Library items tagged:

Protecting yourself from Conficker

Anonymous
Monday, February 13, 2012 - 20:14
CSIRT
conficker
incident response
malware
protection
security
The Conficker worm (also known as Downup, Downadup and Kido) is probably the most prevalent computer worm on Janet and the Internet at this time. It’s success can be attributed to it’s use of a number of different vectors it uses to infect machines:
Read more

Zeus/Zbot

Anonymous
Monday, February 13, 2012 - 20:12
security
incident response
CSIRT
advice
malware
Zeus
Zbot
Zeus is the name for a family, or perhaps ecosystem of malware that is created and customised using a single toolkit. Not only does the toolkit generate the executable that infects systems, but it also produces server files that act as the command and control infrastructure for the operator’s botnet. Primarily Zeus is used to steal banking details through the use of keystroke logging and screen captures that are sent from the infected system to the command and control sever.
Read more

The Carberp Information Stealing Trojan

Anonymous
Monday, February 13, 2012 - 20:12
security
incident response
CSIRT
malware
Carberp
Carberp is the name of the latest in an increasing line-up of information stealing malware that have evolved in the last few years. As in the case of it’s forerunners (Torpig/Mebroot,Clampi, ZeuS and SpyEye) the most recognised role of Carberp is to steal users e-commerce payment transaction data (e-banking, Paypal, debit/credit card etc.), although any sensitive data is at risk (personal identity or research data for example).
Read more

Conficker

Anonymous
Monday, February 13, 2012 - 20:12
CSIRT
conficker
incident response
malware
security
Janet CSIRT routinely processes netflow data to detect signs of Conficker infections on Janet.
Read more

Spam bounces considered harmful

Anonymous
Monday, February 13, 2012 - 20:10
CSIRT
advice
incident response
security
spam
Rodney Tillotson The expectation that e-mail services will return a failure notice or report for messages that cannot be delivered is no longer realistic. In most cases Janet-connected organisations should not attempt to provide such notifications.
Read more

Penetration testing

Anonymous
Monday, February 13, 2012 - 20:09
security
incident response
CSIRT
advice
penetration testing
testing
factsheet
PB/INFO/082 (11/04) Many organisations are looking to have some form of penetration testing performed on their systems. This may simply be to evaluate existing security measures and to find gaps where security needs improvement, but increasingly it is performed to comply with security standards when connecting to public sector networks or processing payment details.
Read more

Janet CSIRT use of NetFlow data

Anonymous
Monday, February 13, 2012 - 20:09
CSIRT
NetFlow
advice
data
incident response
security
usage
Janet processes netflow data collected on various routers within the Janet network. This netflow data is used in planning, network operations, research and security incident response, and is considered necessary to effectively complete some of the tasks involved in these areas.
Read more

Investigating SSH port scans

Anonymous
Monday, February 13, 2012 - 20:09
CSIRT
SSH port scans
advice
incident response
scanning
security
This page provides a brief overview on how to deal with reported SSH scans originating from your own systems. It does not cover SSH scanning targeted at your systems and originating elsewhere.
Read more

DNS Resolver configuration

Anonymous
Monday, February 13, 2012 - 20:08
CSIRT
DNS resolver
advice
configuration
incident response
security
Background There is a great deal of literature about the operation of authoritative nameservers, but not so much about the resolver function.This note is for system and network managers or administrators in Janet organisations (particularly smaller organisations with relatively simple networks) and is intended to give them confidence that they have correctly configured this straighforward but critical part of the DNS in their own networks.
Read more

Technical advice

Anonymous
Monday, February 13, 2012 - 20:07
Read more