Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH...
12
1
Transcript of Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH...
![Page 1: Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH Price: 60 WMZ for 1k 26, 2010 9:48 am buts am bots allowed ero cnaM60Ta, 3arpy3K'.1](https://reader033.fdocuments.in/reader033/viewer/2022060610/60612c11698d071761575141/html5/thumbnails/1.jpg)
1
![Page 2: Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH Price: 60 WMZ for 1k 26, 2010 9:48 am buts am bots allowed ero cnaM60Ta, 3arpy3K'.1](https://reader033.fdocuments.in/reader033/viewer/2022060610/60612c11698d071761575141/html5/thumbnails/2.jpg)
2
![Page 3: Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH Price: 60 WMZ for 1k 26, 2010 9:48 am buts am bots allowed ero cnaM60Ta, 3arpy3K'.1](https://reader033.fdocuments.in/reader033/viewer/2022060610/60612c11698d071761575141/html5/thumbnails/3.jpg)
3
![Page 4: Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH Price: 60 WMZ for 1k 26, 2010 9:48 am buts am bots allowed ero cnaM60Ta, 3arpy3K'.1](https://reader033.fdocuments.in/reader033/viewer/2022060610/60612c11698d071761575141/html5/thumbnails/4.jpg)
![Page 5: Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH Price: 60 WMZ for 1k 26, 2010 9:48 am buts am bots allowed ero cnaM60Ta, 3arpy3K'.1](https://reader033.fdocuments.in/reader033/viewer/2022060610/60612c11698d071761575141/html5/thumbnails/5.jpg)
5
![Page 6: Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH Price: 60 WMZ for 1k 26, 2010 9:48 am buts am bots allowed ero cnaM60Ta, 3arpy3K'.1](https://reader033.fdocuments.in/reader033/viewer/2022060610/60612c11698d071761575141/html5/thumbnails/6.jpg)
If we controlthese …
… we can monitor &influence these
![Page 7: Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH Price: 60 WMZ for 1k 26, 2010 9:48 am buts am bots allowed ero cnaM60Ta, 3arpy3K'.1](https://reader033.fdocuments.in/reader033/viewer/2022060610/60612c11698d071761575141/html5/thumbnails/7.jpg)
![Page 8: Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH Price: 60 WMZ for 1k 26, 2010 9:48 am buts am bots allowed ero cnaM60Ta, 3arpy3K'.1](https://reader033.fdocuments.in/reader033/viewer/2022060610/60612c11698d071761575141/html5/thumbnails/8.jpg)
Types of Storm C&CMessages
• Activation (report from bot to botmaster)• Email address harvests• Spamming instructions• Delivery reports• DDoS instructions• FastFlux instructions• HTTP proxy instructions• Sniffed passwords report• IFRAME injection/report
![Page 9: Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH Price: 60 WMZ for 1k 26, 2010 9:48 am buts am bots allowed ero cnaM60Ta, 3arpy3K'.1](https://reader033.fdocuments.in/reader033/viewer/2022060610/60612c11698d071761575141/html5/thumbnails/9.jpg)
Spam campaign mechanics
TCP
HTTP
HTTPproxies
Workers
Proxybots
Botmaster
![Page 10: Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH Price: 60 WMZ for 1k 26, 2010 9:48 am buts am bots allowed ero cnaM60Ta, 3arpy3K'.1](https://reader033.fdocuments.in/reader033/viewer/2022060610/60612c11698d071761575141/html5/thumbnails/10.jpg)
Campaign mechanics: harvest
TCP
HTTP
HTTPproxies
Workers
Proxybots
Botmaster
@@@@
@
@@ @
![Page 11: Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH Price: 60 WMZ for 1k 26, 2010 9:48 am buts am bots allowed ero cnaM60Ta, 3arpy3K'.1](https://reader033.fdocuments.in/reader033/viewer/2022060610/60612c11698d071761575141/html5/thumbnails/11.jpg)
![Page 12: Spam - ICIR · Spam pa60rb. B com 3a 29.12-2007 Greetin s to all! Due to overstock am sellin ueH Price: 60 WMZ for 1k 26, 2010 9:48 am buts am bots allowed ero cnaM60Ta, 3arpy3K'.1](https://reader033.fdocuments.in/reader033/viewer/2022060610/60612c11698d071761575141/html5/thumbnails/12.jpg)
Campaign mechanics: spamming
TCP
HTTP
HTTPproxies
Workers
Proxybots
Botmaster