4 ms·
FTA: "By analysing the logs from the command servers, we have observed 59 unique victims in 23 countries." How does a random IT security company get logs from
by Scramblejams 14y ago
FTA: "By analysing the logs from the command servers, we have observed 59 unique victims in 23 countries."
How does a random IT security company get logs from the command servers, especially if they're located in Panama and Turkey, where receiving quick cooperation from law enforcement is presumably difficult?
- showerst 14y agoLooks like they left the connection logs on a public folder on one of the web command/control servers. From the PDF - The C2s maintain a detailed, encoded log of the victims connecting to the servers. The logs are available to anyone who knows the exact filename. By collecting the logs from all the known command servers, we’ve discovered connections from several high profile networks belonging to ...
- revelation 14y agoWell, the command server also had directory listing enabled. The bad people just didn't bother with properly configuring their (hacked?) box.
- ChuckMcM 14y agoUnclear that it was a mistake. Clearly the FBI or whomever would suponea records of every machine that accessed those logs, by letting this 'leak' and having lots of people then access the logs, which then gives the actual bad guys a way to access them with plausible denieability. Like kidnapping, malware has the problem with externally visibile trails that you can't hide and still pull it off. The story about the stuxnet C&C servers being setup as an advertising service was clearly to throw off suspicions about random outcalls to those servers.