Recommendations for the Remediation of Bots in ISP Networks
This is an older version of an Internet-Draft that was ultimately published as RFC 6561. Internet Engineering Task Force J. Livingood Internet-Draft N. Mody Intended status: Informational M. O'Reirdan Expires: March 19, 2010 Comcast September 15, 2009 Recommendations for the Remediation of Bots in ISP Networks draft-oreirdan-mody-bot-remediation-03 Status of this Memo This Internet-Draft is submit
What is a botnet? When infected devices attack
Controlling thousands or even millions of devices gives cyber attackers the upper hand to deliver malware or conduct a DDoS attack. Botnet definition A botnet is a collection of internet-connected devices that an attacker has compromised to carry out DDoS attacks and other tasks as a swarm. The idea is that each computer becomes a mindless robot in a larger network of identical robots, which gives
The Shadowserver Foundation
The Shadowserver Foundation is a nonprofit security organization working altruistically behind the scenes to make the Internet more secure for everyone. Our Story We collect vast amounts of threat data, send tens of thousands of free daily remediation reports, and cultivate strong reciprocal relationships with network providers, national governments and law enforcement. We bring malicious activiti
ボットãƒãƒƒãƒˆãŒãƒ†ãƒ¼ãƒžã®ã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã€ŒHotBots‘07ã€ã‚ˆã‚Š
McAfee Avert Labs Blog 「Hello from HotBots‘07ã€ã‚ˆã‚Š April 11, 2007　Posted by Allysa Myers ボットãƒãƒƒãƒˆã‚’テーマã¨ã™ã‚‹ã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹HotBotsãŒï¼Œç±³å›½æ™‚é–“4月10æ—¥ã«ãƒžã‚µãƒãƒ¥ãƒ¼ã‚»ãƒƒãƒ„州ボストンã§é–‹å‚¬ã•ã‚ŒãŸã€‚è¦æ¨¡ã¯æ¯”較的å°ã•ã„ãŒï¼Œå…¨ç±³ã®å¦æ ¡ã‹ã‚‰ç›¸å½“ãªæ•°ã®ç ”究者ãŒé›†ã¾ã‚Šï¼Œãƒœãƒƒãƒˆã«ã¤ã„ã¦æ„見を交ã‚ã—ãŸã€‚çŸã„プレゼンテーション11件ã¨å…¬é–‹è¨Žè«–会1件ã«åŠ ãˆï¼Œã„ãã¤ã‚‚ã®ç ”究進æ—å ±å‘ŠãŒè¡Œã‚ã‚ŒãŸã€‚PtoPãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã«ãŠã‘るボットãƒãƒƒãƒˆã®å°†æ¥ï¼Œãƒœãƒƒãƒˆãƒãƒƒãƒˆã®è¦æ¨¡è¨ˆæ¸¬ã«é–¢ã™ã‚‹å•é¡Œã¨æ‰‹æ³•ï¼Œãƒœãƒƒãƒˆãƒãƒƒãƒˆç ”究者ã«ã‹ã‹ã‚る法的ãªå•é¡Œï¼Œã„ãã¤ã‹ã®ç‰¹å®šã®ãƒœãƒƒãƒˆã«ã¤ã„ã¦ã®è©³ç´°è§£æžãªã©ï¼Œãƒœãƒƒãƒˆã«é–¢ã™ã‚‹ã‚らゆる話題ãŒå–り上ã’られãŸã€‚ 特ã«å°è±¡ã«æ®‹ã£ãŸä¸€ã¤ç›®ã®è©±é¡Œã¯ï¼Œé–¢ä¿‚者ãŒã€Œãƒœãƒƒãƒˆã®ä¸»æµã¯ï¼Œç¾åœ¨ã‚‚å˜ç´”ãªã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãƒ»ãƒãƒ£ãƒƒãƒˆã«ã‚ˆã‚‹ãƒœãƒƒãƒˆï¼ˆ
First Workshop on Hot Topics in Understanding Botnets (HotBots '07)
Peer-to-Peer Peer-to-Peer Botnets: Overview and Case Study Julian B. Grizzard, The Johns Hopkins University; Vikram Sharma, Chris Nunnery, and Brent ByungHoon Kang, University of North Carolina at Charlotte; David Dagon, Georgia Institute of Technology Read the paper in PDF | HTML An Advanced Hybrid Peer-to-Peer Botnet Ping Wang, Sherri Sparks, and Cliff C. Zou, University of Central Florida Read
「ボットãƒãƒƒãƒˆã‚’“飼ã£ã¦â€ã¿ã¾ã—ãŸã€ï¼ŒTelecom-ISAC Japan
Telecom-ISAC Japanã®ä¼ç”»èª¿æ•´éƒ¨å‰¯éƒ¨é•·ã§ã‚ã‚‹å°å±±è¦šæ°ã¯4月26日，「RSA Conference Japan 2006ã€ã®è¬›æ¼”ã§ï¼Œã€Œãƒœãƒƒãƒˆãƒãƒƒãƒˆã€ã‚’実際ã«é‹ç”¨ã™ã‚‹ã“ã¨ã§åˆ¤æ˜Žã—ãŸèª¿æŸ»çµæžœã‚’公開ã—ãŸï¼ˆå†™çœŸ1）。 å°å±±æ°ã‚‰ã¯ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã§ãƒœãƒƒãƒˆã€ŒrxBOTã€ã®ã‚½ãƒ¼ã‚¹ãƒ»ã‚³ãƒ¼ãƒ‰ã‚’入手ã—ã¦ï¼Œæ¤œè¨¼ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯å†…ã«ãƒœãƒƒãƒˆãƒãƒƒãƒˆã‚’自作ã—ãŸã€‚ãã®ä¸Šã§ï¼Œãƒœãƒƒãƒˆãƒãƒƒãƒˆã®å‘½ä»¤ä¼é”体系やサーãƒãƒ¼æ”»æ’ƒæ‰‹æ³•ãªã©ã‚’調査ã—ãŸã€‚å°å±±æ°ã¯ã€Œæœ€è¿‘ã®ãƒœãƒƒãƒˆãƒãƒƒãƒˆã¯ï¼Œä½¿ã„å‹æ‰‹ã‚‚良ã機能も豊富ã§ï¼Œéžå¸¸ã«æ´—ç·´ã•ã‚Œã¦ã„る。真剣ã«å¯¾ç–を講ã˜ãªã‘ã‚Œã°ãªã‚‰ãªã„ã€ã¨è¨´ãˆãŸã€‚ Telecom-ISAC Japanã¯ï¼Œå›½å†…ã®é€šä¿¡äº‹æ¥è€…ã‚„ISPã§æ§‹æˆã™ã‚‹ã‚»ã‚ュリティ組織ã§ã‚る。å°å±±æ°ã¯ãƒœãƒƒãƒˆãƒãƒƒãƒˆã‚’自らé‹ç”¨ã—ãŸèƒŒæ™¯ã«ã¤ã„ã¦ï¼Œæ¬¡ã®ã‚ˆã†ã«èªžã£ãŸã€‚「去年ã¾ã§ã¯ï¼Œãƒœãƒƒãƒˆãƒãƒƒãƒˆã®ç®¡ç†è€…（Herder）ã‹ã‚‰ãƒœãƒƒãƒˆï¼ˆãƒœãƒƒãƒˆãƒ»ãƒ—ãƒã‚°ãƒ©ãƒ ã«æ„ŸæŸ“ã—ã¦ä¹—ã£å–
官民挙ã’ã¦ã®ã€Œãƒœãƒƒãƒˆå¯¾ç–プãƒã‚¸ã‚§ã‚¯ãƒˆã€å§‹å‹•ï¼Œæ„ŸæŸ“ユーザーã«é§†é™¤æ–¹æ³•ã‚’個別通知
経済産æ¥çœã¨ç·å‹™çœã¯12月12日，官民連æºã®ã€Œãƒœãƒƒãƒˆå¯¾ç–プãƒã‚¸ã‚§ã‚¯ãƒˆã€ã‚’開始ã—ãŸã“ã¨ã‚’発表ã—ãŸã€‚プãƒã‚¸ã‚§ã‚¯ãƒˆã§ã¯ï¼Œãƒœãƒƒãƒˆã®æƒ…å ±ã‚„é§†é™¤ãƒ„ãƒ¼ãƒ«ã‚’ç”¨æ„ã—ãŸå°‚用Webサイトを用æ„。ボットã«æ„ŸæŸ“ã—ã¦ã„るパソコンã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«å¯¾ã—ã¦ï¼Œãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒå¥‘ç´„ã—ã¦ã„ã‚‹ISPã‹ã‚‰å€‹åˆ¥ã«ãƒ¡ãƒ¼ãƒ«ã‚’é€ã£ã¦å°‚用Webサイトã«èª˜å°Žã—，駆除や対ç–を促ã™ã€‚ 感染ユーザーを対ç–サイトã¸èª˜å°Ž ボットã¨ã¯ï¼Œãƒ‘ソコンã«æ„ŸæŸ“ã—ã¦ï¼Œãã®ãƒ‘ソコンを攻撃者ãŒæ“れるよã†ã«ã™ã‚‹æ‚ªè³ªãªãƒ—ãƒã‚°ãƒ©ãƒ ã®ã“ã¨ï¼ˆé–¢é€£è¨˜äº‹ï¼šã€Œãƒœãƒƒãƒˆ(bot)ã€ã«æ°—ã‚’ã¤ã‘ã‚ï¼ï¼‰ã€‚ボットã«æ„ŸæŸ“ã—ãŸãƒ‘ソコンã¯ï¼Œã‚¹ãƒ‘ム（迷惑メール）ã®é€ä¿¡ã‚„フィッシングè©æ¬ºï¼ŒDoS（サービス妨害）攻撃ã¨ã„ã£ãŸã•ã¾ã–ã¾ãªãƒãƒƒãƒˆçŠ¯ç½ªï¼æ‚ªäº‹ã®â€œè¸ã¿å°â€ã¨ã—ã¦åˆ©ç”¨ã•ã‚Œã¦ã„ã¦ï¼Œå¤§ããªå•é¡Œã¨ãªã£ã¦ã„る。 ボットã¯ã§ãã‚‹ã ã‘目立ãŸãªã„よã†ã«å‹•ä½œã™ã‚‹ãŸã‚，感染ã—ã¦ã‚‚æ°—ã¥ã‹ãªã„ã“ã¨ãŒã»ã¨ã‚“ã©ã€‚2005å¹´ã®èª¿æŸ»ã§ã¯ï¼Œã‚¤ãƒ³ã‚¿ãƒ¼
SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System - Current Infosec News and Analysis
We got this code from a reader who got hit by this malware just as he patched his horde install. Again, one of these examples that tells you how fast these exploits are spreading, and not to waste any time patching. We do see a lot of these perl bots/worms. They are not to special but kind of a "e;classic"e; at this point so I figure its worth while to deconstruct a sample. These simple p
paper.dvi
1 An Inside Look at Botnets Paul Barford Vinod Yegneswaran {pb,vinod}@cs.wisc.edu Computer Sciences Department University of Wisconsin, Madison Abstract The continued growth and diversification of the Internet has been accompanied by an increasing prevalence of attacks and intrusions [40]. It can be argued, however, that a significant change in motivation for malicious activity has taken place ove
ボットãƒãƒƒãƒˆã®çŸ¥ã‚‰ã‚Œã–る「内å´ã€ã‚’探る
最近，個人ã®é‡‘èžæƒ…å ±ã‚’ç›—ã¿å‡ºã™ãƒˆãƒã‚¤ã®æœ¨é¦¬ã€ŒMetaFisherã€ï¼ˆSpy-Agentã¨ã—ã¦ã‚‚知られã¦ã„る）ã«é–¢ã™ã‚‹èˆˆå‘³æ·±ã„ニュースãŒå ±ã˜ã‚‰ã‚ŒãŸï¼ˆé–¢é€£è¨˜äº‹ï¼šã€Œæ©Ÿå¯†ãƒ‡ãƒ¼ã‚¿ã‚’盗むトãƒã‚¤ã®æœ¨é¦¬ã€ŒMetaFisherã€ãŒåŒ—ç±³ã§çŒ›å¨ã€ï¼‰ã€‚ç±³VeriSign傘下ä¼æ¥ã§ã‚ã‚‹iDEFENSEã®Ken Dunhamæ°ãŒå ±ã˜ãŸãƒ‹ãƒ¥ãƒ¼ã‚¹ã§æœ€ã‚‚興味深ã‹ã£ãŸã®ã¯ï¼ŒMetaFisherを使ã£ãŸãƒœãƒƒãƒˆãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ï¼ˆãƒœãƒƒãƒˆãƒãƒƒãƒˆï¼‰ã®ç®¡ç†è€…ãŒä½¿ç”¨ã™ã‚‹ç®¡ç†ç”»é¢ã®ã‚¹ã‚¯ãƒªãƒ¼ãƒ³ãƒ»ã‚·ãƒ§ãƒƒãƒˆã§ã‚る。ã“れらã®ç”»åƒã‚’見るã¨ï¼Œãƒœãƒƒãƒˆãƒãƒƒãƒˆã®å†…å´ã§ä½•ãŒèµ·ãã¦ã„ã‚‹ã®ã‹ç†è§£ã§ãる。 iDEFENSEã®Ken Dunhamæ°ãŒå…¬é–‹ã—ãŸã‚¹ã‚¯ãƒªãƒ¼ãƒ³ã‚·ãƒ§ãƒƒãƒˆã¯ï¼Œå›³1ã¨å›³2ã§ã‚る。図1ã¯ï¼Œãƒœãƒƒãƒˆï¼ˆãƒˆãƒã‚¤ã®æœ¨é¦¬ã«ä¹—ã£å–られãŸãƒ‘ソコン）ã®ã¾ã‚“延状æ³ï¼ˆãƒœãƒƒãƒˆãƒãƒƒãƒˆç®¡ç†è€…ã‹ã‚‰è¦‹ãŸå ´åˆã¯æ™®åŠçŠ¶æ³ï¼‰ã‚’閲覧ã™ã‚‹ç”»é¢ã§ã‚る。図2ã¯ï¼Œãƒœãƒƒãƒˆã«å¯¾ã—ã¦ã‚¯ã‚¨ãƒªãƒ¼ï¼ˆå‘½ä»¤ï¼‰ã‚’é€ã‚Šè¾¼ã‚€
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
- Project Rishi: Identify Bot Contaminated Hosts -
CTA Anonymizer - Cyber-TA Overview
404 | Secureworks
BotHunter Free Internet Distribution Page
Bugtraq
SANS.edu Internet Storm Center - SANS Internet Storm Center
Bugtraq
Computer Security: When Bots Attack
Die 'Pinguin'-Turla-APT : Viruslist.com - Analytiker-Tagebuch
http://www.shadowserver.org/botnet/main_page.php
{{#tags}}- {{label}}
{{/tags}}