I had planned to continue posting a series of articles detailing my findings from looking into the Kelihos botnet (namely the peer-to-peer protocol). Although my intentions were only to crawl the botnet and try to gauge its size (out of personal interest), I've been made aware that the information posted in my previous article may have been used by others to perform attacks, resulting in some changed being made to the protocol. Personally I'd be happy to keep reversing the bot and play protocol whack-a-mole, though I understand that there's probably a lot of people out there who are going to be upset if the protocol is repeatedly changed as a result of my articles. I did consider taking a different path with the article and documenting the malware side of Kelihos, like I usually do, but the code is rather software like and doesn't contain anything interesting such as any form of stealth or defense against removal.
If you have any suggestions for what I should write about instead, please email me on [email protected].
SOCIAL SHARE CARD GENERATOR