Eric.freyssinet: 1 revision imported

2015-02-07T14:22:28Z

1 revision imported

New page

{{Publication
|Titre=Waledac Botnet - Deployment & Communication Analysis
|Image=Waledac_flow_com.png
|Document=
|Video=
|Link=http://www.fortiguard.com/analysis/waledacanalysis.html Fortinet Article
|Author=Kyle Yang, Derek Manky
|NomRevue=Fortiguard Threat Research and Response
|Date=
|Editor=Fortinet
|Year=2009
|Page=
|Abstract=Historically, [[botnet|Botnets]] have used [[IRC]] (Internet Relay Chat) for control. This has a critical drawback, which is its server/client architecture. We could find the server/RP (Rendezvous Point) easily since it’s really hard to hide them based on their server/client model. As a result of this architecture, the entire Botnet will be stopped if we take down the server/RP. In recent years, [[botnet|Botnets]] have moved to use [[P2P]] technology. One of the most remarkable examples is the [[Storm]] Botnet, which was prevalent in 2007. At the time, it was the world's most active and infamous Botnet, with a sophisticated C&C channel which created a high impact on spam sent worldwide. [[Waledac]] enhanced its predecessor by abandoning the server/client model, moving forward to use [[P2P]] to control its bots. The [[P2P]] architecture performs as a protector/shield of the server/RP in an effort to hide them from being found. This also allows the “controller” to control the Bots completely decentralized. [[Waledac]]'s main purpose is to send spam, usually by taking advantage of many real-world events - social engineering that tricks users into downloading copies of itself or other malicious executables. Notable [[Waledac]] spam campaigns include Valentine's day, Obama presidency, The "Couponizer", 4th of July, and Bomb Scares.
|Botnet=Waledac
|Malware=Waledac
}}

Waledac Botnet - Deployment and Communication Analysis - Revision history

Eric.freyssinet: 1 revision imported