A Case Study on Asprox Infection Dynamics

Abstract. The Asprox infection weaves a complex chain of dependencies involving bots that perform SQL injections on vulnerable web servers, and visitors whose machines get compromised simply by visiting infected websites. Using real-world data sets, we study Asprox bots, infected web servers, and the malicious infrastructure behind Asprox propagation. We find that the malware-propagation infrastructure in Asprox is aggressively provisioned to resist take-down efforts. This, combined with the easy availability of vulnerable user machines and web servers whose administrators are probably constrained in time and resources necessary to fix the problem, indicates that cleaning up Asprox infections is not going to be easy.

• Type: Conference
• Year: 2009
• Where: DIMVA
• Authors: Youngsang Shin, Steven A. Myers, Minaxi Gupta
• Keywords: Dependencies Involving Bots, DIMVA 2007, DIMVA 2009, Vulnerable Web Servers, Web Servers