The Internet Motion Sensor A Distributed Blackhole Monitoring

The Internet Motion Sensor: A Distributed Blackhole Monitoring System Authors: Michael Bailey, Evan Cooke, Farnam Jahanian, Jose Nazario, David Watson. 12 th Annual Network and Distributed System Security Symposium (NDSS'05) Presented By: Arun Krishnamurthy

Presentation Outline n The Threat Problem n n Why the Internet Motion Sensor (IMS) was created? Introduction to IMS What is it? n What is it supposed to do? n What are the components? n n Observations n n What nasty stuff did IMS find? My comments and Conclusion What rocked? What sucked? n Suggestions for improvement? n

The Threat Problem n A network that is always connected is highly vulnerable to threats. n Threats Properties: Globally Scoped. n Can have no patches or fixes. n Evolutionary. n Can spread through the entire network within minutes. n

The Threat Problem n Promising Method to Investigate Threats: n n Monitor unused or dark address space. Issues: n Sensor Coverage. n Visibility of the system into Internet threats. n Service Emulation n What services to emulate and at what level to emulate them?

The Internet Motion Sensor (What is it? ) n Definition: n n A globally scoped Internet monitoring system whose objective is to measure, characterize, and track threats. Goals: n Maintain a level of interactivity that can differentiate traffic on the same service. n Provide visibility into Internet threats beyond address, geographical, and operational boundaries. n Enable characterization of emerging threats while minimizing incremental effort.

The Internet Motion Sensor (Architecture – Basic Idea) n Consist of a set of distributed blackhole sensors, each monitoring a dedicated range of unused IP address space. Blackhole sensors contain passive and active component. n Passive Component: n n n Records packets sent to sensor’s address space. Responds to specific packets to elicit more data from source. Active Component: n Designed to extract the first payload of data across the major protocols.

The Internet Motion Sensor (Architecture – Diagram)

The Internet Motion Sensor (Architecture - Main Components) n Distributed Blackhole Network n n Lightweight Active Responder n n Used to increase visibility into global threats. Provides enough interactivity that traffic on the same service can be differentiated independent of application semantics. Payload Signatures & Caching n Used to avoid recording duplicate payloads.

The Internet Motion Sensor (Distributed Blackhole Network) n A large distributed sensor network built from address blocks of many sizes that are scattered throughout the network. n Using Moore’s Telescopes Analogy, blocks of larger sizes have a broader detection coverage. n Different sensors observe different magnitudes and types of traffic. /16 Address Sensor /8 Address Sensor

The Internet Motion Sensor (Lightweight Responder) n Main responsibility is to elicit payloads for TCP connections. n Two key contributions: Ability to elicit payloads to differentiate traffic. n Ability to get responses across ports without application semantic information. n

The Internet Motion Sensor (Lightweight Responder – Other Characteristics) n Differentiate Services: n n By using payload signatures, IMS can identify the presence of new worms even in extremely noisy conditions. Service Agnostic: n Enables insight into less popular services. n n Example: Backdoor ports on existing worms One Limitation: n IMS provides little or no information on threats that depend on application level responses.

The Internet Motion Sensor (Payload Signatures and Caching) n Basic idea: Check the MD 5 checksum of the payload. n If the checksum is found in cache, then n n Only log the signature. (DO NOT store the payload. ) n Else n Store both payload and signature. n With a 96% cache hit rate, this method saves over 100 GB/day per address sensor!!!

The Internet Motion Sensor (Payload Signatures and Caching Example) Worm Signature Payload My. Worm 9 e 107 d 9 d 372 bb 6 826 bd 81 d 3542 bt 569 g 9 e 107 d 9 d 372 bb 6826 bd 81 d 3542 bt 569 g MD 5 Signature + Payload Blackhole Sensor Hits 1

The Internet Motion Sensor (Payload Signatures and Caching Example) Worm Signature Payload My. Worm 9 e 107 d 9 d 372 bb 6 826 bd 81 d 3542 bt Hits 1 569 g Another. Worm e 56 d 4 cd 98 f 00 b 204 e 9800998 ecf 8427 e e 56 d 4 cd 98 f 00 b 204 e 9800998 ecf 8427 e MD 5 Signature + Payload Blackhole Sensor 1

The Internet Motion Sensor (Payload Signatures and Caching Example) Worm Signature Payload My. Worm 9 e 107 d 9 d 372 bb 6 826 bd 81 d 3542 bt Hits 2 569 g Another. Worm e 56 d 4 cd 98 f 00 b 204 e 9800998 ecf 8427 e 9 e 107 d 9 d 372 bb 6826 bd 81 d 3542 bt 569 g MD 5 Signature + Payload Blackhole Sensor 1

The Internet Motion Sensor (Observations) n An IMS prototype developed at University of Michigan consisted of 28 address sensors at 18 physical locations. n 3 events captured: Internet Worms n Scanning n Distributed Denial of Service (DDo. S) Attacks n

The Internet Motion Sensor (Internet Worms) n IMS detection of various behaviors from worms: n Worm Virulence n n n Worm Demographics n n n Number of hosts infected? Operating System and other information of host? Worm Propagation n n How much traffic resulted from worm? What routers/paths got congested? How does the worm select next target? Community Response n n What organizations reacted the fastest? Who is still infected?

The Internet Motion Sensor (The Blaster Worm) n Description: n n Affected Windows 2000/XP systems running DCOM RPC services and used a buffer overflow attack to run code on target machine. In a 7 day period, IMS detected 3 Phases: 1 st Phase – Growth n 2 nd Phase – Decay n 3 rd Phase – Persistence n

The Internet Motion Sensor (The Blaster Worm – Phases Diagram)

The Internet Motion Sensor (The Blaster Worm) n Other observation: n n The Blaster Worm sends an exploit on TCP port 135, then follows with some commands on TCP port 4444. Conclusion from Blaster Worm observations: IMS provides data that can differentiate between different variants of worms. n Passive blackhole sensors can not do that! n

The Internet Motion Sensor (Blaster Worm Captured)

The Internet Motion Sensor (Blaster Worm Captured)

The Internet Motion Sensor (Blaster Worm Captured)

The Internet Motion Sensor (Scanning) n n Attackers scan for vulnerable services to exploit them. Beagle and My. Doom Worm: n n n SMTP worms that began spreading in 2004. Listens to port 2745 (Beagle) and port 3127 (My. Doom) for backdoors to load malicious software. Conclusion from observations: n n Lightweight Responder allowed IMS to detect the backdoor ports. Since both worms have variants, having the responder made it less time consuming than creating handcrafted service modules for each variant.

The Internet Motion Sensor (Beagle and My. Doom Scanning Activity Chart)

The Internet Motion Sensor (Distributed Denial of Service) n n These attacks rely on many end hosts to consume network resources. The SCO Group Attack: n n Attacked www. sco. com on December 10, 2003 Attacked 3 web servers, an FTP server, and a SMTP server. Since the attackers used spoofed IP addresses, IMS was able to observe some backscatter from these attacks. Conclusion from observation: n Showed the need for address diversity (having different blocks of many sizes).

The Internet Motion Sensor (Backscatter Diagram from SCO Attack)

The Internet Motion Sensor (Strengths) n IMS’ variety of address blocks allows it to find various worms that passive sensors can not detect. n Payload Signature and Caching System can save over 100 GB of memory per sensor per day!

The Internet Motion Sensor (Weaknesses) n Provides little or no information on threats that depend on application level responses. n n Requires a relatively powerful machine. n 1 Net. BIOS services requires RPC bind() before being able to do RPC request(). IMS can detect RPC bind(), but not RPC request() since no application level response was sent. x 86 machine with at least 1 GB RAM. 1 From Internet Motion Sensor FAQ Site. http: //ims. eecs. umich. edu/faq/index. html

The Internet Motion Sensor (Suggestions for Improvement) n Find a way to get information on threats that depend of application level responses. n Get IMS to fully learn the behavior of worms so it can automatically develop patches.

The Internet Motion Sensor (Conclusion) n The IMS uses a variety of blackhole sensors of various sizes to track, characterize, and measure threats. n It can detect various types of threats that passive sensors can’t detect! n It would be great to run if you have a relatively powerful computer!