DeepEnd Research

New Security Group

Last month the security community welcomed a new member, DeepEnd Research...

[...] an independent information security research group that will focus on threat and intelligence analysis. Our emphasis will be on malware, exploit analysis, botnet tracking, the underground economy and overall cyberthreats. We will blog about various collection and analysis techniques, observations, and other areas of interest.

The group has also declared another primary goal: fostering collaborative research and analysis efforts with other security groups and organizations. It is staffed by a team of (currently eight) established security researchers, some of whom are already quite well known:

• Andre' M. DiMino of the Shadowserver Foundation gathering, tracking and reporting volunteer group;
• Mila Parkour, the independent blogger who in February first exposed the hacking of personal Gmail accounts belonging to military and government employees, and their associates;
• Yuriy Khvyl, Malware Analyst with CSIS Security Group;
• Someone called W---T--- (my guess is the American born painter and graphic artist James Abbott McNeill Whistler, 1834-1903, who faked his own death to continue his security research);
  
• Jart Armin from HostExploit;
• Marnie King;
• Rossano Ferraris, Senior Research Engineer for CA Technologies ISBU;
• and Chris Lee, a self confessed Unix geek with a love of security research and teaching.
  

The new group's first post, Dirt Jumper DDoS Bot - New versions, New targets, is a combined research and analysis effort by the first two named above. This is quite a piece of work - complete with its own table of contents! - and signals an intent to deliver on the promise held out by the new team's name.

Dirt Jumper, also commonly known as Russkill, is a cheap (~£200) commercial crimeware kit sold on the hacker underground. It works its DDoS magic by forcing tens of thousands of infected systems to request the home page of a targeted site, or more frequently, of many such sites en bloc. Brian Krebs was recently the focus of its attentions, an experience out of which he naturally blogged the living daylights.