Offense Brute Force A Multifaceted Approach to Understanding

Offense: Brute Force A Multifaceted Approach to Understanding the Botnet Phenomenon (Rajab/Zarfoss/Monrose/Terzis)

Enough Data? l Research paper states: l 800, 000 DNS domains examined l 85, 000 servers botnet-infected l 65 IRC server domain names l Is above data statistically significant? l 450, 000 hosts via DNS (isc. org) l Over 150, 000 domain names exist l 47, 700, 000. com domains (1% probed)

Realtime Tracking Source: Shadowserver. org

Longitudinal Tracking l Research paper states: l 65 IRC server domain names l 85, 000 servers infected by bots l Type-II botnets only l Shadowserver. org tracking (2+ years): l 1800 active botnets daily l 3, 000 active bots daily l Updates every 15 minutes

Where’s the 40%? l Research paper exclusively Win. Tel l Easier l Most internet servers are Linux-based l Hard l to obtain bot binaries? to ignore the majority Worm or Trojan backdoors exploited l Defenses are already weakened

Botnet size Footprint vs. effective size l The paper complains that the footprint is much larger than the effective size. l So? Bots are trying to stay off DNSBL (black lists) and be more stealthy. l Sections of footprint may be rented out l

Botmaster concerns Source: swatit. org

C&C Stealth Botmasters want to remain hidden l IRC-based isn’t the only way l Peer-to-peer systems hide IP source addr l Virtualization of C&C l l Dynamic web servers l Network creation/reconfiguration l Come and go quickly l Difficult to trace l Works for honeypots, why not botnets?

Gray-box testing Only binary bot behavior studied l Results limited by mimicing IRC state l Research emphasized automation over thoroughness l Source code or disassembly reveals more l Behavior may be different in honeynet l

Agobot C&C Variable Description: bot ftrans port Set bot - file transfer port bot ftrans port ftp Set bot - file transfer port for FTP si chanpass IRC server information - channel password si mainchan IRC server information - main channel si nickprefix IRC server information - nickname prefix si port IRC server information - server port si server IRC server information - server address si servpass IRC server information - server password si usessl IRC server information - use SSL ? si nick IRC server information - nickname bot version Bot - version bot filename Bot - runtime filename bot id Bot - current ID bot prefix Bot - command prefix bot timeo Bot - timeout for receiving (in milliseconds) bot seclogin Bot - enable login only by channel messages bot compnick Bot - use the computer name as a nickname bot randnick Bot - random nicknames of letters and numbers bot meltserver Bot - melt the original server file bot topiccmd Bot - execute topic commands do speedtest Bot - do speed test on startup do avkill Bot - enable anti-virus kill do stealth Bot - enable stealth operation as valname Autostart - value name as enabled Autostart - enabled as service Autostart - start as service name Autostart - short service name scan maxthreads Scanner - maximum number of threads scan maxsockets Scanner - Maximum number of sockets ddos maxthreads DDo. S - maximum number of threads redir maxthreads Redirect - maximum number of threads identd enabled Ident. D - enable the server cdkey windows Return windows product keys on cdkey. get scaninfo chan Scanner - output channel scaninfo level Info level 1 (less) - (3) more spam aol channel AOL spam - channel name spam aol enabled AOL spam - enabled ? sniffer enabled Sniffer - enabled ? sniffer channel Sniffer - output channel vuln channel Vulnerability daemon sniffer channel inst polymorph Installer - polymorphoic on install ? Command Description: bot. about Displays information (e. g. , version) about the bot code bot. die Terminates the bot. dns Resolves IP/hostname via DNS bot. execute Makes the bot execute a specific. exe bot. id Displays the ID of the current bot code bot. nick Changes the nickname of the bot. open Opens a specified file bot. remove Removes the bot from the host bot. removeallbut Removes the bot if ID does not match bot. rndnick Makes the bot generate a new random nickname bot. status Echo bot status information bot. sysinfo Echo the bot’s system information bot. longuptime If uptime > 7 days then bot will respond bot. highspeed If speed> 5000 then bot will respond bot. quit Quits the bot. flushdns Flushes the bot’s DNS cache bot. secure Delete specified shares and disable DCOM bot. unsecure Enable specified shares and enables DCOM bot. command Executes a specified command with system()

Botnet evolution Polymorphic bot code l Gmail as control protocol l SSL usage l Invisible to network inspection l XML/RSS messages l Exploit IPv 6 flaws l