<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Tagging and Tracking Espionage Botnets</title>
	<atom:link href="http://krebsonsecurity.com/2012/07/tagging-and-tracking-espionage-botnets/feed/" rel="self" type="application/rss+xml" />
	<link>http://krebsonsecurity.com/2012/07/tagging-and-tracking-espionage-botnets/</link>
	<description>In-depth security news and investigation</description>
	<lastBuildDate>Sun, 19 May 2013 06:15:27 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.5.1</generator>
	<item>
		<title>By: bob</title>
		<link>http://krebsonsecurity.com/2012/07/tagging-and-tracking-espionage-botnets/comment-page-1/#comment-94211</link>
		<dc:creator>bob</dc:creator>
		<pubDate>Fri, 03 Aug 2012 11:15:58 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16161#comment-94211</guid>
		<description><![CDATA[You&#039;re going to block dyn.com ?]]></description>
		<content:encoded><![CDATA[<p>You&#8217;re going to block dyn.com ?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Cyber Guy</title>
		<link>http://krebsonsecurity.com/2012/07/tagging-and-tracking-espionage-botnets/comment-page-1/#comment-94068</link>
		<dc:creator>Cyber Guy</dc:creator>
		<pubDate>Thu, 02 Aug 2012 22:19:28 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16161#comment-94068</guid>
		<description><![CDATA[Damballa is using machine learning and big data analysis to look at internet level information about threat operators.  Why are they getting no love?  They&#039;ve been putting computing power to use in profiling cybercriminals for five years already, and have automated systems to track malware chains and family trees.]]></description>
		<content:encoded><![CDATA[<p>Damballa is using machine learning and big data analysis to look at internet level information about threat operators.  Why are they getting no love?  They&#8217;ve been putting computing power to use in profiling cybercriminals for five years already, and have automated systems to track malware chains and family trees.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: JCitizen</title>
		<link>http://krebsonsecurity.com/2012/07/tagging-and-tracking-espionage-botnets/comment-page-1/#comment-93401</link>
		<dc:creator>JCitizen</dc:creator>
		<pubDate>Tue, 31 Jul 2012 18:14:05 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16161#comment-93401</guid>
		<description><![CDATA[Good point Jay! Thanks for posting!]]></description>
		<content:encoded><![CDATA[<p>Good point Jay! Thanks for posting!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Jay Pfoutz</title>
		<link>http://krebsonsecurity.com/2012/07/tagging-and-tracking-espionage-botnets/comment-page-1/#comment-93264</link>
		<dc:creator>Jay Pfoutz</dc:creator>
		<pubDate>Tue, 31 Jul 2012 09:05:07 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16161#comment-93264</guid>
		<description><![CDATA[Emsisoft has proven their loyalty to zero-day threats, that&#039;s for sure.

Also, to note the other misconstrued &quot;cyber-warriors&quot; don&#039;t have a job, but still spot the bugs/exploits faster than the highest paid researcher. Pretty sad, I think! While they&#039;re being paid royalties of $20,000 per bug, the researchers being paid a salary are making less.

I know what I want a job in now. :)]]></description>
		<content:encoded><![CDATA[<p>Emsisoft has proven their loyalty to zero-day threats, that&#8217;s for sure.</p>
<p>Also, to note the other misconstrued &#8220;cyber-warriors&#8221; don&#8217;t have a job, but still spot the bugs/exploits faster than the highest paid researcher. Pretty sad, I think! While they&#8217;re being paid royalties of $20,000 per bug, the researchers being paid a salary are making less.</p>
<p>I know what I want a job in now. <img src='http://krebsonsecurity.com/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Adrian</title>
		<link>http://krebsonsecurity.com/2012/07/tagging-and-tracking-espionage-botnets/comment-page-1/#comment-93253</link>
		<dc:creator>Adrian</dc:creator>
		<pubDate>Tue, 31 Jul 2012 08:13:18 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16161#comment-93253</guid>
		<description><![CDATA[Stewart: It’s a dynamic mix of dynamic DNS and actively registered domains, and it all comes down to the preferences of the groups and what they like to use... have just blocked all dynamic DNS providers within their networks, and in those cases the attackers are forced to go with some kind of hard-coded IPs or registering their own domains.

Is it difficult to block all dynamic DNS providers? How could I do that?  Would an Cisco ASA 5520 be up for the job?

Thanks, very interesting post today]]></description>
		<content:encoded><![CDATA[<p>Stewart: It’s a dynamic mix of dynamic DNS and actively registered domains, and it all comes down to the preferences of the groups and what they like to use&#8230; have just blocked all dynamic DNS providers within their networks, and in those cases the attackers are forced to go with some kind of hard-coded IPs or registering their own domains.</p>
<p>Is it difficult to block all dynamic DNS providers? How could I do that?  Would an Cisco ASA 5520 be up for the job?</p>
<p>Thanks, very interesting post today</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Uzzi</title>
		<link>http://krebsonsecurity.com/2012/07/tagging-and-tracking-espionage-botnets/comment-page-1/#comment-93249</link>
		<dc:creator>Uzzi</dc:creator>
		<pubDate>Tue, 31 Jul 2012 07:47:21 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16161#comment-93249</guid>
		<description><![CDATA[Well, I can&#039;t remember Steve Jobs complain about industrial espionage when Apple outsourced production to china like so many other companies did. But I remember the following news was wildely spread in asia:

&quot;US intelligence spying costs over 80 billion dollars annually […] 53.1 billion dollars covers the CIA and some of the other 16 intelligence agencies, CBS News reports.&quot;
http://www.stinkinglyrich.com/article/334/us-intelligence-spying-costs-over-billion.html

And maybe you remember &quot;U.S. intelligence agencies have pinpointed many of the Chinese groups responsible for cyberspying in the U.S.[…]&quot;
http://online.wsj.com/article/SB10001424052970204336104577094690893528130.html

You can read 04/26/2012 report that &quot;NATO Faced with Rising Flood of Cyberattacks&quot; with most of them apparently originating with intelligence services in Russia and China here:
http://www.spiegel.de/international/world/a-829908.html

So let&#039;s look under the clouds:

April 2012 german SPIEGEL MAGAZIN reported a study that China, former Soviet Republics and the USA are mainly involved in espionage on german companies.
http://www.spiegel.de/wirtschaft/unternehmen/a-829055.html (german)

March 2012 wired.com reported that the NSA builds a &#039;Spy Center&#039; with figurative 170+ Terrabyte of storage for every person on earth:
&quot;The NSA Is Building the Country’s Biggest Spy Center […] Under construction by contractors with top-secret clearances, the blandly named Utah Data Center is being built for the National Security Agency. […] Its purpose: to intercept, decipher, analyze, and store vast swaths of the world’s communications as they zap down from satellites and zip through the underground and undersea cables of international, foreign, and domestic networks. The heavily fortified $2 billion center should be up and running in September 2013. […] the Pentagon is attempting to expand its worldwide communications network, known as the Global Information Grid, to handle yottabytes (1024 bytes) of data. (A yottabyte is a septillion bytes—so large that no one has yet coined a term for the next higher magnitude.)&quot;
http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/all/1

But at last I agree that espionage OF ALL KIND &amp; COUNTRIES including the USA blends back in the white noise of cybercrime and so called hacktivism. And yes, that last group is suffering from unemployment:

&quot;On average across OECD countries, 17.7% of the 20-to-24-year-olds and 8.4% of the 15-to-19-year-olds were neither in school nor at work […] The share of youth who are neither in education nor in employment was twice as high for youths aged 20 to 24 than those aged 15 to 19. […] Differences across countries are large: in Japan, Luxembourg and the Netherlands less than 9% of youth were in this situation. The ratio is substantially higher in Hungary, Ireland, Israel, Italy, Mexico, Spain, the United States and Brazil, where this figure exceeded 20%, and in Turkey, where the share exceeded 40%.&quot; (OECD Factbook 2011-2012, http://dx.doi.org/10.1787/888932505792 (Excel))

Sadly the OECD doesn&#039;t include youth unemployment rates for former soviet republics, most of asia and the rest of the world, but when it comes to numbers there are legions of young people without jobs. Some of them having nothing to do but just their pcs. They say they don&#039;t forget...

At least I laughed about that last sentence in the JapanTimes article Brian linked in the second to last paragraph:

&quot;It is not known if Anonymous is connected to the Trojan horse attack.&quot;

Thanks, Brian!]]></description>
		<content:encoded><![CDATA[<p>Well, I can&#8217;t remember Steve Jobs complain about industrial espionage when Apple outsourced production to china like so many other companies did. But I remember the following news was wildely spread in asia:</p>
<p>&#8220;US intelligence spying costs over 80 billion dollars annually […] 53.1 billion dollars covers the CIA and some of the other 16 intelligence agencies, CBS News reports.&#8221;<br />
<a href="http://www.stinkinglyrich.com/article/334/us-intelligence-spying-costs-over-billion.html" rel="nofollow">http://www.stinkinglyrich.com/article/334/us-intelligence-spying-costs-over-billion.html</a></p>
<p>And maybe you remember &#8220;U.S. intelligence agencies have pinpointed many of the Chinese groups responsible for cyberspying in the U.S.[…]&#8221;<br />
<a href="http://online.wsj.com/article/SB10001424052970204336104577094690893528130.html" rel="nofollow">http://online.wsj.com/article/SB10001424052970204336104577094690893528130.html</a></p>
<p>You can read 04/26/2012 report that &#8220;NATO Faced with Rising Flood of Cyberattacks&#8221; with most of them apparently originating with intelligence services in Russia and China here:<br />
<a href="http://www.spiegel.de/international/world/a-829908.html" rel="nofollow">http://www.spiegel.de/international/world/a-829908.html</a></p>
<p>So let&#8217;s look under the clouds:</p>
<p>April 2012 german SPIEGEL MAGAZIN reported a study that China, former Soviet Republics and the USA are mainly involved in espionage on german companies.<br />
<a href="http://www.spiegel.de/wirtschaft/unternehmen/a-829055.html" rel="nofollow">http://www.spiegel.de/wirtschaft/unternehmen/a-829055.html</a> (german)</p>
<p>March 2012 wired.com reported that the NSA builds a &#8216;Spy Center&#8217; with figurative 170+ Terrabyte of storage for every person on earth:<br />
&#8220;The NSA Is Building the Country’s Biggest Spy Center […] Under construction by contractors with top-secret clearances, the blandly named Utah Data Center is being built for the National Security Agency. […] Its purpose: to intercept, decipher, analyze, and store vast swaths of the world’s communications as they zap down from satellites and zip through the underground and undersea cables of international, foreign, and domestic networks. The heavily fortified $2 billion center should be up and running in September 2013. […] the Pentagon is attempting to expand its worldwide communications network, known as the Global Information Grid, to handle yottabytes (1024 bytes) of data. (A yottabyte is a septillion bytes—so large that no one has yet coined a term for the next higher magnitude.)&#8221;<br />
<a href="http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/all/1" rel="nofollow">http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/all/1</a></p>
<p>But at last I agree that espionage OF ALL KIND &amp; COUNTRIES including the USA blends back in the white noise of cybercrime and so called hacktivism. And yes, that last group is suffering from unemployment:</p>
<p>&#8220;On average across OECD countries, 17.7% of the 20-to-24-year-olds and 8.4% of the 15-to-19-year-olds were neither in school nor at work […] The share of youth who are neither in education nor in employment was twice as high for youths aged 20 to 24 than those aged 15 to 19. […] Differences across countries are large: in Japan, Luxembourg and the Netherlands less than 9% of youth were in this situation. The ratio is substantially higher in Hungary, Ireland, Israel, Italy, Mexico, Spain, the United States and Brazil, where this figure exceeded 20%, and in Turkey, where the share exceeded 40%.&#8221; (OECD Factbook 2011-2012, <a href="http://dx.doi.org/10.1787/888932505792" rel="nofollow">http://dx.doi.org/10.1787/888932505792</a> (Excel))</p>
<p>Sadly the OECD doesn&#8217;t include youth unemployment rates for former soviet republics, most of asia and the rest of the world, but when it comes to numbers there are legions of young people without jobs. Some of them having nothing to do but just their pcs. They say they don&#8217;t forget&#8230;</p>
<p>At least I laughed about that last sentence in the JapanTimes article Brian linked in the second to last paragraph:</p>
<p>&#8220;It is not known if Anonymous is connected to the Trojan horse attack.&#8221;</p>
<p>Thanks, Brian!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: JCitizen</title>
		<link>http://krebsonsecurity.com/2012/07/tagging-and-tracking-espionage-botnets/comment-page-1/#comment-93192</link>
		<dc:creator>JCitizen</dc:creator>
		<pubDate>Tue, 31 Jul 2012 01:59:57 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16161#comment-93192</guid>
		<description><![CDATA[I use a utility that already went head to head with the German government by exposing a surveillance spy that was being disseminated in Europe and elsewhere. I thought is was pretty funny when Emisoft refused to white-list this bot. I think the Austrian company embarrassed the Bundesregierung.

I like their Mamutu product, and the behavioral heuristics seem to be excellent. It found all of my DRM modules within 5 seconds of installation. I had to mark these as un-monitored, so I could enjoy my protected content. Many of the forums I belong to have videos of Emisoft performance and it scores 95% or better on zero day exploits.

Because it only uses behavioral analysis, it needs little updating. Only the exception whitelist and kernel updates are needed to maintain this utility.

I have no financial affiliation to this company - I only promote whatever I see that works the best in the industry. Unfortunately this is one of the few, that isn&#039;t free. I think PCTools Threatfire and Winpatrol have free versions that may work similarly, but Winpatrol hasn&#039;t had the detection ability that Emisoft does. It is also easily manipulated by malware.]]></description>
		<content:encoded><![CDATA[<p>I use a utility that already went head to head with the German government by exposing a surveillance spy that was being disseminated in Europe and elsewhere. I thought is was pretty funny when Emisoft refused to white-list this bot. I think the Austrian company embarrassed the Bundesregierung.</p>
<p>I like their Mamutu product, and the behavioral heuristics seem to be excellent. It found all of my DRM modules within 5 seconds of installation. I had to mark these as un-monitored, so I could enjoy my protected content. Many of the forums I belong to have videos of Emisoft performance and it scores 95% or better on zero day exploits.</p>
<p>Because it only uses behavioral analysis, it needs little updating. Only the exception whitelist and kernel updates are needed to maintain this utility.</p>
<p>I have no financial affiliation to this company &#8211; I only promote whatever I see that works the best in the industry. Unfortunately this is one of the few, that isn&#8217;t free. I think PCTools Threatfire and Winpatrol have free versions that may work similarly, but Winpatrol hasn&#8217;t had the detection ability that Emisoft does. It is also easily manipulated by malware.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Nick P</title>
		<link>http://krebsonsecurity.com/2012/07/tagging-and-tracking-espionage-botnets/comment-page-1/#comment-93124</link>
		<dc:creator>Nick P</dc:creator>
		<pubDate>Mon, 30 Jul 2012 21:23:47 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16161#comment-93124</guid>
		<description><![CDATA[And now we&#039;re back to my old advice of isolating common sources of harm from the main OS. Alternative method, 2nd cheap PC w/ KVM, one of the better security-centric virtualization technologies, software fault isolation, etc.

There are many approaches to solving the problem that all work to varying degrees. What they have in common is they make sure you can&#039;t just visit a web site or open an attachment, then loose everything. They also isolate changes &amp; force manual transfer of important documents, possibly through an inspection system. 

Of course, following the basic security rules helps too.]]></description>
		<content:encoded><![CDATA[<p>And now we&#8217;re back to my old advice of isolating common sources of harm from the main OS. Alternative method, 2nd cheap PC w/ KVM, one of the better security-centric virtualization technologies, software fault isolation, etc.</p>
<p>There are many approaches to solving the problem that all work to varying degrees. What they have in common is they make sure you can&#8217;t just visit a web site or open an attachment, then loose everything. They also isolate changes &amp; force manual transfer of important documents, possibly through an inspection system. </p>
<p>Of course, following the basic security rules helps too.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: bwallHatesTwits</title>
		<link>http://krebsonsecurity.com/2012/07/tagging-and-tracking-espionage-botnets/comment-page-1/#comment-93095</link>
		<dc:creator>bwallHatesTwits</dc:creator>
		<pubDate>Mon, 30 Jul 2012 18:41:04 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16161#comment-93095</guid>
		<description><![CDATA[Also, just in case you wanted to see some of the data we have recovered, it is listed here https://www.firebwall.com/decoding/read.php

Feel free to contact me for anymore information you desire.]]></description>
		<content:encoded><![CDATA[<p>Also, just in case you wanted to see some of the data we have recovered, it is listed here <a href="https://www.firebwall.com/decoding/read.php" rel="nofollow">https://www.firebwall.com/decoding/read.php</a></p>
<p>Feel free to contact me for anymore information you desire.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: bwallHatesTwits</title>
		<link>http://krebsonsecurity.com/2012/07/tagging-and-tracking-espionage-botnets/comment-page-1/#comment-93035</link>
		<dc:creator>bwallHatesTwits</dc:creator>
		<pubDate>Mon, 30 Jul 2012 15:32:53 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16161#comment-93035</guid>
		<description><![CDATA[They aren&#039;t exactly DDoS&#039;ing as much as escalating their scanning attacks.  While the bots do have the capability to DDoS, their primary use is to obtain more bots and send emails from what I&#039;ve seen.]]></description>
		<content:encoded><![CDATA[<p>They aren&#8217;t exactly DDoS&#8217;ing as much as escalating their scanning attacks.  While the bots do have the capability to DDoS, their primary use is to obtain more bots and send emails from what I&#8217;ve seen.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

<!-- Performance optimized by W3 Total Cache. Learn more: http://www.w3-edge.com/wordpress-plugins/

Page Caching using memcached (User agent is rejected)
Database Caching 20/21 queries in 0.003 seconds using memcached
Object Caching 385/399 objects using memcached

 Served from: krebsonsecurity.com @ 2013-05-19 10:44:24 by W3 Total Cache -->