427 Botnet fm qxd

More about lsass.exploited.org
Symantec’s Web site discusses related malware at www.sarc.com/
avcenter/venc/data/w32.spybot.won.html. They named this malware
W32.spybot.won
and noted that IRC may be used as the command and
control channel. They mention the name 
exploited.lsass.org
and var-
ious Microsoft security bulletins, including MS 03-026, 
Buffer Overrun
in RPC Interface Could Allow Code Execution
(www.microsoft.com/
technet/security/bulletin/MS03-026.mspx). We suspect that there is a
likely relationship between the name of the DNS-based C&C
(lsass.exploited.org) and its attacks against the Microsoft file share
system. 
www.syngress.com
Botnet Detection: Tools and Techniques • Chapter 5
137
427_Botnet_05.qxd 1/9/07 9:59 AM Page 137

---

One remaining question is, how you might report abuse? This is done
through the various registries and can be done over the Web using a browser,
or with the traditional UNIX 
whois
command as follows:
# whois –h whois.arin.net 192.168.249.146
OrgName:
Enormous State University
OrgID:
ENORMOUSSU-X
Address:
XXX XX XXXX Street
Address:
Suite XXXX
City:
Enormoustown
StateProv: SOMESTATE
PostalCode: XXXXX
Country:
US
NetRange:
192.168.0.0 - 192.168.255.255
CIDR:
192.168.0.0/16
NetName:
ENORMOUSSU-NET
NetHandle: NET-192-168-0-0-1
Parent:
NET-192-0-0-0-0
NetType:
Direct Assignment
RTechHandle: XXXXX-ARIN
RTechName:
Netguy, Rick
RTechPhone: +X-XXX-XXX-XXXX
RTechEmail: [e-mail]
OrgAbuseHandle: ABUSEXXX-ARIN
OrgAbuseName:
Abuse
OrgAbusePhone: +X-XXX-XXX-XXXX
OrgAbuseEmail: [e-mail]