Your botnet is my botnet: Analysis of a botnet takeover

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2009, Pages 635-647

  Stone Gross, Brett ^a   Cova, Marco ^a   Cavallaro, Lorenzo ^a   Gilbert, Bob ^a   Szydlowski, Martin ^a   Kemmerer, Richard ^a   Kruegel, Christopher ^a   Vigna, Giovanni ^a  

^a University of California   (United States)

Author keywords

Botnet; Malware; Measurement; Security; Torpig

Indexed keywords

BANK ACCOUNTS; BOTNET; BOTNETS; COMMAND AND CONTROL; CREDIT CARDS; IP ADDRESSS; MALWARES; PERSONAL INFORMATION; REASONABLE ACCURACY; ROOT CAUSE; SECURITY PROBLEMS; SENSITIVE INFORMATIONS;

COMPUTER CRIME; INTERNET PROTOCOLS;

NETWORK SECURITY;

EID: 74049154670     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1653662.1653738     Document Type: Conference Paper

References (47)

1. P. Amini. Kraken Botnet Infiltration. http://dvlabs.tippingpoint.com/ blog/2008/04/28/kraken-botnet-infiltration, 2008.
2. S. Burnette. Notice of Termination of ICANN Registrar Accreditation Agreement. http://www.icann.org/correspondence/burnette-to-tsastsin-28oct08-en. pdf, 2008.
3. A. Burstein. Conducting Cybersecurity Research Legally and Ethically. In USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2008.
4. E. Cooke, F. Jahanian, and D. McPherson. The zombie roundup: Understanding, detecting, and disrupting botnets. In Usenix Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI), 2006.
5. D. Dagon, G. Gu, C. Lee, and W. Lee. A Taxonomy of Botnet Structures. In Annual Computer Security Applications Conference (ACSAC), 2007.
6. D. Dagon, C. Zou, and W. Lee. Modeling Botnet Propagation Using Time Zones. In Symposium on Network and Distributed System Security, 2006.
7. Finjan. How a cybergang operates a network of 1.9 million infected computers. http://www.finjan.com/MCRCblog.aspx?EntryId=2237, 2009.
8. J. Fink. FBI Agents Raid Dallas Computer Business. http://cbs11tv.com/ local/Core.IP.Networks.2.974706.html, 2009.
9. E. Florio and K. Kasslin. Your computer is now stoned (...again!). Virus Bulletin, April 2008.
10. J. Franklin, V. Paxson, A. Perrig, and S. Savage. An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants. In ACM Conference on Computer and Communications Security, 2007.
11. F. Freiling, T. Holz, and G. Wicherski. Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks. In European Symposium on Research in Computer Security (ESORICS), 2005.
12. GMER Team. Stealth MBR rootkit. http://www2.gmer.net/mbr/, 2008.
13. D. Goodin. Superworm seizes 9m pcs, 'stunned' researchers say. http://www.theregister.co.uk/2009/01/16/9m-downadup-infections/, 2009.
14. P. Guehring. Concepts against Man-in-the-Browser Attacks. http://www2.futureware.at/svn/sourcerer/CAcert/SecureClient.pdf, 2006.
15. P. Gutmann. The Commercial Malware Industry. In DEFCON conference, 2007.
16. T. Holz, M. Engelberth, and F. Freiling. Learning More About the Underground Economy: A Case-Study of Keyloggers and Dropzones. Reihe Informatik TR-2008-006, University of Mannheim, 2008.
17. T. Holz, C. Gorecki, K. Rieck, and F. Freiling. Measuring and Detecting Fast-Flux Service Networks. In Symposium on Network and Distributed System Security, 2008.
18. T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling. Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm. In USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2008.
19. J. Hruska. Cracking down on Conficker: Kaspersky, OpenDNS join forces. http://arstechnica.com/business/news/2009/02/cracking-down-on- confickerkaspersky-opendns-join-forces, February 2009.
20. D. Jackson. Untorpig. http://www.secureworks.com/research/tools/untorpig/ , 2008.
21. B. Kang, E. Chan-Tin, C. Lee, J. Tyra, H. Kang, C. Nunnery, Z. Wadler, G. Sinclair, N. Hopper, D. Dagon, and Y. Kim. Towards complete node enumeration in a peer-to-peer botnet. In ACM Symposium on Information, Computer & Communication Security (ASIACCS 2009), 2009.
22. C. Kanich, C. Kreibich, K. Levchenko, B. Enright, G. Voelker, V. Paxson, and S. Savage. Spamalytics: An Empirical Analysis of Spam Marketing Conversion. In ACM Conference on Computer and Communications Security, 2008.
23. C. Kanich, K. Levchenko, B. Enright, G. Voelker, and S. Savage. The Heisenbot Uncertainty Problem: Challenges in Separating Bots from Chaff. In USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2008.
24. A. Karasaridis, B. Rexroad, and D. Hoeflin. Wide-scale botnet detection and characterization. In USENIX Workshop on Hot Topics in Understanding Botnet, 2007.
25. P. Kleissner. Analysis of Sinowal. http://web17.webbpro.de/index.php? page=analysis-of-sinowal, 2008.
26. J. Leyden. Conficker botnet growth slows at 10m infections. http://www.theregister.co.uk/2009/01/26/conficker-botnet/, 2009.
27. J. Leyden. Conficker zombie botnet drops to 3.5 million. http://www.theregister.co.uk/2009/04/03/conficker-zombie-count/, 2009.
28. R. McMillan. Conficker group says worm 4.6 million strong. http://www.cw.com.hk/content/conficker-group-says-worm-46-million-strong, 2009.
29. D. Moore, G. Voelker, and S. Savage. Inferring Internet Denial of Service Activity. In Usenix Security Symposium, 2001.
30. G. Ollmann. Caution Over Counting Numbers in C&C Portals. http://blog.damballa.com/?p=157, 2009.
31. Openwall Project. John the Ripper password cracker. http://www.openwall. com/john/.
32. P. Porras, H. Saidi, and V. Yegneswaran. A Foray into Conficker's Logic and Rendezvous Points. In USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2009.
33. N. Provos and P. Mavrommatis. All Your iFRAMEs Point to Us. In USENIX Security Symposium, 2008.
34. M. Rajab, J. Zarfoss, F. Monrose, and A. Terzis. My Botnet is Bigger than Yours (Maybe, Better than Yours) : Why Size Estimates Remain Challenging. In USENIX Workshop on Hot Topics in Understanding Botnet, 2007.
35. M. A. Rajab, J. Zarfoss, F. Monrose, and A. Terzis. A Multifaceted Approach to Understanding the Botnet Phenomenon. In ACM Internet Measurement Conference (IMC), 2006.
36. A. Ramachandran and N. Feamster. Understanding the Network-level Behavior of Spammers. In ACM SIGCOMM, 2006.
37. A. Ramachandran, N. Feamster, and D. Dagon. Revealing Botnet Membership Using DNSBL Counter-Intelligence. In Conference on Steps to Reducing Unwanted Traffic on the Internet, 2006.
38. RSA FraudAction Lab. One Sinowal Trojan + One Gang = Hundreds of Thousands of Compromised Accounts. http://www.rsa.com/blog/blog-entry.aspx?id= 1378, October 2008.
39. S. Saroiu, S. Gribble, and H. Levy. Measurement and Analysis of Spyware in a University Environment. In Networked Systems Design and Implementation (NSDI), 2004.
40. M. Shields. Trojan virus steals banking info. http://news.bbc.co.uk/2/hi/ technology/7701227.stm, 2008.
41. Sophos. Security at risk as one third of surfers admit they use the same password for all websites, Sophos reports. http://www.sophos.com/pressoffice/ news/articles/2009/03/password-security.html, March 2009.
42. SpeedMatters.org. 2008 Report on Internet Speeds in All 50 States. http://www.speedmatters.org/document-library/sourcematerials/ cwa-report-on-internet-speeds-2008.pdf, August 2008.
43. Symantec. Report on the underground economy. http://www.symantec.com/ content/en/us/about/media/pdfs/Underground-Econ-Report.pdf, 2008.
44. The Spamhaus Project. ZEN. http://www.spamhaus.org/zen/.
45. VeriSign iDefense Intelligence Operations Team. The Russian Business Network: Rise and Fall of a Criminal ISP. blog.wired.com/defense/files/iDefense- RBNUpdated-20080303.doc, 2008.
46. J. Wolf. Technical details of Srizbi's domain generation algorithm. http://blog.fireeye.com/research/2008/11/technical-details-of-srizbis- domaingeneration-algorithm.html, 2008.
47. L. Zhuang, J. Dunagan, D. Simon, H. Wang, I. Osipkov, G. Hulten, and J. Tygar. Characterizing botnets from email spam records. In USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2008.