Reversing the wrath of Khan

(Publication) Google search: [1]

Reversing the wrath of Khan
Botnet	Khan
Malware	Khan_(bot)
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol	HTTP
Date	2012 / March 7, 2012
Editor/Conference	Arbor SERT
Link	http://ddos.arbornetworks.com/uploads/2012/03/Wrath-of-Khan1.pdf arbornetworks.com (pdf) (arbornetworks.com (pdf) Archive copy)
Author	Jeff Edwards
Type

Abstract

“ This article continues our ongoing series on reversing the crypto mechanisms used by contemporary DDoS botnets; our guest of honor today will be a bot we have been calling

Trojan.Khan. Khan's primary purpose in life is to perform DDoS attacks; in fact, it goes to a considerable effort to generate floods of HTTP requests that are intended to appear like legitimate web traffic, in an attempt at making DDoS mitigations much more difficult. One of its techniques is to flood a victim with HTTP requests that appear to be crawler requests from search engines; this is presumably based on the quite reasonable expectation that the victim web sites will be terrified of filtering out web requests from such crawlers for fear of seriously impairing their page rankings at Google, Bing, etc., and thus becoming effectively invisible to potential customers. Fortunately, there are ways of exploiting the subtle flaws in Khan's flooding engine to safely block its attacks. This is an interesting topic by itself, one that could easily take up an entire article; however today we will focus instead on studying the crypto algorithm used by Khan to hide its sensitive strings from prying eyes such as ours.

Bibtex

 @misc{2012BFR923,
   editor = {Arbor SERT},
   author = {Jeff Edwards},
   title = {Reversing the wrath of Khan},
   date = {07},
   month = Mar,
   year = {2012},
   howpublished = {\url{http://ddos.arbornetworks.com/uploads/2012/03/Wrath-of-Khan1.pdf arbornetworks.com (pdf)}},
 }