Slashdot Mirror

← Back to Domains

Domain: dronebl.org

Stories and comments across the archive that link to dronebl.org.

Comments · 6

  1. Re:Searchable database of attackers? by Anonymous Coward · · Score: 0 · on Dyn Executive Responds To Friday's DDOS Attack (dyn.com)

    Look yourself up on DroneBL or on Multi RBL. I know the DroneBL guy was working to get a list of responsible IPs for the Krebs attack and this one.

  2. Re:Test by Hatta · · Score: 1 · on How Banker Trojans Steal Millions Every Day

    How's this one?

  3. Try using rubotted or dronebl by Anonymous Coward · · Score: 2, Informative · on How Can I Tell If My Computer Is Part of a Botnet?

    The rubotted tool does a pretty decent job of detecting most botted computers. Have your dad download it here:

    http://www.trendsecure.com/portal/en-US/tools/security_tools/rubotted

    You could also look for his system on the dronebl:

    http://dronebl.org/

    Good luck!

  4. Yahoo cached version of DroneBL announcement by veranikon · · Score: 1 · on Botnet Worm Targets DSL Modems and Routers

    Yahoo cached version of DroneBL announcement at http://dronebl.org/blog/8

    http://74.6.239.67/search/cache?ei=UTF-8&p=http%3A%2F%2Fdronebl.org%2Fblog%2F8&fr=ubuntu&u=dronebl.org/blog/8&d=XjpWTp2uSg7q&icp=1&.intl=us

  5. Re:What to do about it? by powerlord · · Score: 1 · on Botnet Worm Targets DSL Modems and Routers

    It's hard enough for most people to just hook one of these up, much less wipe a rootkit from it.

    FTFA: http://dronebl.org/blog/8

    Update 4 -- Before you read anything else, read this

    Am I Vulnerable?

    You are only vulnerable if:

    Your device is a mipsel device.
    Your device has telnet, SSH or web-based interfaces available to the WAN
    Your username and password combinations are weak, OR the daemons that your firmware uses are exploitable.
    As such, 90% of the routers and modems participating in this botnet are participating due to user-error (the user themselves or otherwise). Unfortunately, it seems that some of the people covering this botnet do not understand this point, and it is making us look like a bunch of idiots.

    Any device that meets the above criteria is vulnerable, including those built on custom firmware such as OpenWRT and DD-WRT. If the above criteria is not met, then the device is NOT vulnerable.

    How can I tell if I have been infected?

    Ports 22, 23 and 80 are blocked as part of the infection process (but NOT as part of the rootkit itself, running the rootkit itself will not alter your iptables configuration).

    If these ports are blocked, you should perform a hard reset on your device, change the administrative passwords, and update to the latest firmware. These steps will remove the rootkit and ensure that your device is not reinfected.

    The removal instructions seem pretty easy to me. Wipe the image and reinstall.

  6. Re:Run to my openWRT router and look for.. what? by Darkk · · Score: 1 · on Botnet Worm Targets DSL Modems and Routers

    Look at the info from the above link....I pasted it in here for you:

    http://dronebl.org/blog/8