Malware:ITX8042:2011:LAB

Labs

4 Lab/Home assignment

Milestone: 14.10.2011 - 15:00 EET

Download a file [ https://sim.cert.ee/hw/pahadus.zip pahadus.zip ]

WARNING FILE CONTAINS LIVE VIRUSES

Things that should be presented

* My externeal ip- where from i try to do this work (you can omit last 8 bytes) 
* My ISP
* My ISP AS number  and abuse adress* 

atleast 3 times (wil send 3 or mo ip-is)

* Route to ip
* Hostname - in your best knowledge.
* ISP-s upstream ISP for given IP
* Abuse contact for IP and contact for national CERT whose constituency this IP belongs to. 
* Do i need any additional information besides knowing my problem and  ip to send abuse to this ISP and why.

* tools and or Websites you used to gather this information 

3 Lab/Home assignment

Milestone: 07.10.2011 - 08:00

Find whom to sent abuse and other information about that ip get ip-s send mail to course-malware(at)cert.ee

Things that should be presented

* My externeal ip- where from i try to do this work (you can omit last 8 bytes) 
* My ISP
* My ISP AS number  and abuse adress* 

atleast 3 times (wil send 3 or mo ip-is)

* Route to ip
* Hostname - in your best knowledge.
* ISP-s upstream ISP for given IP
* Abuse contact for IP and contact for national CERT whose constituency this IP belongs to. 
* Do i need any additional information besides knowing my problem and  ip to send abuse to this ISP and why.

* tools and or Websites you used to gather this information 

2 Lab/Home assignment

Milestone: 26.09.2011 12:00EET

Results to tarmo at cert dot ee cc course-malware(at)cert.ee

for Malware2 optional = requiered and for requiered dedline is 15 now

Primary task • extract disk image of your or your friends thumbdrive / sd ( / cf) card • analyze disk image • document the process • selection of tools and howtos is here and here

Required for those taking Malware 2 and Bonus for others • analyze mobile malware file mmc.jar • unpack it (hint - use zip on .jar) • examine .class files using tool available here • find code sending SMSes using 'sms://' URI • XTRA points - calculate short number used in SM.send • document the process

1 Lab/Home assignment

Milestone: 8.10.2011 - 20:00

should be sent to course-malware(at)cert.ee

Find out how much costs

*  DDOS , 
*  credit card number , 
*  infected machine , 
*  sending spam for 1 000 000 people,

Hints :

Knowing Russian slang for that will be beneficial and there are other search engines beside google.

Things that should be presented

* Where you found information (links or sources)
* IM ,AMI forum or whatever contact you have for person whom you can acquire  such thing
* Prices 
 and what ever other information you find relavent.