April 2010

Advanced Persistent Threat Hydraq

Is a targeted attack that is also currently referred to as Aurora, Google Attacks, and the Microsoft IE Vulnerability. Through the exploitation of a vulnerability, it attempts to install a trojan on a specific computer that steals information from that machine. The trojan attempts to make contact with command and control servers in order to receive instructions and to upload any information that it may have collected. This type of attack is often called an advanced persistent threat because of the sophistication and persistence of the attack within a business.This attack is of concern to all computer users because vulnerabilities used in this attack are now widely known and likely to be exploited by other cybercriminals.
 

In recent years, wireless networking has become more available, affordable, and easy to use. Home users are adopting wireless technology in great numbers.
On-the-go laptop users often find free wireless connections in places like coffee shops and airports.If you’re using wireless technology, or considering making the move to wireless, you should know about the security threats you may encounter.

Home Wireless Threats

 By now, you should be aware of the need to secure traditional, wired internet connections. If you’re planning to move to a wireless connection in your home,
take a moment to consider what you’re doing: You’re connecting a device to your DSL or
cable modem that broadcasts your internet connection through the air over a radio signal to your computers. if traditional wired connections are prey to security problems, think of the security problems that arise when you open your internet connection to the airwaves.
 

This script parses all the IIS-related log files (IIS log files, HTTPError log files, UrlScan log files) looking for "suspicious'" URL's that might have been sent to compromise the server. The "HackerScan.txt" file contains a sample of the patterns to search for in URL's.
 

Requirements

• Windows Log Parser

Supported Platforms

• Windows Server 2003

Windows Remote Management is one component of the Windows Hardware Management features that manage server hardware locally and remotely.
These features include a service that implements the WS-Management protocol,
hardware diagnosis and control through baseboard management controllers (BMCs),
and a COM API and scripting objects that allow you to write applications that communicate remotely through the WS-Management protocol.

Components of WinRM and Hardware Management