ZeuSbot/Spyeye P2P updated, fortifying the botnet - Revision history

Eric.freyssinet: Text replacement - "p2p" to "P2P"

2015-08-12T03:27:51Z

Text replacement - "p2p" to "P2P"

← Older revision		Revision as of 03:27, 12 August 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://www.symantec.com/connect/blogs/zeusbotspyeye-~~p2p~~-updated-fortifying-botnet		\|Link=http://www.symantec.com/connect/blogs/zeusbotspyeye-P2P-updated-fortifying-botnet
	\|Author=Andrea Lelli,		\|Author=Andrea Lelli,
	\|NomRevue=Symantec Connect Community		\|NomRevue=Symantec Connect Community
Line 24:		Line 24:
	\|Botnet=ZeuS, SpyEye, Kelihos, Waledac,		\|Botnet=ZeuS, SpyEye, Kelihos, Waledac,
	\|Malware=Zbot,		\|Malware=Zbot,
	\|CCProtocol=~~p2p~~, http,		\|CCProtocol=P2P, http,
	\|Operation=,		\|Operation=,
	\|Keyword=,		\|Keyword=,
	}}		}}

Eric.freyssinet: Text replacement - " www.symantec.com" to ""

2015-08-05T19:47:04Z

Text replacement - " www.symantec.com" to ""

← Older revision		Revision as of 19:47, 5 August 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://www.symantec.com/connect/blogs/zeusbotspyeye-p2p-updated-fortifying-botnet ~~www.symantec.com~~		\|Link=http://www.symantec.com/connect/blogs/zeusbotspyeye-p2p-updated-fortifying-botnet
	\|Author=Andrea Lelli,		\|Author=Andrea Lelli,
	\|NomRevue=Symantec Connect Community		\|NomRevue=Symantec Connect Community

Eric.freyssinet: Text replacement - "Spyeye" to "SpyEye"

2015-07-30T19:14:55Z

Text replacement - "Spyeye" to "SpyEye"

← Older revision		Revision as of 19:14, 30 July 2015
Line 13:		Line 13:
	\|ISBN=		\|ISBN=
	\|Page=		\|Page=
	\|Abstract=We [[Cracking_into_the_new_P2P_variant_of_ZeuSbot/~~Spyeye~~\|blogged]] about a parallel ZeuSbot/~~Spyeye~~ build near the end of last year that introduced some improvements in the botnet, moving the network architecture away from a simple bot-to-C&C system and introducing the beginnings of a peer-to-peer model. This new variant new uses P2P communication exclusively in order to keep the botnet alive and gathering information.		\|Abstract=We [[Cracking_into_the_new_P2P_variant_of_ZeuSbot/SpyEye\|blogged]] about a parallel ZeuSbot/SpyEye build near the end of last year that introduced some improvements in the botnet, moving the network architecture away from a simple bot-to-C&C system and introducing the beginnings of a peer-to-peer model. This new variant new uses P2P communication exclusively in order to keep the botnet alive and gathering information.

	Previously, every compromised computer was a peer in the botnet and the configuration file (containing the URL of the C&C server) was distributed from one peer to another. This way, even if the C&C server was taken down, the botnet was still able to contact other peers to receive configuration files with URLs of new C&C servers.		Previously, every compromised computer was a peer in the botnet and the configuration file (containing the URL of the C&C server) was distributed from one peer to another. This way, even if the C&C server was taken down, the botnet was still able to contact other peers to receive configuration files with URLs of new C&C servers.
Line 22:		Line 22:

	While these changes make the botnet more resistant to takedown, and equally more difficult to track the attackers behind it, it also provides another major benefit to the attackers. ZeuStracker is a site which has had considerable success in tracking and publishing IP block lists for ZeuS C&C servers around the world. With ZeuS switching to P2P for these functions means that the site would no longer be able to produce exact ZeuS C&C IP block lists.		While these changes make the botnet more resistant to takedown, and equally more difficult to track the attackers behind it, it also provides another major benefit to the attackers. ZeuStracker is a site which has had considerable success in tracking and publishing IP block lists for ZeuS C&C servers around the world. With ZeuS switching to P2P for these functions means that the site would no longer be able to produce exact ZeuS C&C IP block lists.
	\|Botnet=ZeuS, ~~Spyeye~~, Kelihos, Waledac,		\|Botnet=ZeuS, SpyEye, Kelihos, Waledac,
	\|Malware=Zbot,		\|Malware=Zbot,
	\|CCProtocol=p2p, http,		\|CCProtocol=p2p, http,

Eric.freyssinet: 1 revision imported

2015-02-07T14:23:21Z

1 revision imported

← Older revision	Revision as of 14:23, 7 February 2015
(No difference)

Eric.freyssinet: Eric.freyssinet a déplacé la page Zeusbot/Spyeye P2P updated, fortifying the botnet vers ZeuSbot/Spyeye P2P updated, fortifying the botnet sans laisser de redirection : Remplacement du texte — « Zeus » par « ZeuS »

2012-11-25T19:26:33Z

Eric.freyssinet a déplacé la page Zeusbot/Spyeye P2P updated, fortifying the botnet vers ZeuSbot/Spyeye P2P updated, fortifying the botnet sans laisser de redirection : Remplacement du texte — « Zeus » par « ZeuS »

New page

{{Publication
|Image=zeusbotspyeyefortifying.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.symantec.com/connect/blogs/zeusbotspyeye-p2p-updated-fortifying-botnet www.symantec.com
|Author=Andrea Lelli,
|NomRevue=Symantec Connect Community
|Date=23/02/2012
|Editor=Symantec
|Year=2012
|ISBN=
|Page=
|Abstract=We [[Cracking_into_the_new_P2P_variant_of_ZeuSbot/Spyeye|blogged]] about a parallel ZeuSbot/Spyeye build near the end of last year that introduced some improvements in the botnet, moving the network architecture away from a simple bot-to-C&C system and introducing the beginnings of a peer-to-peer model. This new variant new uses P2P communication exclusively in order to keep the botnet alive and gathering information.

Previously, every compromised computer was a peer in the botnet and the configuration file (containing the URL of the C&C server) was distributed from one peer to another. This way, even if the C&C server was taken down, the botnet was still able to contact other peers to receive configuration files with URLs of new C&C servers.

With the latest update, it seems that the C&C server has disappeared entirely for this functionality. Where they were previously sending and receiving control messages to and from the C&C, these control messages are now handled by the P2P network.

This means that every peer in the botnet can act as a C&C server, while none of them really are one. Bots are now capable of downloading commands, configuration files, and executables from other bots—every compromised computer is capable of providing data to the other bots. We don’t yet know how the stolen data is communicated back to the attackers, but it’s possible that such data is routed through the peers until it reaches a drop zone controlled by the attackers.

While these changes make the botnet more resistant to takedown, and equally more difficult to track the attackers behind it, it also provides another major benefit to the attackers. ZeuStracker is a site which has had considerable success in tracking and publishing IP block lists for ZeuS C&C servers around the world. With ZeuS switching to P2P for these functions means that the site would no longer be able to produce exact ZeuS C&C IP block lists.
|Botnet=ZeuS, Spyeye, Kelihos, Waledac,
|Malware=Zbot,
|CCProtocol=p2p, http,
|Operation=,
|Keyword=,
}}