-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
He is, aparently, talking about a wildcard DNS server which responds
to the whole IP address range, with answers indicating if the site is
included or not. Standard RBL DNS methodolory, if I understood correctly.
On Sat, Apr 02, 2005 at 01:08:13PM -0600, Harper, Patrick wrote:
Still not sure what you are talking about. The bleeding snort project
has some spyware and malware rule sets for Snort. www.bleedingsnort.com
and www.snort.org. Is that what your looking for?
-----Original Message-----
From: Konstantin Khrooschev [mailto:nathoo@rtsnet.ru]
Sent: Saturday, April 02, 2005 9:04 AM
To: Harper, Patrick
Cc: focus-ids@securityfocus.com
Subject: Re: Spyware Master Hosts DB
Harper, Patrick wrote:
Something like this?
http://www.bleedingsnort.com/blackhole-dns/
thanks for great resource, but it isn't exactly what mean.
i think about special trusted DNS somewhere on the net doing reverse
lookup
every known "master" host ip to something like
master1.gator.in-addr.spyware for example.
firewall log analiser script can use it automatically to detect
infection.
- --
Rodrigo Barbosa <rodrigob@suespammers.org>
"Quid quid Latine dictum sit, altum viditur"
"Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCUY7lpdyWzQ5b5ckRAl+WAJ9clAhpFMKz0kWEb2Xsr5X+HJ3yMACeOd2f
2UCI6zKZTY5fymkurRAeK6k=
=l0om
-----END PGP SIGNATURE-----
--------------------------------------------------------------------------
Stop hurting your network!
The NeVO passive vulnerability sensor continuously finds vulnerabilities,
applications and new hosts without the need for network scanning.
It also finds compromised systems with application-based intrusion detection.
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------
