Security-X
Forum Security-X => News => Discussion démarrée par: igor51 le avril 10, 2012, 19:14:14
-
FAQ: Disabling the new Hlux/Kelihos Botnet
<p><b>Q: What is the Hlux/Kelihos botnet?</b> A: Kelihos is Microsoft's name for what Kaspersky calls Hlux. Hlux is a peer-to-peer botnet with an architecture similar to the one used for the <a href=http://en.wikipedia.org/wiki/Waledac_botnet>Waledac botnet</a>. It consists of layers of different kinds of nodes: controllers, routers and workers. </p> <p><b>Q: What is a peer-to-peer botnet?</b> A: Unlike a classic botnet, a peer-to-peer botnet doesn't use a centralized command and control-server (C&C). Every member of the network can act as a server and/or client. The advantages from the malicious user’s point of view is the omission of the central C&C as a single-point-of-failure. From our point of view, this makes it a lot harder to take down this kind of botnet. Architecture of traditional botnet vs P2P: </p> <p class=c><img src="images/pictures/klblog/208193435.jpg" border="1" alt="Traditional botnet with centralized C&C" title="Traditional botnet with centralized C&C"><center>Traditional botnet with centralized C&C</center></p> <p class=c><img src="images/pictures/klblog/208193436.jpg" border="1" alt="Architecture of a P2P botnet" title="Architecture of a P2P botnet"><center>Architecture of a P2P botnet</center></p>
Source: FAQ: Disabling the new Hlux/Kelihos Botnet (http://www.securelist.com/en/blog/208193438/FAQ_Disabling_the_new_Hlux_Kelihos_Botnet)