Library items tagged: security

PB/INFO/022 (05/07) The role of a computer network should, in its simplest terms, be to carry commands and information from client software running on one computer to server software running on another computer, and to return information in response to those commands. Servers can be divided into two types: those that are freely available to any client and those where access is restricted by some test such as a password, a certificate or an IP address. In an ideal world this would be all the security that was needed: however, this ideal fails in reality for two reasons.

From time to time Janet CSIRT may report activity to you that is related to the Conficker worm. Typically this is a record of traffic from an infected host, to a Conficker sinkhole server. These sinkhole servers pretend to be part of the worm’s command and control infrastructure. The worm then attempts to load a web page on the sinkhole server, that were the server real, would contain instructions for the worm. Our reports typically look like this

Zeus is the name for a family, or perhaps ecosystem of malware that is created and customised using a single toolkit. Not only does the toolkit generate the executable that infects systems, but it also produces server files that act as the command and control infrastructure for the operator’s botnet. Primarily Zeus is used to steal banking details through the use of keystroke logging and screen captures that are sent from the infected system to the command and control sever.

Janet CSIRT routinely processes netflow data to detect signs of Conficker infections on Janet.