Call for Paper: 1st USENIX Workshop on Offensive Technologies (WOOT '07)

Wednesday, May 2. 2007
The Call for Paper for the 1st USENIX Workshop on Offensive Technologies (WOOT '07) is now available.

Important dates:
  • Paper submissions due: Thursday, June 7th, 2007, 11:59 p.m. PDT

  • Notification to authors: July 7th, 2007

  • Final papers due: July 31st, 2007

The workshop will be will be co-located with the 16th USENIX Security Symposium (Security '07), which will take place August 6–10, 2007.

About WOOT:
Progress in the field of computer security is driven by a symbiotic relationship between our understanding of attack and of defense. The USENIX Workshop on Offensive Technologies aims to bring together researchers and practitioners in system security to present research advancing the understanding of attacks on operating systems, networks, and applications.

Computer security is unique among systems disciplines in that practical details matter and concrete case studies keep the field grounded in practice. WOOT provides a forum for high-quality peer-reviewed papers for discussing tools and techniques for attack.

Submissions should reflect the state of the art in offensive computer security technology—either surveying previously poorly known areas or presenting entirely new attacks.

We are interested in work that could be presented at more traditional security forums, as well as more applied work that informs the field about the state of security practice in offensive techniques.

A significant goal is producing published artifacts that will inform future work in the field. Submissions will be peer-reviewed and shepherded as appropriate.

Web-based Honeypot Decoys: Results II

Wednesday, May 2. 2007
Here are some more statistics regarding the data we have collected with the help of Michael Müter's web-based honeypot decoys. PHP-Nuke is the most attractive target, presumably due to it's large number of security vulnerabilities in the past and the large user-base. Commonly, we see file inclusion or SQL injection attempts. These attacks try often to install backdoors written in PHP or defacing tools like the one from r3v3ng4ns.

Attacks per module:
PHP-Nuke: 266 Hits [81.85%]
php Shell: 49 Hits [15.08%]
phpBB: 5 Hits [1.54%]
phpMyAdmin: 5 Hits [1.54%]

Attack Types:
File Inclusion: 167 Hits [51.38%]
SQL injection: 110 Hits [33.85%]
Injection: 30 Hits [9.23%]
WGET 14 Hits [4.31%]
XSS 4 Hits [1.23%]
Defacement attempt: 3 Hits [0.92%]
Directory traversal: 3 Hits [0.92%]

Most often used attack patterns (sanitized):
http://www.XXXzero.com/wp-admin/c.in? : 36 Hits [11.08%]
p0hh0nsee%\') UNION ALL SELECT 1,2,aid,pwd,5,6,7,8,9,10 FROM nuke_authors/* : 34 Hits [10.46%]
http://XXXzero.com/c.in?? : 33 Hits [10.15%]
uname -a : 18 Hits [5.54%]
http://XXXbergsbuss.se/c.in? : 16 Hits [4.92%]
http://XXX.laughingllamas.com/fileupload/store/check.txt? 5 Hits [1.54%]

Captured Downloads:
Total number of captured tools: 36
Average size of a captured tool: 61.22kb
Total size of all captured tools: 2203.84kb