Coreflood: The Hidden Thief

2525 Words6 Pages

Being connected to the Internet today, the question one has to ask himself or herself is not if I get breached, but more on when I will be breached. That being said, according to Verizon’s 2013 Data Breach Investigation Report 92% of all breaches they researched and participated in investigating were committed by parties external to the network being compromised. In addition to this statistic, 40% of breaches incorporated some form of malware and 52% used some form of hacking, which according to their information both were at least a 10% decrease from the previous year (Verizon Risk Team, 2013). Even though those numbers have decreased, there is no definitive data to say whether this is due to an increase in the ability of technology to detect and prevent or if the end user is becoming more educated or some combination of the two.
Malware, short for malicious software, as stated above still accounts for approximately 40% of breaches detected and caught. Coreflood has been gone through multiple iterations and has evolved over its lifetime starting out as an IRC (Internet Relay Chate) Botnet (Robot Network) and evolving into a Trojan capable of stealing your keystrokes, data, and anything else that you might find important. While Coreflood isn’t a big danger today, due to the U.S Department of Justice and FBI replacing the malicious command and control (C2) servers with government controlled systems, it did have a big effect on computers in its hay day. As shown by Computerworld and FBI data Coreflood was receiving as many as 800,000 beacons a day to the C2 servers.

Figure 1: Data: “2011 Computer World”, Keizer

To start with a brief history and terminology, Coreflood is a derivative of the AFcore Trojan which originated ba...

... middle of paper ...

....aspx
Securelist. Backdoor.Win32.Afcore.q. Retrieved from http://www.securelist.com/en/descriptions/90272/Backdoor.Win32.Afcore.q
Stewart, J. (2008). The Coreflood Report. Retrieved from: http://www.secureworks.com/cyber-threat-intelligence/threats/coreflood-report/
Verizon Risk Team (2013). 2013 Data Breach Investigations Report. Retrieved from: http://www.verizonenterprise.com/resources/reports/rp_data-breach-investigations-report-2013_en_xg.pdf
Warner, G. (2008). Russian Cybercrooks, Coreflood, and the Amazing Joe Stewart. Retrieved from: http://garwarner.blogspot.com/2008/07/russian-cybercrooks-coreflood-and.html
Wikipedia. Botnet. Retrieved from: http://en.wikipedia.org/wiki/Botnet
United States District Court District of Connecticut. (2011). United States v. JOHN DOE 1-13. Retrieved from: http://www.fbi.gov/newhaven/press-releases/pdf/nh041311_4.pdf

Open Document