Catching Malware En Masse: DNS and IP Style

on YouTube ↗59m

" summary

Presents concrete methods: a Hadoop batch + streaming DNS pipeline that extracts fast‑flux bipartite graphs, flags ~900 zbot fast‑flux domains (TTL 150s) serving Zeus, Pony and Andromeda, and finds .ru/.dosu-heavy IP pools and US-heavy clients; an IP analysis that fingerprints sub‑allocated /28–/30 blocks (OVH abuse, recycled IPs) and uses ASN topology plus BGP outage correlation to link sibling peripheral ASNs; a GPU‑accelerated 3D engine (OpenCL/OpenGL ES/GLSL, force‑directed layout) visualizes clusters; system achieves predictive IP blocking by quarantining suspect ranges before domains go live.

AI-written summary · about

" chapters (54)

1. 0:00Introduction
2. 0:32Welcome
3. 0:47Agenda
4. 1:22Current Climate
5. 2:19Investigation Process
6. 2:50What is Fast Flux
7. 3:03Fast Flux Proxy Network
8. 4:08Zeus
9. 5:35CNC domains
10. 6:05Methods
11. 7:55Workflow
12. 8:07Semantic Library
13. 8:28Data Extraction
14. 10:14Citadel Examples
15. 10:25Botnet Examples
16. 10:58What is Pony
17. 11:24Passwords
18. 11:44Applications
19. 12:27Stats
20. 12:57Clients
21. 14:27IP Style
22. 16:16OVH Canada
23. 16:51OVH Ukraine
24. 17:24OVH Russia
25. 18:35Nuclear Exploited Domains
26. 19:15Prediction for Fight Protection
27. 19:37How we did it
28. 20:45Interest
29. 21:17Fingerprinting
30. 21:38Same server setup
31. 22:17Growing trend
32. 23:06OVH
33. 24:51Rope
34. 25:22Electric Kitten
35. 25:43Police
36. 26:30English dictionaries
37. 26:45ASN graph
38. 26:57Understanding the internet
39. 27:35The IT Crowd
40. 27:53The Internet
41. 34:34Why do we do this
42. 35:31OpenCL view
43. 36:29Cluster view
44. 36:50Network geek
45. 37:39Network connectivity
46. 39:12Investigation
47. 41:40Conclusions
48. 42:24Visual approach
49. 44:13Detect
50. 44:52Summary
51. 46:24BGP Outages
52. 47:57ISP Outages
53. 48:17Autonomous Systems
54. 49:19In Conclusion

" related talks

• 50mTowards a Holistic Approach in Building Intelligence to Fight CrimewareDhia Mahjoub, Mykhailo Sakaly, Thomas Mathew · Black Hat USA 2016
• 52mInvestigating DDOS - Architecture Actors and AttributionElliott Peterson, Andre Correa · Black Hat USA 2016
• 32mSomething’s Phishy: See the Hook Before the BaitMalachi Walker · BSidesSF 2025
• 47mDetecting and analyzing files-less malwareChristopher Williams, Evan Wagner · BSides Tampa 2021
• 39mCommSec D1 - Behaviors and Patterns of Rogue Hosting ProvidersD. Mahjoub, S. Brown · Hack In The Box Amsterdam 2018
• 45mThe Security Wolf of Wall StreetThibault Reuille · Data By the Bay 2016
• 43mWho are the people in your neighborhood? Tracking 'Shady' CIDR blocksJohn Smith · BSides Tampa 2021
• 25mDark Side of the DNS ForceErik Wu · Black Hat USA 2016