Re: [Full-disclosure] SSH scans, i caught one

[Robin <robin@xxxxxxxxx>]

MIPS is very common in routers - most home ones I've seen are MIPS. As
for purpose, it's a good place to DDoS from, because it's very hard to
detect. It's also a very nice place to sniff passwords from, as you get
a whole network's traffic passing through, and it's extremely hard to
detect.

~Robin
> On 11/19/2010 09:11 PM, OrderZero wrote:
>   
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Looks like the syslgd is your average botnet, simply connects to an
>> irc for cnc, from strings...
>>
>> WHO@^NICKªH^@c^_ì{JOIN^_:^ONULL^GOþÿ>^f3µT%9:unable to
>> resolveÛ?`Ã;#spoofs:
>>
>> where #spoofs could be the channel, no cleartext server however
>> (other than a conspicuous string "nubnet")..a disassembly of said
>> syslgd is attached...
>>     
> Nice one. I assumed the syslgd was for overwriting syslogd to hide its 
> tracks but it doesn't look like that indeed. Like many people already
> thought, this is starting to look like a mips-router-hacking-irc-botnet.
> Leaves me with two questions. Why MIPS? And whats the purpose. I think 
> DDOS, but who knows...
>
> Grtz,
> Marco van Berkum
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/