Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Firewall Wizards: Re: Botnets, IRC servers and firewalls?

Re: Botnets, IRC servers and firewalls?

From: Gadi Evron <ge_at_egotistical.reprehensible.net>
Date: Tue, 03 Feb 2004 13:20:20 +0200

> I've yet to see a business need for BotNet clients to run successfully ;)

Perhaps application filtering for the Drone control protocol?

Drone armies, although massive are nothing special.

They are usually built of the same 2-4 Trojan horses that are big at
that time.

Filtering the traffic for their control protocol, on whatever port, or
their repetetive echo commands/ special connections to IRC servers under
certain IRC names or nickname/ident/name pattern-combinations is pretty
easy to do when you come to think about it.

        Gadi Evron.

_______________________________________________
firewall-wizards mailing list
firewall-wizards_at_honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
Received on Feb 03 2004

[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos