Ä¿ÇÇÇâÀÌ ³ª´Â *NIX
Ä¿ÇǴнº
½Ã½ºÅÛ/³×Æ®¿÷/º¸¾ÈÀ» ´Ù·ç´Â °÷
*
HanIRCÀÇ #coffeenix ¹æ
[
Àåºñ ¹× ȸ¼± ÈÄ¿ø
]
> Forum <
IT ÀÏÁ¤
N
e
w
!
ÀÚµ¿È ÇÁ·ÎÁ§Æ®
HOME
>
³×Æ®¿öÅ©(network)
>
¸ÞÀÏ ¼¹ö(mail)
>
¸ÞÀÏ ÇÊÅ͸µ(½ºÆÔ¸ÞÀÏ) / procmail
µµ¿ò¸»
°Ë»ö :
»çÀÌÆ®
WHOIS
À¥¼¹ö Á¾·ù
procmailÀ» ÀÌ¿ëÇؼ ¸¶ÀÌµÒ ¿ú(MyDoom Worm) ÇÊÅ͸µ
ÀÛ¼ºÀÏ : 2004/01/31 19:37
±Û¾´ÀÌ : ÁÁÀºÁøÈ£ (
http://coffeenix.net/
)
Á¶È¸¼ö : 8859
[
ÀÌÀüȸé
/
¼öÁ¤
] ºñ¹Ð¹øÈ£ :
Á¦ ¸ñ : procmailÀ» ÀÌ¿ëÇؼ ¸¶ÀÌµÒ ¿ú(MyDoom Worm) ÇÊÅ͸µ
ÀÛ¼ºÀÚ : ÁÁÀºÁøÈ£(truefeel,
http://coffeenix.net/
)
ÀÛ¼ºÀÏ : 2004.01.31
¸¶ÀÌµÒ ¿ú(MyDoom Worm)ÀÌ ±â½ÂÀ» ºÎ¸®°í ÀÖ½À´Ï´Ù. MyDoom.A, MyDoom.B¿¡ ÀÌÀº ¶Ç´Ù¸¥
º¯Á¾±îÁö ÇöÀç 4Á¾·ùÀÇ MyDoom ¿úÀÌ ¹ß°ßµÇ¾ú½À´Ï´Ù.
1. ÇÊÅ͸µ
procmailÀ» ÅëÇØ °£´ÜÈ÷ ¸·´Â ¹æ¹ýÀ» ¾Ë¾Æº¾½Ã´Ù.
/etc/procmailrc ¿¡ ´ÙÀ½À» Ãß°¡Çؼ º°µµ ÆÄÀÏ·Î ÀúÀåÇϰųª »èÁ¦ÇÒ ¼ö ÀÖ½À´Ï´Ù. (ºóÁÙ Æ÷ÇÔ 9ÁÙ)
WORM_LOG = "/var/log/worm.log"
:0HB
* > 25000
* < 45000
* ^Subject: ($|error|status|server report|mail (transaction failed|delivery subsystem)|hello|hi|test)
* charset=.?Windows-1252.?
* (file)?name=.*\.(bat|cmd|com|exe|pif|scr|zip)
$WORM_LOG
¸ÞÀÏ ³»¿ëÀº $WORM_LOG ·Î ¸ðµÎ ÀúÀå. ÇÊ¿ä¾øÀ¸¸é /dev/null ·Î Çϼ¼¿ä.
- ¸ÞÀÏ Å©±â´Â 25K~45K±îÁö
- Á¦¸ñÀÌ ¾ø´Â °ÍºÎÅÍ ´ë¼Ò¹®ÀÚ ±¸º°¾øÀÌ Hi, Hello, Test, ... µî ±îÁö
- º»¹®Áß¿¡ charset="Windows-1252" À» Æ÷ÇÔÇÏ°í
- ÷ºÎÆÄÀÏÀÌ .bat, .cmd, .com, .exe, .pif, .scr, .zipÀÎ °ÍÀ»
¸¶ÀÌµÒ ¿úÀ¸·Î ÆÇ´ÜÇÏ¿© ÇÊÅ͸µÇÕ´Ï´Ù.
2. Âü°í±Û
* Procmail·Î Worm/MyDoom.A ÇÊÅ͸µ
http://groups.google.co.kr/groups?selm=bv6920%24gdh%241%40FreeBSD.csie.NCTU.edu.tw&oe=UTF-8&output=gplain
* [C±Þ] Worm_MIMAIL.R(Worm_Mydoom.A) ¿¹º¸
http://www.certcc.or.kr/cvirc/Alert/warning/2004/Worm_mimail_r.html
* Win32/MyDoom.worm.22528 (MyDoom.A)
http://info.ahnlab.com/smart2u/virus_detail_1298.html
* Win32/MyDoom.worm.29184 (MyDoom.B, º¯Á¾)
http://info.ahnlab.com/smart2u/virus_detail_1299.html
* Win32/MyDoom.worm.32768 (º¯Á¾)
http://info.ahnlab.com/smart2u/virus_detail_1302.html
* Win32/MyDoom.worm.40448 (º¯Á¾)
http://info.ahnlab.com/smart2u/virus_detail_1303.html
Ä¿ÇǴнº Ä«Æä ÃÖ±Ù ±Û
[04/22]
Re: OpenSSL Ãë¾àÁ¡ Á¤¸®, Logjam(·Î±×Àë)¿¡¼ Heartbleed±îÁö
[04/21]
LET¡¯S START WITH ON
[04/21]
º¸Çè
[04/20]
Á¦ÁÖ
[04/20]
±¹³»
[04/19]
Á¦ÁÖ
[04/18]
??? ?????
[04/17]
???? onion ?????? -
[04/11]
±¹°¡
[04/10]
Stride Into Dream:
[03/20]
Re: ¿Â¶óÀΰÔÀÓÀÇ Á¾ÁÖ±¹ ´ëÇѹα¹
[10/20]
Cross Compiler ±ò
[07/14]
SSL ¬¡¬°
[04/26]
Re: µµ½ºÈ¸é ¿ø°ÝÁ¶Á¾ ¿©ºÎ
[04/25]
µµ½ºÈ¸é ¿ø°ÝÁ¶Á¾ ¿©ºÎ
N
e
w
! ÃÖ±Ù¿¡ µî·ÏÇÑ ÆäÀÌÁö
KiCad EDA Suite project (Free/Libre/Open-Source EDA Suite) (CAD)
¿ÀÇÂij½ºÄÉÀ̵å ijµå (OpenCASCADE CAD)
QCad for Windows --- GNU GPL (Free Software)
The Hello World Collection
IPMI¸¦ È°¿ëÇÑ ¸®´ª½º ¼¹ö°ü¸®
DNS ¼³Á¤ °Ë»ç
nagiosgraph ¼³Ä¡ ¹æ¹ý
Slony-I ¼³Ä¡ ¹æ¹ý (postgresql replication tool)
Qmail±â¹ÝÀÇ Anti spam ½Ã½ºÅÛ ±¸ÃàÇϱâ
clusterssh
[ ÇÔ²²ÇÏ´Â »çÀÌÆ® ]
¿î¿µÁø :
ÁÁÀºÁøÈ£(truefeel)
, ¾ß¼ö(yasu), ¹ü³ÃÀÌ, sCag
2003³â 8¿ù 4ÀÏ~