Twitter botnet takedown<\/h4>\n\n\n\n
In 2013, I discovered some accounts on Twitter that were sending identical tweets. Studying these tweets and then writing a tool that detected similar ones helped me find more than 45,000 fake Twitter accounts that were being sold as followers. Twitter removed the accounts after I reported them. A brief write-up<\/a> appeared on Virus Bulletin’s blog.<\/p>\n\n\n\n For more then ten years while working at Virus Bulletin<\/a>, I researched unwanted and malicious email campaigns and products’ ability to block them. The most important trend I noticed during this time, was that the more successful campaigns gradually became less prolific but at the same time did a better job at evading filters.<\/p>\n\n\n\n In security, we are often impressed by big numbers, but even in something as mundane as email spam, size doesn’t always matter: a campaign sending 25,000 emails can be more effective than one sending many millions. Here are two<\/a> examples<\/a> of this kind of research, a more concluding version was presented at Botconf 2020.<\/p>\n\n\n\n In 2013, together with Jo\u00e3o Gouveia from Anubisnetworks, I looked into network traffic of what appeared to be a mysterious but prolific botnet. We were able to link it to Mevade (also known as Sefnit), a botnet used to mine for cryptocurrencies. We presented our research at Botconf 2014<\/a> in Nancy and also did a write-up for Anubisnetworks’ blog (of which only an archived version<\/a> exists).<\/p>\n\n\n\n In 2014, Jo\u00e3o looked at the network traffic of another botnet, Qakbot (also known as Qbot and Pinkslipbot). Seven years later, Qakbot continues to be active and has been the initial infection for a number of prominent ransomware cases. An archived version<\/a> of the blog post we wrote still exists.<\/p>\n\n\n\n This is an example of some ad hoc malware analysis performed with two colleagues at Virus Bulletin, resulting in a short blog post<\/a>.<\/p>\n\n\n\n During the early days of phone support scams (around 2012), I found myself of the receiving end of a few of such calls and then ended up researching this kind of scam and the (fake) companies behind them, getting a good understanding of how and why such scams work. A regularly cited paper<\/a> on the subject, written together with three others, was presented at Virus Bulletin 2012. I also shared my research with other researchers, the FTC and law enforcement.<\/p>\n","protected":false},"excerpt":{"rendered":" Throughout my career working in digital security, I have been engaged in many smaller and sometimes larger research projects. This page includes a selection of these projects. (Before working in digital security, I worked as a junior researcher in pure mathematics, a job which obviously included a large research component.) Silent Push I worked for […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"_links":{"self":[{"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/pages\/782"}],"collection":[{"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/comments?post=782"}],"version-history":[{"count":10,"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/pages\/782\/revisions"}],"predecessor-version":[{"id":1025,"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/pages\/782\/revisions\/1025"}],"wp:attachment":[{"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/media?parent=782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Spam: quality vs quantity<\/h4>\n\n\n\n
Mevade (Sefnit) botnet<\/h4>\n\n\n\n
![\"Global](\"http:\/\/lapsed.ordinary\/wp-content\/uploads\/2021\/01\/MevadeGlobalSpread.png\")
<\/figure>\n\n\n\nQakbot botnet<\/h4>\n\n\n\n
Dridex malicious spam campaign<\/h4>\n\n\n\n
Phone support scams<\/h4>\n\n\n\n