The topic of my proposed presentation is simple: I'll be setting up several myths surrounding what happens to malware-infected machines, and then investigating them in the style of the ever-popular Mythbusters of Discovery Channel fame. My secret weapon in this investigation process - beyond just cool videos of fire-breathing Snort pigs - is the massive malware farm that I've been running for over a year now. Based on the ClamAV submission database, which takes in ~40,000 unique pieces of malware per day, this farm automates the process of executing those samples on unpatched Windows XP SP2 boxes (because if there's anywhere malware will run, it's there), with tcpdump fork()'d off in the background to capture all of the network traffic generated once a given machine is infected. As of May 31, 2011, I've run ~3.6 million samples through this farm, and have generated well over 1TB worth of PCAP data.

Myths to be investigated include:

• The majority of C&C servers reside in countries like China, Russia, or Brazil
• Domains and IP addresses used to call home into a botnet are transient, typically lasting for only hours or days at a time
• Outside the occasional DDoS or ping to Google to verify connectivity, traffic generated by malicious programs rarely touches legitimate hosts
• Spambots are easy to find because they're incredibly noisy and blatant
• Malware authors are too smart to leave obvious markers in their network traffic, because that'd make them easy to spot