>
        
        <item>
            <title>DoD CyberCrime Conference 2009</title>
            <description><![CDATA[Just got to St. Louis, MO a few hours ago ready for the DoD CyberCrime Conference.&nbsp; The talks look to be pretty interesting, we will see how&nbsp; the week goes though.&nbsp; The conference will be held at the <a href="http://www.marriott.com/hotels/travel/stldt-renaissance-st-louis-grand-and-suites-hotel/">St. Louis Renaissance Grand Hotel</a> this week.&nbsp; Tomorrow is the classified briefings at <a href="http://public.scott.amc.af.mil/">Scott AFB</a> so that should be interesting, supposed to have lunch with my old office-mate Dan, hopefully that will be able to happen. ]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2009/01/dod-cybercrime-conference-2009.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2009/01/dod-cybercrime-conference-2009.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Forensics</category>
            
            
            <pubDate>Sun, 25 Jan 2009 13:19:30 -0500</pubDate>
        </item>
        
        <item>
            <title>Microsoft® Malware Protection Center : The new IE exploits for Advisory 961051, now hosted on pornography sites</title>
            <description><![CDATA[<h2>The new IE exploits for Advisory 961051, now hosted on pornography sites</h2>
	
	<div class="postcontent">
		<p>Two days ago, we <a class="" href="http://blogs.technet.com/mmpc/archive/2008/12/11/limited-exploitation-of-microsoft-security-advisory-961051.aspx" mce_href="http://blogs.technet.com/mmpc/archive/2008/12/11/limited-exploitation-of-microsoft-security-advisory-961051.aspx">blogged</a>
about attacks that involve exploits of the recently discovered
vulnerability in Internet Explorer. We would like to give you a quick
update about these attacks.</p>
<p>Based on our stats, since the vulnerability has gone public, roughly
0.2% of users worldwide may have been exposed to websites containing
exploits of this latest vulnerability. That percentage may seem low,
however it still means that a significant number of users have been
affected. The trend for now is going upwards: we saw an&nbsp;increase of
over 50% in the number of reports today compared to yesterday.</p>
<p>How are the attackers managing to affect more users now? First, some
legitimate web sites were maliciously modified to include the exploits.
For example a popular search engine in Taiwan was found to be hosting
the exploit. Luckily, that site was quickly cleaned. Secondly, we've
noticed some pornography sites have started hosting these exploits too:
We recently found a web site in Hong Kong that serves various content
including adult entertainment. Users who hoped to watch that content,
became target of those attacks: specifically, the exploit dropped
trojans that we detect as Trojan:Win32/VB.IQ.dr and Trojan:Win32/VB.IQ.</p>
<p>MSRC keeps their <a class="" href="http://www.microsoft.com/technet/security/advisory/961051.mspx" mce_href="http://www.microsoft.com/technet/security/advisory/961051.mspx">advisory</a>
updated with possible workarounds. Read carefully, see what applies to
you and in the meantime, you should always exercise caution when
browsing and try to go to sites that you trust.</p>
<p>-- Ziv Mador &amp; Tareq Saade</p>
	</div><br /><br />]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2008/12/microsoft-malware-protection-c.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2008/12/microsoft-malware-protection-c.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">security</category>
            
            
            <pubDate>Tue, 16 Dec 2008 19:28:25 -0500</pubDate>
        </item>
        
        <item>
            <title>Forensic tool detects pornography in the workplace | Latest Security News - CNET News</title>
            <description><![CDATA[<p>Pornography in the workplace can pose a serious problem for
employers because a significant amount of material is downloaded by
employees during business hours. </p><p>
The viewing of porn at work can result in lost time, creativity,
productivity, and employer profitability. More importantly, it can help
create a hostile work environment and can be considered sexual
harassment, in violation of <a href="http://www.eeoc.gov/policy/vii.html">Title VII</a>
of the Civil Rights Act of 1964. Naturally, corporations want to avoid
the potentially serious legal consequences and protect their bottom
line.</p><p>

</p><p>
On Sunday, Orem, Utah-based forensic-software maker <a href="http://www.paraben.com/">Paraben</a>
plans to introduce a unique piece of enterprise software developed to
detect and analyze images on workplace networks and computers for
suspect content. The system looks for a number of sophisticated
parameters and grades images at three levels, based upon their
correlation with criteria that have been programmed into the system. <br /></p><br /><a href="http://news.cnet.com/8301-1009_3-10084938-83.html?tag=mncol;title">http://news.cnet.com/8301-1009_3-10084938-83.html?tag=mncol;title</a><br /><br />]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2008/11/forensic-tool-detects-pornogra.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2008/11/forensic-tool-detects-pornogra.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Forensics</category>
            
            
            <pubDate>Sun, 09 Nov 2008 17:55:42 -0500</pubDate>
        </item>
        
        <item>
            <title>BotHunter Software Distribution Page</title>
            <description><![CDATA[BotHunter is a passive network monitoring tool designed to recognize
the communication patterns of malware-infected computers within your
network perimeter.&nbsp; Using an advanced <span style="font-style: italic;">infection-dialog-based </span>event
correlation engine (patent pending), BotHunter represents the most
in-depth network-based malware infection diagnosis system available
today.<br /><br /><a href="http://www.bothunter.net/">Link to Bothunter software</a><br /><br /><div><br /></div>]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2008/11/bothunter-software-distributio.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2008/11/bothunter-software-distributio.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Botnets</category>
            
            
            <pubDate>Sun, 09 Nov 2008 13:41:45 -0500</pubDate>
        </item>
        
        <item>
            <title>OpenSSL vulnerability</title>
            <description><![CDATA[Just the other day, CERT announced an OpenSSL vulnerability in the random number generator used by OpenSSL and Debian and Ubuntu systems.&nbsp; According to the vulnerability:<br /><br /><pre>A weakness has been discovered in the random number generator used<br />by OpenSSL on Debian and Ubuntu systems.  As a result of this<br />weakness, certain encryption keys are much more common than they<br />should be, such that an attacker could guess the key through a<br />brute-force attack given minimal knowledge of the system.  This<br />particularly affects the use of encryption keys in OpenSSH, OpenVPN<br />and SSL certificates.  This vulnerability only affects operating systems which (like<br />Ubuntu) are based on Debian.  However, other systems can be<br />indirectly affected if weak keys are imported into them.<br /><br />So for those who are using ubuntu like myself, you might want to update libssl and then <br />regen those keys/certs.  More information can be found <a href="http://www.securityfocus.com/archive/1/491987">here</a>.<br /></pre><br />]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2008/05/openssl-vulnerability.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2008/05/openssl-vulnerability.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Network Traffic Analysis</category>
            
                <category domain="http://www.sixapart.com/ns/types#category">security</category>
            
            
            <pubDate>Wed, 14 May 2008 13:29:26 -0500</pubDate>
        </item>
        
        <item>
            <title>Net Flow tool list</title>
            <description><![CDATA[I thought I would post a create site that keeps net flow tools up to date - <a href="http://www.switch.ch/network/projects/completed/TF-NGN/floma/software.html">http://www.switch.ch/network/projects/completed/TF-NGN/floma/software.html</a><br /><br />Some examples of the tools are the following:<br /><br /><dl><dd> <br /></dd><dt><a href="https://www.labgeek.net/mt-static/html/editor-content.html?cs=utf-8" name="flowscan"></a><a href="http://net.doit.wisc.edu/%7Eplonka/FlowScan/">FlowScan</a> </dt><dd> A Perl-based system to analyze and report on flows collected by
<a href="http://www.switch.ch/network/projects/completed/TF-NGN/floma/software.html#flow-tools"><tt>flow-tools</tt></a>, <tt>lfapd</tt> or <a href="http://www.switch.ch/network/projects/completed/TF-NGN/floma/software.html#cflowd"><tt>cflowd</tt></a>, by <a href="http://net.doit.wisc.edu/%7Eplonka/">Dave Plonka</a>.  <a href="http://wwwstats.net.wisc.edu/">Sample output graphs</a> are
available too, as well as Majordomo-driven <a href="http://net.doit.wisc.edu/%7Eplonka/FlowScan/#Mailing_Lists">mailing
lists</a> for announcements and general discussion (<a href="http://net.doit.wisc.edu/%7Eplonka/list/flowscan/archive/">archive</a>).
It is currently built on <tt><a href="http://net.doit.wisc.edu/%7Eplonka/Cflow/">Cflow.pm</a></tt>.
User-contributed tools based on FlowScan include:

  <dl><dt> <a href="http://carrierin.sourceforge.net/">CarrierIn</a>
    from Stanislav Sinyagin </dt><dd> which claims to be more suitable for larger ISP/Carriers
    </dd><dt> <a href="https://www.labgeek.net/mt-static/html/editor-content.html?cs=utf-8" name="cuflow"></a><a href="http://www.columbia.edu/acis/networks/advanced/CUFlow/">CUFlow</a>
    from Matt Selsky and Johan M. Andersen at Columbia University </dt><dd> which is an alternative graphing tool "designed to combine
    the features of CampusIO and SubNetIO".  Robert S. Galloway has
    contributed a nice <a href="http://www.dynamicnetworks.us/netflow/">howto-style
    document</a> describing how it can be used. </dd><dt> <a href="http://www.columbia.edu/acis/networks/advanced/FlowMonitor/">FlowMonitor</a>
    from Johan M. Andersen at Columbia University </dt><dd> monitors individual users' network usage against a bandwidth
    usage policy. </dd><dt> <a href="http://users.telenet.be/jurgen.kobierczynski/jkflow/JKFlow.html">JKFlow</a>
    by Jurgen Kobierczynski </dt><dd> A new reporting module which is highly configurable using an
  XML configuration file. </dd><dt> <a href="https://www.labgeek.net/mt-static/html/editor-content.html?cs=utf-8" name="flowscanplus"></a><a href="http://noc.kreonet2.re.kr/Measurement/">FlowScan+</a> </dt><dd> An extension to FlowScan developed by KISTI/KAIST.  Adds
      servlet-based visualization and support for queries for top
      user, AS, port, protocol, etc.  This is supposed to be available
      under <a href="http://flowscan.kreonet2.net/">http://flowscan.kreonet2.net/</a>,
      but that site doesn't seem to be responsive. </dd></dl>

</dd><dt><a href="https://www.labgeek.net/mt-static/html/editor-content.html?cs=utf-8" name="flow-tools"></a><a href="http://www.splintered.net/sw/flow-tools/"><tt>flow-tools</tt></a> </dt><dd> Similar to <a href="http://www.switch.ch/network/projects/completed/TF-NGN/floma/software.html#cflowd"><tt>cflowd</tt></a> but implemented
 as a set of smaller tools, with the addition of compression of the
 recorded data, thus capable of recording many more flows in a given
 amount of disk space.  See <a href="http://www.switch.ch/network/projects/completed/TF-NGN/floma/references.html#osu-id">paper</a>
 about its application for Intrusion Detection. There is also a <a href="http://www.pairlist.net/mailman/listinfo/flow-tools">mailing
 list</a> for the package. <br />

 There is a short presentation called <a href="http://www.itec.oar.net/oartech/2002-06/oartech06122002.html">Ohio
 Gigapop Traffic Measurements</a> that shows some examples on how
 <tt>flow-tools</tt> can be used. <br />

 The package is widely used, and there are quite a few user
 contributions, such as

  <dl><dt> <a href="https://www.labgeek.net/mt-static/html/editor-content.html?cs=utf-8" name="FlowViewer"></a><a href="http://ensight.eos.nasa.gov/FlowViewer/"><tt>FlowViewer</tt></a> </dt><dd> Web-interface to <a href="http://www.switch.ch/network/projects/completed/TF-NGN/floma/software.html#flow-tools">flow-tools</a>.  Consists
of three tools: <em>FlowViewer</em> provides the user with web access
to many of the textual and statistical flow-tools reports.
<em>FlowGrapher</em> provides a web page with a graph of the selected
flow data. These web pages can be saved.  <em>FlowTracker</em>
(introduced in FlowViewer 3.0, released in July 2006) allows the user
to maintain this information long-term by creating four MRTG-like
graphs.  Filtered flow data is collected every five minutes and the
graphs are updated.  FlowTracker requires Tobi Oetiker's <a href="http://oss.oetiker.ch/rrdtool/">RRDtool</a> package.
Screenshots are available. </dd><dt> <a href="http://security.uchicago.edu/tools/net-forensics"><tt>flow-extract</tt></a>
 </dt><dd> which can be used to filter flow-tools-recorded flows through
 user-specified tests </dd><dt> a set of <a href="http://cng.ateneo.net/cng/wyu/software/src/"><em>"Inter.netPH
 contribs"</em></a> </dt><dd> by Horatio B. Bogbindero </dd><dt> some patches and a <a href="http://www.icir.org/robin/flowtools"><em>Python
 module</em></a> </dt><dd> by <a href="http://www.icir.org/robin/">Robin Sommer</a>. </dd><dt> <a href="http://lusars.net/%7Emhunter/flow-pairs/">flow-pairs</a> </dt><dd> A script that extracts lists of the highest bandwidth
    consumers by host and by port.  <a href="http://www.net.berkeley.edu/flow">Installed at
    UCB</a>.  Seems to have similar uses as the older <a href="http://www.switch.ch/network/projects/completed/TF-NGN/floma/software.html#mathe">MATHE</a> system. </dd></dl>

</dd><dt> <a href="https://www.labgeek.net/mt-static/html/editor-content.html?cs=utf-8" name="perl-net-flow"></a><a href="http://search.cpan.org/%7Eakoba/Net-Flow/">Net::Flow</a>
  <img src="http://www.switch.ch/img/new_icon.gif" alt="NEW:" border="0" height="12" width="31" />  </dt><dd> Perl module for de- and encoding Netflow (v5/v9) and IPFIX
  packets. </dd><dt> <a href="https://www.labgeek.net/mt-static/html/editor-content.html?cs=utf-8" name="jflow"></a><a href="http://www.net-track.ch/opensource/jflow/">jflow</a> </dt><dd> A set of Java classes for collecting and analyzing NetFlow data.
Supports Netflow versions 5 and 6, multithreaded implementation to
facilitate real-time traffic accounting and analysis. </dd><dt> <a href="https://www.labgeek.net/mt-static/html/editor-content.html?cs=utf-8" name="autofocus"></a><a href="http://ial.ucsd.edu/AutoFocus/">Autofocus</a> </dt><dd> A traffic analysis and visualization tool that describes the
traffic mix of a link through textual reports and time series plots.
The underlying research is documented in a SIGCOMM 2003 paper,
<em>Automatically Inferring Patterns of Resource Consumption in
Network Traffic</em>, C. Estan, S. Savage, G. Varghese (<a href="http://www.cs.ucsd.edu/users/cestan/papers/p0403-estan.pdf">PDF</a>
paper, <a href="http://www.cs.ucsd.edu/users/cestan/papers/TrafficClusters.ppt">PPT</a>
slides). </dd><dt> <a href="https://www.labgeek.net/mt-static/html/editor-content.html?cs=utf-8" name="netpy"></a>Wisconsin <a href="http://wail.cs.wisc.edu/netpy/">Netpy</a> </dt><dd> Netpy is a network traffic analysis and visualization package
developed at University of Wisconsin-Madison.  This application is
intended for the use of network administrators and it can help
understand usage trends in your network as well as support interactive
analysis of specific network events of interest.  Netpy is distributed
under GPL and a BDS-like license.  Netpy stores NetFlow records in a
local database after applying some sampling to reduce the size of the
data. The analysis engine supports interactive analyses on this data
where the user chooses the time interval of interest, the filtering
rules to apply to the traffic and the type of analysis. The netpy
console allows the user to manage the database, and perform analyses
interactively or through scripts. The graphical user interface
visualizes the results of the analyses accessing the database locally
or remotely through a netpy server that is also part of the
package.</dd></dl><br />]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2008/05/net-flow-tool-list.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2008/05/net-flow-tool-list.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Network Traffic Analysis</category>
            
            
            <pubDate>Wed, 14 May 2008 13:25:28 -0500</pubDate>
        </item>
        
        <item>
            <title>using Digest::MD5/SHA - OO style</title>
            <description><![CDATA[Took this from another, larger project that I worked on and wrote something small but modular to get me the <a href="http://search.cpan.org/%7Egaas/Digest-MD5-2.36/MD5.pm">MD5,</a> <a href="http://search.cpan.org/%7Egaas/Digest-SHA1-2.11/SHA1.pm">SHA1,</a> and <a href="http://search.cpan.org/%7Edido/SHA256-0.01b/SHA256.pod">SHA256</a> values for any file I want...nothing novel (and extremely limited) here but more efficient for me and now I can have all my private functions in one customized perl module.&nbsp; Here are the files:&nbsp; <a href="https://labgeek.net/hedgehogs_bl0g/filehash.tar.gz">filehash.tar.gz</a>.<br /><br />The package is EncryptTypes::Hash, thus your driver program called getfilehash.pl must be located in the same directory where your EncryptTypes directory sits.&nbsp; Within your EncryptTypes directory, Hash.pm must be located.<br /><br />Something like:<br />...<br />getfilehash.pl<br />EncryptTypes/<br />&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;  &nbsp;&nbsp;  &nbsp;&nbsp;  &nbsp;&nbsp;  Hash.pm<br />...<br />...<br />...<br /><span class="mt-enclosure mt-enclosure-file" style="display: inline;"></span>]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2008/05/using-digestmd5sha-oo-style.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2008/05/using-digestmd5sha-oo-style.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Perl</category>
            
            
            <pubDate>Sun, 04 May 2008 18:07:01 -0500</pubDate>
        </item>
        
        <item>
            <title>storm resources and pdfs</title>
            <description><![CDATA[For my documentation, here are some good sites relative to storm and its analysis:<br /><br />1.&nbsp; <a href="http://offensivecomputing.net/">http://offensivecomputing.net/</a><br />2.&nbsp; <a href="http://trustedsource.net/">http://trustedsource.net/</a><br />3.&nbsp; <a href="http://asert.arbornetworks.com/">http://asert.arbornetworks.com/</a><br />4.&nbsp; http://asert.arbornetworks.com/<br />5.&nbsp; <a href="http://honeyblog.org/">http://honeyblog.org/</a><br />6.&nbsp; <a href="http://www.darkreading.com/document.asp?doc_id=151862&amp;f_src=drdaily">http://www.darkreading.com/document.asp?doc_id=151862&amp;f_src=drdaily</a><br />7.&nbsp; <a href="http://www.usenix.org/events/leet08/tech/full_papers/holz/holz_html/">http://www.usenix.org/events/leet08/tech/full_papers/holz/holz_html/</a><br />8.&nbsp; <a href="http://noh.ucsd.edu/%7Ebmenrigh/exposing_storm.ppt">http://noh.ucsd.edu/~bmenrigh/exposing_storm.ppt</a><br />9.&nbsp; <a href="http://noh.ucsd.edu/%7Ebmenrigh/storm_data.tar.bz2">http://noh.ucsd.edu/~bmenrigh/storm_data.tar.bz2</a><br />10.&nbsp;&nbsp; <a href="http://www.cs.ucsd.edu/%7Evoelker/pubs/stormspam-leet08.pdf">http://</a><span class="a"><a href="http://www.cs.ucsd.edu/%7Evoelker/pubs/stormspam-leet08.pdf">www.cs.<b>ucsd</b>.edu/~voelker/pubs/<b>stormspam</b>-leet08.pdf</a><br />11.&nbsp; <a href="http://sudosecure.net/storm.php">http://sudosecure.net/storm.php</a><br />12. </span><a href="http://www.eecs.harvard.edu/%7Emema/courses/cs264/papers/eclipse-infocom06.pdf">http://</a><span class="a"><a href="http://www.eecs.harvard.edu/%7Emema/courses/cs264/papers/eclipse-infocom06.pdf">www.eecs.harvard.edu/~mema/courses/cs264/papers/<b>eclipse</b>-infocom06.pdf</a><br />13.&nbsp; <a href="http://dsd.lbl.gov/Net-Mon/TALKS/SCNM1-17-02.pdf">http://</a></span><span class="a"><a href="http://dsd.lbl.gov/Net-Mon/TALKS/SCNM1-17-02.pdf">dsd.lbl.gov/Net-Mon/TALKS/SCNM1-17-02.pdf</a><br />14.&nbsp; <a href="https://opensvn.csie.org/mlnet/trunk/docs/overnet.txt">https://opensvn.csie.org/mlnet/trunk/docs/overnet.txt</a><br />15.&nbsp; <a href="http://www.tml.tkk.fi/Publications/C/25/papers/Nummipuro_final.pdf">http://</a></span><span class="a"><a href="http://www.tml.tkk.fi/Publications/C/25/papers/Nummipuro_final.pdf">www.tml.tkk.fi/Publications/</a><wbr><a href="http://www.tml.tkk.fi/Publications/C/25/papers/Nummipuro_final.pdf">C/25/papers/Nummipuro_final.pdf</a><br />16.&nbsp; <a href="http://planete.inrialpes.fr/%7Eperito/">http://planete.inrialpes.fr/~perito/</a><br />17.&nbsp; <a href="http://www.offensivecomputing.net/papers/js-StormWorm-3-23-2008.pdf">http://www.offensivecomputing.net/papers/js-StormWorm-3-23-2008.pdf</a><br />18.&nbsp; <a href="http://mtc.sri.com/">http://mtc.sri.com/</a><br />19.&nbsp; <a href="http://www.cyber-ta.org/pubs/StormWorm/SRITechnical-Report-10-01-Storm-Analysis.pdf">http://www.cyber-ta.org/pubs/StormWorm/SRITechnical-Report-10-01-Storm-Analysis.pdf</a><br />20.&nbsp; <a href="http://www.secureworks.com/research/threats/view.html?threat=storm-worm">http://www.secureworks.com/research/threats/view.html?threat=storm-worm</a><br />21.&nbsp; <a href="http://blogs.technet.com/antimalware/archive/2007/09/20/storm-drain.aspx">http://blogs.technet.com/antimalware/archive/2007/09/20/storm-drain.aspx</a><br />22.&nbsp;<a href="http://spamtrackers.eu/wiki/index.php?title=Storm"> http://spamtrackers.eu/wiki/index.php?title=Storm</a><br />23.&nbsp;<a href="http://malwaredomains.com/"> http://malwaredomains.com/</a><br />24.&nbsp; <a href="http://www.honeynet.org/papers/ff/fast-flux.html">http://www.honeynet.org/papers/ff/fast-flux.html</a><br />25.&nbsp; <a href="http://spamtrackers.eu/wiki/index.php?title=Fast-flux">http://spamtrackers.eu/wiki/index.php?title=Fast-flux</a><br /><br /><br />- just to name a few....I am sure there have been many more but thought I would list a few I have been to...<br /></span><span class="a"><br /></span>]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2008/05/storm-resources-and-pdfs.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2008/05/storm-resources-and-pdfs.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Botnets</category>
            
                <category domain="http://www.sixapart.com/ns/types#category">security</category>
            
            
            <pubDate>Fri, 02 May 2008 13:24:28 -0500</pubDate>
        </item>
        
        <item>
            <title>whoa,  lemme at those spam templates</title>
            <description><![CDATA[Captured about an hours worth of pcap traffic and decided to pull out those notorious spam templates being sent to and from my infected bot.&nbsp; Will write a quick parser to pick through based on From, To, subject, User-agent,&nbsp; message-id - all of which are assembled within the spam template and then spoofed out using your infected bot as the spamming engine. &nbsp;&nbsp; Listed below are those spam templates from my infected vm bot, here is just one to give you an idea of what it looks like:<br /><span class="mt-enclosure mt-enclosure-file" style="display: inline;"><a href="https://labgeek.net/hedgehogs_bl0g/template1.txt">template1.txt</a></span><br /> <div><br />Here are the rest if you are interested in seeing all the data:&nbsp; <br /><span class="mt-enclosure mt-enclosure-file" style="display: inline;"><a href="https://labgeek.net/hedgehogs_bl0g/spamtemplates.tar.gz">spamtemplates.tar.gz</a></span></div><div><br /></div>]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2008/04/whoa-lemme-at-those-spam-templ.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2008/04/whoa-lemme-at-those-spam-templ.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Botnets</category>
            
                <category domain="http://www.sixapart.com/ns/types#category">Perl</category>
            
            
            <pubDate>Wed, 30 Apr 2008 17:16:26 -0500</pubDate>
        </item>
        
        <item>
            <title>MITRE Honeyclient project - CPAN</title>
            <description><![CDATA[I noticed a project I worked on published their code in CPAN located at:&nbsp; <a href="http://search.cpan.org/%7Emitrehc/HoneyClient-Manager-0.99/">http://search.cpan.org/~mitrehc/HoneyClient-Manager-0.99/</a>.&nbsp; To my knowledge the project integrated with Caputre-HPC to handle their real-time integrity check functionality.&nbsp; Additionally, if you want to find our more with the status of the project, you can visit their main site at:&nbsp; <a href="http://honeyclient.org/trac">http://honeyclient.org/trac</a>.&nbsp; If you are curious and don't know what a honeyclient is, it is " <strong></strong>a dedicated host that drives
specially instrumented applications to access remote servers to see if
those servers are behaving in a malicious manner. Specifically,
honeyclients can proactively detect exploits against client
applications without known signatures.".&nbsp; Some of my work can be found here as well:&nbsp; <a href="http://search.cpan.org/src/MITREHC/HoneyClient-Manager-0.99/lib/HoneyClient/Manager/FW.pm">http://search.cpan.org/src/MITREHC/HoneyClient-Manager-0.99/lib/HoneyClient/Manager/FW.pm</a><br />or<br /><a href="http://honeyclient.org/trac/browser/honeyclient/trunk/lib/HoneyClient/Manager/FW.pm">http://honeyclient.org/trac/browser/honeyclient/trunk/lib/HoneyClient/Manager/FW.pm</a><br />]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2008/04/mitre-honeyclient-project-cpan.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2008/04/mitre-honeyclient-project-cpan.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Perl</category>
            
                <category domain="http://www.sixapart.com/ns/types#category">security</category>
            
            
            <pubDate>Tue, 29 Apr 2008 13:25:46 -0500</pubDate>
        </item>
        
        <item>
            <title>pcaplistener-v0.2.pl</title>
            <description><![CDATA[I added some more functionality to my homemade sniffer which now grabs all the outbound DNS packets from my infected bot.&nbsp; The variant I am running I grabbed from sudosecure.net, 681554faf60a96ad2fcebcee4a8e0b53&nbsp; StormCodec8.exe.&nbsp; Some quick stats, in thirty minutes of sniffing, I grabbed 6781 unique DNS hostnames and 12383 ip address ( unique 6748 unique) going across the wire.&nbsp; Here is a file with the latest printout of IPs =&gt; GeoIP lookup:&nbsp; <br /><span class="mt-enclosure mt-enclosure-file" style="display: inline;"><a href="https://labgeek.net/hedgehogs_bl0g/042808_latest_run.txt">042808_latest_run.txt</a><br /><br /><br /></span>Here is a snippet of what hostnames I found coming from my box once infected, the file lists the hostname =&gt; # of ips it resolves to and all the IP addresses:&nbsp; <br /><span class="mt-enclosure mt-enclosure-file" style="display: inline;"><a href="https://labgeek.net/hedgehogs_bl0g/dnsoutputfile.txt">dnsoutputfile.txt</a></span> <div><br />I have some more data but will put it up later...<br /></div>]]></description>
            <link>http://www.labgeek.net/labgeeks_blog/2008/04/pcaplistenerv02pl.html</link>
            <guid>http://www.labgeek.net/labgeeks_blog/2008/04/pcaplistenerv02pl.html</guid>
            
                <category domain="http://www.sixapart.com/ns/types#category">Botnets</category>
            
                <category domain="http://www.sixapart.com/ns/types#category">Perl</category>
            
            
            <pubDate>Mon, 28 Apr 2008 21:24:15 -0500</pubDate>
        </item>
        
    </channel>
</rss>
