Taming Zeus by leveraging its own crypto internals

Malware is one of the main threats to the Internet security in general, and to commercial transactions in particular. However, malware detection and containment tools and techniques still call for effective and efficient solutions. In this paper, we address a specific, dreadful, and widely diffused financial malware: Zeus. The contributions of this paper are manifold: first, we propose a general methodology to break the encrypted malware communications; second, we provide a proof of concept of such a methodology by applying it to the production environment. Further, we show how our proposal can be implemented to detect and contain the Zeus threat. Finally, we provide lesson learning highlighting some general principles that underly malware in general (and Zeus in particular).