Editorial team

Takedowns: case studies and what we all could be doing better Botconf 2015 Wednesday | 17:50 – 18:30 John Bambenek 🗣 We have all seen the splashy headlines of large threats being subjected to takedowns only to re-emerge days (or hours) later. A few takedowns, however, have achieved long term results. This talk will focus […]

DGArchive – A deep dive into domain generating malware Botconf 2015 Thursday | 09:00 – 09:50 Daniel Plohmann 🗣 An observable trend in recent years of malware development is the increased use of Domain Generation Algorithms (DGAs). After having announced the project “DGArchive” in a lightning talk of last year’s Botconf, we would like to

Travelling to the far side of Andromeda Botconf 2015 Thursday | 09:50 – 10:30 Jose Miguel Esparza 🗣 Andromeda, also known as Gamarue by some Antivirus vendors, is a popular and modular bot active since 2011. It is normally used to spread additional malware, but sometimes, depending on the criminals, the main objective could be

Whose phone is in your pocket? Botconf 2015 Thursday | 11:00 – 11:30 Mikhail Kuzin 🗣 | Nikita Buchka 🗣 In later April we discovered an Android malware that used for installing backdoor with root priveleges on the devices. This malware is popular in Russia, India, Ukraine, Algeria, but the spread is not limited to this countries.

Building a hybrid experimental platform for mobile botnet research Botconf 2015 Thursday | 11:50 – 12:30 Apostolos Malatras 🗣 | Laurent Beslay Mobile botnets are an emerging security threat that aims at exploiting the wide penetration of mobile devices and systems and their vulnerabilities in the same spirit of traditional botnets. Mobile botmasters take advantage of infected

BoxBotNet Botconf 2015 Thursday | 14:00 – 14:40 Paul Jung 🗣 A hosted box botnet, is a botnet of compromised web servers, usually using vulnerabilities in CMS on low cost hosted servers. Since last year I had followed an indonesian group which operate this kind of botnet and resell access to theses powned servers. The

Malware Instrumentation: Application to Regin Analysis Botconf 2015 Thursday | 14:40 – 15:30 Matthieu Kaczmarek 🗣 The complexity of the Regin malware underlines the importance of reverse engineering in modern incident response. The present study shows that such complexity can be overcome: substantial information about adversary tactics, techniques and procedures is obtained from reverse engineering.

Practical Experiences of Building an IPFIX Based Open Source Botnet Detector Botconf 2015 Thursday | 16:00 – 16:40 Mark Graham 🗣 | Adrian Winckles 🗣 | Erika Sanchez 🗣 The academic study of flow-based malware detection has primarily focused on NetFlow v5 and v9. In 2013 IPFIX was ratified as the flow export standard. As part of a larger

Automatically classifying unknown bots by the register messages Botconf 2015 Thursday | 17:00 – 17:30 Ya Liu 🗣 | Bing Song 🗣 The ever-increasing number of malware/botnet samples demands efficient and scalable classification solution for better detection and prevention. C&C protocol based classification has proved to be effective and accurate. However, it’s not trivial to acquire new