mwserv support in mwcollectd, dionaea and perhaps some other honeypots

For some reasons, the configuration of mwserv in say, dionaea is perhaps among the mysterious question that I could find when I want to know the info.

Few years ago, I registered my honeypot as a "freelance" at Mwcollect Alliance. Here, the maintainer (from Giraffe Honeynet - Germany based honeynet chapter) needs you to contribute back. In my case, I turned on the mwserv config in my honeypot.

In dionaea.conf (or any honeypot that you have, let say, mwcollectd), you need to uncomment mwserv in the ihandlers section:

        ihandlers = {

            handlers = ["ftpdownload", "tftpdownload", "emuprofile", "cmdshell", "store", "uniquedownload",

            "logsql",

            "virustotal",

            "mwserv",

//            "submit_http",

//            "logxmpp",

            "nfq",

//            "p0f",

//            "surfids",

//            "fail2ban"

            ]
        }

Next, once your registration approved in mwcollect alliance, you will be able to create your honeypot sensors.

      mwserv = {                      // ask your mwserv backend provider for needed values

                        url = "https://mwserv.mwcollect.org/"           // the url to send the submission requests to

                        maintainer = ""     // username of the maintainer of this sensor

                        guid = ""               // guid of this sensor, as generated serverside; typically 8 chars

                        secret = ""

        // shared secret used for authentication aka password; typically 48 chars

                }

Perhaps, people hard to find the url for mwserv, so as for last few years, it always been "https://mwserv.mwcollect.org/" .. this couldn't be find anywhere as far as I know, unless you hang out in #nepenthes channel at irc.freenode.net

You can filter the verbose output once your start you dionaea sensor:

dionaea -l all,-debug -L 'mwserv'

Output:

[01032012 08:24:41] mwserv dionaea/mwserv.py:77: mwserv _heartbeat
[01032012 08:24:45] mwserv dionaea/mwserv.py:166: mwserv heartbeatresult: b'OK: 120'
[01032012 08:26:41] mwserv dionaea/mwserv.py:77: mwserv _heartbeat
[01032012 08:26:47] mwserv dionaea/mwserv.py:166: mwserv heartbeatresult: b'OK: 120'
[01032012 08:28:41] mwserv dionaea/mwserv.py:77: mwserv _heartbeat
[01032012 08:28:47] mwserv dionaea/mwserv.py:166: mwserv heartbeatresult: b'OK: 120'
[01032012 08:30:41] mwserv dionaea/mwserv.py:77: mwserv _heartbeat
[01032012 08:30:48] mwserv dionaea/mwserv.py:166: mwserv heartbeatresult: b'OK: 120'
[01032012 08:32:41] mwserv dionaea/mwserv.py:77: mwserv _heartbeat
[01032012 08:32:46] mwserv dionaea/mwserv.py:166: mwserv heartbeatresult: b'OK: 120'
[01032012 08:34:41] mwserv dionaea/mwserv.py:77: mwserv _heartbeat

"Data Mining Tools for Malware Detection" book

I recently bought this fresh, new book on the application of Data Mining for malware detection.

I bought it on-line from UK as it is not available yet in Malaysia. Perhaps you can try the following method to get the book:

Amazon
CRC Press

Paper accepted at UKSIM 2012, Cambridge, UK

My paper was submitted at UKSIM 2012, Cambridge, UK and was accepted
To quote, use to following BibTeX:

@INPROCEEDINGS{Ahma1203:Malware,
AUTHOR="Muhammad Najmi {Ahmad Zabidi}",
TITLE="Malware Analysis with Multiple Features",
BOOKTITLE="UKSim 14th International Conference on Computer Modelling and Simulation,
UKSim2012 (UKSim2012)",
ADDRESS="Cambridge, United Kingdom",
DAYS=28,
MONTH=mar,
YEAR=2012,
KEYWORDS="malware, static analysis, feature selection",
ABSTRACT="Malware analysis process is being categorized into static analysis and
dynamic analysis. Both static and dynamic analysis have their own strengths
and weaknesses. In this paper, we present a tool written in Python
programming language called as pi-ngaji, which could assist the work of
malware analyst to get the static features of malware. pi-ngaji contains
several modules - Application Programming Interface (API) calls extractor,
binary entropy information, anti virtual machine and anti debugger detector
and XOR encrypted strings decryptor. pi-ngaji was developed in order to
assist our work in getting malware features. pi-ngaji is focusing on
ripping Microsoft Windows executable binaries' malicious features."
}

Buku

Ni le bukunya...

Baucer ada baki, top up sikit beli kertas

Sebagai seorang pelajar saya menerima baucer buku 1 malaysia berjumlah rm200 yang saya telah manfaatkan untuk membeli sebuah buku berkaitan penyelidikan saya. Buku tersebut adalah mahal, jadi dengan baucer itu saya hanya memperoleh buku berkenaan sahaja.

Published with Blogger-droid v2.0.4

Virus mengubah DNS

Krebs, seorang jurnalist di dalam bidang keselamatan komputer mengupas sejenis malware yang mengubah alamat DNS - Domain Name System. Malware ini mampu menyah-aktifkan perisian anti virus dan menyebabkan sistem sasaran tidak boleh mengemaskini sistem operasi Microsoft mereka.

Nama malware, DNSChanger

sumber

New published paper - 2011

I presented my paper in 7th IAS 2011 conference in Melaka last December 2011. The paper now already appears in IEEExplore. Get it here

Since I already transfer my copyright to them, you have to get (paid) access to the paper. If your organization subscribe for them, you'll be able to access the paper.

Most universities have access to IEEExplore, should not be a problem.

To cite my paper, use the following BibTex entry

@INPROCEEDINGS{6122799,
author={Zabidi, Muhammad Najmi Ahmad and Maarof, Mohd Aizaini and Zainal, Anazida},
booktitle={Information Assurance and Security (IAS), 2011 7th International Conference on},
title={Ensemble based categorization and adaptive model for malware detection},
year={2011},
month={dec.},
volume={},
number={},
pages={80 -85},
keywords={},
doi={10.1109/ISIAS.2011.6122799},
ISSN={},}

My talks at the recent HITB 2011 Kuala Lumpur

Abstract:

Malware infects a host with exploiting known and unknown vulnerabilities. Among the list of current detections methods, one of them is by using malware signatures in which it is considered fast and works with acceptable computing overhead. The signature generation begins with analysis done by the malware analysts. Since most antiviruses are commercial, least known to the public the method being done for large scale malware signature detection.

One method of detecting malware is by using dynamic analysis, where the behaviour of malware being monitored. The other one is by using static analysis, where it involves the process of diassembling the binary. Here I will share how we can use Python, a powerful interpreted language to do a malicious call analysis.

Drop page: here

Slides: here