Re: Recent Gaobot event

[Ron Watts <rwatts () CSUB EDU>]

I would like it as well, Thanks.


> > > dobbins () ND EDU 12/16/2004 11:08:23 AM >>>
> If anyone would like the SNORT sig we're using to sense 'bots
> phoning
> home
> for control instructions, just drop me a line.  Am not sure posting
> it
> here
> would be wise - too many lurkers who might like to subtly alter
> this
> overused variant to counter the sig.
>
> When this triggers an alert on your SNORT, the bot is just waking
> up
> and
> still benign (relatively speaking) and can be removed before the
> 'owner'
> wakes them up and uses them to do harm.
>
>
> H. Morrow Long wrote:
>
>
> > > Gordon -- Yes, we saw this, but it was for approx. the
> > > two weeks prior to last week. A number of PCs
> > > were hit with it and they began attempting to brute
> > > force the passwords for (all of ?) the accounts in our
> > > Active Directory.
> > >
> > > We'd just implemented a domain account lockdown
> > > policy -- a short lockdown period -- after a somewhat
> > > high number of unsuccessful login attempts
> > > so we began to see the effects of the new lockdown
> > > policy kick into effect rather quickly (some users
> > > reported their accounts would lock out for the
> > > lockdown period).
> > >
> > > The infected PCs would show up in the security
> > > event log of other computers and the active directory
> > > servers with high numbers of unsuccessful login
> > > attempts on various accounts.
> > >
> > > - H. Morrow Long, CISSP, CISM
> > > University Information Security Officer
> > > Director -- Information Security Office
> > > Yale University, ITS
> > >
> > >
> > > On Dec 16, 2004, at 7:26 AM, Gordon D. Wishon wrote:
> > >
> > >    Is anyone else seeing any evidence of this on their campus?
> Like
>
>
> > >    Boston College, we've been hit with this within the past two
> weeks,
>
>
> > >    and at one point the traffic generated by machines attempting
> to
>
>
> > >    phone home seriously affected our network performance.
> > >
> > >
> > >
> > >    Virus Steals Student Passwords: Boston College's campus
> network
> was
>
>
> > >    hit by a virus that forced computers to guess at passwords
> that
>
>
> > >    would provide access to other linked machines.
> > >    /The Heights/
> > >
> > >
> > >    Curiously, we've found little discussion of this elsewhere.
> > >
> > >    Gordon
> > >
> > >    ********** Participation and subscription information for
> this
>
>
> > >    EDUCAUSE Discussion Group discussion list can be found at
> > >    http://www.educause.edu/groups/.
> --
>
>   ------------------------------------------------------------
>   Gary Dobbins, CISSP -- Director, Information Security
>   University of Notre Dame, Office of Information Technologies
>
> **********
> Participation and subscription information for this EDUCAUSE
> Discussion
> Group discussion list can be found at
> http://www.educause.edu/groups/.
>
> **********
> Participation and subscription information for this EDUCAUSE
> Discussion
> Group discussion list can be found at
> http://www.educause.edu/groups/.
>
> **********
> Participation and subscription information for this EDUCAUSE
> Discussion
> Group discussion list can be found at
> http://www.educause.edu/groups/.
>
> **********
> Participation and subscription information for this EDUCAUSE
> Discussion Group discussion list can be found at
> http://www.educause.edu/groups/.
>
> **********
> Participation and subscription information for this EDUCAUSE Discussion
> Group discussion list can be found at http://www.educause.edu/groups/.
>
> .

--
Ron Watts
Network Operations Security
California State University Bakersfield
9001 Stockdale Highway
Bakersfield, CA 93311
Work: 661-665-6107
Cell: 661-549-7995

Email: RWatts () CSUB EDU

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.