Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH...
12
1
Transcript of Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH...
1
2
3
5
If we controlthese …
… we can monitor &influence these
Types of Storm C&CMessages
• Activation (report from bot to botmaster)• Email address harvests• Spamming instructions• Delivery reports• DDoS instructions• FastFlux instructions• HTTP proxy instructions• Sniffed passwords report• IFRAME injection/report
Spam campaign mechanics
TCP
HTTP
HTTPproxies
Workers
Proxybots
Botmaster
Campaign mechanics: harvest
TCP
HTTP
HTTPproxies
Workers
Proxybots
Botmaster
@@@@
@
@@ @
Campaign mechanics: spamming
TCP
HTTP
HTTPproxies
Workers
Proxybots
Botmaster