The Rise of the Eternal Botnet

on YouTube ↗23m

" summary

Routers are the primary IoT target because they stay online, have usable CPU and gateway access, and criminals reuse a few toolkits — 90% reuse Mirai/Kaiten/Cubot, ~60–75% common variants — to run cheap DDoS-for-hire, VPN-exit services and DNS hijacks (notably in Brazil). A 2018 VPNFilter takedown still shows ~6,000 infected routers as of 2020, and emerging P2P strains (Withhatch, Hajime, Hide'n'Seek, Mosey, Go-based HEH) remove CNCs, creating effectively uncleanable, persistent botnets.

AI-written summary · about

" chapters (8)

1. 0:00Intro
2. 1:07Easy to set up
3. 3:56Monetization
4. 7:15Cleaning up
5. 11:25P2P
6. 14:25Current Monetization
7. 17:54Summary
8. 19:41QA

" related talks

• 47mThe Secret Life of Enterprise BotnetsDr. Craig Labovitz · RSA Conference 2023
• 29mAttack of the Clone ArmyRalph Huuck · IoTSF Conference 2016
• 13mThe dark side of IoTVince Steckler · Collision 2017
• 29mUnderstanding the Mirai BotnetMichael Bailey, Nick Sullivan, Manos Antonakakis, Elie Bursztein, Yi Zhou, Kurt Thomas, Deepak Kumar, Joshua Mason, Zakir Durumeric, J. Alex Halderman, Tim April, Matt Bernhard, Jaime Cochran, Luca Invernizzi, Michalis Kallitsis, Chaz Lever, Zane Ma, Damian Menscher, Chad Seaman · 26th USENIX Security Symposium (USENIX Security '17)
• 35mVPNFilter - YetAnotherBotNet Or Maybe Not...Warren Mercer, Vitor Ventura · BSides Lisbon 2018
• 39mFortifying DevOps: Understand and Fight Botnets ThreatsAlessandra Rizzo, Miguel Hernández · DevOps Barcelona 2024
• 01h 00mIoT Lockdown - Battling Bot Net BuildersAdam Englander · Embedded Linux Conference + OpenIoT Summit North America 2017
• 03mThe world will see (and just saw) an Internet zombie apocalypsePhil Stanhope · O'Reilly Security Conference 2016 - Amsterdam, Netherlands