Archive for the ‘Security’ Category

Using Linux to Detect Conficker

Wednesday, April 1st, 2009

I’ve got this from LinuxJournal. And to make the story short, install nmap-4.85BETA5 (download here) and run the command with parameters:

nmap -PN -d -p445 –script=smb-check-vulns –script-args=safe=1 [network_range]

where network range is either 192.168.10.1-255 or 192.168.10.0/24

and look for the results containing:

Host script results:
| smb-check-vulns:
| MS08-067: FIXED
| Conficker: Likely INFECTED
|_ regsvc DoS: VULNERABLE

or better yet, use grep to filter INFECTED and VULNERABLE

Conficker on April Fools’ Day

Tuesday, March 31st, 2009

I was surprised when I first read the news days ago and thought that it’s like a marketing stint from the developers/owners of Conficker (Downadup).

And to choose a release date that can cause confusion for some, is not funny. Really.

There are articles from Microsoft, Symantec, Dell and others stating that everyone has to be vigilant and ready for this new string of Conficker. Although some mentioned that its target are Windows XP and Vista, we can never tell.

Like always, there are preventive measures.

1. Update all security patches and AV definitions.
2. Be careful with what you do on the net.
3. Security, Firewall, Protection.

So now, let’s see what happens next. There’s nothing wrong with being ready for it rather getting caught unaware. Ayt!