Insights from the analysis of the Mariposa botnet - Revision history

Eric.freyssinet at 15:24, 31 July 2015

2015-07-31T15:24:04Z

← Older revision		Revision as of 15:24, 31 July 2015
Line 2:		Line 2:
	\|Image=MariposaProtocol.png		\|Image=MariposaProtocol.png
	\|Legend=Mariposa Botnet Protocol		\|Legend=Mariposa Botnet Protocol
	\|Link=http://www.ncfta.ca/papers/InsightsFromTheAnalysisOfTheMariposaBotnet.pdf ~~www.ncfta.ca~~		\|Botnet=Mariposa
			\|Year=2010
			\|Date=2010
			\|Link=http://www.ncfta.ca/papers/InsightsFromTheAnalysisOfTheMariposaBotnet.pdf
	\|Author=Prosenjit Sinha, Amine Boukhtouta, Victor Heber Belarde, Mourad Debbabi		\|Author=Prosenjit Sinha, Amine Boukhtouta, Victor Heber Belarde, Mourad Debbabi
	~~\|NomRevue=Conference on Risks and Security of Internet and Systems~~
	~~\|Date=2010~~
	~~\|Year=2010~~
	~~\|Botnet=Mariposa~~
	\|Abstract=Nowadays, botnets are among the topmost network		\|Abstract=Nowadays, botnets are among the topmost network
	threats by combining innovative hacking capabilities. This is		threats by combining innovative hacking capabilities. This is
Line 28:		Line 27:
	technologies and enable the elaboration of analysis, detection		technologies and enable the elaboration of analysis, detection
	and prevention techniques.		and prevention techniques.
			\|NomRevue=Conference on Risks and Security of Internet and Systems
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-07T14:27:57Z

1 revision imported

← Older revision		Revision as of 14:27, 7 February 2015
(No difference)

Eric.freyssinet at 18:48, 31 August 2012

2012-08-31T18:48:18Z

New page

{{Publication
|Image=MariposaProtocol.png
|Legend=Mariposa Botnet Protocol
|Link=http://www.ncfta.ca/papers/InsightsFromTheAnalysisOfTheMariposaBotnet.pdf www.ncfta.ca
|Author=Prosenjit Sinha, Amine Boukhtouta, Victor Heber Belarde, Mourad Debbabi
|NomRevue=Conference on Risks and Security of Internet and Systems
|Date=2010
|Year=2010
|Botnet=Mariposa
|Abstract=Nowadays, botnets are among the topmost network
threats by combining innovative hacking capabilities. This is
due to the fact that they are constantly improved by hackers
to become more resilient against detection and debugging
techniques. In this respect, we analyze one of the most
prominent botnets, namely Mariposa, which infected more
than 13 million computers that are located in more than 190
countries. In this regard, we analyze the botnet architecture,
components, commands and communication. In this setting, we
detail the obfuscation and anti-debugging techniques it uses.
Moreover, we detail the infection and code-injection techniques
into legitimate processes. In addition, we explain the spreading
mechanisms that are employed in Mariposa as well as the
underlying communication protocols. More importantly, we
analyze the injected bot code. This is accomplished by a reverse
engineering exercise that uses both a network analysis together
with reverse-engineering analysis. The insights from this work
are meant to illustrate the know-how used in current botnet
technologies and enable the elaboration of analysis, detection
and prevention techniques.
}}