{"id":16647,"date":"2019-10-21T10:52:17","date_gmt":"2019-10-21T18:52:17","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/10\/21\/news-10386\/"},"modified":"2019-10-21T10:52:17","modified_gmt":"2019-10-21T18:52:17","slug":"news-10386","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/10\/21\/news-10386\/","title":{"rendered":"VB2019 paper: Geost botnet. The story of the discovery of a new Android banking trojan from an OpSec error"},"content":{"rendered":"<p>OpSec mistakes are what lead to many malware discoveries, but in the case of the Geost <em>Android<\/em> botnet the mistake was a really interesting one: its operators were using another botnet, HtBot, to manage infected devices, not realising that researchers were analysing some HtBot-infected hosts.<\/p>\n<p>This led researchers Sebastian Garc\u00eda, Maria Jose Erquiaga and Anna Shirokova to the discovery of Geost, a large <em>Android<\/em> botnet mostly targeting users of online banking in Russia.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" style=\"display: block; margin-left: auto; margin-right: auto;\" src=\"https:\/\/www.virusbulletin.com\/files\/cache\/14239326b1a9dcb2923f92893957c4f7_f3785.jpg\" alt=\"htbot-infra.jpg\" width=\"340\" height=\"433\" \/><span class=\"centered-caption\">Discovery of the Geost botnet. A monitored bot of the HtBot malware was used by the Geost botmasters. First, the Geost botmaster connected to the HtBot network; second, the HtBot network relayed the data to our bot; third, our bot sent the traffic to the Internet; fourth, the botmaster accessed the Geost C&amp;C server on the Internet.<\/span><br \/>Today we publish the researchers&#8217; paper on Geost in both <a title=\"VB2019 paper: Geost botnet. The story of the discovery of a new Android banking trojan from an OpSec error\" href=\"https:\/\/www.virusbulletin.com\/virusbulletin\/2019\/10\/vb2019-paper-geost-botnet-story-discovery-new-android-banking-trojan-opsec-error\/\">HTML<\/a> and <a href=\"https:\/\/www.virusbulletin.com\/uploads\/pdf\/magazine\/2019\/VB2019-Garcia-etal.pdf\" target=\"_blank\">PDF <\/a>format. We have also uploaded the video of Sebastian and Anna presenting at VB2019 in London to our <em>YouTube<\/em> channel.<\/p>\n<p>\u00a0<\/p>\n<p>\u00a0<\/p>\n<p style=\"text-align: center;\" width=\"100%\" height=\"420\"><iframe loading=\"lazy\" src=\"https:\/\/www.youtube.com\/embed\/kXjTivaUNKI\" frameborder=\"0\" width=\"100%\" height=\"420\" style=\"\"><\/iframe><\/p>\n<p>\u00a0<\/p>\n<p>outertext<br \/><a href=\"https:\/\/www.virusbulletin.com\/blog\/2019\/10\/vb2019-paper-geost-botnet-story-discovery-new-android-banking-trojan-opsec-error\/\" target=\"bwo\" >https:\/\/www.virusbulletin.com\/rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/www.virusbulletin.com\/files\/cache\/14239326b1a9dcb2923f92893957c4f7_f3785.jpg\"\/><br \/>                                 OpSec mistakes are what lead to many malware discoveries, and in the case of the Geost Android botnet the mistake was a really interesting one. Today we publish the VB2019 paper by Sebastian Garc\u00eda, Maria Jose Erquiaga and Anna Shirokova on the Geost botnet, as well as the recording of Sebastian and Anna presenting their research in London.                <\/p>\n<p>                 <a href=\"https:\/\/www.virusbulletin.com\/blog\/2019\/10\/vb2019-paper-geost-botnet-story-discovery-new-android-banking-trojan-opsec-error\/\">Read more<\/a>                                <\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[23177,10378,23176],"tags":[],"class_list":["post-16647","post","type-post","status-publish","format-standard","hentry","category-magazine","category-security","category-virusbulletin"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/16647","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=16647"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/16647\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=16647"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=16647"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=16647"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}