Slashdot Mirror

← Back to Stories (view on slashdot.org)

WormRadar Node Volunteers Help Graph Attacks

Posted by simoniker on from the wiggly-wiggly dept.

zoombat writes "NTBugtraq has a post looking for volunteers to run WormRadar nodes. The nodes are essentially honeypots that watch for suspicious activity. Its purpose is to both measure the frequency of known, current worms and to alert us all when something new becomes active. A graph (updated every 30 minutes) shows what was detected. Currently it looks like only a Windows client is available, though."

52 of 159 comments (clear)

  1. Other platforms by BWJones · · Score: 5, Insightful

    Currently it looks like only a Windows client is available, though."

    Might it make more sense to have the client available on platforms which are not necessarily vulnerable to most of these infections? After all, many of the systems which are connected to the Internet full time (servers/workstations etc...) are not Windows machines.

    --
    Visit Jonesblog and say hello.
    1. Re:Other platforms by dicepackage · · Score: 2, Interesting

      If the site gets Slashdotted then there are in fact a lot of people on Slashdot using Windows. Of course the Linux people could allways try running the program in WINE.

    2. Re:Other platforms by Raunch · · Score: 5, Insightful

      From The Jargon File

      honey pot: n.
      1. A box designed to attract crackers so that they can be observed in action. It is usually well isolated from the rest of the network, but has extensive logging (usually network layer, on a different machine). Different from an iron box in that its purpose is to attract, not merely observe. Sometimes, it is also a defensive network security tactic -- you set up an easy-to-crack box so that your real servers don't get messed with. The concept was presented in Cheswick & Bellovin's book Firewalls and Internet Security.
      2. A mail server that acts as an open relay when a single message is attempted to send through it, but discards or diverts for examination messages that are detected to be part of a spam run.
      With emphasis on the attract part. How are you going to monitor worms that propigate using windows with a linux box? You may be able to say, for instance, how many times a certain port was probed. You can't get a linux box to respond in the same way as a windows box without seriously getting into the kernel though.

      --
      George II -- Spreading Freedom and American values, one bomb at a time.
    3. Re:Other platforms by bruthasj · · Score: 3, Interesting

      It didn't work in WINE (CodeWeavers Wine):

      0x65f00000-65fc0800 (PE) C:\WINDOWS\SYSTEM\OLE32.DLL
      0x70bd0000-70c34600 (PE) C:\WINDOWS\SYSTEM\SHLWAPI.DLL
      0x78000000-78040000 (PE) C:\WINDOWS\SYSTEM\MSVCRT.DLL
      Threads:
      process tid prio
      0000000a (D) Y:\updates\WormRadar.exe
      0000000b 0 <==
      WineDbg terminated on pid a

    4. Re:Other platforms by schwaang · · Score: 2, Interesting
      How are you going to monitor worms that propigate using windows with a linux box?
      The perl script I used to monitor incoming Code Red attacks on port 80 runs just as well on linux as windows. A scanner evaluating the idiosyncracies of the TCP/IP stack would not have been fooled, but the real worm certainly was.
    5. Re:Other platforms by 0racle · · Score: 4, Insightful

      Better tell the people at honeyd. They seem to think you can emulate the TCP/IP stack of other OS's, and use scripts to fool the app or person on the other end to run an entire honeynet of composed of several different "OS's" on one system.On top of that, you do not need a vulnerable system, nor allow your box to become compromised in order to attract a worm that will attempt to propagate. If you wanna see how it tries to locally, you analyze the actual code, if you want to see how it affects the network, or detect that something odd is occurring, thats what the honeypot is for.

      --
      "I use a Mac because I'm just better than you are."
    6. Re:Other platforms by minas-beede · · Score: 3, Interesting

      "You can't get a linux box to respond in the same way as a windows box without seriously getting into the kernel though."

      It's a blasted worm. Only if very sophisticated would a worm look for an authentic Windows environment. Why would they bother?

      I'm far more familiar with honey pot definition 2 - and I know how incredibly stupid spammers have long been when it comes to open relay honeypots. They are doing bulk abuse, not pinpoint abuse. Whatever the details they are looking for a vulnerability - and then exploit that vulnerability when they find it. They look for hundreds or thousands of vulnerable systems. They do that "quick and dirty" - that's all they've had to do (almost no complex countermeasures are employed against them.) That has worked for them. Why should they make it more complicated?

      It's not guaranteed that the woms are so primitive that they don't verify that a system is a Windows system - but it's not guaranteed the worms do. Wouldn't it be better to set up the Linux systems and see if they succeed or are discovered as fakes? That has some chance of success. Arm's-length philosophical discussions won't stop any abuse.

      My experience with open relay honeypots suggests that all the spammers do to check for those is attempt to relay. I can see reason for the abusers to be more careful and more clever - but rather than assume they are the better idea is to force them into being more careful and more clever. Burn up more of their time, confuse them about the rest of the internet (the part they abuse, as opposed to their own part.) There are many goals in fighting abuse - don't fixate on just one. If the abusers can be made thoroughly confused about the rest of the internet (i.e., can't tell what is and what isn't vulnerable to abuse) then they pretty much have to give up. That will never happen if all that is done is engage in discussions.

      OK, do fixate - it's you time - who am I to tell you what to do? But give some thought to how much better it is to make a broader attack, if you will, please.

      P.S. Open relay honeypots still work today, April 23, 2004. Open proxy honeypots may be even more powerful.

  2. so go by jacquesm · · Score: 4, Interesting

    and sign up ! these people are doing good things.

    distributed attacks against hackers doing distributed attacks :)

    --
    MP3 Search Engine
    1. Re:so go by Rosco+P.+Coltrane · · Score: 2, Insightful

      Do you really want to fight Microsoft's war for them for free? they won't give you any money to plug their security holes you know...

      Besides, the way I see it, the more viruses and worms floating around the better: it helps people realize how shitty Windows is as a platform, and how Microsoft just treats their customer like crap by selling them mediocre products at outrageous prices. I certainly don't to help Microsoft look better.

      --
      "A door is what a dog is perpetually on the wrong side of" - Ogden Nash
  3. Obvious joke by Chris_Jefferson · · Score: 4, Insightful

    Let me be the first to get the obvious joke out of the way.

    Why is there only a windows client? Because all the worms only effect windows machines, what would be the point of a client on anything else? :)

    Although of course, the more serious answer is "A client on something other than windows would be sensible, because if a new worm comes out and hits a 0-day windows hole then your machine could be infected and dead before it gets the chance to report that it is being attacked. (Just why is it that all these worms people write nowadays just seem so.. nice? I remember the days when 90% of viruses would at the very least format your hard disc.. now they just sit there. It's almost a shame, because one good formating worm might finally make people take them more seriously.. it's only a matter of time)

    --
    Combination - fun iPhone puzzling
    1. Re:Obvious joke by Ironica · · Score: 3, Insightful

      Just why is it that all these worms people write nowadays just seem so.. nice? I remember the days when 90% of viruses would at the very least format your hard disc.. now they just sit there.

      Why is smallpox darn near extinct, but the common cold thrives?

      If a worm formats your hard disk, it can't keep scanning for and infecting new machines. For one thing, now you know something is wrong, and are more inclined to fix it.

      It's almost a shame, because one good formating worm might finally make people take them more seriously.

      And there, you answer your own query. If worms did "real" damage (i.e. obviously interfered with the working of the computer), people would be much more cautious about contracting and spreading them. But how many of you freak out and quarantine yourself if you come in contact with a carrier of the common cold? Same thing...

      --
      Don't you wish your girlfriend was a geek like me?
    2. Re:Obvious joke by tunabomber · · Score: 2, Insightful

      Just why is it that all these worms people write nowadays just seem so.. nice? I remember the days when 90% of viruses would at the very least format your hard disc.. now they just sit there.

      It's evolution. A pathogen that kills its host too fast is a failure unless it can spread extremely fast to compensate. While the old viruses and worms were the equivalent of ebola, wreaking as much havoc to the host as possible, the new ones are more the software equivalent of lampreys or tapeworms- slowly but surely stealing a host's resources.
      Virus writers just discovered that it was far more logical, efficient (and not to mention profitable) to install a spam proxy that would run silently in the background for as long as possible than to torch the contents of the victim's hard drive and display a splash that says "j00 R 50 0w|\|3d!". ...And they know that the less noise their worms make, the more complacent users will grow, which will increase the amount of potential future hosts.

      --

      pi = 3.141592653589793helpimtrappedinauniversefactory71 ...
    3. Re:Obvious joke by DoraLives · · Score: 2, Informative
      Why is smallpox darn near extinct, but the common cold thrives?

      'Cause we KILLED smallpox! (well...excepting what's so far noncontagiously tucked away in cryo storage here and there)

      It has nothing to do with the virulence of smallpox as opposed to the common cold. Hell, as far as that goes, the great sweaty mass of humanity is a fat ripe target just waiting for something that will sweep through and slay the many, but I drift OT.

      Worms that can do "real" damage may well yet spring up from out of the ground and simply wipe out half the computing power on this planet.

      There's nothing at all preventing this from happening. They whistled as the o-rings showed evidence of blow by and burn. They whistled as TPS material that was never designed for foam strikes took hit after hit. But all the whistling in the world didn't prevent what came next, BOTH TIMES. Ditto your (and mine, and everybody else's) computer.

      That which is not prohibited is MANDATORY.

      --
      Is it fascism yet?
  4. Open Source or Trojan Horse? by Comatose51 · · Score: 4, Insightful

    Is this thing open source? It doesn't seem like it. For all we know we could be downloading the world's next biggest trojan horse/worm. Considering the only people who would download this would be techies with big pipes, this could get interesting. Just a theory and a reminder to the author that people usually feel safer downloading something they can examine.

    --
    EvilCON - Made Famous by /.
    1. Re:Open Source or Trojan Horse? by jacquesm · · Score: 4, Informative

      Looks genuine enough though, unless this is false information:

      Roger Thompson
      Roger Thompson
      1650 Emerald Ridge
      Marietta, GA 30062
      US
      Phone: 6785608027
      Fax..: 6785609109
      Email: rogert@mindspring.com

      If not that would be the first time that a trojan writer puts his real world address out for all to see.

      In the windows world people don't even expect to be able to see the source code.

      --
      MP3 Search Engine
    2. Re:Open Source or Trojan Horse? by tunabomber · · Score: 2, Insightful

      Is this thing open source? It doesn't seem like it. For all we know we could be downloading the world's next biggest trojan horse/worm.

      This could be said about any small, proprietary software utility that you see on download.com or tucows. Only time will tell if it's a trojan or not, but if it is, the techies who make up its target audience will find out fast. And they'll spread the word fast. And after receiving the word, they will take it seriously. Techies have other traits besides access to lots of bandwidth.
      Also, it's not likely that this program will be installed on anything more mission-critical than an average office workstation, which could just as easily be infected with Kazaa or some other crapware by its PHB or marketroid user.
      If you want to spread a trojan, might as well write a porn-based video game or MP3 player to use as the vector. Since your target market will be Joe Luser, you'll go much longer before being caught.

      --

      pi = 3.141592653589793helpimtrappedinauniversefactory71 ...
    3. Re:Open Source or Trojan Horse? by minus_273 · · Score: 2, Insightful

      whta gives you the impression that name is the name of the author?

      --
      The war with islam is a war on the beast
      The war on terror is a war for peace
  5. Lol. Understatement. by SatanicPuppy · · Score: 5, Funny

    Why would you need a worm activity detecting program on a Windows box? If there's a lot of worm activity that is close enough that the windows box could monitor it, you'll know.

    It's like the canary in the mineshaft...Works fine for detecting hazards, but a little rough on the bird.

    --
    ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
    1. Re:Lol. Understatement. by laugau · · Score: 5, Funny

      The REASON there is only a windows client is because the windows client does this:

      while (not_infected) {
      send ("Woo Hoo! I'm alive still") ;
      }

      And the server does this:

      listen (client_port) {
      while (get_alive_messages) {
      writeGraph (noWorm);
      }
      ohShit(clientMachineGotWorm);
      }

      Not a very good solution if the clients never die now, is it?

  6. "Download WormRadar.exe now" by eddy · · Score: 4, Funny

    Yeah, that's going to happen.

    Someone run it through IDA? :-P

    --
    Belief is the currency of delusion.
  7. Seems like a good idea implemented poorly by Anonymous Coward · · Score: 5, Informative

    The website is scarce on details, but from the looks of it, it would appear to not be very sophisticated. It detects very few actual worms and exploits, and would seem to be just like http://isc.incidents.org/ (Internet Storm Centre), except without nearly so much data.

    Leusent _AT_ Link-net.org

  8. IINAL by z0ink · · Score: 3, Interesting

    I thought honeypotting is being considerd as not-so-legal. Hopefully this could be something positive in the case for using hoeypots affectively.

    --
    Steal This Sig
    1. Re:IINAL by Anonymous Coward · · Score: 5, Interesting

      I thought honeypotting is being considerd as not-so-legal.

      Why would you say that? It certainly isn't entrapment. If you leave your house windows open, it doesn't give thieves permission to steal.

      And a burglar can't complain that you have video cameras all over the house recording them while you call the cops.

      In Texas & many other states, you could blow them away with a shotgun and get cheers in the local paper.

    2. Re:IINAL by tomstdenis · · Score: 3, Insightful

      Um whoever modded that as interesting is a fucking moron.

      A honeypot is just a pseudo-server meant to trap, delay and/or observe a client. Useful for wasting spammers time/bandwidth, looking for spiders or in this case looking for active worm traffic.

      You have to connect to the honeypot for it to be active so in absolutely no way can this be "illegal".

      Tom

      --
      Someday, I'll have a real sig.
    3. Re:IINAL by chadjg · · Score: 4, Interesting

      Think unlawful interception of communications, not entrapment. I know, it's stupid, but that's the legal theory. IANAL and all that...

      --
      Why do I have this? I don't smoke.
  9. Worm Watching Clients for Windows Only? by PetoskeyGuy · · Score: 4, Funny

    Pass, Too Easy.

  10. Graph shows u137unk exploit by Dark+Lord+Seth · · Score: 5, Interesting

    And, as it says in the article, u137unk is aimed at port 137 using UDP. NetBIOS request en masse. Over the internet? Why does this not make sense? Maybe all those exploits are Messenger spams? However, iirc, Messenger spam uses a different port and TCP. So if this is not Messenger spam... Then what?

    --
    Hate me!
  11. A little creepy ... calling home? by digitalgimpus · · Score: 5, Informative

    Each time I launched the app, norton fires up because an email is being sent.

    no mention of what anywhere.

    Sorry, perhaps I'm paranoid... but that's not very cool with me.

    1. Re:A little creepy ... calling home? by Gadi+Evron · · Score: 3, Insightful

      As explained by Roger, the author of WR, WormRadar calls home using SMTP and UDP for real-time, so that the data-sharing between all the nodes can exist.

      This data-sharing/graphing of Internet attacks graphs.. etc.. comes as a second to the actual use for the program - a good and decent honey pot.

      The program doesn't hide the fact that it "calls home" and it is all explained in another comment.

    2. Re:A little creepy ... calling home? by Ancient+Devices+King · · Score: 4, Informative

      They say explicitly that it communicates with them via email and UDP.

      "Events are reported by both email and udp... email because it makes it convenient to attach a capture if it is something new, and udp because while unreliable, it is fast."

      Exactly how do you expect it to function if it doesn't talk to the people who are using it to track things?

      --
      -"It seems like you're trying to exploit a security hole. Would you like help?"
  12. What a headline by alefbet · · Score: 4, Funny
    Wow, I think this is a serious contender for hardest headline ever to parse.

    WormRadar Node Volunteers Help Graph Attacks

    Did a node spontaneously provide some "help graph" attacks? Did node volunteers assist in attacking a graph or several graphs? Did the help given by volunteers end up graphing an attack? Or did it perform a little known "graph attack" on something?

    --

    A hack is just an idiom waiting for wider use.
  13. You can always use VMware or Virtual Machine by Anonymous Coward · · Score: 4, Informative

    Works great, and the author promised to try and port the software to Linux, although he said it may take some time as he is very busy with his real job, as well as working on developing WR and solving all the small bugs.

    The program is under constant development, surprising us with new features. The author is also very quick on responding to bug reports.

    WR allows for emulation of IIS, sub7 and other useful applications/Trojan horses, as well as specifying your own ports to listen on.

    It's a great program and a project worth supporting.

    Important note: the .CAP (capture) files are encrypted using a simple XOR, the .UNX files are the actual captures.

    There is some way yet to go until this program hits 'legacy', but as I said it is under constant development, really useful .. and it *is* free.

  14. What's Truly Sad... by ashitaka · · Score: 4, Insightful

    Is the number of SQL-Slammer-infected systems still out there:

    Date: 04/23 01:24:30 Name: ICMP PING CyberKit 2.2 Windows
    Priority: 3 Type: Misc activity
    IP info: 216.18.121.12:n/a -> x.x.x.x:n/a
    References: none found SID: 483

    Date: 04/23 02:10:26 Name: MS-SQL Worm propagation attempt
    Priority: 2 Type: Misc Attack
    IP info: 152.66.211.244:3280 -> x.x.x.x:1434
    References: none found SID: 2003

    Date: 04/23 02:10:59 Name: MS-SQL Worm propagation attempt
    Priority: 2 Type: Misc Attack
    IP info: 210.13.22.79:1171 -> x.x.x.x:1434
    References: none found SID: 2003

    Date: 04/23 02:32:46 Name: SCAN Squid Proxy attempt
    Priority: 2 Type: Attempted Information Leak
    IP info: 69.158.81.79:4380 -> x.x.x.x:3128
    References: none found SID: 618

    Date: 04/23 02:32:49 Name: SCAN Squid Proxy attempt
    Priority: 2 Type: Attempted Information Leak
    IP info: 69.158.81.79:4380 -> x.x.x.x:3128
    References: none found SID: 618

    Date: 04/23 02:32:54 Name: SCAN SOCKS Proxy attempt
    Priority: 2 Type: Attempted Information Leak
    IP info: 69.158.81.79:4514 -> x.x.x.x:1080
    References: none found SID: 615

    Date: 04/23 02:32:57 Name: SCAN SOCKS Proxy attempt
    Priority: 2 Type: Attempted Information Leak
    IP info: 69.158.81.79:4514 -> x.x.x.x:1080
    References: none found SID: 615

    Date: 04/23 02:59:50 Name: ICMP PING CyberKit 2.2 Windows
    Priority: 3 Type: Misc activity
    IP info: 216.18.121.12:n/a -> x.x.x.x:n/a
    References: none found SID: 483

    Date: 04/23 03:22:04 Name: MS-SQL Worm propagation attempt
    Priority: 2 Type: Misc Attack
    IP info: 67.163.239.113:1209 -> x.x.x.x:1434
    References: none found SID: 2003

    --
    If you don't want to repeat the past, stop living in it.
  15. Windows has free built-in worm watching by Anonymous Coward · · Score: 2, Funny

    Just plug and play baby. You can do more than watch worms as well, you can experiance the worm. Take that, Linux.

  16. Excellent! by dj245 · · Score: 4, Funny
    "NTBugtraq has a post looking for volunteers to run WormRadar nodes.

    I volunteer enthusiastically. Wormradar will complement nicely my Gaydar, Chickdar, and of course, flamedar.

    --
    Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
  17. For Those of you worried WR might be a Trojan by Gadi+Evron · · Score: 5, Informative

    The author of WR is Roger Thompson, a well respected AV professional since the very first days in the late 80's/early 90's.

    He is also a CARO member, which is a very respectable organization for old-timer AV researchers.

    I know him personally and vouch for him, much like pretty much any other AV researcher in the world. Everybody knows Roger.

  18. reporting for ISPs by SuperBanana · · Score: 2, Insightful

    How about reporting for ISPs? Say, daily reports grouped by netblock owner in an easily parsed format? Set it up so ISPs can sign up for them. ISP doesn't sign up? Shucks, they must be supporting viruses and whatnot.

    While backbone providers love 'em because they get paid for every byte...worms are the scourge of DSL/cablemodem companies, because they don't get paid by the byte, and worms eat into their margins. So you'd think they would have a vested interest in taking care of the problem.

    Of course, if they were competent, they'd be running IDS systems that would examine a portion of traffic looking for worm activity, automatically shutting off any systems...

    --
    Please help metamoderate.
  19. Re:Infect, Effect and Affect by value_added · · Score: 3, Interesting

    "worms only effect windows machines"

    "Infect" refers to passing along a nasty.
    "Effect" means "make happen" or "bring about" as in "Make it so."
    "Affect" can be understood in terms of a combination the above.

    I think you meant to say "worms only affect windows machines".

    Affectionately speaking, of course.

  20. PNG for gawds sake! by eddy · · Score: 3, Insightful

    And oh, "they" use JPEG for the graph! Look at it -- it's horrible!

    Okay, you DON'T download and run executables from people who can't even pick the right image format for an image like that one (hint: it's PNG). What's the odds of these people knowing anything about researching worms if they can't even get a fscking image right? Close to zero.

    I honestly don't understand how come so many have a problem with this. Just look at that "JPEG patents"-story. Scary. I thought this was a place for nerds?

    Here's a heuristics for those of you still confused: "If it's lines, blocks, text (that you want readable) and areas of repetitive pattern(s), then use PNG. Else try JPEG (photographs, noisy images)."

    --
    Belief is the currency of delusion.
    1. Re:PNG for gawds sake! by modecx · · Score: 3, Informative

      Actually, the image looks okay.

      They used the size variables in HTML to resize it (which of course makes it look terrible). Image size is 446x668, They resize it to 560x839. Makes no sense.

      Still makes their operation look pretty bad.

      --
      Constitutional rights may be respected, repealed, or modified; but they must never be ignored.
  21. everything is explained in the NTBUGTRAQ post, by Gadi+Evron · · Score: 5, Informative

    Hi Russ,

    I am looking for some more folks who would be interested in running
    WormRadar. ( http://wormradar.com). The web site is still rudimentary, but
    the graph is generated every 30 minutes, and is interesting to watch, and
    WormRadar.exe is available for download from there.

    It is essentially a distributed Windows honeypot that listens on known
    wormy ports (or ports that are likely to become wormy), and crcs, or scans,
    anything that comes along. Its purpose is to both measure the frequency of
    known, current worms and to alert us all when something new becomes active.
    It is free provided you allow it to report to the central site.

    If you allow it, WormRadar will synchronize your pc to network time, and
    all events are recorded to the millisecond utc. Events are reported by both
    email and udp... email because it makes it convenient to attach a capture
    if it is something new, and udp because while unreliable, it is fast.

    A summarized graph of activity is refreshed every 30 minutes to the
    website, and is refreshed every 15 minutes on the WorldView tab within
    WorldRadar itself. The WorldView tab also has notification options which
    allow you to be alerted by a variety of means if something new appears,
    such as email to a pager or by playing a wav file. In the fullness of time,
    I'll add more views and graphs. The summary graph is interpreted like this...

    (1) Green bars are recognized things
    (2) Red bars are new (and should be watched)
    (3) If I didn't get any data, I generate a name based on whether it was tcp
    or udp, plus the port number, plus '0 bytes'.E.g. "t17300 0 bytes" means it
    was TCP port 17300 and was 0 bytes long.
    (4) If I got some data, but couldn't recognize it, I generate a similar
    filename, but the suffix is 'unk', for unknown.
    (5) I call it a 'summary', because if a single sourceip hits a single
    targetip 200 times on the same port (such as a sql dictionary attack on
    1433), it is really only one incident, and that is how I summarize it.

    It emulates some common servers, such as web and ftp, and some common
    backdoors, such as sub7 and kuang, and there are a bunch of tcp and udp
    ports that can be set to whatever you like.

    To install it, simply make a directory, copy it in, run it, configure it a
    bit if you want, and tell it to listen. You can set it to cc yourself, and
    you will receive a copy of the email sent to wormradar.com. The UDP
    messages are content-identical to the email, although without email-y
    things like headers, and I don't UDP the attachment if there is one.

    It runs on about any Windows platform but runs best on Win ME, W2k or
    WinXP. Win ME is a good platform, because there are fewer services to turn
    off to allow WormRadar to listen on those ports. It runs nicely behind
    firewalls like ZoneAlarm, and runs nicely in Virtual PC or VMWare. It
    doesn't need much hardware... 200 or 300 mhz is fine. In the unlikely event
    that you want to install it on more than one computer, please don't install
    them on side by side IP addresses... this just skews the data. What we
    really want is a nice, random, widespread distribution.

    Thanks

    Roger

  22. What WR connects out to.. SMTP and UDP, explained by Gadi+Evron · · Score: 4, Interesting

    As Roger wrote on NTBUGTRAQ:

    If you allow it, WormRadar will synchronize your pc to network time, and
    all events are recorded to the millisecond utc. Events are reported by both
    email and udp... email because it makes it convenient to attach a capture
    if it is something new, and udp because while unreliable, it is fast.

    A summarized graph of activity is refreshed every 30 minutes to the
    website, and is refreshed every 15 minutes on the WorldView tab within
    WorldRadar itself. The WorldView tab also has notification options which
    allow you to be alerted by a variety of means if something new appears,
    such as email to a pager or by playing a wav file. In the fullness of time,
    I'll add more views and graphs. The summary graph is interpreted like this...

  23. Recruit these guys for a good data sample by G4from128k · · Score: 4, Interesting

    Back when we discussed the Witty worm the article & discussion noted that UCSD Network Telescope mentioned here has 1/256 of the entire IPv4 address space. They seem well suited to track anomolous behavior.

    --
    Two wrongs don't make a right, but three lefts do.
  24. Ya gotta wonder. by Anonymous Coward · · Score: 3, Funny

    I suspect there'll be a report next week about the number of people willing to blindly download and install unknown software.

  25. You mean absolutely everybody who runs Windoze? by Anonymous Coward · · Score: 2, Funny

    That's a pretty big number. ;-)

  26. Re:new open source project idea? by Gadi+Evron · · Score: 4, Insightful

    I thought the idea of open source was to work together and help out? Not double and compet when there is no real need to?

    Email the author and offer your help, he is a great guy and I am sure he will take any help he can get.

    I trust him, the question is if he can trust everyone who offers to help with a project such as this? Ask him and you'll find out.

    Constructive vs....

  27. Dshield and myNetwatchman by JustinXB · · Score: 2, Informative

    DShield and myNatwatchMan do pretty much the same thing, only for all ports instead of just worms. Gives a much better lay-of-the-land for administrators.

  28. Because by autopr0n · · Score: 2, Insightful

    A lot of the worms don't cause the machines to go down. Obviously, a lot of users are oblivious to the fact that their machines are not only spreading viruses around the 'net, but are infested with Spyware and probably being used as Spam zombies.

    It seems like windows was implemented with the "everyone is mostly nice" idea that the original internet, and certainly the original email system was. No one at MS anticipated that people would run programs that actively harmed them, and that their computers would turn against them.

    What we really need is an OS that doesn't just protect one user from another, but also protects users from programs and vise versa. Yeah, things like this can be done in Linux, probably MacOS, and even, in theory Windows (run the program as a service with a user logon, but most programs aren't services). But I don't think it's at all a general, easy to use feature.

    Honestly, the only ones who seem to have thought ahead were the java people with their sandbox, and the ability to give permissions based on code signatures.

    And then, of course, we get MS trying to shoehorn the whole thing into their "trusted computing" framework witch also tries to protect the content from the user which I think is Bullshit. An entire system to protect users could be built simply by using memory protection and standard user-level controls.

    --
    autopr0n is like, down and stuff.
  29. Well of course! by pavera · · Score: 3, Funny

    Currently it looks like only a Windows client is available, though. Why would you need to monitor worm activity on a Linux box?

  30. Port 2000 by toupsie · · Score: 2, Interesting

    I have my Linksys cable/dsl router pointing the DMZ to an old notebook running redhat 8 and portsentry. One thing I have noticed is that a majority of the hits I record are for port 2000. These are coming from all over the world and I have no clue what is hitting it. Does anyone know what would be probing port 2000? I was disappointed that it didn't show up on the graph at the WormRadar site. I figured if I was being probed for the port it would be universal.

    --
    Strange women lying in ponds distributing swords is no basis for a system of government.
  31. dshield by sir_cello · · Score: 2, Informative

    Try dshield, I've had my OpenBSD pf firewall generate and submit logs on a daily basis for near a year now. There are a numerous dshield clients and adapter scripts. You will also get daily reports from dshield, there's a tonne of online statistics, and they use your data to submit reports to abuse owners at domain names.

    Here's the current statistics:
    Records Added:
    Last Month - 286,455,729
    Last Week - 112,352,882
    Today - 591,719

  32. Yes, you can by autopr0n · · Score: 2, Insightful

    If someone types "rm -rf /" at a terminal, you can be pretty sure they want it to be done.

    The problem is that programs these days do things that the user dosn't know about, dosn't want, can't control, and ultimately can't even stop when they find out. That's ridiculous.

    If I'm root, and I don't trust a program I'm running, I can su it, and run it as a regular user and lock it down to a single folder on the file system with no network access. You have to do it manually, and on windows you can only do it with services.

    What I'm talking about doing is automating the process using certs, things like that, and running them in a java-like sandbox. It's not hard and in the case of java, it's already been done.

    --
    autopr0n is like, down and stuff.