Document Type
Journal Article
Publisher
Teamlink Australia Pty Ltd
Faculty
Faculty of Computing, Health and Science
School
School of Computer and Information Science / Centre for Security Research
RAS ID
4998
Abstract
This paper describes an initial investigation into the propagation of malicious software (malware) that allows for remote command and control of Internet connected machines using the Windows platform in the Australian ISP address space. The research as conducted utilised the mwcollect daemon which is a low interaction honeypot on the Linux platform, to collect the details about the activity. The program mwcollect works by emulation of vulnerable services on the target platform in this case Windows based computers. There were two collectors within the pilot collection system. The machines were running no other Internet services such as http or mail, and were not used by any person - they were simply connected to the Internet. The machines are located on two separate ISP networks and they both utilised high-speed ADSL connections connected to different segments of the Australian ISP network. The malware collected is a variety of known exploits that allow for remote execution of code as well as known and unknown shellcodes that enabled attacks. General results from the initial scoping exercise are given and discussed.
Access Rights
free_to_read
Comments
This is an Author's Accepted Manuscript of: Valli, C. (2006). A Preliminary Investigation into Malware Propagation on Australian ISP Networks using the mwcollect Malware Collector daemon. Journal of Information Warfare, 5(1), 1-9. Available here