Comments on: Kraken Botnet Twice The Size Of Storm http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/ Ethical Hacking, Penetration Testing & Computer Security Tue, 07 Oct 2008 07:52:48 +0000 http://wordpress.org/?v=2.6.2 By: zupakomputer http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122763 zupakomputer Thu, 17 Apr 2008 15:33:50 +0000 http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122763 Does anyone else think it's funny there's a Kraken vs Damballah theme here? Cthuhlu vs Giga Cobra.....it's like a Stomp Tokyo! movie. Does anyone else think it’s funny there’s a Kraken vs Damballah theme here? Cthuhlu vs Giga Cobra…..it’s like a Stomp Tokyo! movie.

]]> By: fever http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122759 fever Thu, 17 Apr 2008 04:26:45 +0000 http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122759 @ Bogwitch Thanks for the input on fwalls However, ZA has advanced significantly since the 95 and 98 days (you know 10 years) i would suggest you give it a second chance. it has saved me on more than one occasion. granted it isn't perfect but no fwall is, there is always a way around, it's pretty close though. @ Bogwitch
Thanks for the input on fwalls
However,
ZA has advanced significantly since the 95 and 98 days (you know 10 years) i would suggest you give it a second chance. it has saved me on more than one occasion. granted it isn’t perfect but no fwall is, there is always a way around, it’s pretty close though.

]]> By: zupakomputer http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122757 zupakomputer Wed, 16 Apr 2008 17:57:18 +0000 http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122757 lol, zupak, makes me sound like a hip-hop star :-p Do they know if the SMTP server uses any ports outgoing, or does it always use the SMTP port? Why not have a system that blocks outgoing mail by protocol (and port), and only except it when/if you happen to use that protocol to do any mailings; then you can still accept incoming SMTP or any other mail types. lol, zupak, makes me sound like a hip-hop star :-p

Do they know if the SMTP server uses any ports outgoing, or does it always use the SMTP port?

Why not have a system that blocks outgoing mail by protocol (and port), and only except it when/if you happen to use that protocol to do any mailings; then you can still accept incoming SMTP or any other mail types.

]]> By: Darknet http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122756 Darknet Wed, 16 Apr 2008 17:17:11 +0000 http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122756 zupak the mail is sent from a simple smtp server process on the client machine, most likely hidden from any process view programs by normal rootkit behaviour. This is exactly the reason why many corporate mail servers don't accept mail from dynamic IP address pools. The mail is sent directly from the machine for exactly that reason too, to avoid black lists on IP addresses known for sending spam, if the spammers used a centralised mail service it would be easily blocked. By infecting random machines and chopping up batches and sending them from each the mails are coming from a variety of smtp servers. My favourite firewall ever was Conseal back in the Win98 days, it was excellent! zupak the mail is sent from a simple smtp server process on the client machine, most likely hidden from any process view programs by normal rootkit behaviour. This is exactly the reason why many corporate mail servers don’t accept mail from dynamic IP address pools. The mail is sent directly from the machine for exactly that reason too, to avoid black lists on IP addresses known for sending spam, if the spammers used a centralised mail service it would be easily blocked. By infecting random machines and chopping up batches and sending them from each the mails are coming from a variety of smtp servers.

My favourite firewall ever was Conseal back in the Win98 days, it was excellent!

]]> By: zupakomputer http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122754 zupakomputer Wed, 16 Apr 2008 14:21:04 +0000 http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122754 Agreed that everyday users aren't likely to know much about what processes should and shouldn't be running, but that's what app's address anyway when they're bg scanners and firewall packages. If something has gotten in already and installed itself, then it's possible it will be able to hide even from process scans - but if the system is being properly monitored to begin with then the initial attempt by the trojan rootkit etc to install itself will be noticed, because it will need to either just install, or it begins to alter the core kernal settings so it is not monitored once it's installed. Another thing that could be useful is to have a system resources display, that shows percentages of resources used per process - then you can compare those in total to the overall respurces used. If it's significantly higher use for overall than the known processes total, then you have hidden processes running. Again - if these are in packaged app's then it's up to the coders and interface designers to be specific about the basic settings and configurations, if their target customers are folks that aren't interested in having to read a whole book just to secure their system. I don't know that a firewall can't tell the difference between unwarranted downloads or not? That's not very difficult to spot. In general, if it's not from the same url (and its IP) you're visiting then it shouldn't allow it (that should include ad's and links on the page!), also even if it is from that url it should flag it prior to download. Rogue packets can be spotted that way too, because they won't cohere with the legit websites packet numbering; related to that would be more of what I'd meant about how cookies can be a way in - some of them are pretty large, and even ones that aren't can combine in various ways (depending on what they are written to do) once they are in. I'm not too up on how an individual machine can be hijacked to mail out spam, without invoking a mailer client of some kind (which means a bg or obvious process has to run). Other than using bandwith from it, in which case the mail isn't actually coming from the IP or the machine itself, it's that the machine has become part of a zombie botnet that is sharing its bandwidth with the spammers mail servers. But with this kracken one it's saying the networks IPs are being used to mail the spam out - isn't the point there that it needs to use IPs that are recognised as legit, that's how its spam gets through the filters. Agreed that everyday users aren’t likely to know much about what processes should and shouldn’t be running, but that’s what app’s address anyway when they’re bg scanners and firewall packages.

If something has gotten in already and installed itself, then it’s possible it will be able to hide even from process scans - but if the system is being properly monitored to begin with then the initial attempt by the trojan rootkit etc to install itself will be noticed, because it will need to either just install, or it begins to alter the core kernal settings so it is not monitored once it’s installed.

Another thing that could be useful is to have a system resources display, that shows percentages of resources used per process - then you can compare those in total to the overall respurces used. If it’s significantly higher use for overall than the known processes total, then you have hidden processes running.
Again - if these are in packaged app’s then it’s up to the coders and interface designers to be specific about the basic settings and configurations, if their target customers are folks that aren’t interested in having to read a whole book just to secure their system.

I don’t know that a firewall can’t tell the difference between unwarranted downloads or not? That’s not very difficult to spot. In general, if it’s not from the same url (and its IP) you’re visiting then it shouldn’t allow it (that should include ad’s and links on the page!), also even if it is from that url it should flag it prior to download.

Rogue packets can be spotted that way too, because they won’t cohere with the legit websites packet numbering;
related to that would be more of what I’d meant about how cookies can be a way in - some of them are pretty large, and even ones that aren’t can combine in various ways (depending on what they are written to do) once they are in.

I’m not too up on how an individual machine can be hijacked to mail out spam, without invoking a mailer client of some kind (which means a bg or obvious process has to run). Other than using bandwith from it, in which case the mail isn’t actually coming from the IP or the machine itself, it’s that the machine has become part of a zombie botnet that is sharing its bandwidth with the spammers mail servers.
But with this kracken one it’s saying the networks IPs are being used to mail the spam out - isn’t the point there that it needs to use IPs that are recognised as legit, that’s how its spam gets through the filters.

]]> By: Bogwitch http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122753 Bogwitch Wed, 16 Apr 2008 13:56:04 +0000 http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122753 Hehe - I should have made myself clearer. :) I use Linux as a client for surfing to the more dangerous areas. Like I said, AtGuard was the best of breed software firewall for me. I have yet to find a software firewall that matches it for functionality OR smallness of memory footprint. Hehe - I should have made myself clearer. :)

I use Linux as a client for surfing to the more dangerous areas. Like I said, AtGuard was the best of breed software firewall for me. I have yet to find a software firewall that matches it for functionality OR smallness of memory footprint.

]]> By: Darknet http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122749 Darknet Wed, 16 Apr 2008 11:06:44 +0000 http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122749 'Desktop' firewalls and a linux box at your gateway onto the net are two totally different things addressing totally different issues. The linux box is an ingress filter, it doesn't know what application is doing what - it works on ports and packets only. The software firewalls is an egress filter and can filter by application on the top layer of the ISO stack, ideally you should have both...the linux box won't stop your machine sending out tonnes of spam. The software/desktop firewall will - check out Outpost. ‘Desktop’ firewalls and a linux box at your gateway onto the net are two totally different things addressing totally different issues. The linux box is an ingress filter, it doesn’t know what application is doing what - it works on ports and packets only. The software firewalls is an egress filter and can filter by application on the top layer of the ISO stack, ideally you should have both…the linux box won’t stop your machine sending out tonnes of spam. The software/desktop firewall will - check out Outpost.

]]> By: Pantagruel http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122748 Pantagruel Wed, 16 Apr 2008 11:02:04 +0000 http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122748 With Bogwitch. The software firewalls for windows (XP/Vista) have never been my favored options, mainly due to software incompatibility or stupid little network troubles (they simply block the most basic stuff and will send you on a wild goose chase to solve the problem). Like Bogwitch I employ a dedicated linux firewall, you could argue it's just another 'software' firewall but it definitely works better than the likes of ZA. With Bogwitch.

The software firewalls for windows (XP/Vista) have never been my favored options, mainly due to software incompatibility or stupid little network troubles (they simply block the most basic stuff and will send you on a wild goose chase to solve the problem).
Like Bogwitch I employ a dedicated linux firewall, you could argue it’s just another ’software’ firewall but it definitely works better than the likes of ZA.

]]> By: Bogwitch http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122746 Bogwitch Wed, 16 Apr 2008 10:10:45 +0000 http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122746 I am not a fan of ZoneAlarm. I was put off the software a long time ago. Back in the days of Windows 95 (I was using 95 athough 98 was out) I had a Linux dial-up box (that long ago!) with a Win95 box behind that. I configured ZA with the 'I'm on a network' option and told it not to check for updates. On reboot, just after supplying my username/ password, there was some activity on my hub and the system hung for 60 seconds before allowing me in. Further investigation revealed that there was an encrypted packet trying to get out onto the Internet. It hung the machine because my Linux box was disconnected at the time and no response was received. If the Linux box was connected the login was as rapid as it was before. I have no idea what was in the packet as it was encrypted but all I had supplied was my logon credentials... I removed ZA and changed my password. I have never installed ZA since. I have played with software firewalls, I was particularly keen on AtGuard and was sad to see it being sold to Norton. Now, I have no software firewall. Ont he off chance that my Windows machine picks something up, I have a bandwith meter to give me an immediate indication that something bad is happening but I don't do dangerous things with my Windows box, that's what Linux is for. I am not a fan of ZoneAlarm. I was put off the software a long time ago. Back in the days of Windows 95 (I was using 95 athough 98 was out) I had a Linux dial-up box (that long ago!) with a Win95 box behind that.
I configured ZA with the ‘I’m on a network’ option and told it not to check for updates.
On reboot, just after supplying my username/ password, there was some activity on my hub and the system hung for 60 seconds before allowing me in. Further investigation revealed that there was an encrypted packet trying to get out onto the Internet. It hung the machine because my Linux box was disconnected at the time and no response was received. If the Linux box was connected the login was as rapid as it was before. I have no idea what was in the packet as it was encrypted but all I had supplied was my logon credentials…
I removed ZA and changed my password. I have never installed ZA since.

I have played with software firewalls, I was particularly keen on AtGuard and was sad to see it being sold to Norton. Now, I have no software firewall. Ont he off chance that my Windows machine picks something up, I have a bandwith meter to give me an immediate indication that something bad is happening but I don’t do dangerous things with my Windows box, that’s what Linux is for.

]]> By: fever http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122744 fever Wed, 16 Apr 2008 08:15:01 +0000 http://www.darknet.org.uk/2008/04/kraken-botnet-twice-the-size-of-storm/#comment-122744 i would define a good firewall as one that offers users the ability to choose the software that is allowed to access the internet. (personally i use zonealarm firewall from checkpoint it offers complete listing of all programs that try to or have tried to access the internet. it will even kill a process before it gets a chance to start. which can be very useful with a very determined program.) complete rejection of all others or trust levels you can set yourself. i would define a good firewall as one that offers users the ability to choose the software that is allowed to access the internet. (personally i use zonealarm firewall from checkpoint it offers complete listing of all programs that try to or have tried to access the internet. it will even kill a process before it gets a chance to start. which can be very useful with a very determined program.) complete rejection of all others or trust levels you can set yourself.

]]>