Comments on: Alleged Mariposa Botnet Author Nabbed http://krebsonsecurity.com/2010/07/alleged-mariposa-botnet-author-nabbed/ In-depth security news and investigation Sat, 11 Feb 2012 19:29:31 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Mike http://krebsonsecurity.com/2010/07/alleged-mariposa-botnet-author-nabbed/comment-page-1/#comment-7892 Mike Mon, 02 Aug 2010 16:45:12 +0000 http://krebsonsecurity.com/?p=4236#comment-7892 Is this something DNSSEC would have stopped? Is this something DNSSEC would have stopped?

Like or Dislike: Thumb up 0 Thumb down 2
]]> By: greg http://krebsonsecurity.com/2010/07/alleged-mariposa-botnet-author-nabbed/comment-page-1/#comment-7876 greg Sun, 01 Aug 2010 23:47:00 +0000 http://krebsonsecurity.com/?p=4236#comment-7876 Hi Brian I think in most cases the admins are setting their firewalls as you said, wide open to UDP/53. But they could restrict it a bit more, in such a way that the web access will still work while the bot communication would not. A local client will make the DNS request to its primary or secondary DNS and if this does not have the answer, will fetch it from a higher level DNS. If the firewall rules will specify the company DNS servers IP addresses as the only ones who can receive UDP/53 traffic (DNS requests from clients), and the only ones who can make requests and receive responses to/from DNS server outside local domain, the bot traffic would be hindered (I hope). Are my assumptions correct ? Hi Brian
I think in most cases the admins are setting their firewalls as you said, wide open to UDP/53. But they could restrict it a bit more, in such a way that the web access will still work while the bot communication would not. A local client will make the DNS request to its primary or secondary DNS and if this does not have the answer, will fetch it from a higher level DNS. If the firewall rules will specify the company DNS servers IP addresses as the only ones who can receive UDP/53 traffic (DNS requests from clients), and the only ones who can make requests and receive responses to/from DNS server outside local domain, the bot traffic would be hindered (I hope). Are my assumptions correct ?

Like or Dislike: Thumb up 3 Thumb down 1
]]> By: george http://krebsonsecurity.com/2010/07/alleged-mariposa-botnet-author-nabbed/comment-page-1/#comment-7875 george Sun, 01 Aug 2010 23:34:10 +0000 http://krebsonsecurity.com/?p=4236#comment-7875 I'm not a specialist I’m not a specialist

Like or Dislike: Thumb up 0 Thumb down 3
]]> By: LC http://krebsonsecurity.com/2010/07/alleged-mariposa-botnet-author-nabbed/comment-page-1/#comment-7859 LC Sat, 31 Jul 2010 23:31:23 +0000 http://krebsonsecurity.com/?p=4236#comment-7859 You are right. Brian was not first to post the name, but he was first to name Janžekovič as Isredo. In Globus, he was named - "not as the leader of the group, but as the smartest". Story in the paper edition is much longer and contains fictional and romanced description of events, all related to the details certainly not available to the press (including, but not limited to, dialogues between hackers, hackers naming the net as Mariposa and one of three Spanish hackers being a seductive female - hope Brian will post her swimsuit photos :-) All is spiced with a lot of inaccurate information, mistakes and misunderstanding of the whole case. The saddest point is that it seems Globus journalists really paid a visit to Maribor and still were unable to make contact and talk to the suspects. You are right. Brian was not first to post the name, but he was first to name Janžekovič as Isredo. In Globus, he was named – “not as the leader of the group, but as the smartest”.

Story in the paper edition is much longer and contains fictional and romanced description of events, all related to the details certainly not available to the press (including, but not limited to, dialogues between hackers, hackers naming the net as Mariposa and one of three Spanish hackers being a seductive female – hope Brian will post her swimsuit photos :-)

All is spiced with a lot of inaccurate information, mistakes and misunderstanding of the whole case.

The saddest point is that it seems Globus journalists really paid a visit to Maribor and still were unable to make contact and talk to the suspects.

Like or Dislike: Thumb up 0 Thumb down 0
]]> By: abcd http://krebsonsecurity.com/2010/07/alleged-mariposa-botnet-author-nabbed/comment-page-1/#comment-7858 abcd Sat, 31 Jul 2010 22:57:43 +0000 http://krebsonsecurity.com/?p=4236#comment-7858 oh yeah ... and the globus photo ... they got it wrong ... Dejan is not on that photo ... i know both persons that that are on that photo. oh yeah … and the globus photo … they got it wrong … Dejan is not on that photo … i know both persons that that are on that photo.

Like or Dislike: Thumb up 1 Thumb down 2
]]> By: abcd http://krebsonsecurity.com/2010/07/alleged-mariposa-botnet-author-nabbed/comment-page-1/#comment-7857 abcd Sat, 31 Jul 2010 22:44:25 +0000 http://krebsonsecurity.com/?p=4236#comment-7857 Globus only wrote that he is one of the suspect and that his name is the only name that is known to public -they didn't write that he was Iserdo. Globus only wrote that he is one of the suspect and that his name is the only name that is known to public -they didn’t write that he was Iserdo.

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: reader http://krebsonsecurity.com/2010/07/alleged-mariposa-botnet-author-nabbed/comment-page-1/#comment-7854 reader Sat, 31 Jul 2010 21:09:49 +0000 http://krebsonsecurity.com/?p=4236#comment-7854 The new name published in the media is 24 year old Matjaž Škorjanc - [copper]. http://translate.google.com/translate?js=y&prev=_t&hl=sl&ie=UTF-8&layout=1&eotf=1&u=http%3A%2F%2Fwww.dnevnik.si%2Fnovice%2Faktualne_zgodbe%2F1042377592&sl=sl&tl=en The new name published in the media is 24 year old Matjaž Škorjanc – [copper].

http://translate.google.com/translate?js=y&prev=_t&hl=sl&ie=UTF-8&layout=1&eotf=1&u=http%3A%2F%2Fwww.dnevnik.si%2Fnovice%2Faktualne_zgodbe%2F1042377592&sl=sl&tl=en

Like or Dislike: Thumb up 2 Thumb down 1
]]> By: janez http://krebsonsecurity.com/2010/07/alleged-mariposa-botnet-author-nabbed/comment-page-1/#comment-7853 janez Sat, 31 Jul 2010 20:19:10 +0000 http://krebsonsecurity.com/?p=4236#comment-7853 Dear Brian, you should be aware that you are quoting a press article from a newspaper which is considered as yellow press here in Slovenia (it is a daily newspaper that regularly reports about people meeting aliens and such extraordinary bullshit news). Well the more spectacular the article the better, all in the name of good ratings... The serious press here is just now beginning to mention someone else as being Iserdo, and even now only by his initials (everybody is presumed innocent until convicted in the court of law). So I hope Dejan will get a good lawyer and will be able to cash in some money out of this situation because ruining an innocent person's life should not remain unpunished.

Dear Brian, you should be aware that you are quoting a press article from a newspaper which is considered as yellow press here in Slovenia (it is a daily newspaper that regularly reports about people meeting aliens and such extraordinary bullshit news). Well the more spectacular the article the better, all in the name of good ratings… The serious press here is just now beginning to mention someone else as being Iserdo, and even now only by his initials (everybody is presumed innocent until convicted in the court of law).

So I hope Dejan will get a good lawyer and will be able to cash in some money out of this situation because ruining an innocent person’s life should not remain unpunished.

Well-loved. Like or Dislike: Thumb up 11 Thumb down 3
]]> By: LC http://krebsonsecurity.com/2010/07/alleged-mariposa-botnet-author-nabbed/comment-page-1/#comment-7849 LC Sat, 31 Jul 2010 10:40:02 +0000 http://krebsonsecurity.com/?p=4236#comment-7849 To be frank, Brian was not first to name Dejan Janžekovič as Isredo. Croatian magazine Globus did that a day before Brian: http://globus.jutarnji.hr/svijet/potraga-za-hakerima-koji-su-zarazili-sad?sid=213ac9f2fc7206cab49940deb9b2be75 Also, police news conference yesterday did not shed much light on the case. To be frank, Brian was not first to name Dejan Janžekovič as Isredo.

Croatian magazine Globus did that a day before Brian:
http://globus.jutarnji.hr/svijet/potraga-za-hakerima-koji-su-zarazili-sad?sid=213ac9f2fc7206cab49940deb9b2be75

Also, police news conference yesterday did not shed much light on the case.

Like or Dislike: Thumb up 1 Thumb down 1
]]> By: abcd http://krebsonsecurity.com/2010/07/alleged-mariposa-botnet-author-nabbed/comment-page-1/#comment-7848 abcd Sat, 31 Jul 2010 08:46:33 +0000 http://krebsonsecurity.com/?p=4236#comment-7848 media came up with another person suspected of being Iserdo: http://www.vecer.com/clanekslo2010073005562810 PS: Great job Brian - giving out Dejan's name as Iserdo, not as just as a suspect, like other media did. media came up with another person suspected of being Iserdo:

http://www.vecer.com/clanekslo2010073005562810

PS: Great job Brian – giving out Dejan’s name as Iserdo, not as just as a suspect, like other media did.

Like or Dislike: Thumb up 3 Thumb down 0
]]>