search for: botnets

Hi, Since upgrading our mail servers to Postfix/Dovecot, we've seen a rather large increase in botnet brute force password attacks. I guess our old servers were too slow to suit their needs. Now, when they hit upon a valid user, it's easy to see what passwords they are trying (we've enabled auth_debug_passwords and set auth_verbose_passwords = plain). We can easily have log

On 02/04/2015 07:55 PM, Always Learning wrote: > Rent ? That costs money. Just crack open some Windoze machines and do > it for free. That is what many hackers do. Those crackers who build these botnets are the ones who rent out botnet time to people who just was to get the work done. There is a large market in botnet time. > > Is this safe enough ? > > wac4140SoeTer'#621strAAt0918;@@ > > Yes, it is.

Hello guys, Whats is the best way to identify a possible user using a botnet with php in the server? And if he is using GET commands for example in other server. Does apache logs outbound conections ? If it is using a file that is not malicious the clam av would not identify. Thanks

Another alternative is to use a FIMS/HIDS such as Aide (Advanced Intrusion Detection Environment), OSSEC or Samhain. Be prepared to learn a lot about what your OS normally does behind the scenes (and thus a fair amount of initial fine tuning to exclude those things). Aide seems to work well (I've seen only one odd result) and is quite granular. However, it is local system based rather than

On 11/06/2017 07:06 AM, marcos valentine wrote: > Hello guys, > > > Whats is the best way to identify a possible user using a botnet with php > in the server? And if he is using GET commands for example in other server. > > Does apache logs outbound conections ? > > If it is using a file that is not malicious the clam av would not identify. This sounds like a good

...t I didn't want) ran fiber down the street, and was willing to sell me a static IP address. right now my memory fails me as to exactly when that was, but it may have been as much as 20 years ago, certainly at least 15. so I've had that address for long enough that there shouldn't be any botnets thinking that I am one of its command/control servers. but the amount of attempted traffic on that port certainly does seem like it could be a botnet banging on me. > Just be thankful that you have a working firewall in place! Amen! -- ---- Fred Smith -- fredex at fcshome.stoneham.ma.us --...

On Tue, July 28, 2015 19:46, Warren Young wrote: > > iPads can???t be coopted into a botnet. The rules for iPad passwords > must necessarily be different than for CentOS. > http://www.tomsguide.com/us/ios-botnet-hacking,news-19253.html -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne

> On Feb 4, 2015, at 5:43 PM, Warren Young <wyml at etr-usa.com> wrote: > > SSH as shipped on CentOS doesn?t allow 1,000 guesses per second, as this calculator assumes Hmm, just thought of a counterattack: If CentOS?s SSH currently allows 10 guesses per minute *per IP*, all you need to do to get 1,000 guesses per second is to rent time on a 6,000 machine botnet.

On Sat, 25 Jul 2015 11:16:18 -0600 Chris Murphy <lists at colorremedies.com> wrote: > On Sat, Jul 25, 2015 at 9:40 AM, Scott Robbins <scottro at nyc.rr.com> wrote: > > This might show up twice, I think I sent it from a bad address previously. > > If so, please accept my apologies. > > > > > > In Fedora 22, one developer (and only one) decided that if

Once upon a time, Warren Young <wyml at etr-usa.com> said: > Much of the evil on the Internet today ? DDoS armies, spam spewers, phishing botnets ? is done on pnwed hardware, much of which was compromised by previous botnets banging on weak SSH passwords. Since most of that crap comes from Windows hosts, the security of Linux SSH passwords seems hardly relevant. > Your freedom to use any password you like stops at the point where exerci...

...ts get a million Linux kernels to run at once Scientists at Sandia National Laboratories in Livermore, have run more than a million Linux kernels as virtual machines. (how long before shared hosts use this....lol) The technique will allow them to effectively observe behaviour found in malicious botnets, or networks of infected machines that can operate on the scale of a million nodes. One of the researchers Ron Minnich, said they are often difficult to analyze since they are geographically spread all over the world. However using virtual machine and a Thunderbird supercomputing cluster for the...

...> The new rules are nowhere near that stringent: > > http://manpages.ubuntu.com/manpages/trusty/man8/pam_pwquality.8.html > >> Who thinks the password policy in my machines are my concern. > > Much of the evil on the Internet today ? DDoS armies, spam spewers, phishing botnets ? is done on pnwed hardware, much of which was compromised by previous botnets banging on weak SSH passwords. > > Your freedom to use any password you like stops at the point where exercising that freedom creates a risk to other people?s machines. > > In the previous thread on this to...

...ran fiber down the street, and > was willing to sell me a static IP address. right now my memory fails me > as to exactly when that was, but it may have been as much as 20 years ago, > certainly at least 15. so I've had that address for long enough that there > shouldn't be any botnets thinking that I am one of its command/control > servers. > > but the amount of attempted traffic on that port certainly does seem like > it could be a botnet banging on me. > >> Just be thankful that you have a working firewall in place! >> You want a perfectly silly... a...

On 07/28/2015 03:06 PM, Chris Adams wrote: > Once upon a time, Warren Young <wyml at etr-usa.com> said: >> Much of the evil on the Internet today ? DDoS armies, spam spewers, phishing botnets ? is done on pnwed hardware, much of which was compromised by previous botnets banging on weak SSH passwords. > Since most of that crap comes from Windows hosts, the security of Linux > SSH passwords seems hardly relevant. > I happen to know from firsthand experience that SSH slow brutefor...

> On Feb 4, 2015, at 5:55 PM, Always Learning <centos at u64.u22.net> wrote: > > On Wed, 2015-02-04 at 17:50 -0700, Warren Young wrote: > >>> rent time on a 6,000 machine botnet. > > Rent ? That costs money. Just crack open some Windoze machines and do > it for free. That is what many hackers do. Acquiring your own botnet requires time and effort. Renting

On Thu, 2015-02-05 at 09:51 -0500, Lamar Owen wrote: > On 02/04/2015 07:55 PM, Always Learning wrote: > > Rent ? That costs money. Just crack open some Windoze machines and do > > it for free. That is what many hackers do. > > Those crackers who build these botnets are the ones who rent out botnet > time to people who just was to get the work done. There is a large > market in botnet time. Surely its time for the Feds to arrest and change them ? > > Is this safe enough ? > > > > wac4140SoeTer'#621strAAt0918;@@ > > >...

On Tue, Jul 28, 2015 at 1:06 PM, Chris Adams <linux at cmadams.net> wrote: > Once upon a time, Warren Young <wyml at etr-usa.com> said: >> Much of the evil on the Internet today ? DDoS armies, spam spewers, phishing botnets ? is done on pnwed hardware, much of which was compromised by previous botnets banging on weak SSH passwords. > > Since most of that crap comes from Windows hosts, the security of Linux > SSH passwords seems hardly relevant. Botnets are terrible, it doesn't matter how many of them the...

On Thu, Jul 30, 2015 at 12:20 PM, Warren Young <wyml at etr-usa.com> wrote: > On Jul 29, 2015, at 5:40 PM, Chris Murphy <lists at colorremedies.com> wrote: >> >> On Wed, Jul 29, 2015 at 4:37 PM, Warren Young <wyml at etr-usa.com> wrote: >> >>> Security is *always* opposed to convenience. >> >> False. OS X by default runs only signed

I know this is OT, but I'm not sure where else to ask. I can hope for fogiveness! :) My home router sends its logs to the rsyslog on my desktop system, and from there I can learn all kinds of interesting (or disturbing) things. I've written a really horrid shellscript (about 20 things piped together with a temp file in the middle) to give me the count of DROP events for specific incoming

...street, and > > was willing to sell me a static IP address. right now my memory fails me > > as to exactly when that was, but it may have been as much as 20 years ago, > > certainly at least 15. so I've had that address for long enough that there > > shouldn't be any botnets thinking that I am one of its command/control > > servers. > > > > but the amount of attempted traffic on that port certainly does seem like > > it could be a botnet banging on me. > > > >> Just be thankful that you have a working firewall in place! > >&...