Slashdot Mirror
WormRadar Node Volunteers Help Graph Attacks
zoombat writes "NTBugtraq has a post looking for volunteers to run WormRadar nodes. The nodes are essentially honeypots that watch for suspicious activity. Its purpose is to both measure the frequency of known, current worms and to alert us all when something new becomes active. A graph (updated every 30 minutes) shows what was detected. Currently it looks like only a Windows client is available, though."
Currently it looks like only a Windows client is available, though."
Might it make more sense to have the client available on platforms which are not necessarily vulnerable to most of these infections? After all, many of the systems which are connected to the Internet full time (servers/workstations etc...) are not Windows machines.
Visit Jonesblog and say hello.
and sign up ! these people are doing good things.
:)
distributed attacks against hackers doing distributed attacks
MP3 Search Engine
Let me be the first to get the obvious joke out of the way.
:)
Why is there only a windows client? Because all the worms only effect windows machines, what would be the point of a client on anything else?
Although of course, the more serious answer is "A client on something other than windows would be sensible, because if a new worm comes out and hits a 0-day windows hole then your machine could be infected and dead before it gets the chance to report that it is being attacked. (Just why is it that all these worms people write nowadays just seem so.. nice? I remember the days when 90% of viruses would at the very least format your hard disc.. now they just sit there. It's almost a shame, because one good formating worm might finally make people take them more seriously.. it's only a matter of time)
Combination - fun iPhone puzzling
Is this thing open source? It doesn't seem like it. For all we know we could be downloading the world's next biggest trojan horse/worm. Considering the only people who would download this would be techies with big pipes, this could get interesting. Just a theory and a reminder to the author that people usually feel safer downloading something they can examine.
EvilCON - Made Famous by
Why would you need a worm activity detecting program on a Windows box? If there's a lot of worm activity that is close enough that the windows box could monitor it, you'll know.
It's like the canary in the mineshaft...Works fine for detecting hazards, but a little rough on the bird.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Yeah, that's going to happen.
Someone run it through IDA? :-P
Belief is the currency of delusion.
The website is scarce on details, but from the looks of it, it would appear to not be very sophisticated. It detects very few actual worms and exploits, and would seem to be just like http://isc.incidents.org/ (Internet Storm Centre), except without nearly so much data.
Leusent _AT_ Link-net.org
Pass, Too Easy.
And, as it says in the article, u137unk is aimed at port 137 using UDP. NetBIOS request en masse. Over the internet? Why does this not make sense? Maybe all those exploits are Messenger spams? However, iirc, Messenger spam uses a different port and TCP. So if this is not Messenger spam... Then what?
Hate me!
Each time I launched the app, norton fires up because an email is being sent.
no mention of what anywhere.
Sorry, perhaps I'm paranoid... but that's not very cool with me.
WormRadar Node Volunteers Help Graph Attacks
Did a node spontaneously provide some "help graph" attacks? Did node volunteers assist in attacking a graph or several graphs? Did the help given by volunteers end up graphing an attack? Or did it perform a little known "graph attack" on something?
A hack is just an idiom waiting for wider use.
Works great, and the author promised to try and port the software to Linux, although he said it may take some time as he is very busy with his real job, as well as working on developing WR and solving all the small bugs.
.CAP (capture) files are encrypted using a simple XOR, the .UNX files are the actual captures.
.. and it *is* free.
The program is under constant development, surprising us with new features. The author is also very quick on responding to bug reports.
WR allows for emulation of IIS, sub7 and other useful applications/Trojan horses, as well as specifying your own ports to listen on.
It's a great program and a project worth supporting.
Important note: the
There is some way yet to go until this program hits 'legacy', but as I said it is under constant development, really useful
Is the number of SQL-Slammer-infected systems still out there:
Date: 04/23 01:24:30 Name: ICMP PING CyberKit 2.2 Windows
Priority: 3 Type: Misc activity
IP info: 216.18.121.12:n/a -> x.x.x.x:n/a
References: none found SID: 483
Date: 04/23 02:10:26 Name: MS-SQL Worm propagation attempt
Priority: 2 Type: Misc Attack
IP info: 152.66.211.244:3280 -> x.x.x.x:1434
References: none found SID: 2003
Date: 04/23 02:10:59 Name: MS-SQL Worm propagation attempt
Priority: 2 Type: Misc Attack
IP info: 210.13.22.79:1171 -> x.x.x.x:1434
References: none found SID: 2003
Date: 04/23 02:32:46 Name: SCAN Squid Proxy attempt
Priority: 2 Type: Attempted Information Leak
IP info: 69.158.81.79:4380 -> x.x.x.x:3128
References: none found SID: 618
Date: 04/23 02:32:49 Name: SCAN Squid Proxy attempt
Priority: 2 Type: Attempted Information Leak
IP info: 69.158.81.79:4380 -> x.x.x.x:3128
References: none found SID: 618
Date: 04/23 02:32:54 Name: SCAN SOCKS Proxy attempt
Priority: 2 Type: Attempted Information Leak
IP info: 69.158.81.79:4514 -> x.x.x.x:1080
References: none found SID: 615
Date: 04/23 02:32:57 Name: SCAN SOCKS Proxy attempt
Priority: 2 Type: Attempted Information Leak
IP info: 69.158.81.79:4514 -> x.x.x.x:1080
References: none found SID: 615
Date: 04/23 02:59:50 Name: ICMP PING CyberKit 2.2 Windows
Priority: 3 Type: Misc activity
IP info: 216.18.121.12:n/a -> x.x.x.x:n/a
References: none found SID: 483
Date: 04/23 03:22:04 Name: MS-SQL Worm propagation attempt
Priority: 2 Type: Misc Attack
IP info: 67.163.239.113:1209 -> x.x.x.x:1434
References: none found SID: 2003
If you don't want to repeat the past, stop living in it.
I thought honeypotting is being considerd as not-so-legal.
Why would you say that? It certainly isn't entrapment. If you leave your house windows open, it doesn't give thieves permission to steal.
And a burglar can't complain that you have video cameras all over the house recording them while you call the cops.
In Texas & many other states, you could blow them away with a shotgun and get cheers in the local paper.
I volunteer enthusiastically. Wormradar will complement nicely my Gaydar, Chickdar, and of course, flamedar.
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
The author of WR is Roger Thompson, a well respected AV professional since the very first days in the late 80's/early 90's.
He is also a CARO member, which is a very respectable organization for old-timer AV researchers.
I know him personally and vouch for him, much like pretty much any other AV researcher in the world. Everybody knows Roger.
Think unlawful interception of communications, not entrapment. I know, it's stupid, but that's the legal theory. IANAL and all that...
Why do I have this? I don't smoke.
Hi Russ,
I am looking for some more folks who would be interested in running
WormRadar. ( http://wormradar.com). The web site is still rudimentary, but
the graph is generated every 30 minutes, and is interesting to watch, and
WormRadar.exe is available for download from there.
It is essentially a distributed Windows honeypot that listens on known
wormy ports (or ports that are likely to become wormy), and crcs, or scans,
anything that comes along. Its purpose is to both measure the frequency of
known, current worms and to alert us all when something new becomes active.
It is free provided you allow it to report to the central site.
If you allow it, WormRadar will synchronize your pc to network time, and
all events are recorded to the millisecond utc. Events are reported by both
email and udp... email because it makes it convenient to attach a capture
if it is something new, and udp because while unreliable, it is fast.
A summarized graph of activity is refreshed every 30 minutes to the
website, and is refreshed every 15 minutes on the WorldView tab within
WorldRadar itself. The WorldView tab also has notification options which
allow you to be alerted by a variety of means if something new appears,
such as email to a pager or by playing a wav file. In the fullness of time,
I'll add more views and graphs. The summary graph is interpreted like this...
(1) Green bars are recognized things
(2) Red bars are new (and should be watched)
(3) If I didn't get any data, I generate a name based on whether it was tcp
or udp, plus the port number, plus '0 bytes'.E.g. "t17300 0 bytes" means it
was TCP port 17300 and was 0 bytes long.
(4) If I got some data, but couldn't recognize it, I generate a similar
filename, but the suffix is 'unk', for unknown.
(5) I call it a 'summary', because if a single sourceip hits a single
targetip 200 times on the same port (such as a sql dictionary attack on
1433), it is really only one incident, and that is how I summarize it.
It emulates some common servers, such as web and ftp, and some common
backdoors, such as sub7 and kuang, and there are a bunch of tcp and udp
ports that can be set to whatever you like.
To install it, simply make a directory, copy it in, run it, configure it a
bit if you want, and tell it to listen. You can set it to cc yourself, and
you will receive a copy of the email sent to wormradar.com. The UDP
messages are content-identical to the email, although without email-y
things like headers, and I don't UDP the attachment if there is one.
It runs on about any Windows platform but runs best on Win ME, W2k or
WinXP. Win ME is a good platform, because there are fewer services to turn
off to allow WormRadar to listen on those ports. It runs nicely behind
firewalls like ZoneAlarm, and runs nicely in Virtual PC or VMWare. It
doesn't need much hardware... 200 or 300 mhz is fine. In the unlikely event
that you want to install it on more than one computer, please don't install
them on side by side IP addresses... this just skews the data. What we
really want is a nice, random, widespread distribution.
Thanks
Roger
As Roger wrote on NTBUGTRAQ:
If you allow it, WormRadar will synchronize your pc to network time, and
all events are recorded to the millisecond utc. Events are reported by both
email and udp... email because it makes it convenient to attach a capture
if it is something new, and udp because while unreliable, it is fast.
A summarized graph of activity is refreshed every 30 minutes to the
website, and is refreshed every 15 minutes on the WorldView tab within
WorldRadar itself. The WorldView tab also has notification options which
allow you to be alerted by a variety of means if something new appears,
such as email to a pager or by playing a wav file. In the fullness of time,
I'll add more views and graphs. The summary graph is interpreted like this...
Back when we discussed the Witty worm the article & discussion noted that UCSD Network Telescope mentioned here has 1/256 of the entire IPv4 address space. They seem well suited to track anomolous behavior.
Two wrongs don't make a right, but three lefts do.
I thought the idea of open source was to work together and help out? Not double and compet when there is no real need to?
Email the author and offer your help, he is a great guy and I am sure he will take any help he can get.
I trust him, the question is if he can trust everyone who offers to help with a project such as this? Ask him and you'll find out.
Constructive vs....