full-disclosure - Re: SSH scans, i caught one

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 20 Nov 2010 13:56:22 +0100
From: Marco van Berkum <marco@...t.nl>
To: OrderZero@...hmail.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: SSH scans, i caught one

On 11/19/2010 09:11 PM, OrderZero wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Looks like the syslgd is your average botnet, simply connects to an
> irc for cnc, from strings...
>
> WHO@...CKªH^@c^_Ã¬{JOIN^_:^ONULL^GOÃ¾Ã¿>^f3ÂµT%9:unable to
> resolveÃ?`Ã;#spoofs:
>
> where #spoofs could be the channel, no cleartext server however
> (other than a conspicuous string "nubnet")..a disassembly of said
> syslgd is attached...

Nice one. I assumed the syslgd was for overwriting syslogd to hide its 
tracks but it doesn't look like that indeed. Like many people already
thought, this is starting to look like a mips-router-hacking-irc-botnet.
Leaves me with two questions. Why MIPS? And whats the purpose. I think 
DDOS, but who knows...

Grtz,
Marco van Berkum

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/