iago-vL - Slashdot User

Submission + - Nmap Developers release a picture of the Web (nmap.org)

Submitted by iago-vL on Monday August 23, 2010 @12:04PM

iago-vL writes: The Nmap Project recently posted an awesome visualization of the top million site icons (favicons) on the Web, sized by relative popularity of sites. Once again proving that they're the kings of scanning, this project used the Nmap Scripting Engine, which is capable of performing discovery, vulnerability detection, and anything else you can imagine with lightning speed. We saw last month how an Nmap developer downloaded 170 million Facebook names, and this month it's a million favicons. I wonder what they're going to do next?

Submission + - Taking apart the Energizer Trojan (skullsecurity.org)

Submitted by iago-vL on Monday March 29, 2010 @10:33AM

iago-vL writes: Researchers at SkullSecurity have written a tutorial on how they reverse engineered the Energizer Trojan and generated an Nmap probe to remotely detect infections. The Energizer Trojan is a great educational tool because its inner workings are very simplistic and it makes minimal efforts to hide itself or conceal its purpose; it even lists what appears to be the author's name — "liuhong" — in the source! From infecting a test machine to debugging and disassembling the Trojan to writing the actual probe, this tutorial is a great introduction to malware analysis!

Submission + - NetBIOS Design Allows Traffic Redirection (skullsecurity.org) 1

Submitted by iago-vL on Thursday December 24, 2009 @12:51PM

iago-vL writes: Security researchers at SkullSecurity released research demonstrating how the NetBIOS protocol allows trivial hijacking due to its design; they have demonstrated this attack in a tool called 'nbpoison' (in the package 'nbtool'). If a DNS lookup fails on Windows, the operating system will broadcast a NetBIOS lookup request that anybody can respond to. One vector of attack is against business workstations on an untrusted network, like a hotel; all DNS requests for internal resources can be redirected (Exchange, proxy, WPAD, etc). Other attack vectors are discussed here. Although similar attacks exist against DHCP, ARP, and many other LAN-based protocols, and we all know that untrusted systems on a LAN means game over, NetBIOS poisoning is much quieter and less likely to break other things.

Submission + - Nmap 5.00 Released! (nmap.org)

Submitted by

iago-vL

on Thursday July 16, 2009 @12:12PM

iago-vL writes: "The long-awaited Nmap Security Scanner version 5.00 was just released (download)! This marks the most important release since 1997, and is a huge step in Nmap's evolution from a simple port scanner to an all-around security and networking tool suite. Significant performance improvements were made, and dozens of scripts were added. For example, Nmap can now log into Windows and perform local checks (PDF), including Conficker detection. New tools included in 5.00 are Ncat, a modern reimplementation of Netcat (with IPv6, SSL, NAT traversal, port redirection, and more!), and Ndiff, for quickly comparing scan results. Other tools are in the works for future releases, but we're still waiting for them to add email and ftp clients so we can finally get off Emacs!"

Submission + - Using Conficker's tricks to root out infections (seclists.org)

Submitted by

iago-vL

on Tuesday April 21, 2009 @11:20PM

iago-vL writes: "The folks at Nmap have done it again: despite having their domain blacklisted by Conficker, they released Nmap 4.85BETA8, which promises better detection of the Conficker worm. How? By talking to it on its own peer to peer network! By sending encrypted messages to a suspect host, Conficker.C and higher will reveal itself. This curious case of using Conficker's own tricks to find it is similar to the last trick that Slashdot reported. More info from the author can be found here, and you can download Nmap here (or, if you're a Conficker refugee, try this link instead)."

Submission + - Death Knell for DoS Extortion?

Submitted by

Ron

on Tuesday May 01, 2007 @02:05PM

Ron writes: "An Infoworld article reports that Yazan Gable, a security researcher, has put forward an explanation as to why the numbers of denial of service attacks have been declining. His theory is that DoS attacks are no longer profitable to attackers. While spam and phishing attacks directly generate profit, he argues that extortion techniques often used with DoS attacks are far more risky and often make an attacker no profit at all. He writes:

So what happens if the target of the attack refuses to pay? The DoS extortionist is obligated to carry out a prolonged DoS attack against them to follow through on their threats. For a DoS extortionist, this is the worst scenario because they have to risk their bot network for nothing at all. Since the target has refused to pay, it is likely that they will never pay. As a consequence, the attacker has to spend time and resources on a lost cause.
"

Slashdot Top Deals