View source for Cracking into the new P2P variant of Zeusbot/Spyeye

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.symantec.com/connect/blogs/cracking-new-p2p-variant-zeusbotspyeye www.symantec.com
|Author=Andrea Lelli, 
|NomRevue=Symantec Connect Community
|Date=28 Nov 2011
|Editor=Symantec
|Year=2011
|ISBN=
|Page=
|Abstract=Recently, Symantec observed a modified variant of ZeuSbot/Spyeye which uses peer-to-peer (P2P) architecture to communicate. The original ZeuSbot communicated directly with its C&C server to download configuration data and upload stolen information. This was a major point of failure for the bot because the C&C server could be blocked or taken down, and the attacker would lose control of the botnet. The bot did have a fallback strategy: if the C&C server was down it generated pseudo-random domain names to contact. The attacker could of course predict those domain names and register one in order to gain back control of the bot, but the solution was not very efficient. (Terminology note: although we use the term “C&C” for the main server controlled by the attackers, this server is not a typical C&C in its functionalities, but is mainly a collector of information from the drones.)
|Botnet=ZeuS, Spyeye, 
|Malware=Zbot, 
|CCProtocol=p2p, 
|Operation=, 
|Keyword=portknocking, 
}}