Tag
DDoS
all chapters
- Chapter 1 Someone brought their malware to my house I keep a honeypot in some corner of the network. Most of it is noise: scanners that look and leave. Until one got in, decided it was the administrator, and pushed its critter up through the service door.
- Chapter 3 The botnet that left its code out in the open Another one walks in and drops its critter. But this one left a door open on its own delivery server - and inside was the source code. A multi-architecture Mirai, caught red-handed.
- Chapter 7 The one that came in through the debug cable The previous three went after servers. This one went after a phone: it came in through ADB, wiped out the competition, installed its app disguised as Google, and hid itself. First Android malware in the honeypot.
- Chapter 11 The bot that bragged - and couldn't be bothered A 1,177-byte loader landed: nine lines of wget, one per architecture, in the style I have already opened three times on this blog. I was going to file it as a repeat offender and get on with my day. I opened it anyway, out of habit - and the first thing I saw was that it had a few characters too many.
- Chapter 12 Nikki, you are loved The binary arrived unstripped: its author left inside the names of all six hundred and twenty-eight functions he wrote. It is like being handed a closed book with the index stapled to the cover. Here I read it end to end, function by function, until I reach the one string that fitted nowhere.
- Chapter 16 The tenant who'd been there eleven years A bot walked into my honeypot, stayed 62 seconds and left. I filed it as Gafgyt and I was wrong. A week later I followed its command servers and ended up inside an operation that has been running since 2015 - one I'd had in my hands from day one.
- Chapter 17 Fresh out of the oven A quiet Sunday, my new-binary alarm went off after days of silence. The first thought was the best one there is: something fresh. What followed was a rollercoaster - an old acquaintance, a false positive that nearly fooled me, and finally a critter that wasn't in any public repository, caught less than thirty hours after it was born.
- Chapter 31 One door, three visitors Forty megabytes of binary that won't open: the decompiler takes one look and refuses. Before forcing that door, the boring part that has to come first - who brought them here.
- Chapter 32 It encrypted a broken message too Three lying bytes keep the decompiler out, and behind them there's a second wall: the author's strings aren't in the file at all. By the time I finally got it talking, it had spent a while saying yes to seven orders that don't exist.
- Chapter KHserver