Re: [botnets] tracking a botnet for some time now...

2006-03-03 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- [EMAIL PROTECTED] wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- hi, ive been following this moron bot owner around for a while. the guy appears to be using them to load spyware. im

Re: [botnets] botnet in japan...

2006-03-07 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Lindsey Chesnutt wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- I caught a bot with nepenthes this morning.

Re: [botnets] web remote inclulde path

2006-03-07 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- bodik wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- hi, this list seems to be for white Jedi ;) so I'll add my contribution. Even with low expirience I believe I found botnet through

Re: [botnets] found a botnet

2006-03-07 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Jay Lists wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Hello, I just joined this list because I have

[botnets] Skype - the next vector?

2006-03-16 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Ami (and me) just wrote about it: http://blogs.securiteam.com/index.php/archives/355 But if you have the time, I'd STRONGLY suggest you go straight to the amazing work at the source:

Re: [botnets] Modified upx?

2006-03-16 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Wed, 15 Mar 2006, Tron wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- -BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 I have a file, rp5.exe, snared by my running instance of

Re: [botnets] Modified upx?

2006-03-16 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- M45T3R S4D0W8 wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On 3/15/06, Tron [EMAIL PROTECTED] wrote: To

Re: [botnets] Skype - the next vector?

2006-03-19 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- John Draper wrote: Jose Nazario wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Thu, 16 Mar 2006, Gadi Evron wrote: http://www.blackhat.com/presentations/bh-europe-06/bh-eu-06

Re: [botnets] darkdreamz isocore

2006-03-19 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Brian Allen wrote: A google search on these two hostnames, irc.darkdreamz.com and irc.isocore.biz, only turned up a few hits, but they seemed to be related to filesharing. How can I tell if this is a few students trying

Re: [botnets] AOL AIM bots

2006-03-22 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- scot wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Tuesday 21 March 2006 21:06, scot wrote: Please disregard the email address in my previous post i can only assume he pasted me the

Re: [botnets] AOL AIM bots

2006-03-22 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- scot wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Wednesday 22 March 2006 03:30, scot wrote: Apoligies again for the confusion this is the proper email address to send to if you have

Re: [botnets] botnet reporting

2006-03-25 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Kyle Lutze wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 a new botnet reporting system has been setup at shadowserver. for all interested,

Re: [botnets] Sink Hole Network

2006-04-06 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Georg Wicherski wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- If you already know the DNS, just force responses to 0.0.0.0 at your DNS gateway. Additionally add a Snort rule for these

Re: [botnets] DDoS attack

2006-04-06 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Nicholas Albright wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Shadowserver.org got hit with a DDoS

Re: [botnets] Web-Based Bots

2006-04-14 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- David Cheney wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- I too am interested in botnets whose command and control mechanism is not IRC. The web and the community seem to be ripe with

[botnets] sandbox ddos'd

2006-04-21 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- http://www.norman.com/special/34046 ___ To report a botnet PRIVATELY please email: [EMAIL PROTECTED] All list and server information are public and available to law enforcement upon

[botnets] remember Jason?

2006-04-24 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Our friends at F-Secure just posted this: http://www.f-secure.com/weblog/#0861 F-Secure is not really involved with the zuper-zecret botnet/phishing/etc. fighting club, but they are cool amazing guys who have always

[botnets] blue security folds

2006-05-17 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- I just got this in email: http://wired.com/news/technology/0,70913-0.html?tw=wn_index_1 Now they suddenly care about DDoS by a botnet and of the health of the Internet, I wonder what about their huge DDoS botnet now that

Re: [botnets] Weird bot

2006-05-21 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Sat, 20 May 2006, Jörg Weber wrote: Hi folks, I found this funny thing during the weekend: It connects to symantec.loves.the.cock.pheer.biz 18067 and seems to initiate something akin to an IRC session: USeR l l l

[botnets] RFC: public efforts in the botnets realm

2006-05-22 Thread Gadi Evron
. -- Forwarded message -- Date: Mon, 22 May 2006 02:02:48 -0500 (CDT) From: Gadi Evron [EMAIL PROTECTED] To: closed botnets list Subject: public efforts Hi guys. our public efforts in the botnet realm thus far consist of *mainly*: 1. The monthly CC report. 2. Public botnet reporting

Re: [botnets] Weird bot

2006-05-22 Thread Gadi Evron
-Breuning-Allee 6 D-66115 Saarbruecken T: (0681) 8 80 08 - 59 F: (0681) 8 80 08 - 33 www.infos.de mailto: [EMAIL PROTECTED] -Original Message- From: Gadi Evron [mailto:[EMAIL PROTECTED] Sent: Sunday, May 21, 2006 12:20 PM To: Jörg Weber Cc: botnets@whitestar.linuxbox.org

Re: [botnets] Malware TCP connect report

2006-05-23 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Mon, 22 May 2006, Nicholas Albright wrote: This list was created by Chas Tomlin of Shadowserver.org. All TCP connections were verified before posting. Naturally, the shadowserver guys also verify these IRC servers reply

Re: [botnets] [Bulk] Re: Botnets welcome?

2006-05-31 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Tue, 30 May 2006, Craig Holmes wrote: On Tuesday 30 May 2006 04:55, Gadi Evron wrote: Public IRC servers on IRC networks have been used for botnets extensively in the past. Even though they were in denial

[botnets] NTFS Streams rootkit?

2006-06-11 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- First reported in 1998 (http://www.securiteam.com/windowsntfocus/3H5PQS0N5G.html) and reported since every couple of years or so (last time was last week on bugtraq), now (that we know of) there is apparently a rootkit using

[botnets] microsoft statistics to LOOK at

2006-06-13 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- http://download.microsoft.com/download/3/d/e/3de2470b-ab9a-4a7f-b760-ee2421df294a/WindowsRemovalToolWP.doc .doc link Gadi. ___ To report a botnet PRIVATELY please email:

[botnets] eu spam symposium coverage and spammerX

2006-06-22 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Spamhuntress is doing some coverage, it's interesting: http://spamhuntress.com/ ___ To report a botnet PRIVATELY please email: [EMAIL PROTECTED] All list and server information are

[botnets] Drone Armies CC Report - 30 Jun 2006 (fwd)

2006-07-01 Thread Gadi Evron
12322 PROXAD AS for Proxad ISP7 6 14 Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu

[botnets] CFP: DA Workshop - ISOI

2006-07-08 Thread Gadi Evron
. If you are not a member and would like to attend, feel free to send a request. We would be happy to learn of your interest. The workshop is closed to reporters. Please verify your arrival by August 1st, space is limited. Costs: -- Attendance is free. -- Gadi Evron, ISOI/DA Coordinator, [EMAIL

[botnets] ISOI - DA Workshop agenda and web page

2006-07-17 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Hi. You can find the information and latest agenda on the DA workshop on this URL: http://isotf.org/isoi.html It will be updated in the next few days to include a suggested hotel and the rest of the names missing for the

[botnets] final agenda for August 10th DA Workshop

2006-07-21 Thread Gadi Evron
, and for the community for getting involved beyond the closed circle groups. Agenda -- 09:00 - 09:05 - Preview of the day - Gadi Evron (Beyond Security) 09:05 - 09:30 - Early sessions - botnets from different perspectives, hosted by Paul Vixie (ISC): ISP's Barry Greene (Cisco) Anti Virus industry Joe Hartmann

[botnets] mitigate botnets in 5 steps!

2006-08-25 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Okay, who picks up the glove? I wanna see: Botnets for dummies by next year. Gadi. ___ To report a botnet PRIVATELY please email: [EMAIL PROTECTED] All list and server

[botnets] uh huh

2006-08-25 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Bauer cites Maxwell's lack of a criminal record and maintains that he did not intend such an extensive spread of his robot virus program, or botnet software http://seattlepi.nwsource.com/local/282561_botnet25.html

Re: [botnets] the world of botnets article number?

2006-09-13 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Tue, 12 Sep 2006, Toby McKay wrote: hello gadi. in your recent the world of botnets article that you mentioned, you wrote that there are an average of 12K bots a month in-the-wild. Where do you get this number?

Re: [botnets] [Full-disclosure] the world of botnets article and wrong numbers

2006-09-15 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Thu, 14 Sep 2006, Botnet Hunter wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On 9/14/06, Gadi Evron [EMAIL PROTECTED] wrote: AVG is 15K, I can prove *on my own* 12K... counting

Re: [botnets] [Full-disclosure] the world of botnets article and wrong numbers

2006-09-15 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Fri, 15 Sep 2006, Jörg Weber wrote: I can second that, from a not-associated-with-anyone-POV. I get many, many slightly mutated versions of the same bot every day, on average one new version a day, on a very small

Re: [botnets] [Full-disclosure] the world of botnets article and wrong numbers

2006-09-15 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Thu, 14 Sep 2006, Dude VanWinkle wrote: On 9/14/06, Gadi Evron [EMAIL PROTECTED] wrote: This counts bot samples. Whether they are variants (changed) or insignificant changes such as only the IP address to the CC

[botnets] phishing mailing list

2006-09-16 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- The [EMAIL PROTECTED] mailing list is now going live, months too late, but hey, let's get started on phishing issues over there. Gadi. ___ To report a botnet PRIVATELY

[botnets] Paper: Analyzing Large DDoS Attacks Using Multiple Data Sources

2006-09-17 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- This paper was brought to my attention now three times, so I figured I might as well email it here. An interesting read: http://www.research.att.com/~kobus/docs/ddos.lsad.pdf Gadi.

[botnets] [phishing] identities lost in phishing (fwd)

2006-09-18 Thread Gadi Evron
-- Date: Mon, 18 Sep 2006 06:37:39 -0500 (CDT) From: Gadi Evron [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [phishing] identities lost in phishing As I often comment, it is funny to me (not really but hold on) when people scraem about this or that organization losing a laptop with 20K

[botnets] go FTC

2006-09-18 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- http://news.zdnet.com/2100-1009_22-6115948.html Gadi. ___ To report a botnet PRIVATELY please email: [EMAIL PROTECTED] All list and server information are public and

Re: [botnets] AIM botnet in the news

2006-09-20 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Wed, 20 Sep 2006, Black Ratchet wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Tue, 19 Sep 2006 5:27am, Gadi Evron wrote: The good thing about IM botnets is that they run

Re: [botnets] Spammed - sorry

2006-09-22 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Fri, 22 Sep 2006 [EMAIL PROTECTED] wrote: In light of recent litigation, I might be inclined to recommend that folks ban all emails from spamhaus.org or from anybody that appears to be sending from spamhaus.org. From

[botnets] [Full-disclosure] Devil Linux 1.2.10 has an IRC bot onboard (fwd)

2006-10-19 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- -- Forwarded Message -- Subject: [Full-disclosure] Devil Linux 1.2.10 has an IRC bot onboard Date: Thursday 19 October 2006 11:13 From: Victor Grishchenko [EMAIL PROTECTED] To:

[botnets] Re-branding IPS as an anti botnet tool

2006-10-24 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- I have seen a PR last month from Mcafee on this issue, and now they issued another one. For most cases, I don't believe in IDS products. I think that trying to pitch I[DP]S as a solution for botnets is technologically silly,

[botnets] [funsec] Haxdoor: UK Police Count 8, 500 Victims in Data Theft (So Far) (fwd)

2006-10-24 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- So, here we go. Real-life uses for vulnerabilities. Below is an example of just ONE drop-zone server in the United States, which has 600 financial companies and banks. Several gigs of data. How do these things work? They

Re: [botnets] perliminary agenda for ISOI 2 (DA Workshop, January at Microsoft)

2006-12-03 Thread Gadi Evron
will be out of the country. I hope to be able to do so, it is not clear at this point. Gadi. regards, /virendra Gadi Evron wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- -- Forwarded message -- Date: Sat, 2 Dec 2006 10:27:55

Re: [botnets] Possible DNS DDOS attack

2006-12-07 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Thu, 7 Dec 2006, Pagnozzi Sergio wrote: Help me understand: This is an attack on your network, coming from many IPs in the world to a single IP address in your network? This is an attack coming from your network,

Re: [botnets] 2 Days of Photo Cart Vulnerability Attack

2006-12-07 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Thu, 7 Dec 2006, William Atchison wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Perhaps this might be of interest to a few of you as some of the locations where this attack originates

[botnets] [funsec] Botnet Infected User's PC Results In Armed Police Raid (fwd)

2006-12-08 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Either they have a very interesting case, or they are newbies investigating these frauds for the first time, turning up with warrants at infected people's houses. -- Forwarded message -- Date: Fri, 8 Dec 2006

[botnets] Agenda and Schedule for January Workshop

2006-12-08 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- The agenda and schedule for the workshop can be found here: http://isotf.org/isoi2.html Only 9 seats left. Gadi. ___ To report a botnet PRIVATELY please email: [EMAIL

[botnets] drop zones and an intelligence war

2006-12-23 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- In this post ( http://www.phenoelit.net/lablog/Irresponsible.sl ), FX describes a drop zone for a phishing/banking trojan horse, and how he got to it. Go FX. I will refrain from commenting on the report he describes from

Re: [botnets] [phishing] drop zones and an intelligence war

2006-12-23 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Sat, 23 Dec 2006, Gadi Evron wrote: In this post ( http://www.phenoelit.net/lablog/Irresponsible.sl ), FX describes a drop zone for a phishing/banking trojan horse, and how he got to it. Go FX. I will refrain from

[botnets] CCC lecture by Georg Wicherski

2007-01-02 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Georg (who is a very cool guy who I am proud to have shared beer with along with Thorsten and some other guys at the C-BASE party) gave a lecture at CCC on botnet detection and mitigation. It can be downloaded from here:

Re: [botnets] [da] Finding zombies?

2007-01-08 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Mon, 8 Jan 2007, Sean Zadig wrote: Greetings all, I'm looking for suggestions on innovative ways to find zombie machines on my networks. Right now, we're looking for IRC traffic and doing some checking for connections

Re: [botnets] Finding zombies?

2007-01-08 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Mon, 8 Jan 2007, Sean Zadig wrote: Greetings all, I'm looking for suggestions on innovative ways to find zombie machines on my networks. Right now, we're looking for IRC traffic and doing some checking for connections

[botnets] Web Honeynet Project: announcement, exploit URLs this Wednesday

2007-01-16 Thread Gadi Evron
) will be made public in the February edition of the Virus Bulletin magazine, from: Kfir Damari, Noam Rathaus and Gadi Evron (yours truly). The SecuriTeam and ISOTF Web Honeynet Project would like to thank Beyond Security ( http://www.beyondsecurity.com ) for all the support. Special thanks (so far

Re: [botnets] Germany, Austria and Swizzerland building biggest botnet ever

2007-01-22 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Thread over, FUD elsewhere. Thanks. ___ To report a botnet PRIVATELY please email: [EMAIL PROTECTED] All list and server information are public and available to law enforcement

[botnets] Web Server Botnets and Server Farms as Attack Platforms

2007-02-12 Thread Gadi Evron
(Kfir Damari, Noam Rathaus and Gadi Evron (me) of Beyond Security) wrote an article on cross platform web server malware and their massive use as botnets, spam bots and generally as attack platforms. Web security papers deal mostly with secure coding and application security. In this paper we

[botnets] defacements for the installation of malcode

2007-02-12 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Websense just released a blog post on how sites get defaced for malicious purposes other than the defacement itself, such as installing mallicious software on visiting users. This is yet another layer of abuse of web server

[botnets] Storm Worm DDoS Attack - Research - SecureWorks

2007-02-13 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- http://www.secureworks.com/research/threats/view.html?threat=storm-worm Interesting article about the anatomy of the Storm Worm malware. The article also mentions that they believe the SpamHaus DDoS attack was simply

Re: [botnets] defacements for the installation of malcode

2007-02-14 Thread Gadi Evron
on this subject here: http://blogs.securiteam.com/index.php/archives/815 Gadi. --Jeremy -Original Message- From: Gadi Evron [mailto:[EMAIL PROTECTED] Sent: Monday, February 12, 2007 11:17 AM To: [EMAIL PROTECTED] Cc: botnets@whitestar.linuxbox.org; full-disclosure

Re: [botnets] Web Server Botnets and Server Farms as Attack

2007-02-17 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Sat, 17 Feb 2007, Tom wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- First, I would like to apologize to all for these multiple copies of my post. No one, including myself, wants to see

[botnets] On-going Internet Emergency and Domain Names

2007-03-30 Thread Gadi Evron
email message, elaborating on these above statements. Please note this was indeed just an email message, sent among friends. - Begin quoted message - Date: Fri, 16 Feb 2007 02:32:46 -0600 (CST) From: Gadi Evron To: [EMAIL PROTECTED] Subject: [reg-ops] Internet security and domain names Hi all

[botnets] [funsec] Widespread vandalism of wikis by some type of bot (fwd)

2007-04-11 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- -- Forwarded message -- Date: Wed, 11 Apr 2007 02:32:46 -0500 From: Reed Loden [EMAIL PROTECTED] To: funsec@linuxbox.org Subject: [funsec] Widespread vandalism of wikis by some type of bot I'm seeing _lots_

Re: [botnets] active Bandook site

2007-04-12 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- We are on it. On Thu, 12 Apr 2007, PinkFreud wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- ___ To report a botnet PRIVATELY please email:

Re: [botnets] Alternative Botnet CCs - free chapter from Botnets: The Killer Web App

2007-07-08 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Sun, 8 Jul 2007, Gadi Evron wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Syngress was kind enough to allow me to post the chapter I wrote for Botnets: The Killer Web Application (http

[botnets] [Dshield] ISP redirecting IRC traffic to attempt bot removal (fwd)

2007-07-20 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- -- Forwarded message -- Date: Fri, 20 Jul 2007 06:11:25 -0400 From: jayjwa [EMAIL PROTECTED] Reply-To: General DShield Discussion List [EMAIL PROTECTED] To: Dshield Mail List [EMAIL PROTECTED] Subject:

Re: [botnets] Alternative Botnet CCs - free chapter from Botnets:The Killer Web App

2007-07-25 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Thu, 26 Jul 2007, Craig Holmes wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- As promised, I bought the book and finally received it (thanks for the slow turn around Amazon). I have

[botnets] Community input/questions for ISOI 3?

2007-08-25 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Hi, like last time, we are looking for community input and questions for the Internet security operations community, to be discussed during ISOI 3. ISOI is happening this Monday and Tuesday, we will likely compile the

[botnets] mac trojan in-the-wild

2007-10-31 Thread Gadi Evron
hit hard. All those unpatched vulnerabilities from years past are going to bite them in the behind. I can sum it up in one sentence: OS X is the new Windows 98. Investing in security ONLY as a last resort losses money, but everyone has to learn it for themselves. Gadi Evron

Re: [botnets] mac trojan in-the-wild

2007-10-31 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Wed, 31 Oct 2007, Joel Esler wrote: Um. Not only do you have to purposefully go download it, agree to accept the download, them agree to give the software admin priviledges. That's 3 accept dialogues and a password

Re: [botnets] mac trojan in-the-wild

2007-11-01 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Thu, 1 Nov 2007, Jeremy Chatfield wrote: snip correct stuff And this has, so far, little to do with botnets... Unless this SE attack is installing a bot. Is it? What does the bot do? Is there a signature? That'd be

Re: [botnets] re MAC trojan

2007-11-01 Thread Gadi Evron
PRIVATELY please email: [EMAIL PROTECTED] -- Gadi Evron ÿÿ: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Thu, 1 Nov 2007, Gary Flynn wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- This is nothing more than simple

[botnets] the heart of the problem [was: RE: mac trojan in-the-wild]

2007-11-01 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Thu, 1 Nov 2007, Thor (Hammer of God) wrote: But more importantly, let's look at things from the other side. Let's say I'm wrong, and that Gadi is right on target with his hit hard I'd say we are both right. You look at

Re: [botnets] mac trojan in-the-wild

2007-11-03 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Sat, 3 Nov 2007, Tom wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- (Sorry on Digest) Hey all give it a break. You want to discuss this/ make a big deal about it then categorize it as

Re: [botnets] Php inclusion locations for 04.11.2007

2007-11-04 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Please make them unlinkable such as using hxxp://a bcd.com We don't want them indexed in google. :) On Sun, 4 Nov 2007, Interspace System Department wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED]

Re: [botnets] mac trojan in-the-wild

2007-11-04 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Sun, 4 Nov 2007, Steven Adair wrote: On Sat, 3 Nov 2007 13:54:44 -0400, Mr. X [EMAIL PROTECTED] wrote: To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Dude, you gotta get over yourself. The fact

Re: [botnets] Spam botnet discovered

2007-11-05 Thread Gadi Evron
spreading only through FTP (yes, stolen ftp accounts). Have fun, Dan Gadi Evron ÿÿ: On Mon, 5 Nov 2007, Interspace System Department wrote: Hi Gadi, I don't have time for all that obfu/deobfu games, take it as-is ;) I quite understand, but as much as I regret having to say it, take

[botnets] test

2007-12-25 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- ___ To report a botnet PRIVATELY please email: [EMAIL PROTECTED] All list and server information are public and available to law enforcement upon request.

[botnets] (broadband routers) PC World: Flash Attack Could Take Over Your Router

2008-01-16 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Props to Jeff Chan who I saw it from. Yes, I still believe these ISP distributed machines called broadband routers are a network operators issue. But not all may agree on that. --

Re: [botnets] (broadband routers) PC World: Flash Attack Could TakeOver Your Router

2008-01-16 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- On Wed, 16 Jan 2008, Steven Adair wrote: How are you defining network operators? Do you mean by the normal [in most cases home] user? Apparently flash is able to allow UPnP access per PDP's posting at

[botnets] bot sniffing paper from georgia tech

2008-02-16 Thread Gadi Evron
-static.cc.gatech.edu/~guofei/paper/Gu_NDSS08_botSniffer.pdf Gadi. -- *FART* -- Avi Freedman to Gadi Evron in a Chinese restaurant, Boston 2007. ___ To report a botnet PRIVATELY please email: [EMAIL PROTECTED] All list and server information are public

[botnets] downtime

2008-05-23 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- I apologize for the lists downtime. We are working to assure this doesn't happen again. ___ To report a botnet PRIVATELY please email: [EMAIL PROTECTED] All list and server

[botnets] reviving this list, allowing sharing

2008-08-27 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Hi. When this list was started a while back a lot of sharing and discussion was happening. This make us take a step back at the time. Today, when most of this information can do far more good than harm, it is my strong

[botnets] fake AV (malicious) sites

2008-08-27 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- bestantivirus2009 com iframe with exploits: huytegygle com/index.php --script huytegygle com/bin/ file.exe This information is from: http://sunbeltblog.blogspot.com/2008/08/xp-antivirus-2008-now-with-sploits.html Lots of

[botnets] Another bogus greeting card spamming a malware URL

2008-08-27 Thread Gadi Evron
Another bogus greeting card spamming a malware URL (again, one I've seen for a few days now and still live): h ttp://u gm-records.de/e-card.exe Detection wise...Someone already sent it to VT: http://www.virustotal.com/analisis/50bf6f61971f349a5de651aa5515607f As usual, several days later

[botnets] CC: 195.5.216.10:7007

2008-08-27 Thread Gadi Evron
Contacting server 195.5.216.10:7007 Connection with 195.5.216.10:7007 (49153) established *** highkey, *** MAP KNOCK SAFELIST HCN MAXCHANNELS=10 MAXBANS=60 NICKLEN=30 TOPICLEN=307 KICKLEN=307 MAXTARGETS=15 AWAYLEN=307 :are supported by this server *** WALLCHOPS WATCH=128 SILENCE=15 MODES=12

[botnets] reviving the botnets@ mailing list: a new statregy in fighting cyber crime

2008-08-28 Thread Gadi Evron
cyber war doctrine, getting people involved, engaged. Personally aware and a part of what's going on. It can't hurt us, and perhaps now, four years over-due and two years after the previous attempt, we may be ready to give it a go and test the concept. --- Gadi Evron. -- You

[botnets] facebook worms and id theft [was: Re: [phishing] XP update phish/malware]

2008-08-28 Thread Gadi Evron
Interesting, Do you or anyone else know more about the account theft that has been going on with FaceBook. I ask because my kid sister was using it for a while and she kept on asking why her password was changed. Shortly there after her friends had the same issue and they had random wall

Re: [botnets] URL formats

2008-08-28 Thread Gadi Evron
On Thu, 28 Aug 2008, Michael Collins wrote: It would be enormously helpful. Personal bias: I do a lot of data analysis on stuff collected by a bunch of groups, and my biggest headaches are always normalization and how did you figure this out, so if we had a standard, that would make my life,

Re: [botnets] URL formats

2008-08-28 Thread Gadi Evron
On Thu, 28 Aug 2008, fiberOptiC wrote: Are you asking about a standardized reporting format pertaining to all the information you have obtained and wish to share? The suggestion was about URLs. For now, people.. just share. On Thu, Aug 28, 2008 at 3:14 PM, Gadi Evron [EMAIL PROTECTED

[botnets] URL format thread killed: back to scheduled programming

2008-08-29 Thread Gadi Evron
When a proposal on the subject is created, it will be shared with all of you. For now... we are here to share, so let's share. Gadi. ___ botnets@, the public's dumping ground for maliciousness All list and server information are public and

[botnets] nepethes / honeypot dump list: volunteers and instructions

2008-08-29 Thread Gadi Evron
Hi all. The honey pot dump mailing list is ready. Point your servers to report to; [EMAIL PROTECTED] To get us started I am quoting Jeremy, who came up with the idea of us pointing our nepethes sensors to a mailing list. He is providing with simple instructions on how to get started using

[botnets] Washington Post: Atrivo/Intercage, why are we peering with the American RBN?

2008-08-29 Thread Gadi Evron
This Washington Post story came out today: http://voices.washingtonpost.com/securityfix/2008/08/report_slams_us_host_as_major.html I have some thoughts relating more to network operations, but some of you may be interested in following up on this. In the story, Brian Krebs discusses the SF

Re: [botnets] Washington Post: Atrivo/Intercage, why are we peering with the American RBN? (fwd)

2008-08-30 Thread Gadi Evron
From: Marc Sachs [EMAIL PROTECTED] To: 'Gadi Evron' [EMAIL PROTECTED] Subject: RE: Washington Post: Atrivo/Intercage, why are we peering with the American RBN? Unless I'm mis-reading this (or perhaps GBLX read Kreb's story and said good-bye to Atrivo/Intercage), it looks like