GSoC Update

Tuesday, April 21. 2009
Yesterday the results of Google Summer of Code (GSoC) were released and the Honeynet Project will mentor nine students during the summer who work on different projects: http://socghop.appspot.com/org/home/google/gsoc2009/honeynet. More information is also available at the Honeynet Project GSoC site.

I'm happy to mentor Lukas Rist, who will work on Glastopf. The goal of the project is to learn more about attacks by emulating vulnerabilities in web applications ("We have two goals: First, collecting and analyzing data and second, trying to inform compromised web page owner. Actually we are mainly collecting Remote File Inclusion attacks, but others will follow."). The source code is available at http://trac.1durch0.de/trac and will be improver during the GSoC period.
Posted by Thorsten Holz in honeynets at 16:00 | Comments (2) | Trackback (1)

Ready or Not?

Monday, April 13. 2009
Several days ago, I finally handed in my dissertation with the title "Tracking and Mitigation of Malicious Remote Control Networks". The thesis was reviewed by Prof. Freiling and Prof. Kruegel and my defense is at the end of the month. The thesis itself deals with different methods to study malicious remote control networks, i.e., a mechanism that enables an attacker the control over a large number of compromised machines for illicit activities. Typical examples of this kind of remote control networks are botnets and fast-flux service networks. The thesis summarizes the work from the last few years and the resulting publications.
Once my defense is over I will post a link to my thesis, it is not yet public. For now I'm really happy that my PhD studies are (almost) over, looking forward to new challenges in the future :-)

And another good news arrived today via e-mail:
On behalf of the 18th USENIX Security Symposium (USENIX Security '09) program committee, I am delighted to inform you that your paper #108 has been accepted to appear in the conference.

Title: Return-Oriented Rootkits: Bypassing Kernel Code Integrity
Protection Mechanisms
Authors: Ralf Hund (University of Mannheim)
Thorsten Holz (University of Mannheim)
Felix Freiling (University of Mannheim)

This year's selection process was very selective, and your paper was one of only 26 papers accepted out of 176 submissions. Congratulations!

Posted by Thorsten Holz in paper at 16:36 | Comments (4) | Trackbacks (0)

LEET'09 Taking Place Soon

Tuesday, April 7. 2009
Join us at the 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats: Botnets, Spyware, Worms, and More (LEET'09), which will take place in Boston, MA, on April 21, 2009. LEET '09 will focus on the underlying mechanisms used to compromise and control hosts, the large-scale "applications" being perpetrated upon this framework, and the social and economic networks driving these threats. Sessions include Malware Analysis, Ethics in Botnet Research, Malware Behavior, and more.

The full program is available at http://www.usenix.org/events/leet09/tech/.

LEET '09 will also include a session for Work-in-Progress reports. We encourage you to submit an abstract or proposal for a 5-minute presentation on your preliminary work to leet09wips@usenix.org.

Connect with the broad community of researchers and practitioners who focus on worms, bots, spam, spyware, phishing, DDoS, and the ever-increasing palette of large-scale Internet-based threats in fostering the development of preliminary work in this diverse area and stimulating discussion of thought-provoking ideas.

Find out more and register today at http://www.usenix.org/leet09/
Posted by Thorsten Holz in honeynets, malware, paper at 08:38 | Comments (3) | Trackback (1)

Conficker Detection

Thursday, April 2. 2009
The Internet did not break down yesterday due to Conficker, it seems like the topic was hyped a bit too much by the media.
In case you want to quickly check whether or not your machine is infected with the worm, you can use a simple check developed by Joe Stewart from SecureWorks. Simply go to http://honeyblog.org/junkyard/conficker/ and check which images your browser shows:
Conficker (aka Downadup, Kido) is known to block access to over 100 anti-virus and security websites.

If you are blocked from loading the remote images in the first row of the top table above (AV/security sites) but not blocked from loading the remote images in the second row (websites of alternative operating systems) then your Windows PC may be infected by Conficker (or some other malicious software).

If you can see all six images in both rows of the top table, you are either not infected by Conficker, or you may be using a proxy server, in which case you will not be able to use this test to make an accurate determination, since Conficker will be unable to block you from viewing the AV/security sites.

Furthermore, the Honeynet Project recently released a paper entitled "Know Your Enemy: Containing Conficker" which presents in detail several methods to detect the worm based on network characteristics,

Abstract:
The Conficker worm has infected several million computers since it first started spreading in late 2008 but attempts to mitigate Conficker have not yet proved very successful. In this paper we present several potential methods to contain Conficker. The approaches presented take advantage of the way Conficker patches infected systems, which can be used to remotely detect a compromised system. Furthermore, we demonstrate various methods to detect and remove Conficker locally and a potential vaccination tool is presented. Finally, the domainname generation mechanism for all three Conficker variants is discussed in detail and an overview of the potential for upcoming domain collisions in version .C is provided. Tools for all the ideas presented here are freely available for download including source code.
Posted by Thorsten Holz in malware, paper at 10:19 | Comments (2) | Trackback (1)
(Page 1 of 1, totaling 4 entries)