More UDP Activity
Martin I. wrote in a bit ago in response to the diaries from Saturday and Sunday. Martin has noticed an increase in UDP traffic from various sources on the aforementioned ports. We are really wanting to see some full packet captures, so if anybody has the means and opportunity, we'd greatly appreciate it.
new rogue-DHCP server malware
Thanks to Irwin for alerting us about a new version of rogue DHCP server malware he found in his network. The malware appears to be similar to Trojan.Flush.M which was found last December. Like back then, after infecting its target, the malware installs a rogue DHCP server. The main goal of the DHCP server is to spread a bad DNS server IP address.
Irwin did a good job comparing the two versions. Here is his summary of the differences:
- The new version sets the DHCP lease time to 1 hour.
- it sets the MAC destination to thebroadcast address, rather then the MAC address of the DHCP client
- it does not specify a DNS Domain Name.
- the options field does not contain an END option followed by PAD options.
- Unlike Trojan.Flush.M, the BootP Broadcast Bit is set.
The malicious DNS server is 64.86.133.51 and 63.243.173.162.
Recommendation:
monitor connections to DNS servers other then the approved one pushed out by your DHCP server. This should help you spot this kind of malware. Yes, you can block the two IP addresses listed above, but it will likely do little good.
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Comments
www
Nov 17th 2022
6 months ago
EEW
Nov 17th 2022
6 months ago
qwq
Nov 17th 2022
6 months ago
mashood
Nov 17th 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
5 months ago
isc.sans.edu
Dec 3rd 2022
5 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
isc.sans.edu
Dec 26th 2022
5 months ago
isc.sans.edu
Dec 26th 2022
5 months ago