root/honeyclient/trunk


Mode:

Legend:

Added
Modified
Copied or renamed
Rev Chgset Date Author Log Message
(edit) @1582 [1582] 05/14/08 14:58:08 kindlund Added work_unit_limit logic; where cloned VMs will get recycled after …
(edit) @1581 [1581] 05/12/08 16:24:37 kindlund Reverted to defaults.
(edit) @1580 [1580] 05/12/08 16:24:06 kindlund Added startup_worker_delay.
(edit) @1579 [1579] 05/12/08 16:23:35 kindlund Housekeeping.
(edit) @1578 [1578] 05/12/08 15:47:21 kindlund Updated exclusion list (re: 84e19947e56c3c6713206bed03).
(edit) @1577 [1577] 05/12/08 15:13:29 kindlund Disabled multi-threaded snapshotting, since performing this as a subthread …
(edit) @1576 [1576] 05/12/08 15:12:26 kindlund Initial fix, to deal with spinning up too many clone VMs simultaneously… …
(edit) @1559 [1559] 04/25/08 11:17:11 kindlund Housekeeping.
(edit) @1558 [1558] 04/24/08 17:14:36 kindlund Updated Manager to support DB retrieval of URLs for multiple, simultaneous …
(edit) @1554 [1554] 04/22/08 13:20:44 kindlund Updated unit tests and log messages.
(edit) @1547 [1547] 04/22/08 02:22:00 kindlund Added initial support for managing simultaneous honeyclient VMs on a …
(edit) @1541 [1541] 04/19/08 15:48:53 kindlund Disabled prerouting logging functionality on FW, since it was yielding …
(edit) @1540 [1540] 04/17/08 22:48:41 kindlund IE7 visiting multimedia website (sound) - (308d8ba0ccf89389210ae652f9).
(edit) @1539 [1539] 04/17/08 18:39:00 kindlund IE7 exclusion list update (ee3b1ef22860c7a9c64956d080).
(edit) @1538 [1538] 04/17/08 17:26:50 kindlund Updated Master VM to support IE7 with default policy, active scripting …
(edit) @1537 [1537] 04/17/08 16:52:57 kindlund Updated IE7 false positive (cfb601205432618e08a2857cfd).
(edit) @1536 [1536] 04/17/08 11:27:44 kindlund IE7 benign activity - (392c0d3fa27bb6b46f5bba6804).
(edit) @1535 [1535] 04/17/08 11:17:05 kindlund Capture only works with EXL entries that have dots (.) escaped properly.
(edit) @1534 [1534] 04/17/08 11:14:29 kindlund IE7 Exclusion Entry - (e395e843a5dad632d004be63ca)
(edit) @1532 [1532] 04/16/08 19:45:38 kindlund Added Database recovery logic, in case the Ruby Drone web service …
(edit) @1531 [1531] 04/16/08 19:44:52 kindlund Updated utility script.
(edit) @1530 [1530] 04/16/08 17:17:31 kindlund Updated utility functions.
(edit) @1528 [1528] 04/16/08 17:14:15 kindlund Added utility code.
(edit) @1527 [1527] 04/16/08 15:22:54 kindlund Benign flash activity (IE7) - 2f174eecc05393f1a8a89075cb
(edit) @1526 [1526] 04/16/08 15:20:29 kindlund Updated false positive (0b52f9a0ad4992fdb2abe5afa1).
(edit) @1525 [1525] 04/16/08 15:16:52 kindlund False positive - (29fffdfc3dcc7eb6cdfa65609c).
(edit) @1524 [1524] 04/16/08 14:41:12 kindlund Capture doesn't like extra spaces at the end of each EXL directive.
(edit) @1523 [1523] 04/16/08 14:17:42 kindlund Bumped AM version.
(edit) @1522 [1522] 04/16/08 14:17:28 kindlund Exclusion list updates - IE7 accessing live.com which calls CardSpace …
(edit) @1520 [1520] 04/16/08 13:34:40 kindlund Updated exclusion list to reflect Windows Side-by-Side benign activity. …
(edit) @1518 [1518] 04/15/08 08:17:13 kindlund Encountered rare error, where retry rate would hit 5, yet the 5th …
(edit) @1517 [1517] 04/14/08 08:44:32 xkovah Replaced changes which got removed in r 1511
(edit) @1516 [1516] 04/11/08 11:42:39 xkovah a couple more misc ctfmon.exe entries
(edit) @1515 [1515] 04/11/08 11:18:31 xkovah interesting thing with the language bar getting turned on after I did …
(edit) @1514 [1514] 04/11/08 09:37:26 xkovah a new internationalization reg change found on the default IE7
(edit) @1513 [1513] 04/11/08 09:09:51 xkovah another false positive from IE7 running
(edit) @1512 [1512] 04/10/08 10:58:01 xkovah + SetValueKey C:\\WINDOWS\\explorer\.exe …
(edit) @1511 [1511] 04/10/08 10:47:45 xkovah Added to the file: #XENO: I recommend commenting out all blacklist entries …
(edit) @1510 [1510] 04/09/08 22:01:40 kindlund False positive (d006934159767a7fc28160d5d1).
(edit) @1509 [1509] 04/09/08 20:20:15 kindlund False positives (326851bdd43e32b5554e99a52e).
(edit) @1508 [1508] 04/09/08 20:12:22 kindlund Updated IE7 white list (1d380b911f63801355d90ff5da).
(edit) @1507 [1507] 04/09/08 18:26:14 kindlund Updated to support source_type and source_name.
(edit) @1499 [1499] 04/09/08 15:47:11 kindlund Merging simpler_agent branch into trunk.
(edit) @1496 [1496] 04/09/08 15:39:08 xkovah Added Pod::Usage (aka Pod::Parser)
(edit) @1471 [1471] 04/08/08 10:29:49 xkovah as I thought might happen, the checksums file for the Bundle::CPAN stuff …
(edit) @1470 [1470] 04/08/08 10:26:47 xkovah missing local copy of Compress::BZip2 for some reason
(edit) @1468 [1468] 04/08/08 09:01:43 xkovah Changed Agent bundle to add Win32::Exe and also adding the CPAN::Checksums …
(edit) @1465 [1465] 04/07/08 13:32:19 xkovah Updated the bundle names to reflect the last tag/rel version, 1.0.2. They …
(edit) @1464 [1464] 04/07/08 08:57:17 xkovah As Matt mentioned, we need to state where the modified capture source can …
(edit) @1410 [1410] 04/01/08 15:14:05 kindlund Funky interactions with cleanup code.
(edit) @1409 [1409] 04/01/08 14:59:21 kindlund Updated set_client_suspicious call within Manager.
(edit) @1408 [1408] 04/01/08 11:40:56 kindlund Need to update hive API before that last commit.
(edit) @1407 [1407] 04/01/08 11:28:35 kindlund Updated Agent handling logic slightly — marked clones that do not respond …
(edit) @1406 [1406] 03/31/08 15:01:15 kindlund Updated IE7 white list (f63e8556f0f2ef149f42040b3d).
(edit) @1405 [1405] 03/31/08 14:58:38 kindlund Updated IE7 white list (81e7d88c1adf8af2753fda8e4a).
(edit) @1404 [1404] 03/31/08 14:55:56 kindlund Updated IE7 false positives (7868808e44d97ba3acdf767d09).
(edit) @1403 [1403] 03/31/08 14:17:02 kindlund Updated IE7 false positives (e7c8761830343d86a86bc6f46d).
(edit) @1402 [1402] 03/31/08 14:13:08 kindlund Updated exclusion list for WMP (82b48848e7eef866c15071a252).
(edit) @1401 [1401] 03/31/08 13:59:41 kindlund Updated operational master VM.
(edit) @1400 [1400] 03/28/08 15:31:35 kindlund Updated per false positive (0cec38a5dfbca2defdae7f38c9).
(edit) @1399 [1399] 03/27/08 23:47:47 kindlund More IE7 false positives.
(edit) @1398 [1398] 03/27/08 23:10:56 kindlund Updated exclusion list.
(edit) @1397 [1397] 03/27/08 23:04:05 kindlund More false positives for IE7.
(edit) @1396 [1396] 03/27/08 22:58:20 kindlund More IE7 false positives.
(edit) @1395 [1395] 03/27/08 21:53:36 kindlund Updated base master image to IE7.
(edit) @1394 [1394] 03/27/08 21:36:18 kindlund More IE7 excludes.
(edit) @1393 [1393] 03/27/08 21:11:31 kindlund Updated IE false positives, also ignored writes for .bat and .cmd files …
(edit) @1392 [1392] 03/27/08 21:04:30 kindlund WMI false positive.
(edit) @1391 [1391] 03/27/08 17:17:14 kindlund More IE7 whitelist entries.
(edit) @1390 [1390] 03/27/08 17:04:47 kindlund Updated exclusion lists to support IE 7.
(edit) @1389 [1389] 03/26/08 19:44:22 kindlund Updated Clone initialization, in order to print a more user friendly …
(edit) @1388 [1388] 03/25/08 20:58:08 kindlund Accounting for additional whitelist activity (b7b5f0e08f4c8475d950c4a73c).
(edit) @1387 [1387] 03/25/08 20:39:34 kindlund Updated exclusion list, per ticket #152
(edit) @1368 [1368] 03/25/08 11:42:51 kindlund Make sure errors in communicating with the FW don't affect our ability to …
(edit) @1367 [1367] 03/25/08 10:08:23 kindlund Updated wmiprvse.exe false positive list (3e606c371a805a4c50274ad506).
(edit) @1366 [1366] 03/24/08 20:54:57 kindlund More false positives, related to wmiprvse.exe (31fd1a012f1caca021feb94c08)
(edit) @1361 [1361] 03/19/08 12:14:23 kindlund Updated exclusion list to reflect 8e4b27c9c03e5b2b8c193c3dad false …
(edit) @1360 [1360] 03/19/08 12:09:37 kindlund Updated exclusion list, per 51a99a33ee8b78b45914980658 false positive.
(edit) @1359 [1359] 03/18/08 12:35:42 kindlund Updated utility scripts.
(edit) @1358 [1358] 03/18/08 01:51:32 kindlund Updated operational web service.
(edit) @1357 [1357] 03/17/08 17:09:08 kindlund Updated migration script.
(edit) @1356 [1356] 03/17/08 16:00:13 kindlund Updated operational environment.
(edit) @1353 [1353] 03/17/08 13:20:44 kindlund Updated API to reflect client migration script usage.
(edit) @1352 [1352] 03/17/08 13:19:56 kindlund Helper script to migrate non-deleted clients (internal use only).
(edit) @1351 [1351] 03/14/08 17:01:12 kindlund Sanity check content type value in Browser — in case we arn't able to …
(edit) @1350 [1350] 03/11/08 13:43:51 kindlund Discovered that explorer.exe also purges IE history cache.
(edit) @1349 [1349] 03/11/08 13:16:24 kindlund Updated false positive to reflect temporary files generated by flash.
(edit) @1348 [1348] 03/10/08 11:54:15 kindlund Updated white list with further exclusions (windows update).
(edit) @1347 [1347] 03/10/08 11:23:38 kindlund Updated white list for Windows Update.
(edit) @1346 [1346] 03/07/08 16:36:28 kindlund Found more false-positive activity, re: ticket #144
(edit) @1345 [1345] 03/07/08 16:32:00 kindlund Added rule to exclude benign Flash activity, re: ticket #136
(edit) @1343 [1343] 03/07/08 15:19:24 kindlund Added to cleanup script, to stop any VMs marked as bug before …
(edit) @1341 [1341] 03/07/08 12:49:45 xkovah Checking in the updated Bundle::HoneyClient::Manager for …
(edit) @1340 [1340] 03/07/08 12:47:42 xkovah Copying over the source file for Filesys::DfPortable from 1.0.2 to trunk
(edit) @1337 [1337] 03/06/08 23:24:18 kindlund Modified the XML-RPC code to support proxies.
(edit) @1336 [1336] 03/06/08 17:24:21 kindlund Added support for disk space checking; Manager will now gracefully …
(edit) @1335 [1335] 03/06/08 16:48:02 kindlund Added programmatic organizational support.
(edit) @1334 [1334] 03/06/08 16:29:32 kindlund Bumped master vm version number.
(edit) @1333 [1333] 03/06/08 16:10:43 kindlund Needed a reference to LWP::UserAgent.
(edit) @1332 [1332] 03/06/08 15:58:23 kindlund Updated exclusion lists re: ticket #144
Note: See TracRevisionLog for help on using the revision log.