Crimeware Chaos: Empirical Analysis of HTTP-Based Botnet C&C Panels
summary
Empirical analysis of thousands of real C&C URLs shows HTTP-based panels often use domain names while a significant minority use direct IPs, many panels run 81% domain-based servers versus 18% IP-based connections, server-side code is overwhelmingly PHP (96% PHP), and a small share use non-standard ports (1.2% non-standard ports). Techniques observed include DGAs, gate filters, encrypted POST bodies, Google-indexed panels, low URL entropy, 0.5% SSL usage and ~4.8% hosted on compromised WordPress sites.
AI-written summary · about
chapters (6)
- 0:00Introduction and talk overview
- 1:50Botnets and HTTP C&C basics
- 8:50Real-world C&C panel examples
- 14:04Techniques to find C&C panels
- 23:13Empirical analysis results
- 33:28Arms race and conclusion
related talks
27mWhat Goes Around Comes Back Around - Exploiting Fundamental Weaknesses in Botnet C&C Panels!
36mBehind Enemy Lines:Engaging and Disrupting Ransomware Web Panels
52mInvestigating DDOS - Architecture Actors and Attribution
39mLeviathan: Command and Control Communications on Planet Earth
40mYou have a security problem - your users
29mStandard Classification: Good Bot, Bad Bot: Characterizing Automated Brows...
26mTracking the World's Dumbest Cyber Mercenaries
50mCyber-crime and attacks in the dark side of the web