The Italian Honey Project » Paper

Dorothy @APWG in Dallas

marco.riccardi — Thu, 14 Oct 2010 09:16:18 +0000

On next Tuesday (October 19) I’m going to present a research in progress paper that I wrote with the e-Crime team of Barcelona Digital and Marco Cremonini from Department of Information Technology of the Università degli Studi di Milano.

The title of our paper is “A Framework For Financial Botnet Analysis“ and will be presented at the Anti Phishing Working Group (APWG) conference that this year will be held in Dallas. Our work represents a research study that is still in progress that is based on developing new detection and mitigation strategies to cope with financial botnets.

The proposed research partially relies on a customized version of the Dorothy Framework by improving its overall development status. The Italian Chapter of the Honeynet Project is proud to see that its work is going to be useful also for such purpose, and this publication will encourage its future research.

Attending EC2ND

marco.riccardi — Tue, 27 Oct 2009 16:14:22 +0000

I’m glad to inform that we will be attending the European Conference 2 Network Defence (EC2ND), scheduled on 9-10 November. This year the event is hosted by the Politecnico di Milano technical university in Milano, Italy.
Me and marco will introduce the status of our current activities.

Hope to see you there!

Taking over the Torpig botnet

marco.riccardi — Mon, 04 May 2009 11:11:00 +0000

Interesting paper about the Torpig botnet. It’s a very accurate report about this botnet, and I suggest this paper to any botnet-researcher. I found very interesting the new technique ( called domain flux in this paper) used by Torpig for C&C discovering.

[..] With domain flux, each bot uses a domain generation algorithm (DGA) to compute
a list of domain names. This list is computed independently
by each bot and is regenerated periodically. Then, the bot attempts
to contact the hosts in the domain list in order until one succeeds,
i.e., the domain resolves to an IP address and the corresponding
server provides a response that is valid in the botnet’s protocol [..]

Here is the project web site.