Friday, April 11, 2003

Alright! Alireza Doostdar is blogging the Iranian weblogs, in English. I met Ali at yesterday's ABCD meeting, he's a master's student at Harvard's school of education. [Scripting News] 7:57:25 PM    comment []

The Hong Kong Tourism Board probably began this campaign before SARS. (thanks, The Smoking Gun! 12:57:27 PM    comment []

xian: Dave Taylor on Tim's presentation. Dave Taylor was sitting at the back of the room during Tim's talk and has posted his observations on it at his blog. He thinks that Tim is understating the risks involved in studying and publishing about bleeding-edge technologies, given the adoption cycles involved in mainstreaming new tech and the small proportion of visionary ideas that really end up changing the world. [Radio Free Blogistan] 6:59:15 AM    comment []

Honeynet.org announces Scan 27: This month's challenge is a Windows challenge suitable for both beginning and intermediate analysts. If you rate your skill level as beginning, you can submit answers to only the beginning questions. If you rate your skill level as intermediate, you can submit answers to both the beginning and intermediate questions. In either case, your objective is to analyze the aftermath of an attack on a Windows 2000 honeypot, captured by members of the Azusa Pacific University Honeynet Project. Remember, the purpose of the challenge is to learn. All submissions are due no later then 24:00 GMT, Friday, April 25, 2003. Results will be released Friday, May 2, 2003. Skill Level: Beginner-Intermediate The Challenge: In early March 2003, the Azusa Pacific University Honeynet Project deployed an unpatched Windows 2000 honeypot having a null (blank) administrative password. During its first week of operation, the honeypot was repeatedly compromised by attackers and worms exploiting several distinct vulnerabilities. Subsequent to a succesful attack, the honeypot was joined to a large botnet. During operation of the honeypot, a total of 15,164 distinct hosts were seen entering the botnet. The challenge is based on logs from five days of honeypot operation, collected using Snort. The logs have been edited to remove irrelevant traffic and combined into a single file. Also, IP addresses and certain other information have been obfuscated so that the identity of the honeynet is not readily apparent. Your mission is to analyze the log file in order to answer the questions below. Be sure you review the submission rules at the SotM challenge page before submitting your results. 3:55:51 AM    comment []