http://www.pcworld.com/article/185122/good_guys_bring_down_the_megad_botnet.html
For two years as a researcher with security company FireEye, Atif Mushtaq worked to keep Mega-D bot malware from infecting clients’ networks. In the process, he learned how its controllers operated it. Last June, he began publishing his findings online. In November, he suddenly switched from defense to offense. And Mega-D–a powerful, resilient botnet that had forced 250,000 PCs to do its bidding–went down.
Shadowserver to Take Over as Mega-D Botnet Herder
http://www.fortiguard.com/analysis/pdfanalysis.html
This exploit use heapspray to fill memory at 0x0d0d0d0d.
When you look at 0x301DDDA0,you will see the program will fall into the "sandwich" that contains many pices of shellcode.
301DDD99 8BF3 mov esi, ebx
301DDD9B 8B06 mov eax, [esi]
301DDD9D 57 push edi
301DDD9E 8BCE mov ecx, esi
301DDDA0 FF50 48 call [eax+48]
301DDDA3 84C0 test al, al
301DDDA5 75 1B jnz short 301DDDC2
301DDDA7 8B76 14 mov esi, [esi+14]
301DDDAA 85F6 test esi, esi
301DDDAC 75 ED jnz short 301DDD9B
In fact, this kind of exploit is widely used to targeted attack.
隨著科技不斷進步，網路提高了人們通訊的效率與社會的便利，但也直接改變了民眾的日常生活，例如：手機無線上網、全民瘋Facebook開心農場、Plurk、Twitter微型網誌的出現等；現今的網路發展就像是一個沒有煞車系統的汽車，本身安全性的欠缺，如又遇到不良駕駛，當然會衍生許多資訊安全與犯罪問題，例如：個資外洩、網路詐騙、網路洗錢，駭客入侵等資安事件。
近年最夯的資安話題之一「資料外洩問題」，到了此時仍無法獲得有效控制，至今不管是國內或國外、政府或民間單位，幾乎每個月仍有不少資料外洩之新聞報導；另由於駭客攻擊手法之轉型，例如：由本機(Client)入侵轉變為攻佔網站(Web)、由病毒感染(Virus)轉變為間諜程式植入(Spyware)、由執行檔(EXE)改以各種文件(DOC、PDF、SWF)夾帶惡意程式等手法進入使用者電腦，如果人們使用電腦之安全習慣沒有改變(業務家辦、開啟來路不明信件、連結等)，而在現有掃描與偵測技術無法有效的阻擋此類攻擊下，許多公司企業資料外洩的情況還是會陸續上演，雖目前電腦處裡個人資料保護法未規範八大行業以外之機關，然如因未妥善保管民眾之個人資料而外洩，除造成客戶觀感不佳外，所流出的資料亦是難以收回。