427 Botnet fm qxd

Index
461
forensic techniques, tools for botnet
detection, 179–207, 212–213
FreeBSD, 235, 236, 296, 334, 337, 343
FTP-based C&Cs, and drop zones,
87–89
G
games, stolen CD keys, and Agobot,
115–116
Gaobot, 10–11, 111, 131
Gembe, Axel, 17
GimmyCash, 63–64
Giuseppini, Gabriele, 188
GM IRC bot, 7
Goebbels, Dr. Joseph, 29
Google’s Adsense program, 50–51, 69
graphs
RRDtool, 242
stripcharts (ourmon), 220–221
UDP port, 246
worm, 222–223, 246, 267–269
Griesser, Andreas, 423
Group Policy (Windows XP), 431
GT (Global Threat) Bot, 8–9, 16
H
Hackman Dissembler, 396–397
halting problem, software engineering,
425
Harley, Lee, 167
Harris, Jayson, 423–424
Harvey, Andrew, 16
Haxdoor bot, 87
help for ourmon tool, 248
Heuristic Analysis: Detecting Unknown
Viruses
(Harley), 167
hidden32.exe tool, 38
HideUser2, 38
HIDS (host-based intrusion detection
systems), 156, 157
Hogwash, 160
Honeyd, 178
honeynets, 178–179, 444–445
honeypots for bot, botnet detection,
178–179, 237, 452
honeywalls, 178
host-based intrusion detection systems
(HIDS), 156, 157
host capture (ourmon), 227
host forensics, 180, 215
hosts
cleaning infected, 434–435
discovering how infected, 371–375
lost botnet, 330–331
virus detection on, 160–165
Hosts file, botnet modification, 132
HTML documents, converting XML
to, 359, 368
I
ICMP-controlled botnets, 92
ICMP errors, 274–275
IM.
See
Instant Messaging
IMS (Internet Motion Sensor),
177–178
infrastructure, network.
See 
network
infrastructure
inline code overwriting, 357
installing
adware, click4hire by botnet, 49
ourmon tool, 231–238, 241
programs without IT department,
427
Snort intrusion detection, 169
Instant Messaging (IM)
C&Cs, 86–87
spam attacks (SPIM), 10
Institute of Computer Forensic
Professionals, 403
integrity detection, 166
intellectual property, storage,
distribution of stolen, illegal,
55–60
intelligence resources
confidentiality agreements,
404–407, 413
introduction to, 392, 411
membership organizations,
qualifications, 403–404
resources, Web sites, 398–403
role in aggregating effective law
enforcement, 409–410
tracing attacks back to botherders,
392–398
what to do with information,
407–409
Internet, intelligence sources on, 414
Internet Motion Sensor (IMS),
177–178
Internet Relay Chat.
See 
IRC
interprocess communication (IPC),
357
intrusion detection
generally, 155–160, 210–212
heuristic analysis, 165–168
Snort, 168–172
Tripwire, 172–176
virus detection on hosts, 160–165
intrusion detection systems (IDSes),
156, 432
IP address source spoofing, 257–258
IP Source Guard (Cisco), 154
IRC botnet servers, detecting,
304–308, 311
IRC client botnets, detecting,
298–303, 310
IRC (Internet Relay Chat)
and alternative C&Cs, 78–79
and bot servers, 30
botnet attacks, 5
and Command and Control (C&C)
servers, 75
invention of, 6
ourmon information detection, 219
port vulnerability, 213
protocol described, 286–290, 309
IRC messages, sniffing, 329–333, 341
IRC reports (ourmon), 224, 290–298,
310
ircfr sniffing tool, 333
Isass.exploited.org, 137