full-disclosure - Re: Wipe off, rub out, reappear...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAD6s_Xs72cNP5DjwW-7UB_gTWFx-t7jvXgcA-mU_skk59nt7CA@mail.gmail.com>
Date: Tue, 11 Oct 2011 11:29:46 +0200
From: Christian Sciberras <uuf6429@...il.com>
To: secn3t@...il.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Wipe off, rub out, reappear...

If you ask me, you sound like bragging on something you wrote.

Either that, or you're clueless to what you are saying.

Just because my younger brother won't understand 5 lines of code I wrote
doesn't make my 5 liner smart...
Applying the analogy here, just because they're possibly clueless to how OS
internals work doesn't mean the virus is doing anything particularly smart.








On Tue, Oct 11, 2011 at 1:55 AM, xD 0x41 <secn3t@...il.com> wrote:

> Is obvious, this is a very well made executable :)
> Or, set up well to spread and then hide, and doing so with even its phone
> home, wich is normal nowdays, for example consider an ircd, it uses
> PING/PONG, what if you change the rfc, and use ascii characters,then do this
> to the bot, remove USER mode completely only allow it for set modes/opers,
> and then try take the thing down, if it is connected thru about 40 different
> ips and does not rely on dynami dns...
> it is not impossible, it is happening now, and, it is also visible,
> however, these c7c centres are so advanced, Ids are just not getting enough
> info...you cannot do a thing on the properly modified control centres, and,
> i have seen that code, it is extremely modified version of ircd... it cannot
> be used by a NOn operator, and uses a totally different rfc to phopne home
> etc, thus making conventional methods used atm, useless... as they will
> loook for the strings that they know, and always ids will perform some
> string of commands, and, then slowly the operator sees the servers, and one
> by one he blocks YOU out of his network.
> This is a dog eat dog world, bot masters can be exceptionallt ingenious
> when it comes to these things, and masking an exe nowdays, is not as simple
> as some peoples SFX rar kits :)
> So even kits nowdays, can be way more advanced than 2008/2009 even...
> there has been a burst of tech, so there is also a burst in virus
> numbers... but, smart c&c centres, you wont take down so easily, and they
> will move before you can even decrypt theyre settings... wich is exactly why
> stuxnet is non stoppable.. unless the owner shuuts it down, it wont  be
> killed..
> xd
>
>
>
>
> On 11 October 2011 10:45, Bob Dobbs <bobd10937@...il.com> wrote:
>
>> On Mon, Oct 10, 2011 at 4:31 PM, Michael Schmidt <mschmidt@...gstore.com>wrote:
>>
>>>  If its bot net code and it is behind an air barrier then it will never
>>> phone home. They
>>>
>>
>> It already broke the "air wall" to get in. It can certainly do so to get
>> out.
>>
>> Bob
>>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/