Windows Spam Proxy Viruses.ppt

Windows Spam Proxy Viruses Introduction Introduction I have been accused of being a salesman IPAUDIT I have been accused of being a preacher BLOCK WINDOWS NETWORKING Motivational Speaker Now I am a motivational speaker: You are all smart people with the right (free) tools and good intentions Together we can make a difference! Desperate Times Desperate Times Win PopUp alerts to RPC-DCOM vulnerable hosts (thanks Eric Jacobsen) Hacking hosts that were DOSing our NetReg box (thanks Rich Graves) Sending Spam like this: My Spam Experience the results youve always wanted with a MASSIVE scientific breakthrough: Best of all... There Are NO Agonizing Hanging Weights, NO Tough Exercises, NO Painful And Hard-To-Use Pumps, And There Is NO Dangerous Surgery Involved. But the best part is when you reveal yourself in all your glory to the woman in your life. When she sees how massive and manly, how truly long and hard you are, she will surrender and give you everything you have always wanted. What We Noticed What We Noticed I’ve been answering abuse@ for about two years now. Noticable increase in amount of inbound spam complaints over the course of the Spring: Exciting Full-Color Chart ahead! Worm Ate my Homework Jan = 2 Feb = 15 Mar = 12 Apr = 70 What we Noticed (con’t) April ’03 started nmap the hosts we got complaints about and found unexpected ports open amap them and usually found: http-proxy smtp-proxy ?? probably RAT Visited some and found they were mostly virus related: SoBig, LovGate, Jeem How We Detected It How We Detected It IPAudit graphs looking for outgoing scans local hosts that contact many more remote hosts than they got answers from IPAudit client/server report that told us: Highest mail connections ssh telnet http https How We Detected It (con’t) Daily totals were a good start, but we needed more detail - short bursts got lost in steady volume Jon Rifkin made IPAudit graph that showed outbound SMTP connections per min. Allowed us to quickly see a chan