Trojan.Eclipse — A Bad Moon Rising?

ASERT’s malware collection and processing system has automatic heuristics that bubble up potentially new and interesting DDoS malware samples into a “for human analysis” queue. A recent member of this queue was Trojan.Eclipse and this post is my analysis of the malware and its associated campaigns.

Analysis was performed on the sample with an MD5 of 0cdd10cd3393d3fe916a55b946c10ad6.

The name Eclipse comes from two places: a mutex named “eclipseddos” and a hardcoded Cookie value used in the command and control (C2) phone home. We’ll see in the Campaign section below that this threat is also known as: shadowbot, gbot3, eclipsebot, Rhubot, and Trojan-Spy.Win32.Zbot.qgxi.

Based on the C2 domain names, GeoIP of the C2 IP addresses, and a social media profile of the owner of one of the C2 domains, I suspect this malware to be Russian in origin. In addition, Eclipse is written in Delphi and empirically Russian malware coders have a certain fondness for this language.

Command and Control

The analyzed binary has a hardcoded C2 domain string. This string is protected from modification by running it through a simple hashing algorithm and comparing it against a hardcoded hash at certain points of the code. The Continue reading

Is Netflix’s Arresting Development with Comcast a House of Cards, or Is it The New Black?

Is Netflix's Arresting Development with Comcast a House of Cards, or Is it The New Black?

by Brian Boyko, Technology Contributor - April 22, 2014

Photo credit: Netflix

Comcast has decided to start charging Netflix extra to connect Netflix's customers on Comcast's network. More or less. It gets complicated, depending on whether Netflix is being charged for data transfer, or interconnectivity.   

The headline in the New York Times reads: “Comcast and Netflix Reach Deal On Service.” But Netflix CEO Reed Hastings posted on the official Netflix blog that there was a need for “a strong net neutrality,” calling the Comcast deal an “Internet toll.” That does not sound to me like Hastings came out of the deal happy. 

Now, to be clear, what the deal is actually doing, on a technical level, is allowing Netflix to deliver its content directly to Comcast's servers, rather than going through a middleman such as Cogent. It's a type of “paid peering,” instead of “paid prioritization.” 

Hastings, however, believes the two are the same thing – charging the content provider to provide the data at the rate that the ISP charges its customers. After all, the only reason Continue reading

On Policy in the Data Center: The policy problem

(This post was written by Tim Hinrichs and Scott Lowe with contributions from Martin Casado, Mike Dvorkin, Peter Balland, Pierre Ettori, and Dennis Moreau.)

Fully automated IT provisioning and management is considered by many to be the ultimate nirvana— people log into a self-service portal, ask for resources (compute, networking, storage, and others), and within minutes those resources are up and running. No longer are the people who use resources waiting on the people who are responsible for allocating and maintaining them. And, according to the accepted definitions of cloud computing (for example, the NIST definition in SP800-145), self-service provisioning is a key tenet of cloud computing.

However, fully automated IT management is a double-edged sword. While having people on the critical path for IT management was time-consuming, it provided an opportunity to ensure that those resources were managed sensibly and in a way that was consistent with how the business said they ought to be managed. In other words, having people on the critical path enabled IT resources to be managed according to business policy. We cannot simply remove those people without also adding a way of ensuring that IT resources obey business policy—without introducing a way Continue reading

How do ACLs handle fragments ?

This post represents the solution and explanation for made a test connection -> client learned the PMTUD = 1476 (1500-24/GRE) then I configured lower MTU 1440 on the GRE tunnels also I disabled PMTUD with command sysctl -w net.inet.tcp.path_mtu_discovery=”0″ so the server cannot learn the new PMTUD value You will say that it was not nice of me to hack it this way, but I’ll say: it worth demonstrate this... [read more]

How do ACLs handle fragments ?

This post represents the solution and explanation for quiz-22. It presents how fragmented traffic is handled differently by a simple access list. It is a long read about fragmentation, Path MTU Discovery, MSS and other stuff...

Poster: Network Safety Starts With You

Being a Network Engineer is a hazardous and even dangerous profession yet the Health and Safety division doesn't seem to care about the network damage and prevention.

It's time for us to stand up and start our own ITIL-compliant safety campaign. I've prepared the following handy sign for you to print and place on your cubicle wall to remind you to be safe out there.

The post Poster: Network Safety Starts With You appeared first on EtherealMind.

Using EEM to Remotely Change a WAN IP – Part 1

I often work remotely on customers’ infrastructures with their remote hands on-site. When a small office or branch changes ISPs or IP blocks, I occasionally find myself in a position where I have to change the only public IP address of a device like a branch office router or firewall, with no out-of-band management. The trouble with this is fairly obvious (on a Cisco device): by changing the IP address via which I am accessing the device over SSH, I will lose my own management session to it. Once the management session is lost, I can’t update the default route, and now the device is broken and I get to walk the on-site hands (who are often not very Cisco-literate) through changing a default route.

There are, of course, several ways to avoid this situation all together:
  • Have out-of-band access using a 3G/4G/LTE-connected terminal server (I wrote about one of these before)
  • Use a remote app like GetConsole so the remote hands can get me console access out of band using their smart phone
  • Use something with a proper commit/rollback mechanism like a Juniper device
  • Dial-up modem to the AUX port!
Clearly, from the list above, there are means to Continue reading

BGP VPNv4 Troubleshooting Commands

Original content from Roger's CCIE Blog Tracking the journey towards getting the ultimate Cisco Certification. The Routing & Switching Lab Exam
When working with MPLs Layer 3 VPN a lot of people get stuck with the verification, simply because they don’t know the bgp vpnv4 troubleshooting commands. This post will step through some of the verification you can use to verify the routes end to end through a simple MPLS Layer 3 vpn topology. The topology […]

Other pages of interest:

Post taken from CCIE Blog

Original post BGP VPNv4 Troubleshooting Commands

Don’t forget to restart all your OpenSSL binaries

The wonder of UNIX is that you can delete running binaries and loaded shared libraries. The drawback is that you get no warning that you're still actually running old versions. E.g. old heartbleed-vulnerable OpenSSL.

Server binaries are often not forgotten by upgrade scripts, but client binaries almost certainly are. Did you restart your irssi? PostgreSQL client? OpenVPN client?

Find processes running with deleted OpenSSL libraries: 

$ sudo lsof | grep DEL.*libssl
apache   17179      root  DEL       REG        8,1               24756 /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0

Or if you're extra paranoid, and want to make sure everything is using the right OpenSSL version: 

!/bin/sh
set -e
LIB="/usr/lib/x86_64-linux-gnu/libssl.so.1.0.0"
if [ ! "$1" = "" ]; then
   LIB="$1"
fi
INODE="$(ls -i "$LIB" | awk '{print $1}')"
lsof | grep libssl.so | grep -v "$INODE"

A few points:
  • Run this as root in case lsof otherwise wouldn't be able to get at the data (e.g. if you run grsec)
  • This assumes all libssl is on one filesystem, since it only checks inode number
  • The easiest solution is of course to restart the whole machine, but there's really no reason to if you don't want to

HTIRW: DNS Lookups

Note: Some of this will be really basic for a lot of folks, but bear with me — in looking at the entire system as a system, there are going to be parts of each piece you’ll already know, and other parts you don’t know. Let’s begin where most users will recognize they’re interacting with […]

Author information

Russ White

Russ White
Principle Engineer at Ericsson

Russ White is a Network Architect who's scribbled a basket of books, penned a plethora of patents, written a raft of RFCs, taught a trencher of classes, and done a lot of other stuff you either already know about, or don't really care about. You want numbers and letters? Okay: CCIE 2635, CCDE 2007:001, CCAr, BSIT, MSIT (Network Design & Architecture, Capella University), MACM (Biblical Literature, Shepherds Theological Seminary). Russ is a Principal Engineer in the IPOS Team at Ericsson, where he works on lots of different stuff, serves on the Routing Area Directorate at the IETF, and is a cochair of the Internet Society Advisory Council. Russ will be speaking in November at the Ericsson Technology Day. he recently published The Art of Network Architecture, is currently working on a new book in the area Continue reading

26 – Is VxLAN a DCI solution for LAN extension ?

One of the questions that many network managers are asking is “Can I use VxLAN stretched across different locations to interconnect two or more physical DCs and form a single logical DC fabric?”

The answer is that the current standard implementation of VxLAN has grown up for an intra-DC fabric infrastructure and would necessitate additional tools as well as a control plane learning process to fully address the DCI requirements. Consequently, as of today it is not considered as a DCI solution.

To understand this statement, we first need to review the main requirements to deploy a solid and efficient DC interconnect solution and dissect the workflow of VxLAN to see how it behaves against these needs. All of the following requirements for a valid DCI LAN extension have already been discussed throughout previous posts, so the following serves as a brief reminder.

DCI LAN Extension requirements

Strongly recommended:

  • Failure domain must be contained within a single physical DC
  • Leverage protocol control plane learning to suppress the unknown unicast flooding.
  • Flooding of ARP requests must be reduced and controlled using rate limiting across the extended LAN.
  • Generally speaking, rate limiters for the control plane and data plane must be Continue reading

Awesome Putty tips and tricks for work and the CCIE Lab!

Original content from Roger's CCIE Blog Tracking the journey towards getting the ultimate Cisco Certification. The Routing & Switching Lab Exam
If you use Putty on a daily basis or have only encountered it in the CCIE lab exam then you will know what a great tool it is. Simple and effective (with no tabs!) Most people though may not use putty on a daily basis preferring something like SecureCRT so will not be familiar with […]

Other pages of interest:

Post taken from CCIE Blog

Original post Awesome Putty tips and tricks for work and the CCIE Lab!

NPM build error

NPM build error

NPM has a bunch of useful stuff on it, however you could in life while using NPM get this:

stack Error: "pre" versions of node cannot be installed, use the --node dir flag instead

This error basically says “Give me the node

Configuring Mellanox switches

The following commands configure a Mellanox switch (10.0.0.252) to sample packets at 1-in-10000, poll counters every 30 seconds and send sFlow to an analyzer (10.0.0.50) using the default sFlow port 6343: 
sflow enable
sflow agent-ip 10.0.0.252
sflow collector-ip 10.0.0.50
sflow sampling-rate 10000
sflow counter-poll-interval 30
For each interface: 
interface ethernet 1/1 sflow enable
A previous posting discussed the selection of sampling rates. Additional information can be found on the Mellanox web site.

See Trying out sFlow for suggestions on getting started with sFlow monitoring and reporting.

Coffee Break – Show 6

News of the Networking Industry in the time it takes to drink a coffee (more or less). This week we are joined by Amy Engineer to parse the news and dig into the business of technology.

Author information

Greg Ferro

Greg Ferro is a Network Engineer/Architect, mostly focussed on Data Centre, Security Infrastructure, and recently Virtualization. He has over 20 years in IT, in wide range of employers working as a freelance consultant including Finance, Service Providers and Online Companies. He is CCIE#6920 and has a few ideas about the world, but not enough to really count.

He is a host on the Packet Pushers Podcast, blogger at EtherealMind.com and on Twitter @etherealmind and Google Plus.

TwitterFacebookGoogle+

The post Coffee Break – Show 6 appeared first on Packet Pushers Podcast and was written by Greg Ferro.

1 … 3,697 3,698 3,699 3,700 3,701 … 3,795