View source for Your botnet is my botnet: analysis of a botnet takeover

{{Publication
|Image=Torpig_botnet_takeover.png
|Botnet=Torpig
|Malware=Mebroot
|Year=2009
|Date=2009-11-09
|Editor=Department of Computer Science, University of California, Santa Barbara
|Link=https://seclab.cs.ucsb.edu/media/uploads/papers/torpig.pdf
|Author=Brett Stone-Gross, Marco Cova, Lorenzo Cavallaro, Bob Gilbert, Martin Szydlowski, Richard A Kemmerer, Christopher Kruegel, Giovanni Vigna
|Abstract=[[Botnets]], networks of malware-infected machines that are controlled by an adversary, are the root cause of a large number of security problems on the Internet. A particularly sophisticated and insidious type of bot is [[Torpig]], a malware program that is designed to harvest sensitive information (such as bank account and credit card data) from its victims. In this paper, we report on our efforts to take control of the [[Torpig]] [[botnet]] and study its operations for a period of ten days. During this time, we observed more than 180 thousand infections and recorded almost 70 GB of data that the bots collected.<br/> <br/>

While [[botnets]] have been “hijacked” and studied previously, the [[Torpig]] [[botnet]] exhibits certain properties that make the analysis of the data particularly interesting. First, it is possible (with reasonable accuracy) to identify unique bot infections and relate that number to the more than 1.2 million IP addresses that contacted our command and control server. Second, the [[Torpig]] [[botnet]] is large, targets a variety of applications, and gathers a rich and diverse set of data from the infected victims. This data provides a new understanding of the type and amount of personal information that is stolen by [[botnet|botnets]].
|Document=Ucsb-torpig.pdf
|NomRevue=Proceedings of the ACM CCS
|Titre=Your botnet is my botnet: analysis of a botnet takeover
}}