Loading...
Please wait, while we are loading the content...
Similar Documents
Your Botnet is My Botnet: Analysis of a Botnet Takeover (2009)
| Content Provider | CiteSeerX |
|---|---|
| Author | Cavallaro, Lorenzo Szydlowski, Martin Cova, Marco Stone-Gross, Brett Gilbert, Bob Kruegel, Chris Vigna, Giovanni Kemmerer, Richard |
| Abstract | Botnets, networks of malware-infected machines that are controlled by an adversary, are the root cause of a large number of security threats on the Internet. A particularly sophisticated and insidious type of bot is Torpig, a malware program that is designed to har-vest sensitive information (such as bank account and credit card data) from its victims. In this paper, we report on our efforts to take control of the Torpig botnet for ten days. Over this period, we observed more than 180 thousand infections and recorded more than 70 GB of data that the bots collected. While botnets have been “hijacked ” before, the Torpig botnet exhibits certain properties that make the analysis of the data particularly interesting. First, it is pos-sible (with reasonable accuracy) to identify unique bot infections and relate that number to the more than 1.2 million IP addresses that contacted our command and control server. This shows that botnet estimates that are based on IP addresses are likely to report inflated numbers. Second, the Torpig botnet is large, targets a vari-ety of applications, and gathers a rich and diverse set of information from the infected victims. This opens the possibility to perform in-teresting data analysis that goes well beyond simply counting the number of stolen credit cards. 1. |
| File Format | |
| Publisher Date | 2009-01-01 |
| Access Restriction | Open |
| Subject Keyword | Infected Victim Inflated Number Bank Account Insidious Type Reasonable Accuracy Unique Bot Infection Malware-infected Machine Credit Card Data Malware Program Botnet Estimate Control Server Thousand Infection In-teresting Data Analysis Ten Day Torpig Botnet Exhibit Certain Property Torpig Botnet Botnet Takeover |
| Content Type | Text |
