Down The Rabbit Hole: How Hackers Exploit Weak SSH Credentials To Build DDoS Botnets

No ratings

Presented at Grehack 2017 by

Christophe Tafani-dereeper

DDoS attacks are one of the most prominent threats on the Internet nowadays. In this talk, we explore how hackers exploit servers with weak SSH credentials to build an army of botnets, later used to run high-volume DDoS attacks. After showcasing an experimentation where a honeypot was used to understand the attack pattern and collect relevant malware samples, we reverse engineer the Xor DDoS malware and break down its obfuscation mechanisms, the communication with its command and control server, and how it spreads in a vulnerable system.