http://www.lambda.ee/w/api.php?action=feedcontributions&feedformat=atom&user=Lepik 2026-10-28T13:34:56Z Kasutaja kaastöö MediaWiki 1.43.11 http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11220 2013-12-18T17:15:18Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] : deadline 18 november === <br /> <br /> === 2013.11.20 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab2 Lab 2 ] : deadline 18 dets ===<br /> <br /> === 2013.11.27 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab3 Lab 3 ] : deadline 18 dets ===<br /> <br /> === 2013.12.04 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab4 Lab 4 ]: deadline 8 jan ===<br /> <br /> === 2013.12.11 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab5 Lab 5 ]: deadline 8 jan ===<br /> <br /> <br /> === https://docs.google.com/forms/d/1zVxaYpKrsGr0RNDxXBESIKTkW7Pe4Ah36ENbFQeMZCc/viewform Test ===<br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> === 2013.11.06 [https://docs.google.com/presentation/d/1KzZZx2kG8ue3SjyEIh3nVyhXyE5aNlTxszctZfOO6cU/edit?usp=sharing Intro ] ===<br /> <br /> === 2013.11.06 [http://media.ch9.ms/sessions/teched/na/2013/ATC-B308_Russinovich.pptx About Sysinternals ] ===<br /> <br /> === 2013.11.13 [https://docs.google.com/presentation/d/192rfByYpq8T5HmfbWf0Ttp8JR7rkcaXgcfc5xZY0pIk/edit?usp=sharing Intro to intel x86 ] ===<br /> <br /> === 2013.11.20 [https://docs.google.com/presentation/d/1XB67Rul-rl9EmbLWmSSkWT3Ug4sqBzPQ1mcPjnJGahk/edit?usp=sharing Network Forensic intro] ===<br /> <br /> === 2013.11.27 Kaarel Jõgi ! On Oly debug and IDA pro usage [http://www.thanks.no/ollydbg.ova Olly image ] ===<br /> <br /> === 2013.12.04 [https://docs.google.com/presentation/d/15JaM2OXfOmwt6i2-EobGpPWCAuu-aBixoXJvHNuaQww/edit?usp=sharing Doc , pdf , Pe and Elf file and document structures ] ===<br /> <br /> === 2013.12.11 [https://docs.google.com/presentation/d/1BGWesQnNkrTz4PdaO9ivCt89chxZ_tnqV1dQKLSE1MY/edit?usp=sharing Anti revers engineering methods Jaanus Kääp ] ===<br /> <br /> === 2013.12.18 [ Jarno Nemila Mobile security + how antivirus realy works] ===<br /> <br /> == Other materials ==<br /> <br /> [http://vimeo.com/31890217 Peter Szor 13.11.2013 R.I.P (Lecture from 2 years aggow) ]</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11212 2013-12-17T17:23:42Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] : deadline 18 november === <br /> <br /> === 2013.11.20 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab2 Lab 2 ] : deadline 18 dets ===<br /> <br /> === 2013.11.27 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab3 Lab 3 ] : deadline 18 dets ===<br /> <br /> === 2013.12.04 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab4 Lab 4 ]: deadline 8 jan ===<br /> <br /> === 2013.12.11 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab5 Lab 5 ]: deadline 8 jan ===<br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> === 2013.11.06 [https://docs.google.com/presentation/d/1KzZZx2kG8ue3SjyEIh3nVyhXyE5aNlTxszctZfOO6cU/edit?usp=sharing Intro ] ===<br /> <br /> === 2013.11.06 [http://media.ch9.ms/sessions/teched/na/2013/ATC-B308_Russinovich.pptx About Sysinternals ] ===<br /> <br /> === 2013.11.13 [https://docs.google.com/presentation/d/192rfByYpq8T5HmfbWf0Ttp8JR7rkcaXgcfc5xZY0pIk/edit?usp=sharing Intro to intel x86 ] ===<br /> <br /> === 2013.11.20 [https://docs.google.com/presentation/d/1XB67Rul-rl9EmbLWmSSkWT3Ug4sqBzPQ1mcPjnJGahk/edit?usp=sharing Network Forensic intro] ===<br /> <br /> === 2013.11.27 Kaarel Jõgi ! On Oly debug and IDA pro usage [http://www.thanks.no/ollydbg.ova Olly image ] ===<br /> <br /> === 2013.12.04 [https://docs.google.com/presentation/d/15JaM2OXfOmwt6i2-EobGpPWCAuu-aBixoXJvHNuaQww/edit?usp=sharing Doc , pdf , Pe and Elf file and document structures ] ===<br /> <br /> === 2013.12.11 [https://docs.google.com/presentation/d/1BGWesQnNkrTz4PdaO9ivCt89chxZ_tnqV1dQKLSE1MY/edit?usp=sharing Anti revers engineering methods Jaanus Kääp ] ===<br /> <br /> === 2013.12.18 [ Jarno Nemila Mobile security + how antivirus realy works] ===<br /> <br /> == Other materials ==<br /> <br /> [http://vimeo.com/31890217 Peter Szor 13.11.2013 R.I.P (Lecture from 2 years aggow) ]</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11211 2013-12-17T17:19:28Z

<p>Lepik: /* 2013.12.11 [ Anti revers engineering methods Jaanus Kääp ] */</p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] ===<br /> <br /> === 2013.11.20 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab2 Lab 2 ] ===<br /> <br /> === 2013.11.27 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab3 Lab 3 ] ===<br /> <br /> === 2013.12.04 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab4 Lab 4 ] ===<br /> <br /> === 2013.12.11 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab5 Lab 5 ] ===<br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> === 2013.11.06 [https://docs.google.com/presentation/d/1KzZZx2kG8ue3SjyEIh3nVyhXyE5aNlTxszctZfOO6cU/edit?usp=sharing Intro ] ===<br /> <br /> === 2013.11.06 [http://media.ch9.ms/sessions/teched/na/2013/ATC-B308_Russinovich.pptx About Sysinternals ] ===<br /> <br /> === 2013.11.13 [https://docs.google.com/presentation/d/192rfByYpq8T5HmfbWf0Ttp8JR7rkcaXgcfc5xZY0pIk/edit?usp=sharing Intro to intel x86 ] ===<br /> <br /> === 2013.11.20 [https://docs.google.com/presentation/d/1XB67Rul-rl9EmbLWmSSkWT3Ug4sqBzPQ1mcPjnJGahk/edit?usp=sharing Network Forensic intro] ===<br /> <br /> === 2013.11.27 Kaarel Jõgi ! On Oly debug and IDA pro usage [http://www.thanks.no/ollydbg.ova Olly image ] ===<br /> <br /> === 2013.12.04 [https://docs.google.com/presentation/d/15JaM2OXfOmwt6i2-EobGpPWCAuu-aBixoXJvHNuaQww/edit?usp=sharing Doc , pdf , Pe and Elf file and document structures ] ===<br /> <br /> === 2013.12.11 [https://docs.google.com/presentation/d/1BGWesQnNkrTz4PdaO9ivCt89chxZ_tnqV1dQKLSE1MY/edit?usp=sharing Anti revers engineering methods Jaanus Kääp ] ===<br /> <br /> === 2013.12.18 [ Jarno Nemila Mobile security + how antivirus realy works] ===<br /> <br /> == Other materials ==<br /> <br /> [http://vimeo.com/31890217 Peter Szor 13.11.2013 R.I.P (Lecture from 2 years aggow) ]</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab5&diff=11200 2013-12-17T04:54:30Z

<p>Lepik: Uus lehekülg: &#039;== LAB5 == Lab due date - 8 January Re program Change name to your name and age to your age. [http://lambda.ee/w/images/e/e3/Task.zip Task.zip] == Lab 5 (2/3)== You sold ...&#039;</p> <hr /> <div>== LAB5 ==<br /> <br /> Lab due date - 8 January <br /> <br /> Re program <br /> Change name to your name and age to your age.<br /> <br /> [http://lambda.ee/w/images/e/e3/Task.zip Task.zip]<br /> <br /> == Lab 5 (2/3)==<br /> <br /> You sold describe how you approached the problem and achieved the result<br /> <br /> <br /> and submit executable that displays your name and age.</div>

Lepik http://www.lambda.ee/w/index.php?title=Fail:Task.zip&diff=11199 2013-12-17T04:27:15Z

<p>Lepik: 5 task 2013</p> <hr /> <div>5 task 2013</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab4&diff=11171 2013-12-11T16:54:50Z

<p>Lepik: Uus lehekülg: &#039;== LAB4 == IT s your choice to write essay or to do lab Lab 4 === Lab 4 &quot; Fun lab&quot; === Find RAT (Remote Administration toolkit) -... – Nuclear RAT – Gh0st RA...&#039;</p> <hr /> <div>== LAB4 ==<br /> <br /> IT s your choice to write essay or to do lab Lab 4 <br /> <br /> <br /> === Lab 4 &quot; Fun lab&quot; ===<br /> <br /> Find RAT (Remote Administration toolkit) <br /> <br /> -...<br /> – Nuclear RAT<br /> – Gh0st RAT<br /> – Bifrost Remote Controller <br /> – Poison Ivy<br /> <br /> <br /> <br /> Make malicious document <br /> <br /> Mark it as malicious<br /> <br /> you should include your name and for course use only markings inside document and rat !<br /> <br /> <br /> in text file or in email :<br /> <br /> Describe which rat from where <br /> <br /> Where you found additional information and how you made this document <br /> <br /> send information to course address.<br /> <br /> <br /> <br /> <br /> === some promotional videos might be malicious :) ===<br /> <br /> hxxp://www.securitytube.net/video/284</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11170 2013-12-11T16:13:32Z

<p>Lepik: /* 2013.12.04 [ Doc , pdf , Pe and Elf file and document structures ] */</p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] ===<br /> <br /> === 2013.11.20 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab2 Lab 2 ] ===<br /> <br /> === 2013.11.27 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab3 Lab 3 ] ===<br /> <br /> === 2013.12.04 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab4 Lab 4 ] ===<br /> <br /> === 2013.12.11 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab5 Lab 5 ] ===<br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> === 2013.11.06 [https://docs.google.com/presentation/d/1KzZZx2kG8ue3SjyEIh3nVyhXyE5aNlTxszctZfOO6cU/edit?usp=sharing Intro ] ===<br /> <br /> === 2013.11.06 [http://media.ch9.ms/sessions/teched/na/2013/ATC-B308_Russinovich.pptx About Sysinternals ] ===<br /> <br /> === 2013.11.13 [https://docs.google.com/presentation/d/192rfByYpq8T5HmfbWf0Ttp8JR7rkcaXgcfc5xZY0pIk/edit?usp=sharing Intro to intel x86 ] ===<br /> <br /> === 2013.11.20 [https://docs.google.com/presentation/d/1XB67Rul-rl9EmbLWmSSkWT3Ug4sqBzPQ1mcPjnJGahk/edit?usp=sharing Network Forensic intro] ===<br /> <br /> === 2013.11.27 Kaarel Jõgi ! On Oly debug and IDA pro usage [http://www.thanks.no/ollydbg.ova Olly image ] ===<br /> <br /> === 2013.12.04 [https://docs.google.com/presentation/d/15JaM2OXfOmwt6i2-EobGpPWCAuu-aBixoXJvHNuaQww/edit?usp=sharing Doc , pdf , Pe and Elf file and document structures ] ===<br /> <br /> === 2013.12.11 [ Anti revers engineering methods Jaanus Kääp ] ===<br /> <br /> <br /> === 2013.12.18 [ Jarno Nemila Mobile security + how antivirus realy works] ===<br /> <br /> == Other materials ==<br /> <br /> [http://vimeo.com/31890217 Peter Szor 13.11.2013 R.I.P (Lecture from 2 years aggow) ]</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11137 2013-12-03T17:58:47Z

<p>Lepik: /* 2013.12.18 [] */</p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] ===<br /> <br /> === 2013.11.20 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab2 Lab 2 ] ===<br /> <br /> === 2013.11.27 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab3 Lab 3 ] ===<br /> <br /> === 2013.12.04 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab4 Lab 4 ] ===<br /> <br /> === 2013.12.11 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab5 Lab 5 ] ===<br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> === 2013.11.06 [https://docs.google.com/presentation/d/1KzZZx2kG8ue3SjyEIh3nVyhXyE5aNlTxszctZfOO6cU/edit?usp=sharing Intro ] ===<br /> <br /> === 2013.11.06 [http://media.ch9.ms/sessions/teched/na/2013/ATC-B308_Russinovich.pptx About Sysinternals ] ===<br /> <br /> === 2013.11.13 [https://docs.google.com/presentation/d/192rfByYpq8T5HmfbWf0Ttp8JR7rkcaXgcfc5xZY0pIk/edit?usp=sharing Intro to intel x86 ] ===<br /> <br /> === 2013.11.20 [https://docs.google.com/presentation/d/1XB67Rul-rl9EmbLWmSSkWT3Ug4sqBzPQ1mcPjnJGahk/edit?usp=sharing Network Forensic intro] ===<br /> <br /> === 2013.11.27 Kaarel Jõgi ! On Oly debug and IDA pro usage [http://www.thanks.no/ollydbg.ova Olly image ] ===<br /> <br /> === 2013.12.04 [ Doc , pdf , Pe and Elf file and document structures ] ===<br /> <br /> === 2013.12.11 [ Anti revers engineering methods Jaanus Kääp ] ===<br /> <br /> <br /> === 2013.12.18 [ Jarno Nemila Mobile security + how antivirus realy works] ===<br /> <br /> == Other materials ==<br /> <br /> [http://vimeo.com/31890217 Peter Szor 13.11.2013 R.I.P (Lecture from 2 years aggow) ]</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11136 2013-12-03T17:57:51Z

<p>Lepik: /* 2013.12.04 [ ] */</p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] ===<br /> <br /> === 2013.11.20 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab2 Lab 2 ] ===<br /> <br /> === 2013.11.27 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab3 Lab 3 ] ===<br /> <br /> === 2013.12.04 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab4 Lab 4 ] ===<br /> <br /> === 2013.12.11 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab5 Lab 5 ] ===<br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> === 2013.11.06 [https://docs.google.com/presentation/d/1KzZZx2kG8ue3SjyEIh3nVyhXyE5aNlTxszctZfOO6cU/edit?usp=sharing Intro ] ===<br /> <br /> === 2013.11.06 [http://media.ch9.ms/sessions/teched/na/2013/ATC-B308_Russinovich.pptx About Sysinternals ] ===<br /> <br /> === 2013.11.13 [https://docs.google.com/presentation/d/192rfByYpq8T5HmfbWf0Ttp8JR7rkcaXgcfc5xZY0pIk/edit?usp=sharing Intro to intel x86 ] ===<br /> <br /> === 2013.11.20 [https://docs.google.com/presentation/d/1XB67Rul-rl9EmbLWmSSkWT3Ug4sqBzPQ1mcPjnJGahk/edit?usp=sharing Network Forensic intro] ===<br /> <br /> === 2013.11.27 Kaarel Jõgi ! On Oly debug and IDA pro usage [http://www.thanks.no/ollydbg.ova Olly image ] ===<br /> <br /> === 2013.12.04 [ Doc , pdf , Pe and Elf file and document structures ] ===<br /> <br /> === 2013.12.11 [ Anti revers engineering methods Jaanus Kääp ] ===<br /> <br /> <br /> === 2013.12.18 [] ===<br /> <br /> <br /> == Other materials ==<br /> <br /> [http://vimeo.com/31890217 Peter Szor 13.11.2013 R.I.P (Lecture from 2 years aggow) ]</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11135 2013-12-03T17:57:05Z

<p>Lepik: /* 2013.11.27 [ Kaarel Jõgi !] */</p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] ===<br /> <br /> === 2013.11.20 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab2 Lab 2 ] ===<br /> <br /> === 2013.11.27 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab3 Lab 3 ] ===<br /> <br /> === 2013.12.04 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab4 Lab 4 ] ===<br /> <br /> === 2013.12.11 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab5 Lab 5 ] ===<br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> === 2013.11.06 [https://docs.google.com/presentation/d/1KzZZx2kG8ue3SjyEIh3nVyhXyE5aNlTxszctZfOO6cU/edit?usp=sharing Intro ] ===<br /> <br /> === 2013.11.06 [http://media.ch9.ms/sessions/teched/na/2013/ATC-B308_Russinovich.pptx About Sysinternals ] ===<br /> <br /> === 2013.11.13 [https://docs.google.com/presentation/d/192rfByYpq8T5HmfbWf0Ttp8JR7rkcaXgcfc5xZY0pIk/edit?usp=sharing Intro to intel x86 ] ===<br /> <br /> === 2013.11.20 [https://docs.google.com/presentation/d/1XB67Rul-rl9EmbLWmSSkWT3Ug4sqBzPQ1mcPjnJGahk/edit?usp=sharing Network Forensic intro] ===<br /> <br /> === 2013.11.27 Kaarel Jõgi ! On Oly debug and IDA pro usage [http://www.thanks.no/ollydbg.ova Olly image ] ===<br /> <br /> === 2013.12.04 [ ] ===<br /> <br /> <br /> === 2013.12.11 [ Anti revers engineering methods Jaanus Kääp ] ===<br /> <br /> <br /> === 2013.12.18 [] ===<br /> <br /> <br /> == Other materials ==<br /> <br /> [http://vimeo.com/31890217 Peter Szor 13.11.2013 R.I.P (Lecture from 2 years aggow) ]</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11134 2013-12-03T17:55:13Z

<p>Lepik: /* 2013.11.20 [ ... ] */</p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] ===<br /> <br /> === 2013.11.20 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab2 Lab 2 ] ===<br /> <br /> === 2013.11.27 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab3 Lab 3 ] ===<br /> <br /> === 2013.12.04 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab4 Lab 4 ] ===<br /> <br /> === 2013.12.11 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab5 Lab 5 ] ===<br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> === 2013.11.06 [https://docs.google.com/presentation/d/1KzZZx2kG8ue3SjyEIh3nVyhXyE5aNlTxszctZfOO6cU/edit?usp=sharing Intro ] ===<br /> <br /> === 2013.11.06 [http://media.ch9.ms/sessions/teched/na/2013/ATC-B308_Russinovich.pptx About Sysinternals ] ===<br /> <br /> === 2013.11.13 [https://docs.google.com/presentation/d/192rfByYpq8T5HmfbWf0Ttp8JR7rkcaXgcfc5xZY0pIk/edit?usp=sharing Intro to intel x86 ] ===<br /> <br /> === 2013.11.20 [https://docs.google.com/presentation/d/1XB67Rul-rl9EmbLWmSSkWT3Ug4sqBzPQ1mcPjnJGahk/edit?usp=sharing Network Forensic intro] ===<br /> <br /> === 2013.11.27 [ Kaarel Jõgi !] ===<br /> <br /> === 2013.12.04 [ ] ===<br /> <br /> <br /> === 2013.12.11 [ Anti revers engineering methods Jaanus Kääp ] ===<br /> <br /> <br /> === 2013.12.18 [] ===<br /> <br /> <br /> == Other materials ==<br /> <br /> [http://vimeo.com/31890217 Peter Szor 13.11.2013 R.I.P (Lecture from 2 years aggow) ]</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11133 2013-12-03T17:45:54Z

<p>Lepik: /* 2013.11.13 [ ... ] */</p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] ===<br /> <br /> === 2013.11.20 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab2 Lab 2 ] ===<br /> <br /> === 2013.11.27 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab3 Lab 3 ] ===<br /> <br /> === 2013.12.04 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab4 Lab 4 ] ===<br /> <br /> === 2013.12.11 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab5 Lab 5 ] ===<br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> === 2013.11.06 [https://docs.google.com/presentation/d/1KzZZx2kG8ue3SjyEIh3nVyhXyE5aNlTxszctZfOO6cU/edit?usp=sharing Intro ] ===<br /> <br /> === 2013.11.06 [http://media.ch9.ms/sessions/teched/na/2013/ATC-B308_Russinovich.pptx About Sysinternals ] ===<br /> <br /> === 2013.11.13 [https://docs.google.com/presentation/d/192rfByYpq8T5HmfbWf0Ttp8JR7rkcaXgcfc5xZY0pIk/edit?usp=sharing Intro to intel x86 ] ===<br /> <br /> === 2013.11.20 [ ... ] ===<br /> <br /> === 2013.11.27 [ Kaarel Jõgi !] ===<br /> <br /> === 2013.12.04 [ ] ===<br /> <br /> <br /> === 2013.12.11 [ Anti revers engineering methods Jaanus Kääp ] ===<br /> <br /> <br /> === 2013.12.18 [] ===<br /> <br /> <br /> == Other materials ==<br /> <br /> [http://vimeo.com/31890217 Peter Szor 13.11.2013 R.I.P (Lecture from 2 years aggow) ]</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab3&diff=11132 2013-12-03T17:42:42Z

<p>Lepik: Uus lehekülg: &#039;== LAB3 == Lab due date - 18 December Small teams up to 3 people Install Cuckoo Sandbox and demonstrate it working (analyze an malware on it). You have to demonstrate your Cuc...&#039;</p> <hr /> <div>== LAB3 ==<br /> <br /> Lab due date - 18 December<br /> <br /> Small teams up to 3 people<br /> <br /> Install Cuckoo Sandbox and demonstrate it working (analyze an malware on it). You have to demonstrate your Cuckoo in PERSON.<br /> <br /> [http://docs.cuckoosandbox.org/en/latest/introduc=on/ Read the instructsions and install accordingly.]<br /> <br /> <br /> <br /> == Lab 3 (2/3)==<br /> <br /> <br /> Recommended setup :<br /> * Install Cuckoo sandbox inside a Ubuntu 12.04 64 bit (virtual if you dont have native Ubuntu)<br /> * Ubuntu 12.04 64 bit Desktop Edition<br /> * + 2GB of Memory (MINIMAL)<br /> * + 15GB of HDD (MINIMAL)<br /> * (install virtualbox guest addi=ons to the Ubuntu bot to make your life easier)<br /> * Install Cuckoo according to the guide (h]p://docs.cuckoosandbox.org/ en/latest/installa=on/)<br /> * Install Virtualbox inside the Ubuntu 12.04 machine and install trial version of 32 bit Windows 7 . You can get trial version of Windows 7 either from h]ps://profile.microsoS.com/RegSysProfileCenter/ wizard.aspx?wizid=05ada55f-c391-4247- ab2e-459b0feceaff&amp;lcid=1033&amp;ci=393 (you need to create an account at MicrosoS for that) or I can provide you with the premade image.<br /> * Windows 7 virtual machine (that is INSIDE the Ubuntu 12.04 virtual machine) should have at least 8.5 GB of disk space and 1GB of memory allocated to it<br /> <br /> <br /> ==== AS you are all done with installation come to me (Allan Vein) and demonstrate how to analyze an malware with Cuckoo (you can get the malware from previous labs) and answer some questions about your installation. ====<br /> <br /> <br /> Alternative guide:<br /> http://santi-bassett.blogspot.com/2013/01/installing-cuckoo-sandbox-on-virtualbox.html</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11074 2013-11-21T05:07:35Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] ===<br /> <br /> === 2013.11.20 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab2 Lab 2 ] ===<br /> <br /> === 2013.11.27 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab3 Lab 3 ] ===<br /> <br /> === 2013.12.04 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab4 Lab 4 ] ===<br /> <br /> === 2013.12.11 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab5 Lab 5 ] ===<br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> === 2013.11.06 [https://docs.google.com/presentation/d/1KzZZx2kG8ue3SjyEIh3nVyhXyE5aNlTxszctZfOO6cU/edit?usp=sharing Intro ] ===<br /> <br /> === 2013.11.06 [http://media.ch9.ms/sessions/teched/na/2013/ATC-B308_Russinovich.pptx About Sysinternals ] ===<br /> <br /> === 2013.11.13 [ ... ] ===<br /> <br /> === 2013.11.20 [ ... ] ===<br /> <br /> === 2013.11.27 [ Kaarel Jõgi !] ===<br /> <br /> === 2013.12.04 [ ] ===<br /> <br /> <br /> === 2013.12.11 [ Anti revers engineering methods Jaanus Kääp ] ===<br /> <br /> <br /> === 2013.12.18 [] ===<br /> <br /> <br /> == Other materials ==<br /> <br /> [http://vimeo.com/31890217 Peter Szor 13.11.2013 R.I.P (Lecture from 2 years aggow) ]</div>

Lepik http://www.lambda.ee/w/index.php?title=Arutelu:Malware:ITX8060:2013:Lab2&diff=11073 2013-11-21T05:06:49Z

<p>Lepik: </p> <hr /> <div><br /> <br /> ===Additional hints===<br /> <br /> http://www.forensicswiki.org/wiki/Network_forensics<br /> <br /> http://www.forensicswiki.org/wiki/Tools:Network_Forensics</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab2&diff=11072 2013-11-21T05:06:33Z

<p>Lepik: Uus lehekülg: &#039;== LAB2 == Download Enisa Pcap - found in Enisa exercise [http://www.tud.ttu.ee/im/Toomas.Lepik/ENISA_CERT_Exercises.ova image] [http://www.enisa.europa.eu/activities/cert...&#039;</p> <hr /> <div>== LAB2 ==<br /> <br /> <br /> Download <br /> <br /> <br /> Enisa Pcap - found in Enisa exercise [http://www.tud.ttu.ee/im/Toomas.Lepik/ENISA_CERT_Exercises.ova image]<br /> <br /> [http://www.enisa.europa.eu/activities/cert/support/exercise/exercise-7 Enisa Network Forensic Exercise pointers]<br /> <br /> Use last number from your student code<br /> <br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/pcap1 Pcap1] EVEN<br /> <br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/pcap2 Pcap2] ODD including 0<br /> <br /> <br /> <br /> <br /> <br /> ===Assignment===<br /> <br /> <br /> understand wich files are downloaded is it a Malware ?<br /> <br /> Where from files are downloaded <br /> <br /> Any C&amp;C or P2P connection data .<br /> <br /> Timeline !<br /> <br /> Snort or Suricata rule do detect.<br /> <br /> How you did your assigment wich tools to whom you consulted and so on .. ?<br /> <br /> <br /> <br /> <br /> ===Additional hints===<br /> <br /> http://www.forensicswiki.org/wiki/Network_forensics<br /> <br /> http://www.forensicswiki.org/wiki/Tools:Network_Forensics</div>

Lepik http://www.lambda.ee/w/index.php?title=Arutelu:Malware:ITX8060:2013:Lab2&diff=11071 2013-11-21T05:06:06Z

<p>Lepik: </p> <hr /> <div>== LAB2 ==<br /> <br /> <br /> Download <br /> <br /> <br /> Enisa Pcap - found in Enisa exercise [http://www.tud.ttu.ee/im/Toomas.Lepik/ENISA_CERT_Exercises.ova image]<br /> <br /> [http://www.enisa.europa.eu/activities/cert/support/exercise/exercise-7 Enisa Network Forensic Exercise pointers]<br /> <br /> Use last number from your student code<br /> <br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/pcap1 Pcap1] EVEN<br /> <br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/pcap2 Pcap2] ODD including 0<br /> <br /> <br /> <br /> <br /> <br /> ===Assignment===<br /> <br /> <br /> understand wich files are downloaded is it a Malware ?<br /> <br /> Where from files are downloaded <br /> <br /> Any C&amp;C or P2P connection data .<br /> <br /> Timeline !<br /> <br /> Snort or Suricata rule do detect.<br /> <br /> How you did your assigment wich tools to whom you consulted and so on .. ?<br /> <br /> <br /> <br /> <br /> ===Additional hints===<br /> <br /> http://www.forensicswiki.org/wiki/Network_forensics<br /> <br /> http://www.forensicswiki.org/wiki/Tools:Network_Forensics</div>

Lepik http://www.lambda.ee/w/index.php?title=Arutelu:Malware:ITX8060:2013:Lab2&diff=11070 2013-11-21T05:05:48Z

<p>Lepik: </p> <hr /> <div>== LAB1 ==<br /> <br /> <br /> Download <br /> <br /> <br /> Enisa Pcap - found in Enisa exercise [http://www.tud.ttu.ee/im/Toomas.Lepik/ENISA_CERT_Exercises.ova image]<br /> <br /> [http://www.enisa.europa.eu/activities/cert/support/exercise/exercise-7 Enisa Network Forensic Exercise pointers]<br /> <br /> Use last number from your student code<br /> <br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/pcap1 Pcap1] EVEN<br /> <br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/pcap2 Pcap2] ODD including 0<br /> <br /> <br /> <br /> <br /> <br /> ===Assignment===<br /> <br /> <br /> understand wich files are downloaded is it a Malware ?<br /> <br /> Where from files are downloaded <br /> <br /> Any C&amp;C or P2P connection data .<br /> <br /> Timeline !<br /> <br /> Snort or Suricata rule do detect.<br /> <br /> How you did your assigment wich tools to whom you consulted and so on .. ?<br /> <br /> <br /> <br /> <br /> ===Additional hints===<br /> <br /> http://www.forensicswiki.org/wiki/Network_forensics<br /> <br /> http://www.forensicswiki.org/wiki/Tools:Network_Forensics</div>

Lepik http://www.lambda.ee/w/index.php?title=Arutelu:Malware:ITX8060:2013:Lab2&diff=11069 2013-11-21T05:04:50Z

<p>Lepik: Uus lehekülg: &#039;== LAB1 == Download Enisa Pcap - found in Enisa exercise [http://www.tud.ttu.ee/im/Toomas.Lepik/ENISA_CERT_Exercises.ova image] [http://www.enisa.europa.eu/activities/cert...&#039;</p> <hr /> <div>== LAB1 ==<br /> <br /> <br /> Download <br /> <br /> <br /> Enisa Pcap - found in Enisa exercise [http://www.tud.ttu.ee/im/Toomas.Lepik/ENISA_CERT_Exercises.ova image]<br /> <br /> [http://www.enisa.europa.eu/activities/cert/support/exercise/exercise-7 Enisa Network Forensic Exercise pointers]<br /> <br /> Use last number from your student code<br /> <br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/pcap1 Pcap1] EVEN<br /> <br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/pcap2 Pcap2] ODD including 0<br /> <br /> <br /> <br /> <br /> <br /> ===Assignment===<br /> <br /> <br /> Malware what is downloaded <br /> <br /> Where from is downloaded <br /> <br /> Any C&amp;C or P2P connection data .<br /> <br /> Timeline !<br /> <br /> Snort or Suricata rule do detect.<br /> <br /> How you did your assigment wich tools to whom you consulted and so on .. ?<br /> <br /> <br /> <br /> <br /> ===Additional hints===<br /> <br /> http://www.forensicswiki.org/wiki/Network_forensics<br /> <br /> http://www.forensicswiki.org/wiki/Tools:Network_Forensics</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11065 2013-11-19T15:15:03Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] ===<br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> === 2013.11.06 [https://docs.google.com/presentation/d/1KzZZx2kG8ue3SjyEIh3nVyhXyE5aNlTxszctZfOO6cU/edit?usp=sharing Intro ] ===<br /> <br /> === 2013.11.06 [http://media.ch9.ms/sessions/teched/na/2013/ATC-B308_Russinovich.pptx About Sysinternals ] ===<br /> <br /> === 2013.11.13 [ ... ] ===<br /> <br /> <br /> == Other materials ==<br /> <br /> <br /> == Other materials ==<br /> <br /> [http://vimeo.com/31890217 Peter Szor 13.11.2013 R.I.P (Lecture from 2 years aggow) ]</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1&diff=11055 2013-11-16T02:34:27Z

<p>Lepik: </p> <hr /> <div><br /> == LAB1 ==<br /> <br /> <br /> Download <br /> <br /> Use last nuber from your student <br /> <br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/infected1/ Infected maccine 1] EVEN<br /> <br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/infected2/ Infected maccine 2] ODD<br /> <br /> 0 = EVEN<br /> <br /> VirtualBox 4.3.0 or better !<br /> <br /> <br /> ===Assignment===<br /> <br /> Assignment consists of two parts. First part is individual task and the second is teamwork:<br /> <br /> <br /> Individual task:<br /> <br /> 1)Find out which viruses are present on the virtual image.<br /> <br /> 2)Find how to remove the viruses without reinstalling the OS or installing AV<br /> <br /> 3)Document your process and solution <br /> <br /> <br /> <br /> Group Task:<br /> <br /> This is an group assigment (maximum 4 people)<br /> <br /> 1)Imagine you are responsible for 50 similar windows machines. How can you detect wheather they have been infected with viruses found in previous task (without analysing all the 50 machines one at a time).<br /> <br /> 2)Create a presentation to intruduce your solution.(Please include the names of all your teammates and their contribution.)<br /> <br /> 3) Send short descriptsion of solution and presentation files if you had any.<br /> <br /> <br /> Individual assigment deadline 21 November<br /> <br /> Group assigment presentations 20 th November</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1&diff=11036 2013-11-13T05:43:13Z

<p>Lepik: /* Assignment */</p> <hr /> <div><br /> == LAB1 ==<br /> <br /> <br /> Download <br /> <br /> Use last nuber from your student <br /> <br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/infected1/ Infected maccine 1] EVEN<br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/infected2/ Infected maccine 2] ODD<br /> <br /> 0 = EVEN<br /> <br /> ===Assignment===<br /> <br /> <br /> Understand with what macines are infected <br /> <br /> with group max 4 people (3 people who were present + you may include one how was not present)<br /> <br /> find and present solution for checking are other 50 machines in company infected or they carry other type of infections.. or how to find unknown.<br /> <br /> <br /> (lab description is in process - its partly described in course notes)<br /> <br /> <br /> ====.====</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11035 2013-11-13T05:37:34Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] ===<br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> === 2013.11.06 [https://docs.google.com/presentation/d/1KzZZx2kG8ue3SjyEIh3nVyhXyE5aNlTxszctZfOO6cU/edit?usp=sharing Intro ] ===<br /> <br /> === 2013.11.06 [http://media.ch9.ms/sessions/teched/na/2013/ATC-B308_Russinovich.pptx About Sysinternals ] ===<br /> <br /> === 2013.11.13 [ ... ] ===<br /> <br /> <br /> == Other materials ==</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1&diff=11005 2013-11-07T05:46:06Z

<p>Lepik: Uus lehekülg: &#039; == LAB1 == Download Use last nuber from your student [http://www.tud.ttu.ee/im/Toomas.Lepik/infected1/ Infected maccine 1] EVEN [http://www.tud.ttu.ee/im/Toomas.Lepik/i...&#039;</p> <hr /> <div><br /> == LAB1 ==<br /> <br /> <br /> Download <br /> <br /> Use last nuber from your student <br /> <br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/infected1/ Infected maccine 1] EVEN<br /> [http://www.tud.ttu.ee/im/Toomas.Lepik/infected2/ Infected maccine 2] ODD<br /> <br /> 0 = EVEN<br /> <br /> ===Assignment===<br /> <br /> Understand with what macines are infected <br /> <br /> Provide solution for cheking are other 50 macines in company infected or they carry other type of infections...<br /> <br /> (lab desciptsion is in process)<br /> <br /> ====.====</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=11004 2013-11-07T05:28:28Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> === 2013.11.07 [http://lambda.ee/w/index.php?title=Malware:ITX8060:2013:Lab1 Lab 1 ] ===<br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> <br /> == Other materials ==</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8060:2013&diff=10977 2013-10-31T02:46:52Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.10.30 [https://docs.google.com/presentation/d/1pxcLLWWwG4G3wBezsjai9NDU4wbr_Oh8kIP4d0KKPMU/edit?usp=sharing Introduction to Reverce enginering] ===<br /> <br /> <br /> == Other materials ==</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013&diff=10961 2013-10-24T17:15:43Z

<p>Lepik: /* = QUIZ */</p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> ====Kill meand if you not presented your lab work for this time you are automaticly Faild cource ! ====<br /> <br /> Between Due and Kill you will be penalized !<br /> <br /> ==== [https://docs.google.com/spreadsheet/ccc?key=0AhARjqsUbwN_dEZiOFBiakhOTjQ0NXBnSzFVUmotUVE#gid=0 Current status of homework grading ] ====<br /> <br /> ==== [http://lambda.ee/w/images/2/27/Bestscripst.zip Best 5 scripts presented in lab 3 pass:infected ] ====<br /> <br /> == [https://docs.google.com/spreadsheet/viewform?fromEmail=true&amp;formkey=dElWNDBOc2NDWXBZaGhjRHd1bVVfekE6MA '''QUIZ'''] ==<br /> <br /> == LABS/Homework ==<br /> <br /> <br /> === 2013.09.04 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB1 Lab 1 Due date 13 sept. 2013 Kill date 2 October] ===<br /> <br /> === 2013.09.12 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2 Lab 2 Due date 27 sept. 2013 Kill date 11 October] ===<br /> <br /> <br /> === 2013.09.18 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3 Lab 3 Due date 4 oct. 2013 Kill date 18 October] ===<br /> <br /> <br /> === 2013.10.03 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB4 Lab 4 Due date 25 oct. 2013] ===<br /> <br /> === 2013.10.03 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB5 Lab 5 Due date 25 oct. 2013] ===<br /> <br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.09.02 [https://docs.google.com/presentation/d/1DXh_TjnqzfMViS2FPRDPhsTPwZCSGChD6P1OrgDcZzc/edit?usp=sharing First lecture/ Introduction] ===<br /> <br /> === 2013.09.09 [https://docs.google.com/presentation/d/1bOrif9o7gtKpGppYnAXqXdi_4JXwZ_Hap4l597erZDo/edit?usp=sharing Second lecture ] ===<br /> <br /> === 2013.09.16 [https://docs.google.com/presentation/d/1vsxRfMd_vG53dkhDx7xUbmZj20QiHUOVvBTX5LI1tsI/edit?usp=sharing Thrid lecture] ===<br /> <br /> === 2013.09.23 [https://docs.google.com/file/d/0BwLcblFEXx61ZUdiMGlIZ3BpMVk/edit?usp=sharing Forth lecture Tiit about banking malware] ===<br /> <br /> === 2013.09.30 [https://docs.google.com/presentation/d/1dCfAfS4n0BRvYMMZEC602JcAqPzqFAn5gWsj31yuhU4/edit?usp=sharing Fifth lecture Anto Veldre] ===<br /> <br /> === 2013.10.07 [https://docs.google.com/file/d/0BwLcblFEXx61cHNUb2drVC16MFk/edit?usp=sharing Sixth lecture Mw incident handling] ===<br /> <br /> === 2013.10.14 [https://docs.google.com/presentation/d/1hQE6Uoq7vw5mcH-ns6cny-q9v3g6bvtNf4izUmtx7S4/edit?usp=sharing Seventh lecture Mw incident handling] ===<br /> <br /> === 2013.10.21 [https://docs.google.com/presentation/d/1nszGkCIbqc8-y5Hgy05EoNodf8-2ZAcH6mUAEoj1DHs/edit?usp=sharing Eight lecture Mw incident handling] ===</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013&diff=10960 2013-10-24T17:15:09Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> ====Kill meand if you not presented your lab work for this time you are automaticly Faild cource ! ====<br /> <br /> Between Due and Kill you will be penalized !<br /> <br /> ==== [https://docs.google.com/spreadsheet/ccc?key=0AhARjqsUbwN_dEZiOFBiakhOTjQ0NXBnSzFVUmotUVE#gid=0 Current status of homework grading ] ====<br /> <br /> ==== [http://lambda.ee/w/images/2/27/Bestscripst.zip Best 5 scripts presented in lab 3 pass:infected ] ====<br /> <br /> === [https://docs.google.com/spreadsheet/viewform?fromEmail=true&amp;formkey=dElWNDBOc2NDWXBZaGhjRHd1bVVfekE6MA QUIZ] ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> <br /> === 2013.09.04 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB1 Lab 1 Due date 13 sept. 2013 Kill date 2 October] ===<br /> <br /> === 2013.09.12 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2 Lab 2 Due date 27 sept. 2013 Kill date 11 October] ===<br /> <br /> <br /> === 2013.09.18 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3 Lab 3 Due date 4 oct. 2013 Kill date 18 October] ===<br /> <br /> <br /> === 2013.10.03 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB4 Lab 4 Due date 25 oct. 2013] ===<br /> <br /> === 2013.10.03 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB5 Lab 5 Due date 25 oct. 2013] ===<br /> <br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.09.02 [https://docs.google.com/presentation/d/1DXh_TjnqzfMViS2FPRDPhsTPwZCSGChD6P1OrgDcZzc/edit?usp=sharing First lecture/ Introduction] ===<br /> <br /> === 2013.09.09 [https://docs.google.com/presentation/d/1bOrif9o7gtKpGppYnAXqXdi_4JXwZ_Hap4l597erZDo/edit?usp=sharing Second lecture ] ===<br /> <br /> === 2013.09.16 [https://docs.google.com/presentation/d/1vsxRfMd_vG53dkhDx7xUbmZj20QiHUOVvBTX5LI1tsI/edit?usp=sharing Thrid lecture] ===<br /> <br /> === 2013.09.23 [https://docs.google.com/file/d/0BwLcblFEXx61ZUdiMGlIZ3BpMVk/edit?usp=sharing Forth lecture Tiit about banking malware] ===<br /> <br /> === 2013.09.30 [https://docs.google.com/presentation/d/1dCfAfS4n0BRvYMMZEC602JcAqPzqFAn5gWsj31yuhU4/edit?usp=sharing Fifth lecture Anto Veldre] ===<br /> <br /> === 2013.10.07 [https://docs.google.com/file/d/0BwLcblFEXx61cHNUb2drVC16MFk/edit?usp=sharing Sixth lecture Mw incident handling] ===<br /> <br /> === 2013.10.14 [https://docs.google.com/presentation/d/1hQE6Uoq7vw5mcH-ns6cny-q9v3g6bvtNf4izUmtx7S4/edit?usp=sharing Seventh lecture Mw incident handling] ===<br /> <br /> === 2013.10.21 [https://docs.google.com/presentation/d/1nszGkCIbqc8-y5Hgy05EoNodf8-2ZAcH6mUAEoj1DHs/edit?usp=sharing Eight lecture Mw incident handling] ===</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013&diff=10936 2013-10-22T01:25:29Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> ====Kill meand if you not presented your lab work for this time you are automaticly Faild cource ! ====<br /> <br /> Between Due and Kill you will be penalized !<br /> <br /> ==== [https://docs.google.com/spreadsheet/ccc?key=0AhARjqsUbwN_dEZiOFBiakhOTjQ0NXBnSzFVUmotUVE#gid=0 Current status of homework grading ] ====<br /> <br /> ==== [http://lambda.ee/w/images/2/27/Bestscripst.zip Best 5 scripts presented in lab 3 pass:infected ] ====<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> <br /> === 2013.09.04 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB1 Lab 1 Due date 13 sept. 2013 Kill date 2 October] ===<br /> <br /> === 2013.09.12 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2 Lab 2 Due date 27 sept. 2013 Kill date 11 October] ===<br /> <br /> <br /> === 2013.09.18 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3 Lab 3 Due date 4 oct. 2013 Kill date 18 October] ===<br /> <br /> <br /> === 2013.10.03 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB4 Lab 4 Due date 25 oct. 2013] ===<br /> <br /> === 2013.10.03 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB5 Lab 5 Due date 25 oct. 2013] ===<br /> <br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.09.02 [https://docs.google.com/presentation/d/1DXh_TjnqzfMViS2FPRDPhsTPwZCSGChD6P1OrgDcZzc/edit?usp=sharing First lecture/ Introduction] ===<br /> <br /> === 2013.09.09 [https://docs.google.com/presentation/d/1bOrif9o7gtKpGppYnAXqXdi_4JXwZ_Hap4l597erZDo/edit?usp=sharing Second lecture ] ===<br /> <br /> === 2013.09.16 [https://docs.google.com/presentation/d/1vsxRfMd_vG53dkhDx7xUbmZj20QiHUOVvBTX5LI1tsI/edit?usp=sharing Thrid lecture] ===<br /> <br /> === 2013.09.23 [https://docs.google.com/file/d/0BwLcblFEXx61ZUdiMGlIZ3BpMVk/edit?usp=sharing Forth lecture Tiit about banking malware] ===<br /> <br /> === 2013.09.30 [https://docs.google.com/presentation/d/1dCfAfS4n0BRvYMMZEC602JcAqPzqFAn5gWsj31yuhU4/edit?usp=sharing Fifth lecture Anto Veldre] ===<br /> <br /> === 2013.10.07 [https://docs.google.com/file/d/0BwLcblFEXx61cHNUb2drVC16MFk/edit?usp=sharing Sixth lecture Mw incident handling] ===<br /> <br /> === 2013.10.14 [https://docs.google.com/presentation/d/1hQE6Uoq7vw5mcH-ns6cny-q9v3g6bvtNf4izUmtx7S4/edit?usp=sharing Seventh lecture Mw incident handling] ===<br /> <br /> === 2013.10.21 [https://docs.google.com/presentation/d/1nszGkCIbqc8-y5Hgy05EoNodf8-2ZAcH6mUAEoj1DHs/edit?usp=sharing Eight lecture Mw incident handling] ===</div>

Lepik http://www.lambda.ee/w/index.php?title=Fail:Bestscripst.zip&diff=10935 2013-10-22T01:24:26Z

<p>Lepik: Scripts</p> <hr /> <div>Scripts</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013&diff=10826 2013-10-10T17:24:10Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> ====Kill meand if you not presented your lab work for this time you are automaticly Faild cource ! ====<br /> <br /> Between Due and Kill you will be penalized !<br /> <br /> ==== [https://docs.google.com/spreadsheet/ccc?key=0AhARjqsUbwN_dEZiOFBiakhOTjQ0NXBnSzFVUmotUVE#gid=0 Current status of homework grading ] ====<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> <br /> === 2013.09.04 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB1 Lab 1 Due date 13 sept. 2013 Kill date 2 October] ===<br /> <br /> === 2013.09.12 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2 Lab 2 Due date 27 sept. 2013 Kill date 11 October] ===<br /> <br /> <br /> === 2013.09.18 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3 Lab 3 Due date 4 oct. 2013 Kill date 18 October] ===<br /> <br /> <br /> === 2013.10.03 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB4 Lab 4 Due date 25 oct. 2013] ===<br /> <br /> === 2013.10.03 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB5 Lab 5 Due date 25 oct. 2013] ===<br /> <br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.09.02 [https://docs.google.com/presentation/d/1DXh_TjnqzfMViS2FPRDPhsTPwZCSGChD6P1OrgDcZzc/edit?usp=sharing First lecture/ Introduction] ===<br /> <br /> === 2013.09.09 [https://docs.google.com/presentation/d/1bOrif9o7gtKpGppYnAXqXdi_4JXwZ_Hap4l597erZDo/edit?usp=sharing Second lecture ] ===<br /> <br /> === 2013.09.16 [https://docs.google.com/presentation/d/1vsxRfMd_vG53dkhDx7xUbmZj20QiHUOVvBTX5LI1tsI/edit?usp=sharing Thrid lecture] ===<br /> <br /> === 2013.09.23 [https://docs.google.com/file/d/0BwLcblFEXx61ZUdiMGlIZ3BpMVk/edit?usp=sharing Forth lecture Tiit about banking malware] ===<br /> <br /> === 2013.09.30 [https://docs.google.com/presentation/d/1dCfAfS4n0BRvYMMZEC602JcAqPzqFAn5gWsj31yuhU4/edit?usp=sharing Fifth lecture Anto Veldre] ===<br /> <br /> === 2013.10.07 [https://docs.google.com/file/d/0BwLcblFEXx61cHNUb2drVC16MFk/edit?usp=sharing Sixth lecture Mw incident handling] ===</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB5&diff=10825 2013-10-10T17:16:59Z

<p>Lepik: Uus lehekülg: &#039;== LAB5 == ===Additional Reading + presentations!=== [ Presentation1] ===Assignment=== ==== Write an incident report.==== Intsident report template [http://lambda.ee/w/ima...&#039;</p> <hr /> <div>== LAB5 ==<br /> <br /> ===Additional Reading + presentations!===<br /> <br /> [ Presentation1]<br /> <br /> <br /> ===Assignment===<br /> <br /> ==== Write an incident report.====<br /> <br /> Intsident report template [http://lambda.ee/w/images/1/1c/Turvaintsidendi_raporti_vorm_eng.doc Turvaintsidendi_raporti_vorm_eng.doc]<br /> <br /> <br /> === Baseline for incidnet reporting ===<br /> <br /> * 3 different computers are infected with malware you choose in lab 4 <br /> (you can choose which computer is infected with witch malware.)<br /> * computers are located in different network segments <br /> * Company uses 2 different antivirus products Forefront and Bitdefender (brought with computers) <br /> *[http://lambda.ee/w/images/1/14/4190827.png Company network layout]<br /> * Network consist clients with OS windows xp sp3 , windows 7 sp 1 , windows 7.<br /> <br /> <br /> <br /> === Timeline ===<br /> <br /> * 3.oct.2013 17:00 User Tädi maali notice that her computer with win xp behaved in unusual way <br /> * 3.oct.2013 18:30 User Onu jüri mentioned to passing administrator that antivirus warned him about file he downloaded to his Win 7 machine.<br /> * you should describe future time line as you imagine it.</div>

Lepik http://www.lambda.ee/w/index.php?title=Fail:4190827.png&diff=10824 2013-10-10T16:21:27Z

<p>Lepik: </p> <hr /> <div></div>

Lepik http://www.lambda.ee/w/index.php?title=Fail:Turvaintsidendi_raporti_vorm_eng.doc&diff=10823 2013-10-10T15:56:31Z

<p>Lepik: Võimalik Raporti vorm inglisekeeles ..</p> <hr /> <div>Võimalik Raporti vorm inglisekeeles ..</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB4&diff=10744 2013-10-07T03:16:59Z

<p>Lepik: Uus lehekülg: &#039;== LAB4 == ===Additional Reading + presentations!=== [https://docs.google.com/presentation/d/1pdKyKTI91p7lIQPvM34Fv8mC_VK82pHJe6eyw6dslSI/edit?usp=sharing Slides for lab] ===...&#039;</p> <hr /> <div>== LAB4 ==<br /> <br /> ===Additional Reading + presentations!===<br /> <br /> [https://docs.google.com/presentation/d/1pdKyKTI91p7lIQPvM34Fv8mC_VK82pHJe6eyw6dslSI/edit?usp=sharing Slides for lab]<br /> <br /> === Exercise specifics are in slides ===<br /> <br /> === Things to consider in exercise ===<br /> <br /> *File Has sha 256 and md5<br /> *Search it in Virus Total<br /> *strings analysis<br /> *Use two out of three for quick and dirty <br /> <br /> https://www.virustotal.com/<br /> http://camas.comodo.com/<br /> http://www.threatexpert.com/submit.aspx<br /> <br /> *Find at least 2 additional places for quick and dirty analysis<br /> *Compare results<br /> <br /> === Things to present in report ===<br /> <br /> * Where and how you found additional file <br /> * Hashes for each file <br /> * Most common name (each name differently but what was most common known name) for each file<br /> * Strings that sound meanigful for you and why <br /> * Links to quick and dirty analysis <br /> * Interesting features that you have learned.<br /> * Quick solution how to fix without having anti-virus.<br /> <br /> <br /> <br /> =====Plagiarizing from is PROHIBITED! =====</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3&diff=10743 2013-10-07T03:06:53Z

<p>Lepik: /* Additional Reading + presentations! */</p> <hr /> <div>== LAB3 ==<br /> <br /> ===Additional Reading + presentations!===<br /> <br /> <br /> [https://docs.google.com/file/d/0BwLcblFEXx61bHBCazRvYWxXN0U/edit?usp=sharing Slides for lab]<br /> <br /> ===Assignment===<br /> <br /> Find USB Thumb Drive or SD card (any media less than 128 GB will do). If new then put some files on and delete some.<br /> <br /> * Make an image <br /> * Try to restore data <br /> * Do not forget to document the process <br /> <br /> Present documentation of the procedure !<br /> <br /> <br /> =====Plagiarizing from is PROHIBITED! - (NB! http://predragtasevski.com/attacks_cracking/costofddoscreditcardspam/)=====</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3&diff=10742 2013-10-07T03:06:32Z

<p>Lepik: </p> <hr /> <div>== LAB3 ==<br /> <br /> ===Additional Reading + presentations!===<br /> <br /> <br /> [https://docs.google.com/file/d/0BwLcblFEXx61bHBCazRvYWxXN0U/edit?usp=sharing Slaides for lab]<br /> <br /> <br /> ===Assignment===<br /> <br /> Find USB Thumb Drive or SD card (any media less than 128 GB will do). If new then put some files on and delete some.<br /> <br /> * Make an image <br /> * Try to restore data <br /> * Do not forget to document the process <br /> <br /> Present documentation of the procedure !<br /> <br /> <br /> =====Plagiarizing from is PROHIBITED! - (NB! http://predragtasevski.com/attacks_cracking/costofddoscreditcardspam/)=====</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3&diff=10741 2013-10-07T03:04:04Z

<p>Lepik: </p> <hr /> <div>== LAB3 ==<br /> <br /> ===Additional Reading + presentations!===<br /> <br /> <br /> <br /> <br /> ===Assignment===<br /> <br /> Find USB Thumb Drive or SD card (any media less than 128 GB will do). If new then put some files on and delete some.<br /> <br /> * Make an image <br /> * Try to restore data <br /> * Do not forget to document the process <br /> <br /> Present documentation of the procedure !<br /> <br /> <br /> =====Plagiarizing from is PROHIBITED! - (NB! http://predragtasevski.com/attacks_cracking/costofddoscreditcardspam/)=====</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013&diff=10740 2013-10-07T03:01:26Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> ====Kill meand if you not presented your lab work for this time you are automaticly Faild cource ! ====<br /> <br /> Between Due and Kill you will be penalized !<br /> <br /> ==== [https://docs.google.com/spreadsheet/ccc?key=0AhARjqsUbwN_dEZiOFBiakhOTjQ0NXBnSzFVUmotUVE#gid=0 Current status of homework grading ] ====<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> <br /> === 2013.09.04 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB1 Lab 1 Due date 13 sept. 2013 Kill date 2 October] ===<br /> <br /> === 2013.09.12 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2 Lab 2 Due date 27 sept. 2013 Kill date 11 October] ===<br /> <br /> <br /> === 2013.09.18 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3 Lab 3 Due date 4 oct. 2013] ===<br /> <br /> <br /> === 2013.10.03 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB4 Lab 4 Due date 25 oct. 2013] ===<br /> <br /> <br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.09.02 [https://docs.google.com/presentation/d/1DXh_TjnqzfMViS2FPRDPhsTPwZCSGChD6P1OrgDcZzc/edit?usp=sharing First lecture/ Introduction] ===<br /> <br /> === 2013.09.09 [https://docs.google.com/presentation/d/1bOrif9o7gtKpGppYnAXqXdi_4JXwZ_Hap4l597erZDo/edit?usp=sharing Second lecture ] ===<br /> <br /> === 2013.09.16 [https://docs.google.com/presentation/d/1vsxRfMd_vG53dkhDx7xUbmZj20QiHUOVvBTX5LI1tsI/edit?usp=sharing Thrid lecture] ===<br /> <br /> === 2013.09.23 [https://docs.google.com/file/d/0BwLcblFEXx61ZUdiMGlIZ3BpMVk/edit?usp=sharing Forth lecture Tiit about banking malware] ===<br /> <br /> === 2013.09.30 [https://docs.google.com/presentation/d/1dCfAfS4n0BRvYMMZEC602JcAqPzqFAn5gWsj31yuhU4/edit?usp=sharing Fifth lecture Anto Veldre] ===<br /> <br /> === 2013.10.07 [ Sixth lecture] ===</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013&diff=10715 2013-10-01T03:51:15Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> ====Kill meand if you not presented your lab work for this time you are automaticly Faild cource ! ====<br /> <br /> Between Due and Kill you will be penalized !<br /> <br /> ==== [https://docs.google.com/spreadsheet/ccc?key=0AhARjqsUbwN_dEZiOFBiakhOTjQ0NXBnSzFVUmotUVE#gid=0 Current status of homework grading ] ====<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> <br /> === 2013.09.04 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB1 Lab 1 Due date 13 sept. 2013 Kill date 2 October] ===<br /> <br /> === 2013.09.12 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2 Lab 2 Due date 27 sept. 2013] ===<br /> <br /> <br /> === 2013.09.18 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3 Lab 3 Due date 4 oct. 2013] ===<br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.09.02 [https://docs.google.com/presentation/d/1DXh_TjnqzfMViS2FPRDPhsTPwZCSGChD6P1OrgDcZzc/edit?usp=sharing First lecture/ Introduction] ===<br /> <br /> === 2013.09.09 [https://docs.google.com/presentation/d/1bOrif9o7gtKpGppYnAXqXdi_4JXwZ_Hap4l597erZDo/edit?usp=sharing Second lecture ] ===<br /> <br /> === 2013.09.16 [https://docs.google.com/presentation/d/1vsxRfMd_vG53dkhDx7xUbmZj20QiHUOVvBTX5LI1tsI/edit?usp=sharing Thrid lecture] ===<br /> <br /> === 2013.09.23 [https://docs.google.com/file/d/0BwLcblFEXx61ZUdiMGlIZ3BpMVk/edit?usp=sharing Forth lecture Tiit about banking malware] ===<br /> <br /> === 2013.09.30 [ Fif lecture] ===</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013&diff=10699 2013-09-30T11:28:11Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> ====Kill meand if you not presented your lab work for this time you are automaticly Faild cource ! ====<br /> <br /> Between Due and Kill you will be penalized !<br /> <br /> <br /> == LABS/Homework ==<br /> <br /> <br /> === 2013.09.04 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB1 Lab 1 Due date 13 sept. 2013 Kill date 2 October] ===<br /> <br /> === 2013.09.12 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2 Lab 2 Due date 27 sept. 2013] ===<br /> <br /> <br /> === 2013.09.18 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3 Lab 3 Due date 4 oct. 2013] ===<br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.09.02 [https://docs.google.com/presentation/d/1DXh_TjnqzfMViS2FPRDPhsTPwZCSGChD6P1OrgDcZzc/edit?usp=sharing First lecture/ Introduction] ===<br /> <br /> === 2013.09.09 [https://docs.google.com/presentation/d/1bOrif9o7gtKpGppYnAXqXdi_4JXwZ_Hap4l597erZDo/edit?usp=sharing Second lecture ] ===<br /> <br /> === 2013.09.16 [https://docs.google.com/presentation/d/1vsxRfMd_vG53dkhDx7xUbmZj20QiHUOVvBTX5LI1tsI/edit?usp=sharing Thrid lecture] ===<br /> <br /> === 2013.09.23 [https://docs.google.com/file/d/0BwLcblFEXx61ZUdiMGlIZ3BpMVk/edit?usp=sharing Forth lecture Tiit about banking malware] ===<br /> <br /> === 2013.09.30 [ Fif lecture] ===</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013&diff=10639 2013-09-18T23:52:48Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> ====Kill meand if you not presented your lab work for this time you are automaticly Faild cource ! ====<br /> <br /> Between Due and Kill you will be penalized !<br /> <br /> <br /> == LABS/Homework ==<br /> <br /> <br /> === 2013.09.04 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB1 Lab 1 Due date 13 sept. 2013 Kill date 2 October] ===<br /> <br /> === 2013.09.12 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2 Lab 2 Due date 27 sept. 2013] ===<br /> <br /> <br /> === 2013.09.18 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3 Lab 3 Due date 4 oct. 2013] ===<br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.09.02 [https://docs.google.com/presentation/d/1DXh_TjnqzfMViS2FPRDPhsTPwZCSGChD6P1OrgDcZzc/edit?usp=sharing First lecture/ Introduction] ===<br /> <br /> === 2013.09.09 [https://docs.google.com/presentation/d/1bOrif9o7gtKpGppYnAXqXdi_4JXwZ_Hap4l597erZDo/edit?usp=sharing Second lecture ] ===<br /> <br /> === 2013.09.16 [https://docs.google.com/presentation/d/1vsxRfMd_vG53dkhDx7xUbmZj20QiHUOVvBTX5LI1tsI/edit?usp=sharing Thrid lecture] ===<br /> <br /> === 2013.09.23 [h Forth lecture] ===</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2&diff=10638 2013-09-18T23:49:56Z

<p>Lepik: </p> <hr /> <div><br /> == LAB2 ==<br /> <br /> ===Additional Reading + presentations!===<br /> <br /> [https://docs.google.com/presentation/d/1Wmm3-SAQzJRzZ9SgSTyniUWp9lz9vZqqDB6Zy6itlVM/edit?usp=sharing Presentation1]<br /> <br /> <br /> ===Assignment===<br /> <br /> deal with abuse .. <br /> <br /> for resolve take <br /> *5 names <br /> *20 ipv4 ip-s <br /> *5 ipv6 ip-s <br /> <br /> Scripting is higly recomended.<br /> include information sources / scripts you used to deal with this exercise.<br /> Some scripts will be published for you review and you get choose scripts whos writers will be awarded ! <br /> <br /> <br /> ====1.Find ip for that name and aditional names (if ip has some).====<br /> *[https://docs.google.com/file/d/0BwLcblFEXx61dVJvQlNSanNIT0E/edit?pli=1 Names]<br /> <br /> Take your birfday day date add numbers together + Random number (echo $RANDOM) take mod 106 take 5 names. <br /> <br /> <br /> <br /> ====2.IP , AS , Abuse@mail.aadress (how you notifiy that ip adress owner ?) CERT Responssible to contacts ====<br /> <br /> *[http://pastebin.com/CnUq0Agu IP adresses] <br /> <br /> Take your birfday day date add numbers together +(echo $RANDOM) take mod 1000 add 400 take 20 ip-s <br /> <br /> <br /> ====3. For 5 th ip of 20 establishe wich is 3 AS as upstream from your location ====<br /> <br /> <br /> <br /> ====4.IP v6 , AS number , name company assigend to., abuse@mail adress . CERT Responssible to contacts ====<br /> <br /> * [https://docs.google.com/file/d/0BwLcblFEXx61Rk11YmdORE9JQ00/edit?usp=sharing IPv6 adress] <br /> <br /> Take your birfday day date add numbers together + (echo $RANDOM) take mod 456 take 5 ip-s <br /> <br /> <br /> <br /> ====Common Mistakes and Suggestions:====<br /> <br /> Good answer would include <br /> Number you arived with each execise.<br /> <br /> <br /> My number is = <br /> <br /> <br /> Names - (89)<br /> <br /> name IP known names<br /> <br /> 42.111.106.194.in-addr.arpa. 194.106.111.42 www.ee , web.www.ee<br /> ..<br /> <br /> <br /> IP-s <br /> <br /> <br /> 194.106.111.42 abuse@elion.ee RT Tarkvara OY CERT-EE cert@cert.ee <br /> <br /> <br /> <br /> =====Plagiarizing from is PROHIBITED! - (NB! http://predragtasevski.com/attacks_cracking/costofddoscreditcardspam/)=====</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2&diff=10637 2013-09-18T23:44:16Z

<p>Lepik: </p> <hr /> <div><br /> == LAB2 ==<br /> <br /> ===Additional Reading + presentations!===<br /> <br /> <br /> <br /> <br /> ===Assignment===<br /> <br /> deal with abuse .. <br /> <br /> for resolve take <br /> *5 names <br /> *20 ipv4 ip-s <br /> *5 ipv6 ip-s <br /> <br /> Scripting is higly recomended.<br /> include information sources / scripts you used to deal with this exercise.<br /> Some scripts will be published for you review and you get choose scripts whos writers will be awarded ! <br /> <br /> <br /> ====1.Find ip for that name and aditional names (if ip has some).====<br /> *[https://docs.google.com/file/d/0BwLcblFEXx61dVJvQlNSanNIT0E/edit?pli=1 Names]<br /> <br /> Take your birfday day date add numbers together + Random number (echo $RANDOM) take mod 106 take 5 names. <br /> <br /> <br /> <br /> ====2.IP , AS , Abuse@mail.aadress (how you notifiy that ip adress owner ?) CERT Responssible to contacts ====<br /> <br /> *[http://pastebin.com/CnUq0Agu IP adresses] <br /> <br /> Take your birfday day date add numbers together +(echo $RANDOM) take mod 1000 add 400 take 20 ip-s <br /> <br /> <br /> ====3. For 5 th ip of 20 establishe wich is 3 AS as upstream from your location ====<br /> <br /> <br /> <br /> ====4.IP v6 , AS number , name company assigend to., abuse@mail adress . CERT Responssible to contacts ====<br /> <br /> * [https://docs.google.com/file/d/0BwLcblFEXx61Rk11YmdORE9JQ00/edit?usp=sharing IPv6 adress] <br /> <br /> Take your birfday day date add numbers together + (echo $RANDOM) take mod 456 take 5 ip-s <br /> <br /> <br /> <br /> ====Common Mistakes and Suggestions:====<br /> <br /> Good answer would include <br /> Number you arived with each execise.<br /> <br /> <br /> My number is = <br /> <br /> <br /> Names - (89)<br /> <br /> name IP known names<br /> <br /> 42.111.106.194.in-addr.arpa. 194.106.111.42 www.ee , web.www.ee<br /> ..<br /> <br /> <br /> IP-s <br /> <br /> <br /> 194.106.111.42 abuse@elion.ee RT Tarkvara OY CERT-EE cert@cert.ee <br /> <br /> <br /> <br /> =====Plagiarizing from is PROHIBITED! - (NB! http://predragtasevski.com/attacks_cracking/costofddoscreditcardspam/)=====</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3&diff=10636 2013-09-18T23:42:26Z

<p>Lepik: Uus lehekülg: &#039;== LAB2 == ===Additional Reading + presentations!=== ===Assignment=== Find USB Thumb Drive or SD card (any media less than 128 GB will do). If new then put some files on ...&#039;</p> <hr /> <div>== LAB2 ==<br /> <br /> ===Additional Reading + presentations!===<br /> <br /> <br /> <br /> <br /> ===Assignment===<br /> <br /> Find USB Thumb Drive or SD card (any media less than 128 GB will do). If new then put some files on and delete some.<br /> <br /> * Make an image <br /> * Try to restore data <br /> * Do not forget to document the process <br /> <br /> Present documentation of the procedure !<br /> <br /> <br /> =====Plagiarizing from is PROHIBITED! - (NB! http://predragtasevski.com/attacks_cracking/costofddoscreditcardspam/)=====</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013&diff=10635 2013-09-18T23:38:46Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> <br /> === 2013.09.04 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB1 Lab 1 Due date 13 sept. 2013 Kill date 2 October] ===<br /> <br /> === 2013.09.12 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2 Lab 2 Due date 27 sept. 2013] ===<br /> <br /> <br /> === 2013.09.18 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB3 Lab 3 Due date 4 oct. 2013] ===<br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.09.02 [https://docs.google.com/presentation/d/1DXh_TjnqzfMViS2FPRDPhsTPwZCSGChD6P1OrgDcZzc/edit?usp=sharing First lecture/ Introduction] ===<br /> <br /> === 2013.09.09 [https://docs.google.com/presentation/d/1bOrif9o7gtKpGppYnAXqXdi_4JXwZ_Hap4l597erZDo/edit?usp=sharing Second lecture ] ===<br /> <br /> === 2013.09.16 [Thrid lecture/] ===</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013&diff=10634 2013-09-18T23:32:55Z

<p>Lepik: /* 2013.09.04 Lab 1 Due date 13 sept. 2013 */</p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> <br /> === 2013.09.04 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB1 Lab 1 Due date 13 sept. 2013 Kill date 2 October] ===<br /> <br /> === 2013.09.12 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2 Lab 2 Due date 27 sept. 2013] ===<br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.09.02 [https://docs.google.com/presentation/d/1DXh_TjnqzfMViS2FPRDPhsTPwZCSGChD6P1OrgDcZzc/edit?usp=sharing First lecture/ Introduction] ===<br /> <br /> === 2013.09.09 [https://docs.google.com/presentation/d/1bOrif9o7gtKpGppYnAXqXdi_4JXwZ_Hap4l597erZDo/edit?usp=sharing Second lecture ] ===<br /> <br /> === 2013.09.16 [Thrid lecture/] ===</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2&diff=10602 2013-09-12T17:53:21Z

<p>Lepik: </p> <hr /> <div><br /> == LAB2 ==<br /> <br /> ===Additional Reading + presentations!===<br /> <br /> <br /> <br /> <br /> ===Assignment===<br /> <br /> deal with abuse .. <br /> <br /> for resolve take <br /> *5 names <br /> *20 ipv4 ip-s <br /> *5 ipv6 ip-s <br /> <br /> Scripting is higly recomended.<br /> include information sources / scripts you used to deal with this exercise.<br /> Some scripts will be published for you review and you get choose scripts whos writers will be awarded ! <br /> <br /> <br /> ====1.Find ip for that name and aditional names (if ip has some).====<br /> *[https://docs.google.com/file/d/0BwLcblFEXx61dVJvQlNSanNIT0E/edit?pli=1 Names]<br /> <br /> Take your birfday day date add numbers together + Random number (echo $RANDOM) take mod 106 take 5 names. <br /> <br /> <br /> <br /> ====2.IP , AS , Abuse@mail.aadress (how you notifiy that ip adress owner ?) CERT Responssible to contacts ====<br /> <br /> *[http://pastebin.com/CnUq0Agu IP adresses] <br /> <br /> Take your birfday day date add numbers together +(echo $RANDOM) take mod 1000 add 400 take 20 ip-s <br /> <br /> <br /> ====3.IP v6 , AS number , name company assigend to., abuse@mail adress . CERT Responssible to contacts ====<br /> <br /> * [https://docs.google.com/file/d/0BwLcblFEXx61Rk11YmdORE9JQ00/edit?usp=sharing IPv6 adress] <br /> <br /> Take your birfday day date add numbers together + (echo $RANDOM) take mod 456 take 5 ip-s <br /> <br /> <br /> <br /> ====Common Mistakes and Suggestions:====<br /> <br /> Good answer would include <br /> Number you arived with each execise.<br /> <br /> <br /> My number is = <br /> <br /> <br /> Names - (89)<br /> <br /> name IP known names<br /> <br /> 42.111.106.194.in-addr.arpa. 194.106.111.42 www.ee , web.www.ee<br /> ..<br /> <br /> <br /> IP-s <br /> <br /> <br /> 194.106.111.42 abuse@elion.ee RT Tarkvara OY CERT-EE cert@cert.ee <br /> <br /> <br /> <br /> =====Plagiarizing from is PROHIBITED! - (NB! http://predragtasevski.com/attacks_cracking/costofddoscreditcardspam/)=====</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013&diff=10601 2013-09-12T16:27:20Z

<p>Lepik: </p> <hr /> <div><br /> = Welcome =<br /> <br /> == About ==<br /> <br /> <br /> <br /> == LABS/Homework ==<br /> <br /> <br /> === 2013.09.04 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB1 Lab 1 Due date 13 sept. 2013] ===<br /> === 2013.09.12 [http://lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2 Lab 2 Due date 27 sept. 2013] ===<br /> <br /> <br /> <br /> == LECTURES ==<br /> <br /> === 2013.09.02 [https://docs.google.com/presentation/d/1DXh_TjnqzfMViS2FPRDPhsTPwZCSGChD6P1OrgDcZzc/edit?usp=sharing First lecture/ Introduction] ===<br /> <br /> === 2013.09.09 [https://docs.google.com/presentation/d/1bOrif9o7gtKpGppYnAXqXdi_4JXwZ_Hap4l597erZDo/edit?usp=sharing Second lecture ] ===<br /> <br /> === 2013.09.16 [Thrid lecture/] ===</div>

Lepik http://www.lambda.ee/w/index.php?title=Malware:ITX8042:2013:LAB2&diff=10593 2013-09-12T03:27:42Z

<p>Lepik: Uus lehekülg: &#039; == LAB2 == ===Additional Reading + presentations!=== ===Assignment=== ====1. .==== ====2. ==== ====3. .==== * ====4..==== * ====5. ==== * ====Common ...&#039;</p> <hr /> <div><br /> == LAB2 ==<br /> <br /> ===Additional Reading + presentations!===<br /> <br /> <br /> <br /> <br /> ===Assignment===<br /> <br /> <br /> ====1. .====<br /> <br /> ====2. ====<br /> <br /> ====3. .====<br /> *<br /> ====4..====<br /> *<br /> ====5. ====<br /> *<br /> ====Common Mistakes and Suggestions:====<br /> <br /> L<br /> <br /> <br /> =====Plagiarizing from is PROHIBITED! - (NB! http://predragtasevski.com/attacks_cracking/costofddoscreditcardspam/)=====<br /> <br /> <br /> =</div>

Lepik