Third party information on conficker
This diary will be updated as more information becomes public. Updates are highlighted in green. Please use the URL: "http://www.dshield.org/conficker" to link to this page.
In an effort to provide YOU the end-user the ability to educate your self on this threat we will be posting as much information as possible, from as many sources as possible. This may lead to redundancies in the data that is fallible but we are hoping that this will allow you to pick and choose the information, removal tool, and more importantly your own path when mitigating Conficker. Be careful about help and removal tools offered from unknown sources.
Our own diaries to the topic can be found here: http://isc.sans.org/tag.html?tag=conficker
ALWAYS TEST IN A DEVELOPMENT OR TEST ENVIRONMENT BEFORE ROLLING OUT TO PRODUCTION!
Canada Calling
A reader wrote in to ask about the uptick in port 5060 activity (visible here: isc.sans.org/port.html?port=5060)
Looking at my own sensors, I saw the traffic yesterday for about an hour as an IP address out of Canada swept through my network with packets destined for UDP/5060. These were SIP requests searching for an open VoIP system.
UDP packets can be spoofed, but this appears to be scanning activity so the attacker is going to expect a reply, so I'm fairly confident that the source IP is legitimate. This activity is likely tied to recent criminal enterprises intent on compromising vulnerable VoIP systems that can be later used to distribute vishing messages or even host vishing sites.
Paraskavedekatriaphobia and something I haven't found a word for
Today is Friday the 13th, and also the day when we reach the symbolic 1234567890th second of Unix time. This will occur at 11:31:30pm UTC on Feb 13, 2009.
A quick note: To see when this time is going to occur in your locatime:
perl -e 'print scalar localtime(1234567890),"\n";'
UPDATE: thinkgeek also informed me that we pass the similarly interesting time of 1234554321 today as well.
We want your logs, obfuscated even.
We always have a banner up on the webpage that says "We want your logs" or "How to submit your logs", however, I want to encourage you to do so.
We love Firewall logs from Cable Modems and Home Users, because they cover more end IP addresses, it allows for more diversity, however, we like to make a call out for large submissions as well. Corporations, small business..etc.. We don't even mind if you obfuscate your logs (there is a feature in the Dshield firewall log submitter to do this!).
We'd like you to automate the logs if you want to, every 6 hours or so, do an automatic submission.
The more logs we get, the more we can correlate, the more visibility we have into the "Bad guys" and the more reactive research we can provide to the public as well.
We at the Internet Storm Center are currently working on a couple projects to be able to not only react to "Bad traffic" (of all kinds!) better, but enable you to be able to interact with the data so you can better protect your networks, and react to threats emerging from your networks as well. To effectively work on this project we need more logs, not only from firewalls, but if you take notice at our "How to submit your logs" page, we want logs from things like Snort, LaBrea, and routers as well. Again, please feel free to obfuscate. We aren't interested in YOUR ip's. We are interested in the IP's attacking, and the ports being attacked.
Currently we process about 10-20 million log entries a day. I'd like to AT LEAST double it. Triple or Quadruple it would be ideal.
Thanks! Please submit your logs! Click here to see how.
But first, please, make sure you are allowed to do so!
-- Joel Esler http://www.joelesler.net
Comments