In his company’s suite in a hotel in San Francisco, Infosecurity met with Farsight Security CEO Paul Vixie, who said he was in a mood that has caused him “wake up angry.”
He was referring to overnight reports of a variation of Mozart “which uses DNS to get its commands.” He said that any botnet has the problem of collecting instructions of what the botmaster wants it to do, and this usually involves an Opsec indicator like an IP address or domain name, which would then make the operator a target for law enforcement.
“So anyone who captures the malicious binary that is running inside the botnet can disassemble and reverse engineer it and figure out how it is getting its command and control,” he says.
Vixie explained that a lot of work has been done around how to control a botnet, without getting arrested, and this variant uses DNS so all it has to do is ask the text record associated with a domain name.
read more (infosecurity magazine)
He was referring to overnight reports of a variation of Mozart “which uses DNS to get its commands.” He said that any botnet has the problem of collecting instructions of what the botmaster wants it to do, and this usually involves an Opsec indicator like an IP address or domain name, which would then make the operator a target for law enforcement.
“So anyone who captures the malicious binary that is running inside the botnet can disassemble and reverse engineer it and figure out how it is getting its command and control,” he says.
Vixie explained that a lot of work has been done around how to control a botnet, without getting arrested, and this variant uses DNS so all it has to do is ask the text record associated with a domain name.
read more (infosecurity magazine)
