Re: Dshell versus INNUENDO

["J. Craig" <3141592f () gmail com>]

Firstly, props to the dshell team for making that decoder and releasing it.

Secondly, you shouldn't need a decoder to catch an implant using this type
of channel.  It's pretty high signal.

Thx,
Jason

On Tue, Feb 3, 2015 at 11:06 AM, Dave Aitel <dave () immunityinc com> wrote:

>  The US Army recently released DShell
> <http://gizmodo.com/the-army-just-open-sourced-its-security-software-1683023527>,
> which they've been using to do network incident response, as open source.
> Part of it is a DNS decoder
> <https://github.com/USArmyResearchLab/Dshell/blob/master/decoders/dns/innuendo-dns.py>
> that tries to find INNUENDO traffic. Although they developed it only by
> looking at our demonstration video <https://vimeo.com/115206626> (note:
> email admin () immunityinc com for an eval copy of INNUENDO!) we can confirm
> their script works (see below).
>
> It may, or may not, work against the *next* version of INNUENDO. ;>
>
> Thanks,
> Dave Aitel
> Immunity, Inc.
>
> [image: Dshell image]
>
> _______________________________________________
> Dailydave mailing list
> Dailydave () lists immunityinc com
> https://lists.immunityinc.com/mailman/listinfo/dailydave

_______________________________________________
Dailydave mailing list
Dailydave () lists immunityinc com
https://lists.immunityinc.com/mailman/listinfo/dailydave