The Russian DDoS One: Booters to Botnets

I did a talk at Botconf in Nancy, France where I try to map Russian DDoS booter sites to their respective DDoS botnets.

Slides: https://www.botconf.eu/wp-content/uploads/2014/12/2014-2.9-The-Russian-DDoS-One-Booters-to-Botnets.pdf

Video: https://www.youtube.com/watch?v=eMgKAWfWZlA

Let’s Talk About NewPosThings

Riding the PoS malware coattails:

https://www.arbornetworks.com/blog/asert/lets-talk-about-newposthings/

Five Sinkholes of newGOZ

Dave Loftus and I did some sinkholing of the new Zeus Gameover variant known as newGOZ:

https://www.arbornetworks.com/blog/asert/five-sinkholes-of-newgoz/

Lil' bit of press:

• http://www.v3.co.uk/v3-uk/news/2360338/newgoz-malware-sees-1-879-percent-infection-boom-in-july
• http://www.scmagazineuk.com/new-zeus-gameover-employs-novel-approach-to-malware/article/366221/
• http://threatpost.com/gameover-zeus-botnet-rebuilds/107776 (Dave)
• http://www.networkworld.com/article/2465461/new-gameover-zeus-botnet-keeps-growing-especially-in-the-us.html
• http://www.invincea.com/2014/08/newgoz-malware-sees-1879-percent-infection-boom-in-july/
• http://www.theregister.co.uk/2014/08/15/gameover_zeus_back_from_the_dead_as_/
• http://www.pcadvisor.co.uk/news/security/3536420/new-gameover-zeus-botnet-keeps-growing-especially-in-the-us/
• https://labs.opendns.com/2015/01/26/shmoocon-2015-infrastructure-tracking/

Full Disk Encryption with Key Disk on OpenBSD

Just some notes to myself on how to setup full disk encryption with a key disk on OpenBSD. Pretty much http://tildedennis.blogspot.com/2013/08/full-disk-encryption-on-openbsd.html and http://www.undeadly.org/cgi?action=article&sid=20110530221728.

1. Boot into install shell

2.

cd /dev
sh ./MAKEDEV sd1

3. 

fdisk -i wd0
fdisk -i sd1 (key disk)

3. 

disklabel -E wd0
disklabel -E sd1

a a (RAID)
w
q

4. bioctl -C force -c C -l /dev/wd0a -k /dev/sd1a softraid0

install (use crypto disk, sd2)

The Citadel and Gameover Campaigns of 5CB682C10440B2EBAF9F28C1FE438468

Where I ride the coattails of the Zeus Gameover takedown (and probably upset more researchers):

https://www.arbornetworks.com/blog/asert/the-citadel-and-gameover-campaigns-of-5cb682c10440b2ebaf9f28c1fe438468/

Trojan.Eclipse — A Bad Moon Rising?

https://www.arbornetworks.com/blog/asert/trojan-eclipse-a-bad-moon-rising/

Some commentary:

• http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3249
• http://www.reddit.com/r/Malware/comments/23o0fd/trojaneclipse_a_bad_moon_rising/

ASERT's DDoS Malware Corral, Volume 2

Slides for volume 2:

http://www.slideshare.net/dschwarz_arbor/aserts-ddos-malware-corral-volume-2