Botnet exploiting MS0867 flaws (Inside the botnets that never make the news)

TalkBack 6 of 10:

Next »

« Previous

• Thread View
• Flat View

... uh, how do you propose to do that?

IRC can be set to use literally ANY port, not just the well-publicised ports that are used by most casual IRC users. The same problem occurs when you block known IRC hosts (either by domain or IP range) - all you're doing is blocking the major IRC nets. Botnet operators can set up their own servers/nets, using IRC server 'ware available for free for just about any OS.

Stateful packet inspection's the only viable method, and this gets expensive in terms of processing power needed to scan each inbound and outbound packet. You CAN impose the CIS version of Social Engineering with a "Thou Shalt Not" edict, but unless you have a method of catching someone breaking it, it's hard to enforce.

It's better to close the vulnerabilities at the point of infection/subversion, by aggressive anti-malware scanning, IM proxy servers, or straight-up blocking of the software from the desktops via a GPO.

Posted by: dcnblues   Posted on: 05/21/09 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• The True Costs of Virtual Server Solutions VMware In an economic environment that is repeatedly heralding the message "do ... Download Now