Dirt Jumper DDoS bot increasingly popular - Revision history

Eric.freyssinet at 21:41, 31 July 2015

2015-07-31T21:41:32Z

@@ Line 1: / Line 1: @@
 {{Publication
 |Image=Dirt_Jumper_DDoS_bot_increasingly_popular.png
-|Legend=
+|Botnet=Dirt Jumper,
 |Document=
 |Licence=
 |Video=
 |NomRevue=
 |ISBN=
 |Page=
-|Abstract=We’ve profiled the Dirt Jumper DDoS bot before and shown its evolution over the years. We then took this analysis into our zoo to see which DDoS bot families are growing in popularity with attackers. The marketplace has opened up significantly (see Curt’s excellent overview of DDoS tools and services) in recent years, and with that comes competition.
+|Keyword=,
 }}

Eric.freyssinet: Text replacement - " ddos.arbornetworks.com" to ""

2015-02-08T16:49:57Z

Text replacement - " ddos.arbornetworks.com" to ""

← Older revision		Revision as of 16:49, 8 February 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://ddos.arbornetworks.com/2012/05/dirt-jumper-ddos-bot-increasingly-popular/ ~~ddos.arbornetworks.com~~		\|Link=http://ddos.arbornetworks.com/2012/05/dirt-jumper-ddos-bot-increasingly-popular/
	\|Author=Jose Nazario,		\|Author=Jose Nazario,
	\|NomRevue=		\|NomRevue=

Eric.freyssinet: 1 revision imported

2015-02-07T14:26:38Z

1 revision imported

New page

{{Publication
|Image=Dirt_Jumper_DDoS_bot_increasingly_popular.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://ddos.arbornetworks.com/2012/05/dirt-jumper-ddos-bot-increasingly-popular/ ddos.arbornetworks.com
|Author=Jose Nazario,
|NomRevue=
|Date=Wednesday, May 30th, 2012
|Editor=Arbor Sert
|Year=2012
|ISBN=
|Page=
|Abstract=We’ve profiled the Dirt Jumper DDoS bot before and shown its evolution over the years. We then took this analysis into our zoo to see which DDoS bot families are growing in popularity with attackers. The marketplace has opened up significantly (see Curt’s excellent overview of DDoS tools and services) in recent years, and with that comes competition.

In the past few years, the popular kit we saw in our zoo was Black Energy, an easy to use, powerful DDoS bot distributed in Russian-language spheres. You could find it on the net for anywhere from $40 to free, depending on how hard you looked. Starting in 2009, Black Energy version 2 was available. It boasted a modular architecture and included banking theft Trojan functionality to augment the DDoS functionality. Another competitor that appeared in this timeframe was Optima or Darkness. It then becomes interesting to look in one’s zoo to see which families are popular at present.

The graphic below is from some quick analysis of our zoo, looking at our automated classification system that tags samples with the appropriate family name. Optima includes the group of Darkness, Optima and Votwup samples we have seen; Black Energy focuses on the BEv1 samples we have seen in the wild, and omits any BEv2 samples we have; Dirt Jumper includes all Russkill variants and Dirt Jumper variants we have seen. What we saw was a bit surprising, namely the rate at which Dirt Jumper samples appear in our zoo and quickly overtake the other families in terms of popularity. This matches anecdotally what we had seen, but the magnitude itself is surprising.
|Botnet=Dirt Jumper,
|Malware=,
|CCProtocol=,
|Operation=,
|Keyword=,
}}