Document Type

Journal Article

Publisher

Teamlink Australia Pty Ltd

Faculty

Computing, Health and Science

School

Computer and Information Science, Centre for Security Research

RAS ID

4998

Comments

This article was originally published as: Valli, C. (2006). A Preliminary Investigation into Malware Propagation on Australian ISP Networks using the mwcollect Malware Collector daemon. Journal of Information Warfare, 5(1), 1-9. Original article available here

Abstract

This paper describes an initial investigation into the propagation of malicious software (malware) that allows for remote command and control of Internet connected machines using the Windows platform in the Australian ISP address space. The research as conducted utilised the mwcollect daemon which is a low interaction honeypot on the Linux platform, to collect the details about the activity. The program mwcollect works by emulation of vulnerable services on the target platform in this case Windows based computers. There were two collectors within the pilot collection system. The machines were running no other Internet services such as http or mail, and were not used by any person - they were simply connected to the Internet. The machines are located on two separate ISP networks and they both utilised high-speed ADSL connections connected to different segments of the Australian ISP network. The malware collected is a variety of known exploits that allow for remote execution of code as well as known and unknown shellcodes that enabled attacks. General results from the initial scoping exercise are given and discussed.

 
COinS