A foray into Conficker’s logic and rendezvous points

LEET 2009 - 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats: Botnets, Spyware, Worms, and More

Volumn , Issue , 2009, Pages

  Porras, Phillip ^a   Saïdi, Hassen ^a   Yegneswaran, Vinod ^a  

^a SRI INTERNATIONAL   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BOTNET; COMPUTER VIRUSES;

BINARY LOGIC; CLIENT SIDES; RENDEZVOUS POINT;

COMPUTER CIRCUITS;

EID: 85084094918     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (15)

1. E. Aben. Conficker/Conflicker/Downadup as seen from the UCSD Network Telescope. http://www.caida.org/research/security/ms08-067/conficker.xml, 2009.
2. P. Baecher and M. Koetter. x86 shell code detection and emulation. http://libemu.carnivore.it/, 2008.
3. E. Chien. Downadup: Peer-to-Peer Payload Distribution. http://myitforum.com/cs2/blogs/cmosby/archive/2009/01/22/downaduppeer-to-peer-payload-distribution-symantec-security-response-blog.aspx, 2009.
4. F-Secure. Calculating the Size of the Downadup Outbreak. http://www.fsecure.com/weblog/archives/00001584.html, 2009.
5. P. Fitzgerald. Downadup: Geolocation, Fingerprinting and Piracy. https://forums.symantec.com/t5/Malicious-Code/Downadup-Geo-locationFingerprinting-and-Piracy/ba-p/380993, 2009.
6. E. Floria. Downadup: Small Improvements Yield Big Returns. https://forums.symantec.com/t5/Malicious-Code/Downadup-SmallImprovements-Yield-Big-Returns/ba-p/381717, 2008.
7. J. Hruska. Time for forced updates? Conficker botnet makes us wonder. http://arstechnica.com/news.ars/post/20081202-time-for-forcedupdates-conficker-botnet-makes-us-wonder.html, 2008.
8. Microsoft. Microsoft Security Bulletin MS08-067 – Critical. http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx, 2008.
9. P. Porras, H. Saidi, and V. Yegneswaran. A Multiperspective Analysis of the Storm Worm. SRI Technical Report, 2007.
10. P. Porras, H. Saidi, and V. Yegneswaran. An Analysis of Conficker’s Logic and Rendezvous. http://mtc.sri.com/Conficker/, 2009.
11. H. Ren and G. M. Ong. Exploit-MS08-067 Bundled in Commercial Malware Kit. http://www.avertlabs.com/research/blog/index.php/2008/11/14/exploitms08-067-bundled-in-commercial-malware-kit/, 2008.
12. P. Roberts. Sasser Infections Hit Hard. http://www.pcworld.com/article/115979/sasser infections hit hard.html, 2004.
13. J. Stewart. Rogue Antivirus Dissected. http://www.secureworks.com/research/threats/rogue-antivirus-part-1/, 2008.
14. C. Williams. Conficker seizes city’s hospital network. http://www.theregister.co.uk/2009/01/20/sheffield conficker/, 2008.
15. D. Worthington. Microsoft: SP2 will not install on pirated copies of XP. http://www.betanews.com/article/, 2004.