Loading…
Botconf 2017 has ended
View analytic
Wednesday, December 6 • 11:40 - 12:10
Exploring a P2P Transient Botnet - From Discovery to Enumeration

Log in to save this to your schedule and see who's attending!

Feedback form is now closed.
From DDoS attacks to malicious code propagation, Botnets continue to represent a strength threat to entities and users connected to the Internet and, due to this, continue to be an important research area. The power of those numerous networks proved us its power when they interrupted great part of the Internet causing impacts to companies like Twitter and Netflix when Mirai P2P Botnet targeted Dyn company’s DNS services back in 2016. In this paper, we present the study that allowed us to find out a “Mirai-like” botnet called Rakos – from our high interactivity honeypot recruitment to the detailed analysis and exploitation of this botnet C&C protocol using crawling and node-injection methods to enumerate and estimate its size. Our contribution includes also a comparison between two P2P botnet exploration methods used in our research and in which situations they may be better suitable in further analysis. Additionally, we propose the term “transient” to designate botnets formed by malware that does not use persistence on the compromised system as this tends to be usual amongst modern threats to IoT (Internet of Things) devices.

Speakers
avatar for Renato Marinho

Renato Marinho

Chief Research Officer, Morphus Labs
Renato Marinho is Chief of Research at Morphus Labs and Incident Handler at SANS Internet Storm Center. His journey in the area began in 2001, when he created Nettion, one of the first firewalls to use the contemporary UTM (Unified Threat Management) concept. Experienced in cyber... Read More →


Wednesday December 6, 2017 11:40 - 12:10
Corum Allée du Saint-Esprit, 34000 Montpellier, France