[nsp-sec] Hitpop Chinese DDoS Bot Analysis [PDF]

[Jose Nazario]

On Thu, 15 May 2008, Smith, Donald wrote:

> There is a pretty small limit on enclosures on this mailing list. Jose 
> sent it to another list without that limitation and it arrived. I 
> suspect Jose will just have to "host" it somewhere.

hurr ... send out the report and head for the door .. not so bright!

i am now hosting it on my personal website:

http://monkey.org/~jose/private/nsp/Hitpop%20DDoS%20Malware%20Analysis%20PRIVATE.pdf

this is password protected:

 	u: nsp-sec
 	p: netfl0w

please respect the terms of the document's distribution request.

i'm also anxious to get answers posed at the end of the doc.

a public, shorter version is linked here:

http://asert.arbornetworks.com/2008/05/hitpop-ddos-bot-analysis-available/

-------------------------------------------------------------
jose nazario, ph.d.     <jose at arbor.net>
security researcher, office of the CTO,  arbor networks
v: (734) 821 1427 	      http://asert.arbornetworks.com/