Embedded malware - An analysis of the Chuck Norris botnet

Proceedings - European Conference on Computer Network Defense, EC2ND 2010

Volumn , Issue , 2010, Pages 3-10

  Čeleda, Pavel ^a   Krejčí, Radek ^a   Vykopal, Jan ^a   Drašar, Martin ^a  

^a MASARYK UNIVERSITY   (Czech Republic)

Author keywords

Botnet; DSL; Forensics; Linux; Malware; Monitoring; NetFlow; Network; PSYB0T; Security

Indexed keywords

BOTNET; FORENSICS; LINUX; MALWARES; NETFLOWS; NETWORK; PSYB0T; SECURITY;

CHUCKS; COMPUTER CRIME; COMPUTER OPERATING SYSTEMS; FIRMWARE; INTERNET; INTERNET PROTOCOLS; MODEMS; NETWORK SECURITY;

COMPUTER NETWORKS;

EID: 78650903535     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/EC2ND.2010.15     Document Type: Conference Paper

References (23)

1. Erik Andersen, "BusyBox project," 2010, http://www.busybox.net.
2. Wikipedia, "Cabir," 2010, http://en.wikipedia.org/wiki/Caribe- %28computer-worm%29.
3. Ars Technica, "Truly malicious iPhone malware now out in the wild," 2009, http://arstechnica.com/apple/news/2009/11/truly-malicious- iphone-malware-now-out-in-the-wild.ars.
4. GNUCITIZEN, "Router Hacking Challenge," 2008, http://www.gnucitizen.org/blog/router-hacking-challenge/.
5. Terry Baume, "PSYB0T Information Page," 2009, http://baume.id.au/psyb0t.
6. Nenolod, "Network Bluepill - stealth router-based botnet has been DDoSing dronebl for the last couple of weeks," 2010, http://www.dronebl. org/blog/8.
7. Adrian Pastor, "Cracking Into Embedded Devices and Beyond!" 2008, http://www.gnucitizen.org/static/blog/2008/05/cracking-into-embedded- devices-confidence-2k8.pdf.
8. Sebastian Maier, "The End of Your Internet - Malware for Home Routers," 2008, http://data.nicenamecrew.com/papers/malwareforrouters/ paper.txt.
9. Wikipedia, "Netflow," http://en.wikipedia.org/wiki/Netflow, 2010.
10. M. Oberhumer, L. Molnár, and J. Reiser, "UPX - the Ultimate Packer for eXecutables," 2010, http://upx.sourceforge.net/.
11. P. Eriksson, Parallel Network Scanner, http://www.lysator.liu.se/~pen/ pnscan.
12. Ph3mt, "D-Link Config Reset Exploit By Ph3mt," 2007, http://www.packetstormsecurity.org/0712-exploits/dlink.txt.
13. Contem@efnet, Kaiten bot source code, http://packetstormsecurity.nl/irc/ kaiten.c.
14. "OpenDNS website," http://www.opendns.com.
15. eSio, "Keep Nick Bot source code," http://beer.one.pl/~esio/c/.
16. Andrew Martin, "Exploitation Kits Revealed - Mpack," 2007, sANS white paper, http://www.sans.org/reading room/whitepapers/malicious/ exploitation-kits-revealed-mpack-2039.
17. F-Secure, "Kolab worm description," 2009, http://www.f-secure. com/v-descs/net-worm-w32-kolab-qa.shtml.
18. Sophos, "Motob worm description," 2010, http://www.sophos.com/ security/analyses/viruses-and-spyware/w32mytobkn.html.
19. "VirusTotal," free online virus and malware scan service, http://www.virustotal.com/.
20. Steve Shipway, "Proxy http server source code," http://www.steveshipway.org/software/utils/www-proxy.c.
21. N. C. Fisher, "RFC954 - NICNAME/WHOIS," http://www.faqs.org/ rfcs/rfc954.html, 1985.
22. R. Shah and C. Sandvig, "Software defaults as de facto regulation: The case of wireless aps," in In The 33rd Research Conference on Communication, Information, and Internet Policy, 2005, http://web.si.umich.edu/ tprc/papers/2005/427/TPRC%20Wireless%20Defaults.pdf.
23. Moxiey Marlinspike, "SSLSTRIP," 2009, http://www.thoughtcrime. org/software/sslstrip/index.html.