How to Steal a Botnet and What Can Happen When You Do

Google Tech Talk
September 10, 2009

ABSTRACT

Presented by Richard A. Kemmerer.

Botnets, which are networks of malware-infected machines that are controlled by an adversary, are the root cause of a large number of security threats on the Internet. A particularly sophisticated and insidious type of bot is Torpig, which is a malware program that is designed to harvest sensitive information (such as bank account and credit card data) from its victims. In this talk, we report on our efforts to take control of the Torpig botnet for ten days. Over this period, we observed more than 180 thousand infections and recorded more than 70 GB of data that the bots collected.

While botnets have been hijacked before, the Torpig botnet exhibits certain properties that make the analysis of the data particularly interesting. First, it is possible (with reasonable accuracy) to identify unique bot infections and relate that number to the more than 1.2 million IP addresses that contacted our command and control server during the ten day period. This
shows that botnet estimates that are based on IP addresses are likely to report inflated numbers. Second, the Torpig botnet is large, targets a variety of applications, and gathers a rich and diverse set of information from the infected victims. This allowed us to perform interesting data analysis that goes well beyond simply counting the number of stolen credit cards. In this talk we will discuss the analysis that we performed on the data collected and the lessons learned from the analysis, as well as from the process of obtaining (and losing) the botnet.

• Category

  Science & Technology

[ReadThisCommentOrDie]

Flux Pavilion brought you here, didn't he?

[MrKristoball]

i watched the whole video :)

[mrfriendlygreyhat]

Those dicks on Hackforums are doomed. Thanks for the great video, now I go fuck someone's botnets up for ddosing my site.

[mrfriendlygreyhat]

Gosh, brony fights over a security video. I gotta love Youtube.

[xyzqwa]

Very good talk, great speaker.

[DailyLifeSolutions oka]

ahahhaahahahahaha

[ReadThisCommentOrDie]

It still doesn't. It puts you in the same fundamental group as Beliebers for example. Most things aren't followed by enough people desperate to feel part of something to need a "fandom".

[benblue3]

Yes but your fandom is very similar to the Brony fandom. You take a show/game for kids and enjoy it, which shouldn't really be that big of a deal. I make brony videos because I'm a part of the fandom. I don't run outside and tell random people that I'm a brony. Nor will I ever bring it up, unless somebody asks (AHEM).

If you enjoy Pokemon, you're in the same fundamental group of brony's.

[ReadThisCommentOrDie]

Not at all, I don't call myself a "Pokehead" or something and try to make it as obvious as possible to the world that I enjoy Pokemon. Nor is the fanbase comprised of college guys circlejerking a show made for prepubescent girls.

[benblue3]

And you're a fan of Pokemon so we're at even ground.

[ReadThisCommentOrDie]

Haha try not to throw stones mate, you are a fucking brony after all.