BSidesSF 2017 - Live Dissection: Anatomy of a Browser Based Botnet (Ilya Nesterov)

so in this case when user open a browser oh there's this malicious payload will be allotted from a cash yep and we can't do anything what we can do so thinking about numbers behind it so as i showed in a slide before and that w pad research people got about 16 k unique visitors per month and usually pay per install rates verse for about hundred two hundred eighty dollars for 1000 successful installation for us and your based IP addresses in the same research they found that about fifty percent of traffic coming from us in europe so it can easily make you about 4k amounts if you remove everything that you need pay for infrastructure so and just some

interesting causal if you can go to iron and you can find about 1500 top-level domains i don't know how many of them are free now so you can register w hat there but when i did my research on number so just like in july last year i just went to the mains google comment who w pad names there and i turned to be about like how you hundreds top-level domains that you can register easily with the google and just last week i run the same search and there is a last number so it's like someone already bought this dimension might be using this for a malicious activity so how to protect yourself to not be a victim and

not be a part of this domain so obviously if you using any public Wi-Fi network you want to have clear your cache after that you might want to use the VPN or you might want to use a separate profile in your browser just when I go into public Wi-Fi go and check your settings in your browser and disable trucks after discovery i'm pretty sure that many people not aware about this thing so it's and for example Travis versions of Microsoft so windows the venue is solid by default it has a setting turned on if you have web application developer just to prevent or protect your users make sure that you switch your website to https and you use the strict are strict

Transport Security to prevent allowed in HTTP version of your website and of course you sub-races integrity for any JavaScript you load because this will prevent on any malicious content be loaded there so let's all I have so far if you guys have any questions I will be here around for you can ask them right now thank you [Applause]

thanks very much Julia thank you on behalf of Fitbit and the b-side San Francisco really appreciate it yeah all right everybody or take a couple minutes between things but don't forget that there's a lot of stuff going on our friends from sales sports or sponsoring a happy hour after all the talks today so get down there also if you want to get some help with your resume we have a little bit of resume writing down stairs here and buzz works and the party this starts tonight at eight o'clock