Fighting malware and spam

Last-minute paper reserve: The Waledac botnet: understanding it and breaking it

Pierre-Marc Bureau ESET
Joan Calvet Ecole Polytechnique de Montreal

The Waledac malware family clearly is Storm Worm 2.0: The code for both families is completely different but their functionalities and modus operandi are exactly the same. Waledac, just like Storm, uses a layered peer-to-peer network to communicate, propagates through malicious links, and is used to send huge amounts of spam. A bit like Web 2.0, Waledac introduces new vulnerabilities that were avoided by its predecessor.

In this presentation, we give an in-depth description of the Waledac malware family and its evolution. We explain the behaviour of its custom protection layer, its information-stealing capabilities and its business model. We also discuss the inner workings of its peer-to-peer network, how new peers connect to the network and how they send information back to the operators. Finally, we expose weaknesses that could be exploited to disrupt the botnet's activity and how Waledac's operators are working toward fixing them.