Bonded with Botnets. - SecNiche Security Labs

More documents

Recommendations

Info

Task Execution - Install-by-Install (IBI) • Install-by-Install ● Concept- Installing malicious executables on the already infected systems ● Different from Pay-per Install (PPI) programs – PPI works effectively <strong>with</strong> Browser Exploit Packs – It is a kind of fresh installation of bots on the non-infected systems ● IBI and PPI are the different sides of the same coin ● Sold as different services in the underground market ● IBI is used in the crimeware services such as bot shops 20
• Malvertisement Malvertisements ● Online malicious advertisements ● Content Delivery Networks (CDNs) are infected to trigger malvertising – Distributed attack More on the malvertisement, refer to following post and paper: Armorize’s Blog - http://blog.armorize.com/2011/05/porn-sites-have-lots-of-trafficand.html Malvertisement Paper - http://www.slideshare.net/adityaks/malvertising-exploiting-web-advertising 21
Page 1 and 2: Bonded with Botnets Hard to Capture
Page 3 and 4: Agenda • Overview • Present-day
Page 5 and 6: Generations of Botnets • First Ge
Page 7 and 8: Malware Paradigm 7
Page 9 and 10: Obfuscated Iframes - Present-day
Page 11 and 12: BlackHole BEP • 11
Page 13 and 14: Redkit BEP 13
Page 15 and 16: Drive-by-Download Attacks • Drive
Page 17 and 18: Drive-by Frameworks 17
Page 19: Install-by-Install (IBI) • Instal
Page 23 and 24: • Social Networks Exploiting Soci
Page 25 and 26: Tactics - Subverting System’s Int
Page 27 and 28: Understanding Ruskill • Inside Ru
Page 29 and 30: • DNS Changer ─ How this works?
Page 31 and 32: Demo 31
Page 33 and 34: • Inside MitB Man-in-the-Browser
Page 35 and 36: • Web Injects Web Injects ─ Bas
Page 37 and 38: Web Injects - Real Time Cases (1) F
Page 39 and 40: • Form Grabbing Form-grabbing ─
Page 41 and 42: Form-grabbing • Harvested Data Ha
Page 43 and 44: Conclusion • Continuous war of ex
Page 45: Thanks • US-CERT GFIRST Team ●

Bonded with Botnets. - SecNiche Security Labs

Create successful ePaper yourself

Delete template?

Save as template?