Mac Security FUD Ping!
If you want on or off the Mac Ping List, Freepmail me.
Posted on 12/08/2008 9:47:54 AM PST by Ernest_at_the_Beach
When malware spammers get out of control, what’s the best thing to do?
Call in the US Army, perhaps?
A free malware-detector called BotHunter, sponsored by the US Army Research Office, “works so well that it has even found infected Mac computers, much to the embarrassment of the Mac owners who, of course, swear that their computers cannot be infected with bots,” SC Magazine quotes Marcus Sachs, director at SANS Internet Storm Center, as saying.
And there have been 35,000 downloads so far, the story has Phillip Porras, program director of enterprise and infrastructure security at SRI International, a research and technology organization, and lead developer of the BotHunter project, saying.
“It works so well that it has even found infected Mac computers, much to the embarrassment of the Mac owners who, of course, swear that their computers cannot be infected with bots,” Marcus Sachs, director at SANS Internet Storm Center, told SCMagazineUS.com Tuesday in an email.
BotHunter was funded through a Cyber-Threat Analytics research grant from the US Army Research Office, says SC Magazine, adding:
“It reportedly helps Windows, Mac and Linux users detect malware-infected hosts on their networks by tracking interactions that typically occur when a PC is infected with malware, Porras said. The tool will generate an infection profile with all the forensic evidence that was gathered.
“The infection profile report will then allow users to determine which machines on the network are acting like they are infected. The tool anonymizes infection profiles and passes them back to SRI, where they go into a repository that is used to help generate new threat intelligence.”
About to try it, if I don’t come back....
If you want on or off the Mac Ping List, Freepmail me.
Ping
Thanks for the feedback.....do you have a home network?
[PDF] BotHunter: Detecting Malware Infection Through IDS-Driven Dialog ...
************************
Perhaps to run this.... one has to have a dedicated PC on the network that is to be watched...
It really didn’t seem to do much, run XP, Trend Micro and Spybot.
No network either.
Did it install for you?
Maybe nothing was there, don’t know. Seemed to install easily enough, multiple changes required in Spybot, but that is to be expected when making changes.
Trend seems to do pretty good, but I have run Spybot for years, (Trend came with the computer).
One thing though, I don’t go to very many places I don’t trust. The exception being the grandkids, although they do pretty good job of policing wife. ;)
See #69.
So this is the correct site? Great. Thanks for the information.
My computer’s doing this little, “This object has been blocked.” stuff when I try to go to the mirror sites to download. I’ll try again tomorrow. Thanks for the link.
Found these instructions Here via the linked article.
I haven't set this up yet but it looks as if single PC home use is do'able.
Other network setups are described there as well.
============================================== Here is some advice on answering the network configuration parameters.
1. For Home WinXP Users on a typical Cable, DSL, or modem.
Here is what to do if you are a single PC user attached directly, or via wireless access point, to your Internet provider's cable, DSL, or Modem.
1a. Enter the Network Mask of your Trusted Net
Excellent info....thanks.
Those instructions are what I used to install.
Zone AlarmZone Alarm is more a pain than anything... Comodo FINALLY came out with a Vista64 version. not sure what version you're running, but they should have it: http://www.comodo.com/ (and it's free!)
Yes, I do. Linksys WRT54G wireless router, five XP & one Vista box, and a Palm TX, and two 4-port switches to distribute the network where I want it. Only the laptop and Palm go wireless into the network.
You're welcome for the feedback, and I thank you, as well. I figure if we just sit here and take potshots at each other, nothing gets better. If we help each other out, things do get better, and I think we need a lot of “getting better” in this country.
I've had it running for a little over 24 hours on a span port that's mirrored from the port where our perimeter firewall is plugged in that provids our primary connection to the internet. So far it hasn't found anything. I suppose that's a good thing, but makes for some boring testing. lol I might fire up a VM and do an intentional infection of some kind just to test it(famous last words I know).
I've had it running on a XP box with 2g of RAM, and it seems really stable with only 50megs of RAM used total on Snort and the bot hunter front end. Just for reference, I can fire up Ethereal(Wireshark) while connected to that mirrored port, and it will bring the system to a halt after a few minutes because the machine can't handle the load.
I'll report back when I have more information. I'll give it a run on a Linux machine in the next day or so.
Thanks for letting us know...
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.
