RAID'07 deadline extension

Thursday, March 22. 2007
The deadline for RAID 2007 has been extended to April 8th. So if you plan to submit a paper, you have about one week more time. Looking forward to your submissions :-)
Posted by Thorsten Holz in administrativa at 17:18 | Comments (0) | Trackbacks (0)

SpyBye - Finding Malware

Wednesday, March 7. 2007
Niels Provos has released version 0.2 of SpyBye, a tool for checking URLs while browsing. From the website: "It functions as an HTTP proxy server and intercepts all browser requests. SpyBye uses a few simple rules to determine if embedded links on your web page are harmlesss, unknown or maybe even dangerous"

You can download SpyBye from http://www.monkey.org/~provos/spybye/. Moreover, you also need the latest version of libevent. With the help of the usual configure && make && sudo make install you can install the software. Afterwards you just start SpyBye and you should see an output similar to the following listing:
$ ./spybye
SpyBye 0.2 starting up ...
Report sharing enabled.
Making connection to www.monkey.org:80 for /~provos/good_patterns
Received 529 bytes from http://www.monkey.org/~provos/good_patterns
Added 30 good patterns
Making connection to www.monkey.org:80 for /~provos/bad_patterns
Received 2893 bytes from http://www.monkey.org/~provos/bad_patterns
Added 180 bad patterns
Reading previous state from spybye.log
... read 1 messages
Starting web server on port 8080
Configure your browser to use this server as proxy.

Spybye loads pattern files with known good and bad patterns and then starts a web server on TCP port 8080. You have to configure your browser to use 127.0.0.1 on port 8000 as proxy. Alternatively, you can also use configure your browser to use www.spybye.org:8080 as proxy - this has the advantage that you do not have to install additional software on your machine. SpyBye then checks the URLs you visit and reports every suspicious activities it finds. For example reports of malicious URLs, you can take a look at recent reports. Quite a useful tool, check it out!
Posted by Thorsten Holz in malware at 13:25 | Comments (0) | Trackbacks (0)

"Shelia: A Client-side Honeypot for Attack Detection"

Tuesday, March 6. 2007
The fine folks from Universiteit Amsterdam have published a first preview of Shelia, a client-side honeypot for attacke detection, at http://www.cs.vu.nl/~herbertb/misc/shelia/. Shelia scans through a mail folder and then follows every url and opens every attachment. The tool monitors the processes and generates alerts when the process attempts to change the registry, create files, or attempts specific network operations.

Shelia is available for Windows and supports Outlook Express. It was implemented by Joan Robert Rocaspana from the group around Herbert Bos.
Posted by Thorsten Holz in honeynets at 16:42 | Comments (0) | Trackbacks (0)

"Puppetnets: Misusing Web Browsers as a Distributed Attack Infrastructure"

Monday, March 5. 2007
The recent ACM Conference on Computer and Communications Security (CCS'06) had some interesting papers. One of them deals with so called Puppetnets. A puppetnet is created by malicious web sites which exploit a visiting web browser and take control of it. Similar to a botnet, these puppetnets can be used to mount DDoS attacks, reconnaissance probes, or other nefarious purposes. Presumably the threat posed by these networks is way lower than botnets, but nevertheless they could pose a problem in the future due to the prevalance of client-side exploits. The whole paper is entitled "Puppetnets: Misusing Web Browsers as a Distributed Attack Infrastructure".

Abstract
Most of the recent work on Web security focuses on preventing attacks that directly harm the browser’s host machine and user. In this paper we attempt to quantify the threat of browsers being indirectly misused for attacking third parties. Specifically, we look at how the existing Web infrastructure (e.g., the languages, protocols, and security policies) can be exploited by malicious Web sites to remotely instruct browsers to orchestrate actions including denial of service attacks, worm propagation and reconnaissance scans. We show that, depending mostly on the popularity of a maliciousWeb site and user browsing patterns, attackers are able to create powerful botnet-like infrastructures that can cause significant damage. We explore the effectiveness of countermeasures including anomaly detection and more fine-grained browser security policies.

Continue reading ""Puppetnets: Misusing Web Browsers as a Distributed Attack Infrastructure""

Posted by Thorsten Holz in paper at 12:17 | Comment (1) | Trackbacks (0)
(Page 1 of 1, totaling 4 entries)