[Dailydave] Dshell versus INNUENDO

J. Craig 3141592f at gmail.com
Tue Feb 3 17:31:46 EST 2015


Firstly, props to the dshell team for making that decoder and releasing it.

Secondly, you shouldn't need a decoder to catch an implant using this type
of channel.  It's pretty high signal.

Thx,
Jason

On Tue, Feb 3, 2015 at 11:06 AM, Dave Aitel <dave at immunityinc.com> wrote:

>  The US Army recently released DShell
> <http://gizmodo.com/the-army-just-open-sourced-its-security-software-1683023527>,
> which they've been using to do network incident response, as open source.
> Part of it is a DNS decoder
> <https://github.com/USArmyResearchLab/Dshell/blob/master/decoders/dns/innuendo-dns.py>
> that tries to find INNUENDO traffic. Although they developed it only by
> looking at our demonstration video <https://vimeo.com/115206626> (note:
> email admin at immunityinc.com for an eval copy of INNUENDO!) we can confirm
> their script works (see below).
>
> It may, or may not, work against the *next* version of INNUENDO. ;>
>
> Thanks,
> Dave Aitel
> Immunity, Inc.
>
> [image: Dshell image]
>
> _______________________________________________
> Dailydave mailing list
> Dailydave at lists.immunityinc.com
> https://lists.immunityinc.com/mailman/listinfo/dailydave
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.immunityinc.com/pipermail/dailydave/attachments/20150203/889682d0/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dshell.png
Type: image/png
Size: 270242 bytes
Desc: not available
URL: <https://lists.immunityinc.com/pipermail/dailydave/attachments/20150203/889682d0/attachment-0001.png>


More information about the Dailydave mailing list