Cracking into the new P2P variant of Zeusbot/Spyeye - Revision history

Eric.freyssinet: Text replacement - "p2p" to "P2P"

2015-08-12T03:28:49Z

Text replacement - "p2p" to "P2P"

← Older revision		Revision as of 03:28, 12 August 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://www.symantec.com/connect/blogs/cracking-new-~~p2p~~-variant-zeusbotspyeye		\|Link=http://www.symantec.com/connect/blogs/cracking-new-P2P-variant-zeusbotspyeye
	\|Author=Andrea Lelli,		\|Author=Andrea Lelli,
	\|NomRevue=Symantec Connect Community		\|NomRevue=Symantec Connect Community
Line 16:		Line 16:
	\|Botnet=ZeuS, SpyEye,		\|Botnet=ZeuS, SpyEye,
	\|Malware=Zbot,		\|Malware=Zbot,
	\|CCProtocol=~~p2p~~,		\|CCProtocol=P2P,
	\|Operation=,		\|Operation=,
	\|Keyword=portknocking,		\|Keyword=portknocking,
	}}		}}

Eric.freyssinet: Text replacement - " www.symantec.com" to ""

2015-08-05T19:50:15Z

Text replacement - " www.symantec.com" to ""

← Older revision		Revision as of 19:50, 5 August 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://www.symantec.com/connect/blogs/cracking-new-p2p-variant-zeusbotspyeye ~~www.symantec.com~~		\|Link=http://www.symantec.com/connect/blogs/cracking-new-p2p-variant-zeusbotspyeye
	\|Author=Andrea Lelli,		\|Author=Andrea Lelli,
	\|NomRevue=Symantec Connect Community		\|NomRevue=Symantec Connect Community

Eric.freyssinet: Text replacement - "Spyeye" to "SpyEye"

2015-07-30T19:14:37Z

Text replacement - "Spyeye" to "SpyEye"

← Older revision		Revision as of 19:14, 30 July 2015
Line 13:		Line 13:
	\|ISBN=		\|ISBN=
	\|Page=		\|Page=
	\|Abstract=Recently, Symantec observed a modified variant of ZeuSbot/~~Spyeye~~ which uses peer-to-peer (P2P) architecture to communicate. The original ZeuSbot communicated directly with its C&C server to download configuration data and upload stolen information. This was a major point of failure for the bot because the C&C server could be blocked or taken down, and the attacker would lose control of the botnet. The bot did have a fallback strategy: if the C&C server was down it generated pseudo-random domain names to contact. The attacker could of course predict those domain names and register one in order to gain back control of the bot, but the solution was not very efficient. (Terminology note: although we use the term “C&C” for the main server controlled by the attackers, this server is not a typical C&C in its functionalities, but is mainly a collector of information from the drones.)		\|Abstract=Recently, Symantec observed a modified variant of ZeuSbot/SpyEye which uses peer-to-peer (P2P) architecture to communicate. The original ZeuSbot communicated directly with its C&C server to download configuration data and upload stolen information. This was a major point of failure for the bot because the C&C server could be blocked or taken down, and the attacker would lose control of the botnet. The bot did have a fallback strategy: if the C&C server was down it generated pseudo-random domain names to contact. The attacker could of course predict those domain names and register one in order to gain back control of the bot, but the solution was not very efficient. (Terminology note: although we use the term “C&C” for the main server controlled by the attackers, this server is not a typical C&C in its functionalities, but is mainly a collector of information from the drones.)
	\|Botnet=ZeuS, ~~Spyeye~~,		\|Botnet=ZeuS, SpyEye,
	\|Malware=Zbot,		\|Malware=Zbot,
	\|CCProtocol=p2p,		\|CCProtocol=p2p,

Eric.freyssinet: 1 revision imported

2015-02-07T14:23:22Z

1 revision imported

← Older revision		Revision as of 14:23, 7 February 2015
(No difference)

Eric.freyssinet: Remplacement du texte — « Zeus » par « ZeuS »

2012-10-20T09:12:58Z

Remplacement du texte — « Zeus » par « ZeuS »

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.symantec.com/connect/blogs/cracking-new-p2p-variant-zeusbotspyeye www.symantec.com
|Author=Andrea Lelli,
|NomRevue=Symantec Connect Community
|Date=28 Nov 2011
|Editor=Symantec
|Year=2011
|ISBN=
|Page=
|Abstract=Recently, Symantec observed a modified variant of ZeuSbot/Spyeye which uses peer-to-peer (P2P) architecture to communicate. The original ZeuSbot communicated directly with its C&C server to download configuration data and upload stolen information. This was a major point of failure for the bot because the C&C server could be blocked or taken down, and the attacker would lose control of the botnet. The bot did have a fallback strategy: if the C&C server was down it generated pseudo-random domain names to contact. The attacker could of course predict those domain names and register one in order to gain back control of the bot, but the solution was not very efficient. (Terminology note: although we use the term “C&C” for the main server controlled by the attackers, this server is not a typical C&C in its functionalities, but is mainly a collector of information from the drones.)
|Botnet=ZeuS, Spyeye,
|Malware=Zbot,
|CCProtocol=p2p,
|Operation=,
|Keyword=portknocking,
}}