Turbot - A Next Generation Botnet
•Download as PPT, PDF•
2 likes•1,586 views
The document describes Turbot, a proof-of-concept botnet protocol that uses HTTP and websites with user-generated content to communicate without single points of failure. Turbot bots exchange messages by writing to and reading from these mutual resources. This allows blending into common web traffic and avoids issues like firewall/NAT blocking. The document analyzes Turbot's advantages over other botnet protocols and discusses potential ways to detect and interrupt its communication channels.
![Agenda ,[object Object],[object Object],[object Object],[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommended
More Related Content
Similar to Turbot - A Next Generation Botnet
Similar to Turbot - A Next Generation Botnet (20)
Turbot - A Next Generation Botnet
- 1. Turbot “Catch me if you can” Page Itzik Kotler Ziv Gadot Security Operation Center (SOC)
- 8. SPOF Res vs. Blend In Page P2P Botnets HTTP Botnets NG Botnets Early Botnets Blending in common traffic SPOF Resiliency Excellent Poor Excellent Vacuum! Is it possible? Trin00 (1999) Agobot (2004) Storm (2007) Conficker A,B,C (2008) Twitter Botnet (2008) Black Energy 1.7 (2007) Conficker D,E (2009) PathBot (2004) Rustock (2006) Karaken (2008) Turbot
- 15. Resources to Room Division Page www.cl1p.net www.mailinator.com www.pastebin.com … .. Resource Room Room Space
- 16. A Room Example Page www.cl1p.net www.mailinator.com www.pastebin.com … .. www.cl1p.net/foobar Resource Room Room Set
- 24. Turbot Demo Page
- 27. Technology vs. Problems Turbot Problem Technology IRC P2P HTTP Blend in common traffic Corporate-policy blocking X X V Network footprint detection V X V Firewall and NAT issues V X V SPOF Takedown Actions X V X Blacklisting (IP,URL) X V X
- 28. Technology vs. Problems Turbot Problem Technology IRC P2P HTTP Blend in common traffic Corporate-policy blocking X X V Network footprint detection V X V Firewall and NAT issues V X V SPOF Takedown Actions X V X Blacklisting (IP,URL) X V X Efficiency Interrupting communication Problem Technology IRC P2P HTTP Blend in common traffic Corporate-policy blocking X X V Network footprint detection V X V Firewall and NAT issues V X V SPOF Takedown Actions X V X Blacklisting (IP,URL) X V X
- 36. Technology vs. Problems Turbot V V V V V V V Problem Technology IRC P2P HTTP Blend in common traffic Corporate-policy blocking X X V Network footprint detection V X V Firewall and NAT issues V X V SPOF Takedown Actions X V X Blacklisting (IP,URL) X V X Efficiency Interrupting communication
- 39. Questions & answers Page
- 40. Appendix Page
- 45. The End Page
Editor's Notes
- Present Greetings My name is … I am a security researcher in the security research group which we refer as Security Operation Center. This lecture is about botnet and their evolution over time
- Agenda: Describe the 4 sections of the lecture
- Agenda Scope This research is about understand the future of botnet communication What is known as the C&C Botnets infection technique are out of the scope Botnets actual attacks are out of the scope Methodology Find first the problems and dynamics happening nowadays.
- Agenda Dynamics There is a lot of going on in the past years P2P botnets, HTTP botnets, no so much IRC botnets Conficker Explain how conficker works Even if the bot-herder looses the battle he doesn’t looses the war Conficker attempts to achieve This two properties are the most important factors of botnets nowadays
- Agenda SPOF What is SPOF Example: IRC SPOF Resiliency What is SPOF resiliency
- Agenda What it is? Why is it good?
- Agenda What is this diagram? We put those 2 factors on graph and try to see how recent and past botnets are performing with respect to this 2 factors Explain the axises Early botnets Did not invest much efforts in excelling in either of the two Agobot P2P Botnets Storm,Confikcer Their trademark is their SPOF resiliency HTTP botnets Twitter botnets The novellity of the botnet it did no used a proprietary server but abused a public resource NG botnets The gap - What we noticed is that there is a gap Botnets do not yet excel on both paramters
- Repeat each question
- Repeat each question
- Repeat each question