RE: Spy ware assessment techniques

Some of the things I look for when I suspect spy ware and it isn't straight
forward about its presence are network connections. Apart from how Windows
is by nature the noisiest Operating System on earth on a network, you can
use a connection monitor either at the host or over the wire to look for
connections made to odd addresses that weren't initiated knowingly. Try
pointing the browser at a location void of banner ads and see if any "other"
connections are made to spy ware reporting engines as browser add-ins are
the most common spy ware.

Sounds like one of us with spare time should go on a warez and pr0n site
clicking spree with another clean computer doing some ethereal watching.
Maybe there can be some Snort signatures written for the whole world to
benefit.

-Terry


-----Original Message-----
From: Thorsten Holz [mailto:thorsten.holz@xxxxxxxxxxxxxxxxxxxx]
Sent: Friday, February 10, 2006 1:18 PM
Cc: pen-test@xxxxxxxxxxxxxxxxx
Subject: Re: Spyware assessment techniques

Butler, Theodore wrote:
A companion question, what if you had to do this from a command line?
How would it be done without the spyware tools?

My advise based on some experience with bots/adware:

- Look at the running processes and identify unusual entries
- Similarly, take a look at all the run keys in the registry (autostart
for malware)
- Look for suspicious files in C:\, C:\%windir%, C:\%windir%\system32

With this information, you can find the most obvious ones. With more
stealth malware (hiding with the help of rootkits), you can look for
suspicious drivers, but a good installation will hide itself so that it
can't be detected from the command line.

From a network point of view, look for suspicious connections at the
gateway (netflow helps here). Identify unusual flows, use of unusual
ports used for Command & Control, recurring patterns, ... Perhaps you
can also use ngrep to search for suspicious network communication.

Just my 0.02 cent,
Thorsten

--
http://honeyblog.org


----------------------------------------------------------------------------
--
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are

futile against web application hacking. Check your website for
vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers
do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
----------------------------------------------------------------------------
---


------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------

Relevant Pages

  • RE: Pre-Scanning for Marketing
    ... The controlling interest of the network has to have a inclination to secure ... vulnerabilities are easily and efficiently identified. ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, ...
    (Pen-Test)
  • RE: Finding multi-homed, internet connected, systems as potential point-of-entry.
    ... It uses ICMP and may or may not work depending on how the local network is set up. ... > -Send a spoofed (spoof an internet address under our control) message ... > Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, ...
    (Pen-Test)
  • Re: Qualys
    ... Well, if we are going to get picky about terminology, surely a Class A environment means a network with a Class A subnet configured, not necessarily one with any particular number of hosts. ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • Re: Scanning Class A network
    ... The scan needed to be carried out externally, and not from within the network to identify hosts and ports exposed to the Internet. ... Hackers are concentrating their efforts on attacking applications on your website. ... Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. ... Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • Re: Scanning Class A network
    ... About point 2, i recommend you Nmap... ... >network to identify hosts and ports exposed to the Internet. ... >Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)