RE: Identifying Malware in Outbound Traffic

["IT \(Hafeez Abdul Rahman\)" <HafeezR () emiratesNBD com>]

Dear Helly..

If I did understand what you're looking out for then I would say check out Fireye.com
That should help ,as it tries to perform heuristic detection and also malware/Trojan/Bots on your internal network 
trying to perform a call back.

This doesn't do a signature based detection like the anti-viruses usually does and hence can also pull out zero day 
attacks based on attack patterns that the anti-virus usually misses.

It's a paid tool thou.. 
I am not aware if we have a free version of the same...

Regards
Hafeez Abdul Rahman


-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Henri Salo
Sent: Thursday, September 15, 2011 11:45 PM
To: hellkyng () gmail com
Cc: security-basics () securityfocus com
Subject: Re: Identifying Malware in Outbound Traffic

On Thu, Sep 15, 2011 at 07:08:28PM +0000, hellkyng () gmail com wrote:
> This is an idea we've been playing around with a lot lately. I was hoping the experts here could give us some 
> pointers to improve or modify our process.
>
> We are looking at ways to find existing infections that have evaded anti-virus successfully within our network. We've 
> started doing this by monitoring web traffic for anomalies that we think indicate an infection. For example searching 
> for traffic to sites listed in the Malware Domain list. At a basic level this is finding some interesting results.
>
> But I am curious are other people attempting similar things, if so how are they going about doing so? Any thoughts or 
> recommendations would be appreciated.
>
> Thanks,
> Helly

- http://en.wikipedia.org/wiki/Intrusion_prevention_system
- http://en.wikipedia.org/wiki/Intrusion-detection_system
- http://en.wikipedia.org/wiki/Host_based_intrusion_detection_system
- www-proxies
- Anomaly detection using "smart" firewalls, which can detect traffic in strange times, hosts etc.
- Forced firewall policy
- http://en.wikipedia.org/wiki/Principle_of_least_privilege

Best regards,
Henri Salo

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------



DISCLAIMER:
"This e-mail message including any of its attachments is intended solely for the addressee(s) and may contain 
privileged information. If you are not the addressee or you have received this email message in error, please notify 
the sender who will remove your details from its database. You are not authorized to read, copy, disseminate, 
distribute or use this e-mail message or any attachment to it in any manner and must delete the email and destroy any 
hard copies of it. 
This e-mail message does not contain financial instructions or commitments of any kind. Any views expressed in this 
message are those of the individual sender and do not necessarily reflect the views of Emirates NBD PJSC, or any other 
related subsidiaries, entities or persons."

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------