The Linux XOR DDoS Botnets

More documents

Recommendations

Info

Who were attacked? • ALIBABA has the largest number of attacked IPs – ALIBABA is a cloud computing provider in CHINA • Amazon/Cloudflare/Google/Microsoft are other target IP owners
Repeated Commands in 1 Attack • When launching attacks, the C2s usually distributed multiple ATTACK commands for each target with short intervals # ldx:xxx.xxx.xxx.xxx:yyyy, 20150207200000~20150207230000 – target=101.71.xx.x1, target_port=7002, atk_type=syn_flood, atk_times: 30, cmd_intervals: [35 38 32 36 36 34 35 35 35 35 36 35 35 35 36 35 35 36 36 ] – target=101.71. xx.x2, target_port=7007, atk_type=syn_flood, atk_times: 30, cmd_intervals: [35 38 32 36 36 34 35 35 35 35 36 35 35 35 36 35 35 36 36 ] – target=101.71. xx.x3, target_port=7021, atk_type=syn_flood, atk_times: 30, cmd_intervals: [35 38 32 36 36 34 35 35 35 35 36 35 35 35 36 35 35 36 36 ] – target=101.71. xx.x4, target_port=9903, atk_type=syn_flood, atk_times: 30, cmd_intervals: [351 351 351 350 ]
Page 1 and 2: The Linux XOR DDoS Botnets Network
Page 3 and 4: LDX: Linux XOR DDoS • A notorious
Page 5 and 6: XOR Encrypted Sample Configs • C2
Page 7 and 8: C2 Info Extraction • C&C hostname
Page 9 and 10: Snippet 1 // sample_md5="2d7492e904
Page 11 and 12: C2 Extraction Steps 1. Locating the
Page 13 and 14: Statistics of The Extracted C2s •
Page 15 and 16: The REGISTER message • The first
Page 17 and 18: About Attacking Thread # • It’s
Page 19 and 20: Our Command Tracking System • The
Page 21 and 22: A Sample Tracked Command time famil
Page 23 and 24: Top 10 Attacked Ports • >95% atta
Page 25 and 26: Top 100 Active Botnets
Page 27: Targets in Map
Page 31 and 32: Different IPs, Same Target? • The
Page 33 and 34: Grouping C2 Servers • It’s not
Page 35 and 36: The Largest C2 Server Net: N1 • T
Page 37 and 38: LDX Bots Distribution in Map
Page 39: Q&A

The Linux XOR DDoS Botnets

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?