Thorsten Holz of the German Honeynet Project has posted a very interesting article describing the methods used by botnet owners to hide command and control servers. I’ve seen much of it in the wild myself, confirming the techniques described in the whitepaper.
Blog posts
-
Fast-flux Service Networks
Posted on Blog over 19 years agoon July 17, 2007 - 9:02 PM and archived here at /blog/2007/2007-07-17-fast-flux-service-networks/at https://pizza.slow.high.quality.gravely.pizza/blog/2007/2007-07-17-fast-flux-service-networks/ in the Blog collection in both HTML and markdown. -
I am Obliged
I am obliged to record the things that I am told, but I am certainly not required to believe them–this remark may be taken to apply to the whole of my account.
Posted on Blog over 19 years agoon July 11, 2007 - 5:42 AM and archived here at /blog/2007/2007-07-10-i-am-obliged/at https://pizza.slow.high.quality.gravely.pizza/blog/2007/2007-07-10-i-am-obliged/ in the Blog collection in both HTML and markdown. -
Dictionary Attacks
We’ve all been asked to use passwords that are more than just a word that could be found in the dictionary…
Waiting for a conference call to start I took a look at a dictionary attack in a live packet capture I had running. In this case, the attacker is trying to log into an FTP server.
[root@sensor-## active]# strings grant.20070628-104057.ftpscan.i.p.add.ress.lpc | grep -a PASS | grep -ao '[^ ]*$' antagonism antagonisms antagonist antagonistic antagonistically antagonists antagonize antagonized antagonizes antagonizing antarctic Antarctica Antares ante anteater anteaters antecedent antecedents antedate antelope antelopes antenna antennae antennas anterior anthem anthems anther anthologies anthology Anthony anthracite anthropological anthropologically anthropologist anthropologist anthropologists anthropology anthropomorphic anthropomorphically anti antibacterial antibiotic antibioticsAnd so on…
The blank lines contained passwords that I’ve removed, some because I recognized them as real passwords for FTP users, some because they did not fit the pattern of starting with the letter ‘a’, suggesting that they were legitimate passwords of which I was not aware.
I like that proper names are capitalized and that the signal/noise ratio causes outliers to jump off the screen. I dislike that the server is running IIS6, which has a good vulnerability history but completely lacks any configurability to react to this sort of attack.
Posted on Blog over 19 years agoon June 28, 2007 - 7:27 PM and archived here at /blog/2007/2007-06-28-dictionary-attacks/at https://pizza.slow.high.quality.gravely.pizza/blog/2007/2007-06-28-dictionary-attacks/ in the Blog collection in both HTML and markdown. -
Petey News
Will: we bought Petey a stuffed Platypus that makes a weird squeek noise
Will: when we gave it to him, he bit it and it made the noise, and he got all scared and confused
Pictured above: Petey, scared of my camera.
Posted on Blog over 19 years agoon June 27, 2007 - 8:17 PM and archived here at /blog/2007/2007-06-27-petey-news/at https://pizza.slow.high.quality.gravely.pizza/blog/2007/2007-06-27-petey-news/ in the Blog collection in both HTML and markdown. -
FREE - to a good home
A large starbucks box on the kitchen table at work proclaimed in magic marker:
FREE TO A GOOD HOME
I peeked in the box to see what was being given away, expecting some vendor swag or gadgets. Inside was a dozen packages of decaffinated starbucks coffee.
Posted on Blog over 19 years agoon June 25, 2007 - 8:10 PM and archived here at /blog/2007/2007-06-25-free-to-a-good-home/at https://pizza.slow.high.quality.gravely.pizza/blog/2007/2007-06-25-free-to-a-good-home/ in the Blog collection in both HTML and markdown. -
Moving Again (last time for a long time I promise!)
From:
We have a lot of practice, all in the last five years and not counting helping friends move:
- Moving to Columbia
- Moving Ben in from Ohio to MD
- Moving within Columbia
- Moving to DC
- Moving within DC
- Moving to Towson
- And in a week, moving into a house we bought
The big move is happening Saturday, starting early.
We have rented a truck that is about half the length of a full 18-wheeler, and because of the size only comes in a manual transmission.
Posted on Blog over 19 years agoon June 23, 2007 - 4:53 PM and archived here at /blog/2007/2007-06-23-moving-again-last-time-for-a-long-time-i-promise/at https://pizza.slow.high.quality.gravely.pizza/blog/2007/2007-06-23-moving-again-last-time-for-a-long-time-i-promise/ in the Blog collection in both HTML and markdown. -
There will always be doubters
And sometimes, they are even right…
Date: March 5, 1974
To: Bob Metcalf and Dave Boggs
From: R. T. Bachrach
Location: PARC - Bldg. 31
Organization: GSL - 44Subject: Comments on “Draft Ethernet Overview”
I have read with dismay your presentation “Draft Ethernet Overview”. As I am sure you are aware, technically or conceptually there is nothing new in your proposal. Perhaps appropriately, you have chosen a coined jargon utilizing discredited scientific conceptual expression in which to frame your ideas. I find your analysis of the proposed interconnection lacking in technical credibility. Quantitative statistical analysis would show that your proposed system would be a failure. You have tried to adopt a scheme inappropriate to the intended engineering application. A random transmisstion scheme such as you propose, along with the quasi-de-randomizing hardware you invoke to patch the obvious deficiency, would place in fact an undo [sic] hardware, software, and scheduling problem on the individual stations.
You should seriously reconsider your basic premises and formulate fully and logically all the parameters necessary to evaluate the system. Your transmission medium or environment is not quantum noise limited. Simple analysis shows that imposing a [P]oisson (i.e., random) statistics on message transmission drastically reduces the available effective bandwidth. Such a system is effective (reasonable) only in the limit of negligible average bit transmission rates. In fact you will want to maintain as high an effective transmission rate as possible. This requires a synchronized system. The fallacy in your conception is that the stations should be transmitting randomly. One possibility for a syncrhonized system would be time division multiplexing. You should seriously study how the telephone companies handle this problem. For example the A.T.T. long lines T2 buried microwave link multiplexes close to 10[^]7 - 6 KHz channels.
Most importantly, you should fully define your engineering applications before proceeding further. You specify an undefined message packet length, a 1 mile or 1 mile diameter loop and 256 stations working at a 3 Mbs rate. What is the nature of the station? How many bits transmitted does an activity require and what is the expected average rate that the 256 stations will be seeking use of the bus in the comtemplated application? What is a tolerable dead time for a given station to acquire a full set of data? The worst case delay for your 1 mile loop is ~2 usec. What effect does this have on far station getting locked out, etc. . . .?
RTB/Tk
cc: W. K. English
R. W. Taylor
J. I. Elkind
H. H. Hall[signed: Robert Bachrach]
It is a lot easier to complain without offering solutions in a memo, or a blog comment, or a usenet or mailing list thread. For some reason, in conversation, the same behavior is obviously lame, annoying, counter-productive, etc…
They are so fun to write though.
Posted on Blog over 19 years agoon June 21, 2007 - 4:16 PM and archived here at /blog/2007/2007-06-21-there-will-always-be-doubters/at https://pizza.slow.high.quality.gravely.pizza/blog/2007/2007-06-21-there-will-always-be-doubters/ in the Blog collection in both HTML and markdown. -
Gimme Some Money
American Express is using Spinal Tap’s first single in a commercial.
Posted on Blog over 19 years agoon June 20, 2007 - 5:01 AM and archived here at /blog/2007/2007-06-19-gimme-some-money/at https://pizza.slow.high.quality.gravely.pizza/blog/2007/2007-06-19-gimme-some-money/ in the Blog collection in both HTML and markdown. -
Why even have Wikipedia anymore?
Truthiness really jumped the shark with this compendium of knowledge and answers.
The mind simply REELS.
On logic:
- A young man approached me at a seminar and stated, ‘Well, I still believe in the big bang, and that we arrived here by chance random processes. I don’t believe in God.’ I answered him, ‘Well, then obviously your brain, and your thought processes, are also the product of randomness. So you don’t know whether it evolved the right way, or even what right would mean in that context. Young man, you don’t know if you’re making correct statements or even whether you’re asking me the right questions.’
The young man looked at me and blurted out, ‘What was that book you recommended?’ He finally realized that his belief undercut its own foundations —such ‘reasoning’ destroys the very basis for reason.
- On another occasion, a man came to me after a seminar and said, ‘Actually, I’m an atheist. Because I don’t believe in God, I don’t believe in absolutes, so I recognize that I can’t even be sure of reality.’ I responded, ‘Then how do you know you’re really here making this statement?’ ‘Good point,’ he replied. ‘What point?’ I asked. The man looked at me, smiled, and said, ‘Maybe I should go home.’ I stated, ‘Maybe it won’t be there.’ ‘Good point,’ the man said. ‘What point?’ I replied.
This man certainly got the message. If there is no God, ultimately, philosophically, how can one talk about reality? How can one even rationally believe that there is such a thing as truth, let alone decide what it is?
WHAT THE FUCK!!??
Posted on Blog over 19 years agoon June 16, 2007 - 11:26 PM and archived here at /blog/2007/2007-06-16-why-even-have-wikipedia-anymore/at https://pizza.slow.high.quality.gravely.pizza/blog/2007/2007-06-16-why-even-have-wikipedia-anymore/ in the Blog collection in both HTML and markdown. -
From the Block
Posted on Blog over 19 years agoon June 16, 2007 - 5:39 PM and archived here at /blog/2007/2007-06-16-from-the-block/at https://pizza.slow.high.quality.gravely.pizza/blog/2007/2007-06-16-from-the-block/ in the Blog collection in both HTML and markdown.