Do I still have any regular readers left? I hope so, even though I’ve greatly neglected you. I wont even bother with excuses. BUT, here’s a post to prove that I still know what I’m doing!

So, if you’ve been following some of the other blogs (specifically, Krebs), you’ve probably seen the hubbub about ZeusTracker. If not, I highly recommend you click on that previous link and go read. It’s long, but quite interesting.

ZeuS, if you’re unaware, is a big botnet that’s used heavily in cyber crime. You don’t want to get infected by this. To those who manage networks: You don’t want your users to get infected by this.

ZeusTracker is watching for Zeus C&C traffic via honeypots and documenting the known hosts/domains/IP’s associated with them. They’ve created a nice list that can be easily imported in to iptables, Windows host files, Squid, et. al.

I run Squid on one of the gateways here, so I decided to utilize that to implement this blacklist. Squid makes this incredibly simple, which is also a big plus.

In your Squid config file, you’ll see a section that’s all about ACL’s (access control lists). If you scroll down far enough, you’ll see a section that says:

# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS

So, the simplest way to implement a blacklist is by adding the following just below that comment. Mine looks like this:

# ZeuS C&C domains
acl blocksites url_regex "/etc/squid/zeus.txt"
http_access deny blocksites

Pretty simple, eh?

‘Course, now you have to create the “zeus.txt” file, otherwise that rule isn’t going to do you any good. If you go to here, you’ll see a list of files that all contain the hosts & ip’s that ZeusTracker knows about. In this case, you want the one formatted for Squid.

Now, you’ll need for this to update, say, daily, so you’ll need to create a script and invoke it via Crontab. Here’s my stupid-simple script:

#!/bin/sh
 
/bin/rm /etc/squid/zeus.txt
/usr/bin/curl "https://zeustracker.abuse.ch/blocklist.php?download=squidblocklist" >> /etc/squid/zeus.txt
/etc/init.d/squid restart

It simply deletes the current zeus.txt file, downloads the newest version via Curl, and then restarts Squid.

This is a really quick & easy way to (help) protect your network from this trojan/worm/whatever you want to call it. I’ve noticed recently that even a user who is running a fully patched version of Windows (Vista), with Google Chrome, this thing is still capable of infecting the machine. I haven’t found any real good information on how, but from what I’ve witnessed, it appears to be a Java exploit.

Anyway, give this a shot!

Related posts:

1. Browser headers and information leaks
2. Botnet Command and Control Methods
3. File Server LNK Protection