Title
Your botnet is my botnet: analysis of a botnet takeover
Abstract
Botnets, networks of malware-infected machines that are controlled by an adversary, are the root cause of a large number of security problems on the Internet. A particularly sophisticated and insidious type of bot is Torpig, a malware program that is designed to harvest sensitive information (such as bank account and credit card data) from its victims. In this paper, we report on our efforts to take control of the Torpig botnet and study its operations for a period of ten days. During this time, we observed more than 180 thousand infections and recorded almost 70 GB of data that the bots collected. While botnets have been "hijacked" and studied previously, the Torpig botnet exhibits certain properties that make the analysis of the data particularly interesting. First, it is possible (with reasonable accuracy) to identify unique bot infections and relate that number to the more than 1.2 million IP addresses that contacted our command and control server. Second, the Torpig botnet is large, targets a variety of applications, and gathers a rich and diverse set of data from the infected victims. This data provides a new understanding of the type and amount of personal information that is stolen by botnets.
Year
DOI
Venue
2009
10.1145/1653662.1653738
ACM Conference on Computer and Communications Security
Keywords
Field
DocType
unique bot infection,bank account,control server,botnet takeover,harvest sensitive information,credit card data,certain property,large number,personal information,torpig botnet,insidious type,measurement,botnet,security,malware
Cutwail botnet,Internet privacy,ZeroAccess botnet,Rustock botnet,Computer science,Botnet,Computer security,Srizbi botnet,Asprox botnet,Bot herder,Mariposa botnet
Conference
Citations 
PageRank 
References 
253
14.70
26
Authors
8
Search Limit
100253
Name
Order
Citations
PageRank
Brett Stone-Gross152128.74
Marco Cova2142571.19
Lorenzo Cavallaro388652.85
Bob Gilbert425815.17
Martin Szydlowski528117.44
Richard Kemmerer644925.88
Christopher Kruegel78799516.05
Giovanni Vigna87121507.72