full-disclosure - Monitoring for Sober.Y with Squid and swatch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri Jan  6 03:35:46 2006
From: jeremy at linuxwiz.net (Gaddis, Jeremy L.)
Subject: Monitoring for Sober.Y with Squid and swatch

Here's an article I just wrote up real quick on how to monitor for 
Sober.Y HTTP activity (set to begin at midnight 06-Jan-2006) using the 
Squid proxy server and swatch.

Example configurations are provided.  These are the swatch config 
entries that I am using for monitoring Squid's access.log files for 
(some of?) the hosts that Sober.Y is known to utilize and send alerts to 
my e-mail and company pager.

I took the hosts from SANS' list on ISC.  If there are any hosts that 
I've missed, please do let me know.

The article can be found at http://www.jeremygaddis.com/

Thanks,
-j

--
Jeremy L. Gaddis, GCWN, Linux+, Network+
LinuxWiz Consulting
http://www.linuxwiz.net/