Printable View
There's an intersting article I found on securityfocus:
http://online.securityfocus.com/infocus/1605
This brings an interstring question: while we push for more encryption, it also makes detection with NIDSs... I guess a solution might be to favor distributed IDSs with central managment/logging. Some vendors are already pushing this but open source world doesn't seem to be catching on to this...
Ammo
ammo, this may be of interest to you, it’s a paper on the analysis of an IRC trojan.
Sorry i don't remember where i got it from!
That paper is online here. It was written as part of Lenny Zeltser's GCIH certification prcess. In other words, it was written for SANS. His homepage is http://www.zeltser.com/ . He has some neat toys and some other really good papers on his site, including one about intrusion detection.