středa 23. května 2012

The Kelihos Botnet


Kelihos is still alive, building its p2p infrastructure and sending spam. It quickly evolves after b79 take down operation. This raises numerous questions:
Did it survive in the b79 operation or just re-build a new one? How did it evolve? Is there any changes in its infrastructure? Does it change the p2p protocol or communication encryption algorithms? What are the new functionality added in it? In this presentation, I will attempt to shed light on those interrogations after examining 3 main Kelihos generations, from its p2p protocol and encryption schemes to the working mechanisms.

Žádné komentáře:

Okomentovat