Microsoft Unwraps HoneyMonkey Detection Project

Iria · Aug 6, 2005, 05:50 AM

Microsoft has officially lifted the wraps off its Strider HoneyMonkey research project, designed to trawl the dark side of the Internet looking for Web sites hosting malicious code.

Microsoft Corp. released a technical report, available here as a PDF, to introduce the concept of an Automated Web Patrol that uses multiple Windows XP machines, some unpatched and some fully updated, to streamline the process of finding zero-day Web-based exploits.

Yi-Min Wang, group manager of the Cybersecurity and Systems Management group in Microsoft Research, said a total of 752 unique URLs, hosted on 287 sites, were identified within the first month of launching the HoneyMonkey project.

From those URLs, the system was able to confirm that active exploits were infecting Windows XP machines, including one for a fully patched system running the company's newly hardened XP SP2 (Service Pack 2).

In an interview with Ziff Davis Internet News, Wang said his researchers were able to capture the connections between the exploit sites based on traffic redirection and pinpoint "several major players" who are responsible for a large number of exploit pages.
__________
Read More / Source: SBC Yahoo! News

Aug 6, 2005, 05:50 AM	#1
Iria DriverHeaven Extreme Member Join Date: Apr 2004 Posts: 7,275 Rep Power: 89	Microsoft Unwraps HoneyMonkey Detection Project Microsoft has officially lifted the wraps off its Strider HoneyMonkey research project, designed to trawl the dark side of the Internet looking for Web sites hosting malicious code. Microsoft Corp. released a technical report, available here as a PDF, to introduce the concept of an Automated Web Patrol that uses multiple Windows XP machines, some unpatched and some fully updated, to streamline the process of finding zero-day Web-based exploits. Yi-Min Wang, group manager of the Cybersecurity and Systems Management group in Microsoft Research, said a total of 752 unique URLs, hosted on 287 sites, were identified within the first month of launching the HoneyMonkey project. From those URLs, the system was able to confirm that active exploits were infecting Windows XP machines, including one for a fully patched system running the company's newly hardened XP SP2 (Service Pack 2). In an interview with Ziff Davis Internet News, Wang said his researchers were able to capture the connections between the exploit sites based on traffic redirection and pinpoint "several major players" who are responsible for a large number of exploit pages. __________ Read More / Source: SBC Yahoo! News