Honeynet Project

Yep, but it's a lot of work. There at least a few researchers that keep track of bot activity, reverse samples, monitor via wire-compatible clients, etc. From what I gather it's getting harder, some newer worms use decentralized control channels, signed updates, etc. One way to observe worm behavior: http://www.honeynet.org/ SRI writeup on their dissection of Storm: http://www.cyber-ta.org/pubs/StormWorm/report/

http://www.honeynet.org/ http://www.honeyd.org/

I think you're talking about something like Kippo: https://www.honeynet.org/projects/old/kippo/

"In all, the attackers have compromised about 10,500 databases. Promises to restore the databases in return for a ransom payment are dubious, since there's no evidence the attackers copied the data before deleting it." Setting up a mongodb honeypot [0] would make for an interesting study for security researchers. [0] something similar to honeynet ~ https://honeynet.org/about

The article itself was blogjacked from its original source: http://www.megapanzer.com/2009/04/15/the-inner-structure-of-a-trojan-h… edw519, please link to the uncredited, working original source please. [Edit: People interested in this might also like the Honeypot Project's take on Conficker. http://www.honeynet.org/papers/conficker/ Or SRI's take on the same: http://mtc.sri.com/Conficker/ and to get your feet and hands into the pond: http://blog.fortinet.com/the-art-of-unpacking-conficker-worm/ ]

Run a honeypot in a VM for a few weeks. https://www.honeynet.org/projects/ You leave a small enticing ssh listener which is actually a Python or similar daemon process that fakes its output and logs usernames and password attempts. Obviously that thing is on its own DMZ with no outbound access. You can harvest the latest crop of usernames and passwords that the baddies are using with a little bit of effort, but not much! You can also slow them down a bit with a sprinkle of tarpitting. Take that list and use it as a password blacklist for your own systems. You might allow the list to decay by say six months after the last sighting to avoid it getting too big. Actually you could allow decay with a normally distributed six month spread, centred over one year to avoid predictability. That may be going too far - once a password is on the list, I suggest you keep it. Usernames that are not simply given names is a very good idea. Service accounts should not be able to login interactively if they don't need it (set your RDP groups up properly, PLEASE!) Give service accounts odd names and sha1sum style passwords. Administrator, Administrateur, Administrador etc should not be able to login at all to anything and nor should root. Those four names come up in my logs so often, it isn't funny. If you've got an account called sql or ldap or mail or similar, then get rid of it. Please.

I am a convicted malware coder (Agobot/Gaobot/Phatbot/etc...) and it all started because of a chat I had with a botmaster. Back then I needed a key for Warcraft III, which just came out, so I tried some keygen I found on the net, without any antivirus. When the keygen did not work I knew something was wrong, so I checked for suspicious network traffic and saw some IRC connection, quickly found the process responsible for causing the traffic and fired up a disassembler. After UPX unpacking I had the assembler code to the program and was able to determine the IRC server, the bot password (they didn't use password hashes or hostmasks back then) and I got a command reference for the specific bot (SDBOT). I joined the channel disguised as one of the bots, logged in and sent the remove command. This kills the botnet. The bot herder was pissed, but I started talking to him and I got interested in malware to get CD keys, which I couldn't afford at the time. I started modifying SDBOT for my usage, writing scanners and fixing bugs in the IRC connection code. After I while I felt limited by the codebase and started my own called Agobot. Agobot quickly grew into one of the most capable trojans at the time, with thousands of variants. I also quickly got a team of at peak ~15 people together who helped with testing and coding. Coding was mostly done by me and at most 3 other coders. We were having really cool stuff, like wormride which was a tool to make other malware/worms spread…