427 Botnet fm qxd

www.syngress.com
214
Chapter 5 • Botnet Detection: Tools and Techniques
427_Botnet_05.qxd 1/9/07 9:59 AM Page 214

---

Q: 
Do I need antivirus on my Mac and Linux machines?
A: 
Malware for OS X is still fairly rare, but it happens:Trojans, rootkits, even
a bot or two. Bear in mind that antivirus doesn’t just catch viruses.There
is more malware for older Mac OS versions, though it’s seldom seen now.
Linux has been around a lot longer than OS X and has attracted a lot
more malware (but very few real viruses).
Q: 
What’s heterogeneous virus transmission?
A: 
I’m so glad you asked me that. Sometimes you’ll find malicious programs
on a system that isn’t vulnerable to them (like a PC virus on a Mac
server).You still need to detect something like that in case it gets trans-
mitted to a system that really is vulnerable.
Q: 
Is there really that much difference between network and host forensics?
A: 
Maybe not that much. Although bots are planted on a compromised host,
their core activity is almost entirely network based.You’re likelier to iden-
tify malicious code, suspicious configurations, and so on at the host level,
but it’s often possible to pick up network activity on the network and on
the host that’s generating it, depending on what tools you have access to.
We also do both because the interior of our networks tends to be less
instrumented than the boundary.
www.syngress.com
Botnet Detection: Tools and Techniques • Chapter 5
215
427_Botnet_05.qxd 1/9/07 9:59 AM Page 215

---

427_Botnet_05.qxd 1/9/07 9:59 AM Page 216

---