Highly resilient peer-to-peer botnets are here: An analysis of Gameover Zeus

Dennis Andriesse; Christian Rossow; Brett Stone-Gross; Daniel Plohmann; Herbert Bos

doi:10.1109/MALWARE.2013.6703693

Highly resilient peer-to-peer botnets are here: An analysis of Gameover Zeus

Dennis Andriesse, Christian Rossow, Brett Stone-Gross, Daniel Plohmann, Herbert Bos

Research output: Chapter in Book / Report / Conference proceeding › Conference contribution › Academic › peer-review

Abstract

Zeus is a family of credential-stealing trojans which originally appeared in 2007. The first two variants of Zeus are based on centralized command servers. These command servers are now routinely tracked and blocked by the security community. In an apparent effort to withstand these routine countermeasures, the second version of Zeus was forked into a peer-to-peer variant in September 2011. Compared to earlier versions of Zeus, this peer-to-peer variant is fundamentally more difficult to disable. Through a detailed analysis of this new Zeus variant, we demonstrate the high resilience of state of the art peer-to-peer botnets in general, and of peer-to-peer Zeus in particular.

Original language	English
Title of host publication	2013 8th International Conference on Malicious and Unwanted Software [Proceedings]
Subtitle of host publication	"The Americas", MALWARE 2013
Place of Publication	Fajardo, Puerto Rico, USA
Publisher	ACM, IEEE Computer Society
Pages	116-123
Number of pages	8
ISBN (Print)	9781479925339
DOIs	https://doi.org/10.1109/MALWARE.2013.6703693
Publication status	Published - 2013
Event	2013 8th International Conference on Malicious and Unwanted Software: "The Americas", MALWARE 2013 - Fajardo, PR, United States Duration: 22 Oct 2013 → 24 Oct 2013

Conference

Conference	2013 8th International Conference on Malicious and Unwanted Software: "The Americas", MALWARE 2013
Country/Territory	United States
City	Fajardo, PR
Period	22/10/13 → 24/10/13

Access to Document

10.1109/MALWARE.2013.6703693

Persistent URL (handle)

Persistent link

Cite this

Andriesse, D., Rossow, C., Stone-Gross, B., Plohmann, D., & Bos, H. (2013). Highly resilient peer-to-peer botnets are here: An analysis of Gameover Zeus. In 2013 8th International Conference on Malicious and Unwanted Software [Proceedings]: "The Americas", MALWARE 2013 (pp. 116-123). Article 6703693 ACM, IEEE Computer Society. https://doi.org/10.1109/MALWARE.2013.6703693

@inproceedings{d89c7886ab354f06ba47011e3f6da2e1,

title = "Highly resilient peer-to-peer botnets are here: An analysis of Gameover Zeus",

abstract = "Zeus is a family of credential-stealing trojans which originally appeared in 2007. The first two variants of Zeus are based on centralized command servers. These command servers are now routinely tracked and blocked by the security community. In an apparent effort to withstand these routine countermeasures, the second version of Zeus was forked into a peer-to-peer variant in September 2011. Compared to earlier versions of Zeus, this peer-to-peer variant is fundamentally more difficult to disable. Through a detailed analysis of this new Zeus variant, we demonstrate the high resilience of state of the art peer-to-peer botnets in general, and of peer-to-peer Zeus in particular.",

author = "Dennis Andriesse and Christian Rossow and Brett Stone-Gross and Daniel Plohmann and Herbert Bos",

year = "2013",

doi = "10.1109/MALWARE.2013.6703693",

language = "English",

isbn = "9781479925339",

pages = "116--123",

booktitle = "2013 8th International Conference on Malicious and Unwanted Software [Proceedings]",

publisher = "ACM, IEEE Computer Society",

note = "2013 8th International Conference on Malicious and Unwanted Software: {"}The Americas{"}, MALWARE 2013 ; Conference date: 22-10-2013 Through 24-10-2013",

}

Andriesse, D, Rossow, C, Stone-Gross, B, Plohmann, D & Bos, H 2013, Highly resilient peer-to-peer botnets are here: An analysis of Gameover Zeus. in 2013 8th International Conference on Malicious and Unwanted Software [Proceedings]: "The Americas", MALWARE 2013., 6703693, ACM, IEEE Computer Society, Fajardo, Puerto Rico, USA, pp. 116-123, 2013 8th International Conference on Malicious and Unwanted Software: "The Americas", MALWARE 2013, Fajardo, PR, United States, 22/10/13. https://doi.org/10.1109/MALWARE.2013.6703693

Highly resilient peer-to-peer botnets are here: An analysis of Gameover Zeus. / Andriesse, Dennis; Rossow, Christian; Stone-Gross, Brett et al.
2013 8th International Conference on Malicious and Unwanted Software [Proceedings]: "The Americas", MALWARE 2013. Fajardo, Puerto Rico, USA: ACM, IEEE Computer Society, 2013. p. 116-123 6703693.

Research output: Chapter in Book / Report / Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Highly resilient peer-to-peer botnets are here

T2 - 2013 8th International Conference on Malicious and Unwanted Software: "The Americas", MALWARE 2013

AU - Andriesse, Dennis

AU - Rossow, Christian

AU - Stone-Gross, Brett

AU - Plohmann, Daniel

AU - Bos, Herbert

PY - 2013

Y1 - 2013

N2 - Zeus is a family of credential-stealing trojans which originally appeared in 2007. The first two variants of Zeus are based on centralized command servers. These command servers are now routinely tracked and blocked by the security community. In an apparent effort to withstand these routine countermeasures, the second version of Zeus was forked into a peer-to-peer variant in September 2011. Compared to earlier versions of Zeus, this peer-to-peer variant is fundamentally more difficult to disable. Through a detailed analysis of this new Zeus variant, we demonstrate the high resilience of state of the art peer-to-peer botnets in general, and of peer-to-peer Zeus in particular.

AB - Zeus is a family of credential-stealing trojans which originally appeared in 2007. The first two variants of Zeus are based on centralized command servers. These command servers are now routinely tracked and blocked by the security community. In an apparent effort to withstand these routine countermeasures, the second version of Zeus was forked into a peer-to-peer variant in September 2011. Compared to earlier versions of Zeus, this peer-to-peer variant is fundamentally more difficult to disable. Through a detailed analysis of this new Zeus variant, we demonstrate the high resilience of state of the art peer-to-peer botnets in general, and of peer-to-peer Zeus in particular.

UR - http://www.scopus.com/inward/record.url?scp=84893791719&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84893791719&partnerID=8YFLogxK

U2 - 10.1109/MALWARE.2013.6703693

DO - 10.1109/MALWARE.2013.6703693

M3 - Conference contribution

SN - 9781479925339

SP - 116

EP - 123

BT - 2013 8th International Conference on Malicious and Unwanted Software [Proceedings]

PB - ACM, IEEE Computer Society

CY - Fajardo, Puerto Rico, USA

Y2 - 22 October 2013 through 24 October 2013

ER -

Highly resilient peer-to-peer botnets are here: An analysis of Gameover Zeus

Abstract

Conference

Access to Document

Persistent URL (handle)

Other files and links

Fingerprint

Cite this