TDL-4's makers use the botnet to plant additional malware on PCs
Whoa, it's the evil app store!
Could this be used to take the botnet down? Pay them to install something and sneak in an antidote?
Massive Indestructible Botnet
21–30 of 49 posts
Re: Massive Indestructible Botnet
#22TDL-4's makers use the botnet to plant additional malware on PCs Whoa, it's the evil app store! Could this be used to take the botnet down? Pay them to install something and sneak in an antidote?
Pay them enough and they'll uninstall it themself ;)
Re: Massive Indestructible Botnet
#23> TDL-4's makers created their own encryption algorithm Two comments about this -- I give it maybe a week or two against a good cryptographer. You never, ever invent your own encryption algorithm. -- Even if the encryption algorithm happens to be secure against differential/linear/slide/boomerang attacks, I bet there will be an implementation flaw. It's really hard to get implementation right on those things, even if…
>> You never, ever invent your own encryption algorithm.
That is a good advice for the average enterprise/startup programer. But these guys are:
1. Rockstar programers, probably a lot smarter then you or me (don't waste their time writing comments, but have created probably the most cost-efficient cloud platform in the world).
2. Afraid that NSA can come after them. And I'm pretty sure that NSA can crack the popular implementations of AES.
Re: Massive Indestructible Botnet
#24> TDL-4's makers created their own encryption algorithm Two comments about this -- I give it maybe a week or two against a good cryptographer. You never, ever invent your own encryption algorithm. -- Even if the encryption algorithm happens to be secure against differential/linear/slide/boomerang attacks, I bet there will be an implementation flaw. It's really hard to get implementation right on those things, even if…
> The code in the MBR uses an unsophisticated encryption algorithm, but even small modifications to the algorithm are sufficient to evade signature-based detection by most antivirus products.
from http://www.securelist.com/en/analysis/204792157/TDSS_TDL_4
So it is mainly there to fool anti-virus programs that look for a particular fingerpring, and not necessarily to pass secret info back and forth.
Re: Massive Indestructible Botnet
#25Is it just me, or does this article read like a sales brochure for TDL-4?
Re: Massive Indestructible Botnet
#26So that's how some videos on youtube have millions of hits before anyone has heard of them...
Re: Massive Indestructible Botnet
#27Why is anybody on Earth still using Windows?
Re: Massive Indestructible Botnet
#28Earlier quoted context omitted.
> and the botnet uses the domain names of the C&C servers as the encryption keys. ... what? That kind of defeats the entire purpose of encryption when they key is something like that. Besides, what are they using this encryption for. It seems more likely they want a check on the integrity of messages. And even still, a MAC is equally worthless since it's not public/private key. Maybe it is public/private key, and the…
> Maybe it is public/private key, and they use (derive?) the public key from the name of the server? How would that work though? Maybe I just don't know enough, but I can't think of a way to generate a public key from some known source, and then somehow derive a private key from that source such that no one else can derive that same private key. I guess you could generate an RSA key pair using the domain name as a se…
DISCLAIMER: I'm not even a rookie at crypto; I'm just trying to make sense of what I'm reading, like you are.
From [1]:
> The cybercriminals replaced RC4 with their own encryption algorithm using XOR swaps and operations. The domain names to which connections are made and the bsh parameter from the cfg.ini file are used as encryption keys.
A bit later:
> The new protocol encryption algorithm for communications between the botnet control center and infected machines ensures that the botnet will run smoothly, while protecting infected computers from network traffic analysis, and blocking attempts of other cybercriminals to take control of the botnet.
So we have authentication of the C&C through encryption ("block other cybercriminals"), and obfuscation of the payload through encryption ("protect from network traffic analysis"). I suppose the bsh parameter is used for auth, and the domain name just to scramble the payload.
[1] http://www.securelist.com/en/analysis/204792180/TDL4_Top_Bot
Re: Massive Indestructible Botnet
#29Why is anybody on Earth still using Windows?
-The name inspires a lot of trust to a layperson
-There's a lot of software with no equivalent in other OSs (including computer games, which are a selling point for a lot of people, and Visual Studio)
-Many companies are reluctant to change software they've been using for any length of time. Changing the OS is specially unlikely.
-It's really not that bad an OS...
Re: Massive Indestructible Botnet
#30Why is anybody on Earth still using Windows?
Does it matter? Attackers will always target whatever platform is the most popular.