Presented at
VB2017,
Oct. 6, 2017, 2 p.m.
(30 minutes).
Someone recently said that the exploit kit landscape is dying - but this certainly is not the case for the spamming industry, which for last year was probably the biggest source of infections worldwide.
Despite spam botnets being so important in the lifecycle of malware, recent publications (which can be counted on the fingers of one hand) describing massive spam operations have either skipped over the technical details or else concentrated too much on high-level aspects for our liking.
In this paper, we will describe a few of the most prominent spam botnets out there: Necurs, Send Safe, Kelihos, Tofsee and Cutwail.
Our main goal is to describe the technical details of the network protocols used by these botnets to communicate with peers and C&Cs. We will show how to dissect and reimplement basic communication (including, but not limited to, receiving new spam, downloading malicious attachments and detecting updates to the core spam bot or its sub modules).
We will also present the results of our monitoring, including how and what is being spammed, and by which botnet. We will conclude with some funny quirks that one can find while looking closely at spamming operations.
Since these botnets aren't new, there is some information about them in circulation. Unfortunately this knowledge is often fragmented, or hidden within companies. With our talk we hope to share our insights, and allow everyone to track and destroy spam on their own.
*(Note: this is a reserve paper for VB2017. Unless needed to replace another paper on the main programme, it will be presented in the Small Talks room at 09:00 on Friday 6 October. Programme changes will be announced at the event and displayed on the VB2017 [programme page](/conference/vb2017/programme/ "Programme").) *
Presenters:
-
Maciej Kotowicz
- CERT Poland
Maciej Kotowicz Maciej Kotowicz is Principal Botnet Pwner at CERT.pl with a special interest in reverse engineering and exploit development as well as automation of both. In his free time he likes to drink beer and play CTFs, in no particular order.
-
Jarosław Jedynak
- CERT Poland
Jarosław Jedynak Jarosław Jedynak is a malware analyst and security engineer at CERT.pl. His research interests focus on malware, especially P2P botnets. Additionally, he is actively tracking new malicious campaigns in order to disrupt criminal activity. In his free time, he is a passionate CTF player, and co-founder of p4 team.
Links:
Similar Presentations: