Conficker Tools

Felix Leder and Tillmann Werner

The following page contains the tools and analysis results described in our "Know your Enemy" paper "Containing Conficker - To Tame a Malware". The paper is published by the Honeynet Project and can be downloaded here: todo

All tools are to be considered as proof of concepts. Even though most of them run stable, they are not meant for use in production. They don't come with any warranty.
All tools are available including source code and are licences using GPL.

http://iv.cs.uni-bonn.de/wg/cs/applications/containing-conficker/

Nmap 4.85BETA 4

From Fyodor

4.85BETA4 (compared to 4.76) includes our new Ncat and Ndiff tools, a ton of new NSE scripts for superior network discovery, more than 5,000 version detection signatures and nearly 2,000 OS fingerprints, improved scan performance, and much more! You can read about all the changes at http://nmap.org/changelog.html. Be sure to read all the way down to 4.85BETA1, as that includes some of the most dramatic changes.

Download Nmap 4.85BETA4 from: http://nmap.org/download.html

Firefox critical vulnerability patched in 3.0.8, due next week

A new vulnerability has just been found in Firefox. The vulnerability, discovered by security researcher Guido Landi, was published on several security sites on Wednesday the 25th. The flaw could be used by an attacker to remotely execute code on a users machine using remote memory corruption after a user views a specially crafted malicious XML file. Read more...

Beware of "Local Breaking News"

March 16, 2009 (Marshal News)

Over the past month, botherders have been using fake coupon websites to host Waledac malware. Today, these criminals have updated their theme to use "Reuters breaking news" with localized content to easily captivate unwary users. It uses IP geolocation services to achieve content localization which we have mentioned before in our previous blog. As usual, a link from the fake website point to a Waledac binary and to make it more legitimate looking, "Related Links" to Wikipedia and Google Search were added. Read more...

Senator says his office computers were hacked

"One of attacks looked "pretty serious, and it [was] talking to a computer in some international arena,” Nelson said during the March 19 hearing". Read more

Linux Tips: Removing Directory

rmdir command

Remove folder(s), if they are empty.

SYNTAX
rmdir [options]... folder...

OPTIONS
--ignore-fail-on-non-empty
ignore each failure that is solely because the directory is non-empty

-p, --parents remove explicit parent directories if being emptied

--verbose output a diagnostic for every directory processed

--help display this help and exit

--version output version information and exit

Related Linux Bash commands:

ls - List information about files (use ls-al to see if they are empty)
rm - Remove files (rm -rf will recursively remove folders and their contents)

Michael Jackson and Green Card lottery scams come together

"At the bottom you'll see a banner advert inviting people to live and work in the USA. The advert is served up by a division of Jackson's record company, Sony BMG, who themselves get it from an advertising network called Advertising.com. Nothing bad or dangerous so far.

But what I'm especially interested in is what happens when you click on the advert. You get taken to a website called www.usafis.org, which offers you the opportunity to enter the lottery for an American Green Card (essentially the authorisation to live and work in the United States).".

Posted on March 11th, 2009 by Graham Cluley, Sophos