memory of nobody

Kippo Honeypot My laptop currently running Kippo honeypot which can be downloaded here . It supports MySQL database (and soon, the author plans to support SQLite, I am not sure as an option or successor). Basically it's a honeypot which listen on SSH service on port 2222, which, if you're running on Linux for example you can reroute from port 22 (the normal port). As in my case, I am currently running this service behind NAT, so I've to do the port forwarding thing prior to make it work. This can be achieved by; iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 22 -j REDIRECT --to-port 2222 And you can check it by; iptables -t nat -vL Chain PREROUTING (policy ACCEPT 46764 packets, 3114K bytes)  pkts bytes target     prot opt in     out     source               destination     1    60 REDIRECT   tcp  --  eth1   any     anywhere        ...

Mwcollectd v4 Mwcollectd is written by 0xff ( Georg Wicherski) , now that since I plan to contribute back to mwcollect alliance, I've to get a software which provides module for the binaries submission. Nepenthes will do, with the submit-mwserv.conf module (however, I'm yet to know how to enable this, either by editing nepenthes.conf or something). Dionaea, I'm not sure yet since I can't find the module for the submission.  For the mean time I go for Mwcollect, perhaps until I can figure out how to do this on Nepenthes/Dionaea.  If you wondering what mwcollect is, go here  . There is also slides which presented stuffs on mwcollect.

Psi and Pidgin with Dionaea Honeypot (XMPP support)

Dionaea with XMPP I was actually wonder why Nepenthes sensors and Dionaea did not catch any malware since 8th April. It's more than a month now. So I decided to look to the other way despite looking at the empty, boring folder. But I'm not sure whether my config is correct, although I guess I already able to login. You might also want to use XML Console within Psi

I bought several books for my study literature, one of them is "Botnets, The Killer Web App" which covers the technical parts of botnet. At first I doubt the book actually cover the common botnet that people talk about, but after I read the book, yes sure it is. I suggest the word "killer web app" to be phased off, since it is not always dealing with Web... port 6667 isn't Web, port 80 and 443 always Web. Prior to that I already got Provos and Holz's Virtual Honeypot's book. This is also a technical book, finely grained covered on howtos of the honeypot including the popular Nepenthes (although now it's already dead, succeeded by Dionaea).

KUL-TGG-KUL Hello, My paper and slides can be downloaded here: Slides Paper

API Hooking Ok, I admit it. I stumbled to these words once I read literatures on CWSandbox from Mannheim. Since in Nepenthes we can simply send the newly fetched binaries to the sandboxes, I was like triggered to know what was executed behind them. The method being called as API hooking. The other similar solution being used by Joebox, developed by postgrad student from Switzerland. Anubis from Vienna in the other way around use QEMU ... but if you google around you will see there is one paper written by Symantec researcher refuting on the usage of virtual machines.

Afterglow visual from Amun sensor Splendid, awesome.. whatever....! sourcefile dotfile csvfile

From Aachen to Mannheim Well, it seems the Germanians did pretty good job on the lightweight honeypot. I just stumbled to the Thorltz's blog, and it seems that I missed something. Yet another honeypot.. amun! Download here Written in Python, I just got it work in seconds, prior to that you've to install python-psycho module. See, the verbose output: .::[Amun - Decoder] compiling siegburg xor decoder ::. .::[Amun - Decoder] compiling plain1 shellcode ::. .::[Amun - Decoder] compiling plain2 shellcode ::. .: :[Amun - Main] ready for evil orders: ::. Among the services (mixed with my valid ssh service) 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 42/tcp open nameserver 105/tcp open csnet-ns 110/tcp open pop3 135/tcp open msrpc 139/tcp open netbios-ssn 143/tcp open imap 443/tcp open https 445/tcp open microsoft-ds 554/tcp open rtsp 587/tcp open submission 617/tcp open sco-dtmgr 623/tcp open unknown 631/tcp open ipp 1023...

[nepenthes] Using Anubis Python script We can use this python script to automate/mocking the automated submission triggered by Nepenthes... root@nuvox:~/binaries# ./submit_to_anubis.py * -e mailaku @ gmail.com Successfully submitted the sample. Get the task result at http://analysis.seclab.tuwien.ac.at/result.php?taskid =f474d3ae50475c6451031f37d2d283fd Successfully submitted the sample. Get the task result at http://analysis.seclab.tuwien.ac.at/result.php?taskid =357c926ee5bfeb6471185f4fb403b55c Successfully submitted the sample. Get the task result at http://analysis.seclab.tuwien.ac.at/result.php?taskid =0c75b6d90af30124155cf3c69cce504b Could not submit the sample. Successfully submitted the sample. Get the task result at http://analysis.seclab.tuwien.ac.at/result.php?taskid =fd7ca9e064aef6d499121a4956a2d9fa Could not submit the sample. Could not submit the sample. Successfully submitted the sample. Get the task result at http://analysis.seclab.tuwien.ac.at/result.php?taskid =639c...

[nepenthes] Screen shot of hex dumps

[nepenthes] Emulating physical nodes Since the higher number of sensor we get, the huge coverage of outbreak we can cover, so I opt to choose the Neil's and his pal way of doing things: for i in `seq 230 254`;do ip addr add X.X.X.$i/24 brd + dev eth0;done This of course just cover the range of X.X.X.230 until X.X.X.254 . Still finding method to simulate say 10,000 nodes since IPv6 address will be fine. Nobody really use ipv6 here, I guess. Run, ip add show You should see things similar like this: 1: lo: mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: mtu 1500 qdisc pfifo_fast qlen 1000 inet X.X.X.139/24 brd X.X.X.255 scope global eth0 inet X.X.X.230/24 brd X.X.X.255 scope global secondary eth0 inet X.X.X.231/24 brd X.X.X.255 scope global secondary eth0 inet X.X.X.232/24 brd X.X.X.255 scope global secondary eth...

[clamav] submission added source Submission-ID: 3571791 Sender: me Added: Trojan.Kolabc.BFY Virus name alias: Net-Worm.Win32.Kolabc.bfy (Kaspersky AVP)

[nepenthes] New binary notification Description Risk Autostart capabilities : This executable registers processes to be executed at system start. This could result in unwanted actions to be performed automatically. Changes security settings of Internet Explorer : This system alteration could seriously affect safety surfing the World Wide Web. Joins IRC Network : The executable connects to an IRC network, most probably functioning as a zombie in a botnet. Performs Address Scan : The executable scans a range of IP Addresses. In most cases these scans identify more potential vulnerable targets. The analysis of your file is finished. You can find your report at http://analysis.seclab.tuwien ....

[CWsandbox-mannheim and nepenthes] Just this morning I was being alerted by the email sent by CWsandbox-mannheim. At last I received analysis email from them. It seems that one of these malwares which they analyzed considered *known* already since I already sent the binary manually to ClamAV: click here analysis details for Sdbot-8639 analysis from different AV vendors

[clam-av and nepenthes] Sharuzzaman mentioned to me that instead of using virustotal, we can help clam-av (which however given on Windows, I prefer to use AVG since Clam-av definition considered pretty much obselete), to update clam-av's virus definition. However, if you refer to my previous post, AVG on Linux detect less malware compared to Clam-av. This is awesome! Means that, the new malware that I got from the junkyard in /var/lib/nepenthes, given it was/*they were* signaled by Clam-av as "OK" I must send them straight away. (Well, if you have spare time. Consider this as your social community service ;) ). Though the submission per person restricted only up to TWO files only, you can manually email the personnel to send more than that. Interested to help? Send using this form Sample submission report (both malware accepted), click here Submission-ID: 3434478 Sender: nama aku Added: Trojan.SdBot-8639 Virus name alias: Net-Worm.Win32.Kolabc.aws (Kaspersky AVP), Packer....

[nepenthes] scanning with AVG root@nuvox:/var/lib/nepenthes/binaries# ls -l total 280 -rw-r--r-- 1 nepenthes nepenthes 41928 2008-06-09 07:43 0c6734accaf1d500a388f690a1ef3a76 -rw-r--r-- 1 nepenthes nepenthes 41928 2008-06-05 20:16 381dd5ff2ef3993bd92923626ee7948a -rw-r--r-- 1 nepenthes nepenthes 51664 2008-06-04 14:03 3d39a29913a2fe54009d491b89b01ab4 -rw-r--r-- 1 nepenthes nepenthes 41936 2008-06-03 11:04 8e072862754ef6e80831d2fd50376b43 -rw-r--r-- 1 nepenthes nepenthes 41928 2008-06-02 16:38 ba106399aad8b515319f52fac4794a73 -rw-r--r-- 1 nepenthes nepenthes 51664 2008-06-02 16:00 c2f699282a7a16ecf554cfbaa2724204 root@nuvox:/var/lib/nepenthes/binaries# avgscan * AVG7 Anti-Virus command line scanner Copyright (c) 2007 GRISOFT, s.r.o. Program version 7.5.51, engine 442 Virus Database: Version 270.0.0/1491 2008-06-09 License type is TRIAL for WORKSTATION. Number of days to expiration: 30 3d39a29913a2fe54009d491b89b01ab4 Virus found Win32/Virut c2f699282a7a16ecf554cfbaa2724204 Virus foun...

[nepenthes] New malware coming in I just wondering why my ClamAV did not detect the fetched malware as "malware", instead just OK. But then since nepenthes already classified it as "suspicious binary".. and why would a binary being sent to my honeypot anyway? I also create a cron job to ensure that ClamAV updates its definition, sixth times per day. This is the first time I was being alerted by the malware submission after I enabled the submit_norman.so line. my very own 1st automated malware submission The other links was being redirected to joebox.. it just shows this stuffs along with the zip file contains reports of the analyzed malware: The attached zip document contains all kind of behaviour information which Joebox has detected. Please note that Joebox currently only analyse file system, registry system and process system behaviour. Analysis information about network, services and thread activities will be added in the next months. The analysis machine which ...

[Nepenthes] GOT CHA! Living in protected LAN.. I thought I am pretty safe.. not so! I rarely checked my nepenthes /var/lib until today.. after I upgraded my Ubuntu Gutsy to Hordy... wooow... root@nuvox:/var/lib/nepenthes/binaries# ls -l total 192 -rw-r--r-- 1 nepenthes nepenthes 51664 2008-06-04 14:03 3d39a29913a2fe54009d491b89b01ab4 -rw-r--r-- 1 nepenthes nepenthes 41936 2008-06-03 11:04 8e072862754ef6e80831d2fd50376b43 -rw-r--r-- 1 nepenthes nepenthes 41928 2008-06-02 16:38 ba106399aad8b515319f52fac4794a73 -rw-r--r-- 1 nepenthes nepenthes 51664 2008-06-02 16:00 c2f699282a7a16ecf554cfbaa2724204 Lemme check...! Doesn't seems that it is clean as expected root@nuvox:/var/lib/nepenthes/binaries# clamscan * 3d39a29913a2fe54009d491b89b01ab4: W32.Virut.ca FOUND 8e072862754ef6e80831d2fd50376b43: Trojan.DsBot-15 FOUND ba106399aad8b515319f52fac4794a73: OK c2f699282a7a16ecf554cfbaa2724204: W32.Virut.ci FOUND ----------- SCAN SUMMARY ----------- Known viruses: 306262 Engine version: 0.92.1 Sc...

MPH revisited I wish I can have MPH pay me for getting them promoted within my blog. Somehow I believe they should. BN, Amazon, should do the same way as well. In a sense it makes me blogging about new books, getting people updated with the books and of course, getting them commented in my blog. He he. I guess though the online book mechanism do append comments from reader( or somehow there was also a case which accused a reader whom turned out the be the author/influenced by him), my blog should serve non-bias purpose. :-] //Well,honestly it was just an excuse to get myself a FREE BOOK for lifetime.