Still not sure what you are talking about. The bleeding snort project
has some spyware and malware rule sets for Snort. www.bleedingsnort.com
and www.snort.org. Is that what your looking for?
-----Original Message-----
From: Konstantin Khrooschev [mailto:nathoo@rtsnet.ru]
Sent: Saturday, April 02, 2005 9:04 AM
To: Harper, Patrick
Cc: focus-ids@securityfocus.com
Subject: Re: Spyware Master Hosts DB
Harper, Patrick wrote:
Something like this?
http://www.bleedingsnort.com/blackhole-dns/
thanks for great resource, but it isn't exactly what mean.
i think about special trusted DNS somewhere on the net doing reverse
lookup
every known "master" host ip to something like
master1.gator.in-addr.spyware for example.
firewall log analiser script can use it automatically to detect
infection.
-----Original Message-----
From: Konstantin Khrooschev [mailto:nathoo@rtsnet.ru]
Sent: Friday, April 01, 2005 1:55 AM
To: focus-ids@securityfocus.com
Subject: Spyware Master Hosts DB
hello all!
can anybody say something about idea of spyware owners network database
to use in network ids.
i mean of course not db of every infected computer on the net :-) but
database of "master" computer addresses, to which victims try to send
information.
i think, it may be something like dns based open relay db.
-----------------------------------------
Disclaimer: This electronic message, including any attachments, is
confidential and intended solely for use of the intended recipient(s). This
message may contain information that is privileged or otherwise protected
from disclosure by applicable law. Any unauthorized disclosure,
dissemination, use or reproduction is strictly prohibited. If you have
received this message in error, please delete it and notify the sender
immediately.
--------------------------------------------------------------------------
Stop hurting your network!
The NeVO passive vulnerability sensor continuously finds vulnerabilities,
applications and new hosts without the need for network scanning.
It also finds compromised systems with application-based intrusion detection.
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------
