Google Tech Talk
September 10, 2009
ABSTRACT
Presented by Richard A. Kemmerer.
Botnets, which are networks of malware-infected machines that are controlled by an adversary, are the root cause of...
Google Tech Talk September 10, 2009
ABSTRACT
Presented by Richard A. Kemmerer.
Botnets, which are networks of malware-infected machines that are controlled by an adversary, are the root cause of a large number of security threats on the Internet. A particularly sophisticated and insidious type of bot is Torpig, which is a malware program that is designed to harvest sensitive information (such as bank account and credit card data) from its victims. In this talk, we report on our efforts to take control of the Torpig botnet for ten days. Over this period, we observed more than 180 thousand infections and recorded more than 70 GB of data that the bots collected.
While botnets have been hijacked before, the Torpig botnet exhibits certain properties that make the analysis of the data particularly interesting. First, it is possible (with reasonable accuracy) to identify unique bot infections and relate that number to the more than 1.2 million IP addresses that contacted our command and control server during the ten day period. This shows that botnet estimates that are based on IP addresses are likely to report inflated numbers. Second, the Torpig botnet is large, targets a variety of applications, and gathers a rich and diverse set of information from the infected victims. This allowed us to perform interesting data analysis that goes well beyond simply counting the number of stolen credit cards. In this talk we will discuss the analysis that we performed on the data collected and the lessons learned from the analysis, as well as from the process of obtaining (and losing) the botnet.
Like to rate videos and let people know what you think?
Automatically share your ratings, favorites, and more on Facebook, Twitter, and Google Reader with YouTube Autoshare.
Autoshare makes certain YouTube activities public on the services you choose. Select only the services you are comfortable with - like Facebook, Twitter, or Google Reader - to let your friends know what you like on YouTube. You can turn Autoshare off at any time.
Like to share videos with friends?
Automatically share your ratings, favorites, and more on Facebook, Twitter, and Google Reader with YouTube Autoshare.
Autoshare makes certain YouTube activities public on the services you choose. Select only the services you are comfortable with - like Facebook, Twitter, or Google Reader - to let your friends know what you like on YouTube. You can turn Autoshare off at any time.
i'm not so amazed over how few views these get - 95% of the people using the internet fall into that segment of the "youtubian populace" that are perfectly happy just watching a dancing cat.
i like when he goes "so, the ru..... i almost said their name there". so, they are russians (everyone already knew this), but are they the russian mafia or the russian government? or maybe these two are synonymous today.
thanks for agreeing :) hope they will do so, i really enjoyed this presentation (like almost every of googletechtalks) but it would be great, if i could follow the questions at the end too
Autoshare makes certain YouTube activities public on the services you choose. Select only the services you are comfortable with - like Facebook, Twitter, or Google Reader - to let your friends know what you like on YouTube. You can turn Autoshare off at any time.
Does what ever a torpig does.
hope they will do so, i really enjoyed this presentation (like almost every of googletechtalks) but it would be great, if i could follow the questions at the end too