Take a Deep Breath: A Stealthy, Resilient and Cost-Effective Botnet Using Skype

  • Antonio Nappa
  • Aristide Fattori
  • Marco Balduzzi
  • Matteo Dell’Amico
  • Lorenzo Cavallaro
Conference paper

DOI: 10.1007/978-3-642-14215-4_5

Part of the Lecture Notes in Computer Science book series (LNCS, volume 6201)
Cite this paper as:
Nappa A., Fattori A., Balduzzi M., Dell’Amico M., Cavallaro L. (2010) Take a Deep Breath: A Stealthy, Resilient and Cost-Effective Botnet Using Skype. In: Kreibich C., Jahnke M. (eds) Detection of Intrusions and Malware, and Vulnerability Assessment. DIMVA 2010. Lecture Notes in Computer Science, vol 6201. Springer, Berlin, Heidelberg

Abstract

Skype is one of the most used P2P applications on the Internet: VoIP calls, instant messaging, SMS and other features are provided at a low cost to millions of users. Although Skype is a closed source application, an API allows developers to build custom plugins which interact over the Skype network, taking advantage of its reliability and capability to easily bypass firewalls and NAT devices. Since the protocol is completely undocumented, Skype traffic is particularly hard to analyze and to reverse engineer. We propose a novel botnet model that exploits an overlay network such as Skype to build a parasitic overlay, making it extremely difficult to track the botmaster and disrupt the botnet without damaging legitimate Skype users. While Skype is particularly valid for this purpose due to its abundance of features and its widespread installed base, our model is generically applicable to distributed applications that employ overlay networks to send direct messages between nodes (e.g., peer-to-peer software with messaging capabilities). We are convinced that similar botnet models are likely to appear into the wild in the near future and that the threats they pose should not be underestimated. Our contribution strives to provide the tools to correctly evaluate and understand the possible evolution and deployment of this phenomenon.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2010

Authors and Affiliations

  • Antonio Nappa
    • 1
  • Aristide Fattori
    • 1
  • Marco Balduzzi
    • 2
  • Matteo Dell’Amico
    • 2
  • Lorenzo Cavallaro
    • 3
  1. 1.DICoUniversità degli Studi di MilanoItaly
  2. 2.Eurecom Sophia-AntipolisFrance
  3. 3.Faculty of SciencesVrije Universiteit AmsterdamNetherlands

Personalised recommendations