Windows Rootkit ierk8243.sys

I just heard about a thread on NTBugTraq regarding the presence of a kernel level driver called ierk8243.sys. This might be evidence of a trojan related to the MS-SQL "Slammer" worm. Check the thread for more info. I can't find anything else publicly available, yet.

Read More

Review of Windows XP Professional Security Posted

Amazon.com just posted my five-star review of Windows XP Professional Security. From the review:

Good administration-oriented security books teach more than proper system configuration. They illuminate the inner workings of the operating system and explain why certain strategies work best. WXPPS doesn't just list OS settings; it explains what they mean and how they have consequences.

Read More

Port 1434 UDP Traffic

I just finished listening to the SANS webcast on the recent 1434 udp traffic. It's worth a background listen and lasts one hour.

Read More

DALnet DDoS Attacks

slashdot alerted me to an article about DDoS attacks against DALnet. Read more here. Learn more about IRC in general at netsplit.de. A gallery of bots in action makes for good reading.

Read More

SQL Slammer

Looks like the Internet is weathering a new worm. Check out Internet Health Report to see that UUNet appears worse affected at the moment. Details on the vulnerability are available from CERT/CC. eEye has a good write-up and a disassembly. Cisco offers defensive measures. You can find reachability and packet loss graphs at Matrix.net.

Read More

Review of Hacker's Challenge 2 Posted

Amazon.com fixed their reviews page. Now my four-star review of Hacker's Challenge 2 appears. From the review:

I've given up on seeing Mike Schiffman correctly abbreviate the Air Force Information Warfare Center as "AFIWC" in his biography. His use of "AFWIC" must refer to the UN's AFrican Women In Crisis program and not the talk he gave to the AFIWC in Apr 99!

Read More

DNS Traffic Analysis Results

From this article:

Scientists at the San Diego Supercomputer Center (SDSC) at UCSD analyzing traffic to one of the 13 Domain Name System (DNS) “root” servers at the heart of the Internet found that the server spends the majority of its time dealing with unnecessary queries.

The paper explains what is happening and offers recommendations. Observations made at one server for one day don't conform to rigorous statistical norms, but the findings are interesting nevertheless. slashdot is discussing the findings.

Read More