Comments on: Talking Bots with Japan’s ‘Cyber Clean Center’ http://krebsonsecurity.com/2010/03/talking-bots-with-japans-cyber-clean-center/ In-depth security news and investigation Wed, 23 May 2012 21:31:36 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Medidas judiciales contra las Botnets | Carlos A. Castillo L. http://krebsonsecurity.com/2010/03/talking-bots-with-japans-cyber-clean-center/comment-page-1/#comment-3125 Medidas judiciales contra las Botnets | Carlos A. Castillo L. Thu, 04 Mar 2010 04:49:52 +0000 http://www.krebsonsecurity.com/?p=896#comment-3125 [...] se encuentra una de las medidas más efectivas contra el malware y el crimeware a nivel mundial. Un ejemplo de la implementación exitosa de este control se encuentra en Japón con el funcionamiento del [...] [...] se encuentra una de las medidas más efectivas contra el malware y el crimeware a nivel mundial. Un ejemplo de la implementación exitosa de este control se encuentra en Japón con el funcionamiento del [...]

Like or Dislike: Thumb up 0 Thumb down 0
]]> By: Security Briefing – March 2nd : Liquidmatrix Security Digest http://krebsonsecurity.com/2010/03/talking-bots-with-japans-cyber-clean-center/comment-page-1/#comment-3062 Security Briefing – March 2nd : Liquidmatrix Security Digest Tue, 02 Mar 2010 16:44:43 +0000 http://www.krebsonsecurity.com/?p=896#comment-3062 [...] Talking Bots with Japan’s ‘Cyber Clean Center’ – Krebs on Security [...] [...] Talking Bots with Japan’s ‘Cyber Clean Center’ – Krebs on Security [...]

Like or Dislike: Thumb up 0 Thumb down 0
]]> By: jbmoore61 http://krebsonsecurity.com/2010/03/talking-bots-with-japans-cyber-clean-center/comment-page-1/#comment-3058 jbmoore61 Tue, 02 Mar 2010 16:04:45 +0000 http://www.krebsonsecurity.com/?p=896#comment-3058 Illicit traffic is difficult to monitor? IDS will show you the source and destination of a session. If Latvia, Ukraine, or Russia is talking to one of your customers via IRC or web and it's not a legitimate IRC or web server, what do you think is the obvious answer? Plus, the bot will have very brief sessions on the order of less than a minute whereas humans will chat or surf for minutes or hours on IRC or the web. Due to PCI signatures, I'm sure the IDS will fire when a bot sends out credit information overseas in the clear. Most customers credit card traffic would be encrypted via HTTPS. This is not rocket science here and detection is not difficult unless your IT Security staff is either understaffed or incompetent and they deployed their sensors incorrectly. Illicit traffic is difficult to monitor? IDS will show you the source and destination of a session. If Latvia, Ukraine, or Russia is talking to one of your customers via IRC or web and it’s not a legitimate IRC or web server, what do you think is the obvious answer? Plus, the bot will have very brief sessions on the order of less than a minute whereas humans will chat or surf for minutes or hours on IRC or the web. Due to PCI signatures, I’m sure the IDS will fire when a bot sends out credit information overseas in the clear. Most customers credit card traffic would be encrypted via HTTPS. This is not rocket science here and detection is not difficult unless your IT Security staff is either understaffed or incompetent and they deployed their sensors incorrectly.

Like or Dislike: Thumb up 2 Thumb down 1
]]> By: jbmoore61 http://krebsonsecurity.com/2010/03/talking-bots-with-japans-cyber-clean-center/comment-page-1/#comment-3057 jbmoore61 Tue, 02 Mar 2010 15:55:27 +0000 http://www.krebsonsecurity.com/?p=896#comment-3057 The bots don't usually modify DNS so much as add an entry into /etc/hosts on Windows systems. AV products do the same thing by adding 127.0.0.1 entires to redirect the browser through the AV proxy the customer installed. H Security has an article about Cox Communications using DNS redirection to clean bots: http://www.h-online.com/security/news/item/ISP-uses-DNS-to-redirect-from-IRC-to-bot-cleaner-733318.html (from 2007). It's 2010 and I haven't heard of any other ISP doing it, but I've seen Verizon and OpenDNS redirect me to ads. The bots don’t usually modify DNS so much as add an entry into /etc/hosts on Windows systems. AV products do the same thing by adding 127.0.0.1 entires to redirect the browser through the AV proxy the customer installed. H Security has an article about Cox Communications using DNS redirection to clean bots: http://www.h-online.com/security/news/item/ISP-uses-DNS-to-redirect-from-IRC-to-bot-cleaner-733318.html (from 2007). It’s 2010 and I haven’t heard of any other ISP doing it, but I’ve seen Verizon and OpenDNS redirect me to ads.

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: BuddhaChu http://krebsonsecurity.com/2010/03/talking-bots-with-japans-cyber-clean-center/comment-page-1/#comment-3046 BuddhaChu Tue, 02 Mar 2010 08:18:06 +0000 http://www.krebsonsecurity.com/?p=896#comment-3046 Microsoft bashing goes over like a fart in church. This "Rick" sounds a lot like Richard Stallman. RMS, is that you?

Microsoft bashing goes over like a fart in church.

This “Rick” sounds a lot like Richard Stallman. RMS, is that you?

Hot debate. What do you think? Thumb up 5 Thumb down 5
]]> By: BuddhaChu http://krebsonsecurity.com/2010/03/talking-bots-with-japans-cyber-clean-center/comment-page-1/#comment-3045 BuddhaChu Tue, 02 Mar 2010 08:13:40 +0000 http://www.krebsonsecurity.com/?p=896#comment-3045 With automated billing, who actually opens the snail mail statements? With automated billing, who actually opens the snail mail statements?

Like or Dislike: Thumb up 2 Thumb down 2
]]> By: Sniper http://krebsonsecurity.com/2010/03/talking-bots-with-japans-cyber-clean-center/comment-page-1/#comment-3044 Sniper Tue, 02 Mar 2010 07:53:41 +0000 http://www.krebsonsecurity.com/?p=896#comment-3044 good for the japanese at least its seems they got their act together not unlike the americans with wide-open holes such as those of NASA.gov all listed at pinoysecurity. i mean if we cant protect the most valuable govt servers, what chance have we got as ordinary end-users? good for the japanese at least its seems they got their act together not unlike the americans with wide-open holes such as those of NASA.gov all listed at pinoysecurity.

i mean if we cant protect the most valuable govt servers, what chance have we got as ordinary end-users?

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: Rick http://krebsonsecurity.com/2010/03/talking-bots-with-japans-cyber-clean-center/comment-page-1/#comment-3034 Rick Tue, 02 Mar 2010 01:07:56 +0000 http://www.krebsonsecurity.com/?p=896#comment-3034 Great article. But one wants to cry for an Internet that's never had a chance. All this time and expense - all because an individual in the northwest of the americas refuses to release a secure operating system. It's criminal. Hidden due to low comment rating. Click here to see.

Poorly-rated. Like or Dislike: Thumb up 4 Thumb down 11
]]> By: prairie_sailor http://krebsonsecurity.com/2010/03/talking-bots-with-japans-cyber-clean-center/comment-page-1/#comment-3033 prairie_sailor Tue, 02 Mar 2010 00:41:12 +0000 http://www.krebsonsecurity.com/?p=896#comment-3033 I used to work support for Qwest - at that time (about 6 years ago) if a customer was infected and appeared to be ignoring notices we would shut off their account utill they cleaned up. An alert in the customer trouble ticket database would tell support about it. I have no idea if their policy is the same now.

I used to work support for Qwest – at that time (about 6 years ago) if a customer was infected and appeared to be ignoring notices we would shut off their account utill they cleaned up. An alert in the customer trouble ticket database would tell support about it. I have no idea if their policy is the same now.

Well-loved. Like or Dislike: Thumb up 5 Thumb down 1
]]> By: KFritz http://krebsonsecurity.com/2010/03/talking-bots-with-japans-cyber-clean-center/comment-page-1/#comment-3031 KFritz Mon, 01 Mar 2010 23:56:20 +0000 http://www.krebsonsecurity.com/?p=896#comment-3031 Are there any stats on response percentage comparison. IE comparing response rates by notified Japanese customers to response rates to Americans who are notified by their ISP? Are there any stats on response percentage comparison.
IE comparing response rates by notified Japanese customers to response rates to Americans who are notified by their ISP?

Like or Dislike: Thumb up 1 Thumb down 0
]]>