Owning bad guys (and mafia) with JavaScript botnets

Speakers: Chema Alonso | Manu “THE SUR”

Man in the middle attacks are still one of the most powerful techniques for owning machines. In this talk MITM schemas in anonymous services are going to be discussed.

Then attendees will see how easily a botnet using JavaScript can be created to analyze that kind of connections and some of the actions people behind those services are doing… in real.

Knowledge is the life of the mind

Javascript
Article

Creating a JavaScript botnet

A JavaScript botnet would include thousands of systems that have the attacker controlled page open on their browsers for an extended duration allowing continued execution of the attacker’s JavaScript.

Learn more about creating a JavaScript botnet

Article

There are no malicious exploits being used, so there is nothing that can be patched

Building the botnet by getting other people’s browsers to load a piece of JavaScript code and storing data on their computers falls into a legally gray area, Malone said. Read more

Article

Proxy Rewrite = JavaScript Botnet

After watching Chema Alonso at DEF CON 20 I started wondering how hard it could be to build a Javascript botnet. Chema said it took him a day, when I tried it I beat that record by 22 hours and 15minutes and that’s from creating a new Digital Ocean droplet to getting my first victim. Read more

Whitepaper

An analysis of the Asprox botnet

Botherders automate the SQL attack vector to search potential SQL servers through Google search engine and then try to infect the server by inserting a malicious JavaScript file.

Learn more about the Asprox botnet

Presentation

HiveMind: Distributed file storage using JavaScript botnets

Sean Malone gave a presentation at DEF CON 21 about the methodology and tools required to create a distributed file store built on top of a JavaScript botnet.

Believe you can and you’re halfway there