SlideShare a Scribd company logo
1 of 21
Botnet Mitigation, Monitoring and Management - Harshad Patil nullcon Goa 2010 http://nullcon.net
[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Agenda nullcon Goa 2010 http://nullcon.net
Introduction ,[object Object],[object Object],[object Object],[object Object],[object Object],nullcon Goa 2010 http://nullcon.net
What is DOS nullcon Goa 2010 http://nullcon.net ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Why Botnets? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],nullcon Goa 2010 http://nullcon.net
Attack vectors ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],nullcon Goa 2010 http://nullcon.net
How they operate ,[object Object],[object Object],[object Object],[object Object],[object Object],nullcon Goa 2010 http://nullcon.net
CnC Architecture nullcon Goa 2010 http://nullcon.net Botmaster C & C Bots Bots Bots
P2P Architecture nullcon Goa 2010 http://nullcon.net Botmaster C & C C & C Bots Bots Bots
Concerning factors ,[object Object],[object Object],[object Object],[object Object],nullcon Goa 2010 http://nullcon.net
Concerning factors nullcon Goa 2010 http://nullcon.net ,[object Object]
Concerning factors nullcon Goa 2010 http://nullcon.net
Concerning factors nullcon Goa 2010 http://nullcon.net
Protection Detection Remediation nullcon Goa 2010 http://nullcon.net
Detection ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],nullcon Goa 2010 http://nullcon.net
Protection ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],nullcon Goa 2010 http://nullcon.net ,[object Object]
Current Mitigation effort nullcon Goa 2010 http://nullcon.net ,[object Object]
Botnet Monitoring System: nullcon Goa 2010 http://nullcon.net ,[object Object]
Some current cases ,[object Object],[object Object],[object Object],nullcon Goa 2010 http://nullcon.net
Torpig details nullcon Goa 2010 http://nullcon.net
Conclusion ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],nullcon Goa 2010 http://nullcon.net ,[object Object]

More Related Content

Viewers also liked

zbeardUXportfolio816
zbeardUXportfolio816zbeardUXportfolio816
zbeardUXportfolio816
Zach Beard
 
Relax, familiarize and facilitate - Interkulturelles Management in Indien
Relax, familiarize and facilitate - Interkulturelles Management in IndienRelax, familiarize and facilitate - Interkulturelles Management in Indien
Relax, familiarize and facilitate - Interkulturelles Management in Indien
Dr. Christian Fels
 
125 Accreditation Certificate_2016_Gary Hendrickson
125 Accreditation Certificate_2016_Gary Hendrickson125 Accreditation Certificate_2016_Gary Hendrickson
125 Accreditation Certificate_2016_Gary Hendrickson
glhendrickson
 
Maricel Clicker survey session
Maricel Clicker survey sessionMaricel Clicker survey session
Maricel Clicker survey session
Daniela Gachago
 

Viewers also liked (20)

Presentation fgd
Presentation fgdPresentation fgd
Presentation fgd
 
Security News bytes October 2013
Security News bytes  October 2013Security News bytes  October 2013
Security News bytes October 2013
 
zbeardUXportfolio816
zbeardUXportfolio816zbeardUXportfolio816
zbeardUXportfolio816
 
Lessons Learned by Implementing ArchivesSpace and Archivematica at the Bentle...
Lessons Learned by Implementing ArchivesSpace and Archivematica at the Bentle...Lessons Learned by Implementing ArchivesSpace and Archivematica at the Bentle...
Lessons Learned by Implementing ArchivesSpace and Archivematica at the Bentle...
 
Relax, familiarize and facilitate - Interkulturelles Management in Indien
Relax, familiarize and facilitate - Interkulturelles Management in IndienRelax, familiarize and facilitate - Interkulturelles Management in Indien
Relax, familiarize and facilitate - Interkulturelles Management in Indien
 
125 Accreditation Certificate_2016_Gary Hendrickson
125 Accreditation Certificate_2016_Gary Hendrickson125 Accreditation Certificate_2016_Gary Hendrickson
125 Accreditation Certificate_2016_Gary Hendrickson
 
Social media security
Social media securitySocial media security
Social media security
 
Maintenance delivery capacity and options hgs v 1.9 7 jun 2011
Maintenance delivery capacity and options hgs v 1.9 7 jun 2011Maintenance delivery capacity and options hgs v 1.9 7 jun 2011
Maintenance delivery capacity and options hgs v 1.9 7 jun 2011
 
Maricel Clicker survey session
Maricel Clicker survey sessionMaricel Clicker survey session
Maricel Clicker survey session
 
EI FLYER-HC
EI FLYER-HCEI FLYER-HC
EI FLYER-HC
 
Ensayo de las tics
Ensayo de las ticsEnsayo de las tics
Ensayo de las tics
 
Zusammenfassung Barmer GEK - Hilfsmittelversorgungsvertrag (OT - 2) Produktgr...
Zusammenfassung Barmer GEK - Hilfsmittelversorgungsvertrag (OT - 2) Produktgr...Zusammenfassung Barmer GEK - Hilfsmittelversorgungsvertrag (OT - 2) Produktgr...
Zusammenfassung Barmer GEK - Hilfsmittelversorgungsvertrag (OT - 2) Produktgr...
 
Man ne dzin 2016
Man ne dzin 2016Man ne dzin 2016
Man ne dzin 2016
 
Roadwork signing john coles
Roadwork signing   john colesRoadwork signing   john coles
Roadwork signing john coles
 
Sawabona Shikoba
Sawabona ShikobaSawabona Shikoba
Sawabona Shikoba
 
Ecoporanga
EcoporangaEcoporanga
Ecoporanga
 
A Midia Que Mais Cresce
A Midia Que Mais CresceA Midia Que Mais Cresce
A Midia Que Mais Cresce
 
Workshop2 sectorisation v1
Workshop2 sectorisation v1Workshop2 sectorisation v1
Workshop2 sectorisation v1
 
Widgets e Masters no Axure 7.0
Widgets e Masters no Axure 7.0Widgets e Masters no Axure 7.0
Widgets e Masters no Axure 7.0
 
Ghandi p bill paterson ppt v 3
Ghandi p bill paterson ppt v 3Ghandi p bill paterson ppt v 3
Ghandi p bill paterson ppt v 3
 

Similar to nullcon 2010 - Botnet mitigation, monitoring and management

Life Cycle And Detection Of Bot Infections Through Network Traffic Analysis
Life Cycle And Detection Of Bot Infections Through Network Traffic AnalysisLife Cycle And Detection Of Bot Infections Through Network Traffic Analysis
Life Cycle And Detection Of Bot Infections Through Network Traffic Analysis
Positive Hack Days
 

Similar to nullcon 2010 - Botnet mitigation, monitoring and management (20)

nullcon 2010 - The evil karmetasploit upgrade
nullcon 2010 - The evil karmetasploit upgradenullcon 2010 - The evil karmetasploit upgrade
nullcon 2010 - The evil karmetasploit upgrade
 
[1C2]webrtc 개발, 현재와 미래
[1C2]webrtc 개발, 현재와 미래[1C2]webrtc 개발, 현재와 미래
[1C2]webrtc 개발, 현재와 미래
 
A Survey of Botnet Detection Techniques
A Survey of Botnet Detection TechniquesA Survey of Botnet Detection Techniques
A Survey of Botnet Detection Techniques
 
WebRTC: A front-end perspective
WebRTC: A front-end perspectiveWebRTC: A front-end perspective
WebRTC: A front-end perspective
 
introduction to Botnet
introduction to Botnetintroduction to Botnet
introduction to Botnet
 
Lightweight C&C based botnet detection using Aho-Corasick NFA
Lightweight C&C based botnet detection using Aho-Corasick NFALightweight C&C based botnet detection using Aho-Corasick NFA
Lightweight C&C based botnet detection using Aho-Corasick NFA
 
Botnet
Botnet Botnet
Botnet
 
[2010 CodeEngn Conference 04] Max - Fighting against Botnet
[2010 CodeEngn Conference 04] Max - Fighting against Botnet[2010 CodeEngn Conference 04] Max - Fighting against Botnet
[2010 CodeEngn Conference 04] Max - Fighting against Botnet
 
DEF CON 27 - GRICHTER - reverse engineering 4g hotspots for fun bugs net fina...
DEF CON 27 - GRICHTER - reverse engineering 4g hotspots for fun bugs net fina...DEF CON 27 - GRICHTER - reverse engineering 4g hotspots for fun bugs net fina...
DEF CON 27 - GRICHTER - reverse engineering 4g hotspots for fun bugs net fina...
 
nullcon 2011 - Penetration Testing a Biometric System
nullcon 2011 - Penetration Testing a Biometric Systemnullcon 2011 - Penetration Testing a Biometric System
nullcon 2011 - Penetration Testing a Biometric System
 
Detection of Botnets using Honeypots and P2P Botnets
Detection of Botnets using Honeypots and P2P BotnetsDetection of Botnets using Honeypots and P2P Botnets
Detection of Botnets using Honeypots and P2P Botnets
 
A Survey of HTTP Botnet Detection
A Survey of HTTP Botnet DetectionA Survey of HTTP Botnet Detection
A Survey of HTTP Botnet Detection
 
Research Inventy : International Journal of Engineering and Science
Research Inventy : International Journal of Engineering and ScienceResearch Inventy : International Journal of Engineering and Science
Research Inventy : International Journal of Engineering and Science
 
A Botnet Detecting Infrastructure Using a Beneficial Botnet
A Botnet Detecting Infrastructure Using a Beneficial BotnetA Botnet Detecting Infrastructure Using a Beneficial Botnet
A Botnet Detecting Infrastructure Using a Beneficial Botnet
 
Botnet Architecture
Botnet ArchitectureBotnet Architecture
Botnet Architecture
 
098
098098
098
 
Taming botnets
Taming botnetsTaming botnets
Taming botnets
 
Life Cycle And Detection Of Bot Infections Through Network Traffic Analysis
Life Cycle And Detection Of Bot Infections Through Network Traffic AnalysisLife Cycle And Detection Of Bot Infections Through Network Traffic Analysis
Life Cycle And Detection Of Bot Infections Through Network Traffic Analysis
 
Paper(edited)
Paper(edited)Paper(edited)
Paper(edited)
 
Paper Presentation - "Your Botnet is my Botnet : Analysis of a Botnet Takeover"
Paper Presentation - "Your Botnet is my Botnet : Analysis of a Botnet Takeover"Paper Presentation - "Your Botnet is my Botnet : Analysis of a Botnet Takeover"
Paper Presentation - "Your Botnet is my Botnet : Analysis of a Botnet Takeover"
 

More from n|u - The Open Security Community

More from n|u - The Open Security Community (20)

Hardware security testing 101 (Null - Delhi Chapter)
Hardware security testing 101 (Null - Delhi Chapter)Hardware security testing 101 (Null - Delhi Chapter)
Hardware security testing 101 (Null - Delhi Chapter)
 
Osint primer
Osint primerOsint primer
Osint primer
 
SSRF exploit the trust relationship
SSRF exploit the trust relationshipSSRF exploit the trust relationship
SSRF exploit the trust relationship
 
Nmap basics
Nmap basicsNmap basics
Nmap basics
 
Metasploit primary
Metasploit primaryMetasploit primary
Metasploit primary
 
Api security-testing
Api security-testingApi security-testing
Api security-testing
 
Introduction to TLS 1.3
Introduction to TLS 1.3Introduction to TLS 1.3
Introduction to TLS 1.3
 
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
 
Talking About SSRF,CRLF
Talking About SSRF,CRLFTalking About SSRF,CRLF
Talking About SSRF,CRLF
 
Building active directory lab for red teaming
Building active directory lab for red teamingBuilding active directory lab for red teaming
Building active directory lab for red teaming
 
Owning a company through their logs
Owning a company through their logsOwning a company through their logs
Owning a company through their logs
 
Introduction to shodan
Introduction to shodanIntroduction to shodan
Introduction to shodan
 
Cloud security
Cloud security Cloud security
Cloud security
 
Detecting persistence in windows
Detecting persistence in windowsDetecting persistence in windows
Detecting persistence in windows
 
Frida - Objection Tool Usage
Frida - Objection Tool UsageFrida - Objection Tool Usage
Frida - Objection Tool Usage
 
OSQuery - Monitoring System Process
OSQuery - Monitoring System ProcessOSQuery - Monitoring System Process
OSQuery - Monitoring System Process
 
DevSecOps Jenkins Pipeline -Security
DevSecOps Jenkins Pipeline -SecurityDevSecOps Jenkins Pipeline -Security
DevSecOps Jenkins Pipeline -Security
 
Extensible markup language attacks
Extensible markup language attacksExtensible markup language attacks
Extensible markup language attacks
 
Linux for hackers
Linux for hackersLinux for hackers
Linux for hackers
 
Android Pentesting
Android PentestingAndroid Pentesting
Android Pentesting
 

Recently uploaded

CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Service
giselly40
 
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
Earley Information Science
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
vu2urc
 

Recently uploaded (20)

04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Service
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreter
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 

nullcon 2010 - Botnet mitigation, monitoring and management