Conficker botnet not nearly as large as feared

An analysis of the Conficker peer-to-peer network set up by the latest variant of the worm shows that the size of the network is far smaller than originally thought. Estimates of the size of the botnet have run far into the millions, but analysts at Kaspersky Lab have been observing the network a...

Exploiting Skype: Building a telephone botnet

From the Industry Standard Robert McMillan Flaws in popular Internet-based telephony systems could be exploited to create a network of hacked phone accounts, somewhat like the botnets that have been wreaking havoc with PCs for the past few years. Researchers at Secure Science recently discovered...

Conficker business model: Scareware and spam

The Conficker botnet has started to use its peer-to-peer communication system to update itself and download scareware fake anti-virus programs to millions of infected Windows machines, according to malware hunters tracking the threat. The latest Conficker mutant comes a week after a heavily-hyped...

Inside the BBC's Chimera botnet

By Dancho Danchev, ZDNet Earlier this month, the controversial BBC purchase of a botnet and modifying the infected hosts in the name of “public interest” sparked a lot of debate on the pros and cons of their action. Condemned by certain security vendors, and naturally, at least from guerrilla PR...

Infrastructure attacks: A growing concern

In an essay published on his personal blog doxpara.com, security researcher Dan Kaminsky is starting to sound the alarm about “the extraordinary damage” we face from infrastructure attacks, warning that the industry needs to treat infrastructure with more security due diligence and care. “Forget...

NZ telco hires admitted botnet operator

By Michael Field, Sydney Morning Herald TelstraClear, Telstra’s New Zealand subsidiary, has hired one of the worlds best known hackers smh.com.au — a teenager known as “Akill”. Owen Thor Walker, a 19-year-old who became the subject of a US Federal Bureau of Investigation’s “Operation Bot Roast”...

Researchers spot router-based botnet worm

Researchers at DroneBL have spotted signs of a stealthy router-based botnet worm zdnet.com targeting routers and DSL modems. The worm, called “psyb0t,” has been circulating since at least January this year, infecting vulnerable embedded Linux devices such as the Netcomm NB5 ADSL modem and launchi...

BBC defends, explains botnet purchase

After taking some heat for its decision to buy a botnet and use it to send spam and launch a denial-of-service attack against a site owned by Prevx, the BBC has released an editor’s note to explain and defend the broadcast experiment. Here’s the gist of the Beeb’s defense, via BBC Click executive...

BBC paid 'a few thousand dollars' for botnet

In a statement on Monday, the BBC said that its decision to purchase and use a botnet to espose the malware epidemic had been “in the public interest”. “It was not our intention to break the law,” the BBC told ZDNet UK on Monday. “There is a powerful public interest in demonstrating the ease with...

BBC botnet buy: What were they thinking?

By Roel Schouwenberg As Dancho Danchev pointed out, the BBC leased itself a botnet zdnet.com. I couldn’t quite believe it when I read it. The BBC, arguably one of the very best TV producers in the world, surely should have known better? There are so many things wrong about this that I hardly know...

BNC Detection

BNC, an IRC bouncer from The BNC Project, is running on this port. It proxies communications between IRC clients and servers. This may be done to allow clients without direct network access to connect to servers or to hide client addresses. Legimate use of such proxies is rare. They are often...

IRC Bouncer (BNC) Detection

An IRC bouncer aka BNC is running on this port. It proxies communications between IRC clients and servers. This may be done to allow clients without direct network access to connect to servers or to hide client addresses. Legimate use of such proxies is rare. They are often installed by attackers...

ezbounce Detection

ezbounce, an IRC bouncer, is running on this port. It proxies communications between IRC clients and servers. This may be done to allow clients without direct network access to connect to servers or to hide client addresses. Legimate use of such proxies is rare. They are often installed by...

Generic Botnet Client Detection

Binary data 4442.prm...

Generic Botnet Server Detection (PING)

Binary data 4441.prm...

Generic IRC Client Detection / Generic Botnet Detection

Binary data 4440.prm...

Generic Botnet Server Detection (HTTP Client)

Binary data 4401.prm...

Generic Botnet Client Detection

Binary data 4400.prm...

CVE-2007-2651

Multiple off-by-one errors in VooDoo cIRCle before 1.1.beta27 allow remote attackers to cause a denial of service connection loss or possibly execute arbitrary code via a 1 DNS name response of the exact length as a buffer; or a long 2 channel name, 3 partyline channel name, or unspecified vector...

Code injection

Multiple off-by-one errors in VooDoo cIRCle before 1.1.beta27 allow remote attackers to cause a denial of service connection loss or possibly execute arbitrary code via a 1 DNS name response of the exact length as a buffer; or a long 2 channel name, 3 partyline channel name, or unspecified vector...