Tumbling down the rabbit hole: Exploring the idiosyncrasies of botmaster systems in a multi-tier botnet infrastructure

LEET 2010 - 3rd USENIX Workshop on Large-Scale Exploits and Emergent Threats: Botnets, Spyware, Worms, and More

Volumn , Issue , 2010, Pages

  Nunnery, Chris ^a   Sinclair, Greg ^a   Kang, Brent ByungHoon ^a  

^a UNIVERSITY OF NORTH CAROLINA AT CHARLOTTE   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER VIRUSES; NETWORK ARCHITECTURE;

BEHAVIORAL OBSERVATION; BOTMASTER; DISPERSION TECHNIQUE; FILE SYSTEMS; ITS ARCHITECTURE; MULTI-TIER; TIERED ARCHITECTURE; TRACE DATA;

BOTNET;

EID: 85084096629     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (15)

1. J. Calvet, C. Davis, and P M. Bureau. Malware Authors Don’t Learn, and That’s Good. In MALWARE 2009: The Fourth Annual Conference on Malicious and Unwanted Software, October 2009.
2. G. Keizer. ‘We’re Not Scared’ of Storm, Say Researchers. http://tinyurl.com/ygyyrc2, October 2007.
3. J. Grizzard, V.Sharma, C. Nunnery, B. Kang, and D. Dagon. Peer-to-Peer Botnets: Overview and Case Study. In First Usenix Workshop on Hot Topics in Understanding Botnets, April 2007.
4. B. Kang, E. Chan-Tin, C. Lee, J. Tyra, H. J. Kang, C. Nunnery, Z. Wadler, G. Sinclair, N. Hopper, D. Dagon, and Y. Kim. Towards Complete Node Enumeration in a Peer-to-Peer Botnet. In ASIACCS 2009: ACM Symposium on Information, Computer and Communication Security, March 2009.
5. C. Kanich, C. Kreibich, K. Levchenko, B. Enright, G. Voelker, V. Paxson, and S. Savage. Spamalytics: An Empirical Analysis of Spam Marketing Conversion. In CCS 2008: ACM Conference on Computer and Communications Security, pages 3–14, New York, NY, USA, 2008. ACM.
6. C. Kanich, K. Levchenko, B. Enright, G. Voelker, and S. Savage. The Heisenbot Uncertainty Problem: Challenges in Separating Bots from Chaff. In Proceedings of the First USENIX Workshop on Large Scale Exploits and Emergent Threats. USENIX Association, April 2008.
7. D. Samosseiko. The Partnerka - What is it, and why should you care? In Virus Bulletin Conference, September 2009.
8. G. Sinclair. Blog Post: Waledac’s Communication Protocol. http://tinyurl.com/y9u4v98.
9. G. Sinclair, C. Nunnery, and B. Kang. The Waledac Protocol: The How and Why. In MALWARE 2009: The Fourth Annual Conference on Malicious and Unwanted Software, October 2009.
10. J. Stewart. Protocols and Encryption of The Storm Botnet. http://tinyurl.com/yhgwlod.
11. J. Stewart. Storm worm DDoS Attack. http://tinyurl.com/686ugd, February 2007.
12. B. Stock, M. Engelberth, F. Freiling, and T. Holz. Walowdac - Analysis of a Peer-to-Peer Botnet. In EC2ND 2009: European Conference on Computer Network Defense, November 2009.
13. S. Stover, D. Dittrich, J. Hernandez, and S. Deitrich. Analysis of the Storm and Nugache Trojans - P2P is Here. Login, 32(6), December 2007.
14. Sudosecure. Waledac Tracker. http://www.sudosecure.net/waledac/ bmd5updatecycle.php.
15. I. Sysoev. nginx. http://nginx.net/.