Jaime Blasco Blog : /Ossim/ossim_conficker_p2p

April 1st, Conficker day
Tue, 31 Mar 2009

Tomorrow Conficker will activate a P2P system to coordinate to other infected machines over TCP and UDP, we've published a directive to detect the P2P behaviour.

Donwload Directive

posted at: 14:55 | path: /Ossim | permanent link to this entry | 2 comments |

* Posted by The Other Pinocho at Tue Mar 31 15:14:48 2009

Something miss, tomorrow "maybe" Conficker will talk. Over TCP and UDP, you said. But why the directive only match UDP protocol. Is there a answer? Or you forgot TCP protocol?

* Posted by Jaime Blasco at Tue Mar 31 16:11:06 2009

I said over TCP and UDP but the UDP traffic is to scan other peers, the directive match UDP protocol because the directive levels name are "Peer Scanning" so it detects peer scanning behaviour. TCP traffic have different behaviour.

Regards

Categories

/ (34)
    Attacks/ (2)
    Exploits/ (1)
    General/ (3)
    Lua/ (1)
    Malware/ (3)
    Nessus/ (6)
        cisco/ (1)
        plugins/ (3)
    Ossim/ (9)
    Scada Security/ (2)
    Security Visualization/ (6)
        Malware/ (2)
    Vulnerability Management/ (1)

Jaime Blasco
(feel free to get in touch)

Friend's blogs:

Lecture...

< March 2009 >

Mo Tu We Th Fr Sa Su

1

2 3 4 5 6 7 8

9 10 11 12 13 14 15

16 17 18 19 20 21 22

23 24 25 26 27 28 29

30 31