CloudBots: Harvesting Crypto Coins Like a Botnet Farmer
summary
Demonstrates a working cloud-based botnet built from free trials by automating account signup, confirmation, and control: Google App Engine inbound mail handler parses confirmation emails, .afraid.org free DNS provides thousands of subdomains with MX records, and free MongoDB plus a dashboard tracks instances; command-and-control uses Fabric SSH framework to push miners. Finds ~66% of services use only email confirmation, achieves ~0.25 USD/day per account, and validates a 1,000‑node proof‑of‑concept net generating roughly $250/day.
AI-written summary · about
chapters (14)
- 0:00Introduction and scope
- 2:14Cloud service exploitation
- 5:40Automating account creation
- 9:18Advanced evasion techniques
- 12:39Building the mail handler
- 16:09Backend automation flow
- 20:40Botnet attack use cases
- 23:55Resource manipulation
- 25:09Command and control
- 26:43Cryptocurrency mining
- 30:48Evasion and resilience
- 34:42Real-world examples
- 37:43Defensive strategies
- 45:42Q&A session
related talks
48mHow to Thwart Malicious Automation and Kick Bot Butt for $0
40mCloud Foundry Through the Eyes of a Hacker
50mThe Anatomy of Cloud Attacks
46mLiving off the Cloud: A Server-Free Approach to Malware Ops
54mDark Fairytales From A Phisherman
29mStandard Classification: Good Bot, Bad Bot: Characterizing Automated Brows...
48mMillion Browser Botnet
39mReal-World Detection Evasion Techniques in the Cloud