1. Overview

As I wrote in my project outline (https://www.honeynet.org/gsoc/project1) . I should have done some basic  enhancement and experiments on python-spidermonkey for a more fine-granted tracing on spidermonkey. So till now what I have done on it includes:                                                                              

a. Implemented the get_globj method in the Context class, which enables one to ‘pull’ all the properties of the global object inside spidermonkey ( namely the global variables, because all the global variables are properties of the global object ) into python context.

Hello all,

As today is the official start of the Google Summer of Code, an introduction both to the project, and for myself seems to be in order. My name is Kevin Galloway, and I’m currently a graduate student, in Computer Science at the University of Alaska, Fairbanks. Most of my background is more on the security side of things, although, at the start, graphics were one of the main reasons I chose computer science. This project was a way to combine those two passions of mine.

As the plan is to embedd python as scripting language into the honeypot, I ran a benchmark on a testsuite. The ’testsuite’ is a c core which accepts connections, and allows python to deal with the input. The protocol used for benchmarking is http, the service serves a non static html page.

I tested

• • 2.6.2_(release26-maint,_Apr_19_2009,_02:15:38)
• • 3.0.1+_(r301:69556,_Apr_15_2009,_17:22:45)_
• • 3.1a1+_(py3k,_Mar_30_2009,_02:02:26)_

To benchmark, I ran the apache benchmark tool ab

ab -n 100000 -c 15 http://localhost:8080/bar

Hi all!

As defined in gsoc proposal the first step was prepare PicViz-Gui to allow change axes order, including add duplicated axes. Even before start the codification process this feature is done. I hope this is a little sinal of we’ll have success in all tasks that were defined. See a shot:

axis0, As first and last.

Axes reorder

I have no time for this yet, but soon I’ll post new shots of these feature.

Finally updated the roo-base rpm to point at http://yum.honeynet.org/roo/repo-1.4/ for the location of the yum repository.  Once I have access to the server, someone with an old deployment of roo 1.4, will be able to upgrade their honeywall as follows:

2. rpm -i http://yum.honeynet.org/roo/repo-1.4/roo-base-5-36.hw.noarch.rpm

3. yum update

This will update the honeywall with all updated system rpms effective 25 April 2009.

I also placed a new iso with updated rpms on: https://projects.honeynet.org/honeywall/attachment/wiki/WikiStart/roo-1.4.hw-20090425114542.iso.

Many people have asked us, how Conficker looks like. That’s a tough question for something that’s hidden and tries to be as stealthy as possible. The last time somebody asked me: “Can you show me Conficker?”, I decided to visualize Conficker. Here is a little video that shows the evil core of Conficker.C.

The video is a 3D animation of the functions inside Conficker.C and their functional relationships. Yellow balls are functions found inside Conficker. Green loops are functions imported from Dlls and red boxes are jump holes into other functions. The video shows the way our tools analyze Conficker and the derivation of dependencies among the control flow graph.

Earlier this week I had the good fortune to be in Boston for LEET09, a workshop on exploits, malware, and large-scale trends. I presented on PhoneyC, the Python honeyclient I’ve been working on. The paper describes the architecture and features of the tool and a real world evaluation and test. The talk was well received, and many thanks to the organizers of the conference and the PC for their helpful reviews.
Usenix has made the full paper available to all for free.

The results for Google Summer of Code 2009 are out and the Honeynet Project are very excited to have been allocated 9 official slots by Google. You can view the project selection here:

http://socghop.appspot.com/org/home/google/gsoc2009/honeynet

Congratulations to all the students accepted for GSoC 2009, and commiserations to those who didn’t make it this time. We had many more applicants than slots, making the final selection very tough, so we hope everyone who applied will still consider getting involved in open source software and honeynet research. Even if you didn’t get an allocated slot, please get in touch if you would still like get involved. Project mentors and Honeynet Project members may well still be interested in mentoring your project ideas, plus as a volunteer organisation we always welcome new input.

Today we released version 2 of our Simple Conficker Scanner (SCSv2). It contains a new scanning method which allows for detection of machines infected with the recent Conficker version (D or E, depending on the naming scheme - the tool calls it D). Although the patch to the vulnerable function NetpwPathCanonicalize() was updated in the new variant, the RPC response codes for specially crafted requests are still different for infected machines. This enabled us to write a network scanner to distinguish Conficker zombies from clean hosts. The scanning results look like this:

The Honeynet Project is very excited to be a member of the Google Summer of Code.  We are sponsoring at least eight GSoC projects and potentially more, depending on how many other ideas we received.  Google has just closed the application period, we are thrilled to see we received 55 applications.  Our mentors will spend the next week reviewing and ranking each application.  Then, on 15 April Google will select our top applicants.  At this time we do not know how many applicants will be allowed in our program, but we are hoping it will be quite a few! Thanks so much to everyone who submitted an application, we wish you the best of luck! Meanwhile, if you have any questions about our GSoC involvement, join us at irc.freenode.net #gsoc-honeynet