Domain generation algorithms (DGA) in stealthy malware

(Publication) Google search: [1]

Domain generation algorithms (DGA) in stealthy malware
Botnet	Conficker
Malware
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group	Conficker working group
Vulnerability
CCProtocol
Date	2012 / 2012-03-05
Editor/Conference	Damballa
Link	http://blog.damballa.com/?p=1504 blog.damballa.com (blog.damballa.com Archive copy)
Author	Gunter Ollmann
Type

Abstract

“ Do you remember all the fuss about Conficker many moons ago and its odd method of locating C&C servers? Instead of relying upon a static list of preconfigured domain names that corresponded to the location of the badguys C&C servers, it used an algorithm to calculate candidate domain names – and then tried reaching out to a handful of the candidates in a vein attempt to locate an active C&C server.

The authors behind the Conficker variants experimented with a number of algorithms but, at the end of the day, they failed to construct a cohesive botnet. Despite that “minor flaw”, Conficker infected devices still account for a sizable fraction of known malware infections around the work – years after the threat was studied to death and detection/protection/cleanup solutions are available everywhere.

Bibtex

 @misc{Ollmann2012BFR912,
   editor = {Damballa},
   author = {Gunter Ollmann},
   title = {Domain generation algorithms (DGA) in stealthy malware},
   date = {05},
   month = Mar,
   year = {2012},
   howpublished = {\url{http://blog.damballa.com/?p=1504 blog.damballa.com}},
 }