How detecting a botnet from a pcap file ?
I want to know if there is a way to detect a botnet like Ares botnet from a pcap file please ?
1 Answer
- Sort by
oldest newest most voted
0
Article with link to the original report.
the Ares infection preys on the poorly secured configurations many set-top boxes use with the ADB debugging interface in Android. In many of the boxes, TCP port 5555 has been opened for both ADB and remote management commands, making it an easy target to any attacker able to scan the open internet.
Do you have a baseline for "normal" in your network? Does it include adb traffic?
The attack uses android adb.
A display filter of tcp.port==5555 or tcp.port in {5555..5585} would be a good start.
Comments
I dont apply for Android. I used it for linux machine. I tested tcp.port==5555 or tcp.port in {5555..5585} but they are not used
Your Answer
Please start posting anonymously - your entry will be published after you log in or create a new account.
This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.
Comments