Re: what can be done with botnet C&C's? (fwd)

[Valdis.Kletnieks () vt edu]

On Sun, 13 Aug 2006 08:32:16 EDT, Dude VanWinkle said:
> When I worked at a university, the students were always getting
> compromised till we implemented sandboxing. People DHCP'ing into the
> network were placed in a subnet by themselves till a scan revealed
> that they had:
> 1: up to date AV
> 2: up to date patches
> 3: a Functioning firewall

OK, I'll bite - if you detect a functioning firewall, how do you scan for
up to date patches and A/V?  Seems like you'd have to have at least a stub
client on the machine to answer the "What patchlevel you at?" query.

(And this is the sort of thing that is easy to force install in a corporate
environment where you own the machine.  It's also easy to do if you're a
regular ISP, and you can get away with saying "If you don't like it, go to
another ISP".  It's a can of worms when you don't own the machine, and you're
a de facto monopoly because the student lives in the dorms - a Hobson's
choice "install this or don't get net access" doesn't make you many friends...)

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/