Hello and welcome to the Monday, June 29, 2006 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recording day from Riyadh, Saudi Arabia.

And this episode is brought you by the sands.edu bachelor's degree program

in Applied Cybersecurity. Well, in diaries today, we actually have yet another diary by one of

our bachelor's degree students. I just mentioned the bachelor's degree we offer as part of our

sans.edu college. As partnership here, we have Nicole Phillips looking at some

of the background noise that you are seeing in honeypots. And of course, that background noise can

quickly be overwhelming. In particular, since much of that background noise really doesn't

appear to be relevant as far as current exploits go.

The vulnerabilities being exploited are often decades old and, well, in many cases, actually,

the exploits being used are not even functional.

But what Nicole here is pointing out that even though there is a lot of garbage essentially being sent at the honeypot,

there are also some newer threats that are very relevant and are easily drowned by all the noise that the honeypot receives.

And, well, just like in a real system you're protecting, so not a honeypot, it can be quite difficult sometimes to isolate this relevant activity from all the background noise, because overall the requests and patterns often look very similar.

So what you're seeing here is a little bit a breakdown in this diary of the different attacks being seen, what the exploits are that are being exploited, and well, some of the newer threats and the one here being Rondo, but that's something that I've mentioned a few times in the past, that very aggressively, as Nicole points out, picks out newer vulnerabilities and

adds them to the repertoire of scans against vulnerable systems that are covering the internet

very quickly and sometimes several times a day.

And then you have a second diary from late last week, and that's by Xavier, about how to

manipulate the process name that's being reported in Linux.

Now, there are really two locations.

The process name is kept in the proc directory for the respective process.

One is com, COMM. Well, that's just the process name. That's easy to

...