FAQ: Disabling the new Hlux/Kelihos Botnet<p><b>Q: What is the Hlux/Kelihos botnet?</b> A: Kelihos is Microsoft's name for what Kaspersky calls Hlux. Hlux is a peer-to-peer botnet with an architecture similar to the one used for the <a href=http://en.wikipedia.org/wiki/Waledac_botnet>Waledac botnet</a>. It consists of layers of different kinds of nodes: controllers, routers and workers. </p> <p><b>Q: What is a peer-to-peer botnet?</b> A: Unlike a classic botnet, a peer-to-peer botnet doesn't use a centralized command and control-server (C&C). Every member of the network can act as a server and/or client. The advantages from the malicious user’s point of view is the omission of the central C&C as a single-point-of-failure. From our point of view, this makes it a lot harder to take down this kind of botnet. Architecture of traditional botnet vs P2P: </p> <p class=c><img src="images/pictures/klblog/208193435.jpg" border="1" alt="Traditional botnet with centralized C&C" title="Traditional botnet with centralized C&C"><center>Traditional botnet with centralized C&C</center></p> <p class=c><img src="images/pictures/klblog/208193436.jpg" border="1" alt="Architecture of a P2P botnet" title="Architecture of a P2P botnet"><center>Architecture of a P2P botnet</center></p>
Source:
FAQ: Disabling the new Hlux/Kelihos Botnet
