427 Botnet fm qxd

www.syngress.com
Botnet Detection: Tools and Techniques • Chapter 5
181
427_Botnet_05.qxd 1/9/07 9:59 AM Page 181

---

featuring the same list of default userids.They are both capable of exploiting
other vulnerabilities, but it was the password-guessing attack that we detected.
Management made a decision very early in the incident response that we
would not engage law enforcement unless the case met some pre-established
criteria, such as:
■
Loss of credit card or other financial data
■
Loss of student information
■
Loss of privacy-protected information
■
Discovery of illegal (contraband) material (such as child pornography)
If any of these criteria were met, we would:
■
Take a digital signature of the original hard drive.
■
Create a forensically sound image of the original hard drive.
■
Take a signature of the imaged hard drive.
■
Compare the two digital signatures to ensure that our copy is forensi-
cally sound.
■
Establish chain of customer documentation.
■
At this point the original hard drive can be returned to service.
■
Traditional forensics could be performed on the second copy of the
hard drive.
However, for the majority of the cases, we performed a quick forensic,
intended to extract information about the attack vectors, other infected sys-
tems, the botnet architecture (bot server, payload, functions, C&C method),
and code samples that can be sent for further analysis.The steps we take in
these cases are as follows:
1. Receive notification of a bot instance.
2. Open a problem-tracking ticket.
3. Quarantine the network connection.
4. Perform a quick forensic process in a controlled environment.
5. Clean-scan the victim’s computer for viruses.