Case study of the Miner Botnet

Malware and botnets are one of the most serious threats to today's Internet security. In this paper, we characterise the so-called &Miner Botnet”. It received major media attention after massive distributed denial of service attacks against a wide range of German and Russian websites, mainly during August and September 2011. We use our insights on this botnet to outline current botnet-related money-making concepts and to show that multiple activities of this botnet are actually centred on the virtual anonymised currency Bitcoin, thus justifying the name. Furthermore, we provide a binary-level analysis of the malware's design and components to illustrate the modularity of the previously mentioned concepts. We give an overview of the structure of the command-and-control protocol as well as of the botnet's architecture. Both centralised as well as distributed infrastructure aspects realised through peer-to-peer are present to run the botnet, the latter for increasing its resiliency. Finally, we provide the results of our ongoing tracking efforts that started in September 2011, focusing on the development of the botnet's size and geographic distribution. In addition we point out the challenge that is generally connected with size measurements of botnets due to the reachability of individual nodes and the persistence of IP addresses over time.

1. INTRODUCTION

Malicious software (short: malware) is the key enabler for digital crime and thus poses a serious threat to the modern society. One of its many uses is the creation of botnets. These networks of compromised computers (bots) are controlled by a third party (botmasters) and provide a flexible toolset for various illegal activities, promising remarkable financial gain with a low risk of being caught. Examples for activities are the massive sending of unsolicited messages (SPAM), distributed denial of service (DDoS) attacks, or the automated extraction of sensible credentials such as account login information or banking details.