Botnet Dr. 許 富 皓

1. Botnet Dr.許 富 皓

2. Botnet [Trend Micro]

3. Historical List of Botnets (1) [wiki]

4. Historical List of Botnets (2) [wiki]

5. Definition of a Botnet • A botnet(zombie armyordrone army)refers to a pool of compromised computers that are under thecommand of a single hacker, or a small group of hackers, known as a botmaster.

6. Definition of a Bot • A botrefers to a compromised end-host, or a computer, which is a member of a botnet.

7. The First Bot Generation Malware – PrettyPark [F-Secure] • The first bot generation malware, PrettyPark worm, appeared in 1999. • A critical difference between PrettyPark and previous worms is that it makes use of IRC as a means to allow a botmaster to remotely control a large pool of compromised hosts. • Its revolutionary idea of using IRC as a discrete and extensible method for Command and Control (C&C) was soon adopted by the black hat community.

8. How Fast Could Your Computer Be Comprised? • Based on the observation of an unpatched version of Windows 2000 or Windows XP located within a dial-in network of a German ISP. • Normally it takes only a couple of minutes before it is successfully compromised. • On average, the expected lifespan of the honeypot is less than ten minutes. • After this small amount of time, the honeypot is often successfully exploited by automated malware. • The shortest compromise time was only a few seconds: • Once we plugged the network cable in, an SDBot compromised the machine via an exploit against TCP port 135 and installed itself on the machine.

9. Sizes of Botnets[Wikipedia] • Some botnets consist of only a few hundred bots. • In contrast to this, several large botnets with up to 50,000 hosts were also observed. • Botnets with over several hundred thousands hosts have been reported in the past. • Kraken botnet • On April 13, 2008, there were 495,000 computers in the Kraken botnet[Damballa]. • Storm botnet[Enright] • Conficker: 10,000,000[F-Secure]

10. A Hosts May be Infected by Several Botnets Simultaneously • A home computer which got infected by 16 different bots has been found.

11. Taxonomy of Botnets • Attacking behavior • C&C models • Rally mechanisms • Communication protocols • Observable botnet activities • Evasion Techniques

12. Attacking Behavior [Paul Bächer et al.] • Distributed Denial-of-Service Attacks • Spamming • Sniffing Traffic • Keylogging • Spreading new malware • Installing Advertisement Addons • Google AdSense abuse • Manipulating online polls/games • Mass identity theft

13. Distributed Denial-of-Service Attacks (1) • Often botnets are used for Distributed Denial-of-Service (DDoS) attacks. • A DDoS attack is an attack on a computer system or network • that causes a loss of service to users, typically the loss of network connectivity and services by • consuming the bandwidth of the victim network or • overloading the computational resources of the victim system.

14. Distributed Denial-of-Service Attacks (2) • Further research showed that botnets are even used to run commercial DDoS attacks against competing corporations: • Operation Cyberslamdocuments the story of Jay R. Echouafni and Joshua Schichtel alias EMP. • Echouafni was indicted on August 25, 2004 on multiple charges of conspiracy and causing damage to protected computers. • He worked closely together with EMP who ran a botnet to send bulk mail and also carried out DDoS attacks against the spam blacklist servers. • In addition, they took Speedera - a global on-demand computing platform - offline when they ran a paid DDoS attack to take a competitor's website down.

15. Proxy • Some bots offer the possibility to open a SOCKS v4/v5 proxy on a compromised machine. • SOCKS v4/v5 proxy : a generic proxy protocol for TCP/IP-based networking applications (RFC 1928).

16. Spamming • After having enabled the SOCKS proxy, this machine can then be used for nefarious tasks such as spamming. • With the help of a botnet and thousands of bots, an attacker is able to send massive amounts of spam mails. • Often that spam you are receiving was sent from, or proxied through, an old Windows computer at home. • In addition, this can of course also be used to send phishing-mails since phishing is a special case of spam. • Some bots also implement a special function to harvest email-addresses.

17. Botnets Guilty for 87% of 2009 Global Spam Mail [Yahan Wu ] • According to a report released by Symantec, Botnets send out more than 87 percent of all unsolicited mail, equating to around 151 billion emails a day.

18. Spam Capacity of Some Notorious Botnets

19. Sniffing Traffic • Bots can also use a packet sniffer to watch for interesting clear-text data passing by a compromised machine. • The sniffers are mostly used to retrieve sensitive information like usernames and passwords. • If a machine is compromised more than once and also a member of more than one botnet, the packet sniffing allows to gather the key information of the other botnet. Thus it is possible to "steal" another botnet.

20. Keylogging • If the compromised machine uses encrypted communication channels (e.g. HTTPS or POP3S), then just sniffing the network packets on the victim's computer is useless since the appropriate key to decrypt the packets is missing. • With the help of a keylogger it is very easy for an attacker to retrieve sensitive information. • An implemented filtering mechanism further helps in stealing secret data. • e.g. "I am only interested in key sequences near the keyword 'paypal.com" • And if you imagine that this keylogger runs on thousands of compromised machines in parallel you can imagine how quickly PayPal accounts are harvested.

21. Spreading New Malware • In most cases, botnets are used to spread new bots. • This is very easy since all bots implement mechanisms to download and execute a file via HTTP or FTP. • Spreading an email virus using a botnet is a very nice idea, too. • A botnet with 10,000 hosts which acts as the start base for the mail virus allows very fast spreading and thus causes more harm.

22. Installing Advertisement Addons • Botnets can also be used to gain financial advantages. • This works by setting up a fake website with some advertisements: • The operator of this website negotiates a deal with some hosting companies that pay for clicks on ads. • With the help of a botnet, these clicks can be "automated" so that instantly a few thousand bots click on the pop-ups. • This process can be further enhanced if the bot hijacks the start-page of a compromised machine so that the "clicks" are executed each time the victim uses the browser.

23. GoogleAdSense Abuse • A similar abuse is also possible with Google's AdSense program: • AdSense offers companies the possibility to display Google advertisements on their own website and earn money this way. • The company earns money due to clicks on these ads, for example per 10,000 clicks in one month. • An attacker can abuse this program by leveraging his botnet to click on these advertisements in an automated fashion and thus artificially increments the click counter. • This kind of usage for botnets is relatively uncommon, but not a bad idea from an attacker's perspective.

24. Loss Caused by Click Fraud [Catherine Holahan] • On average, consultants estimate that between 14% and 15% of clicks are fraudulent.

25. Retrieve a URL from Old Version of Google Search Results

26. Google Search Page

27. Google Search Result Page

28. Source HTML File of the Google Search Result Page

29. Ampersands (&'s) in URLs [Liam Quinn ] • Always use &amp; in place of & when writing URLs in HTML: • E.g.: <a href="foo.cgi?chapter=1&amp;section=2&amp;copy=3&amp;lang=en">...</a>

30. Click Fraud (1) - Use the Browser’s URL Field

31. Retrieve a URL form Latest Version of Google Search Results – using Chrome

32. move cursor above the hyperlink

33. Click the right button of the mouse

34. Choose Inspect element of the pop-up menu

35. Click Fraud (2) – Connect to the Google Server Directly • Attackers could launch the same attacks by • opening a HTTP connection to a Google server and • sending the URL in the previous slide to the above server directly.

36. Click Fraud (3) - Use Fake Page (1)

37. Click Fraud (3) - Use Fake Page (2) [Mr. 東]

38. Click Fraud (3) - Use Fake Page (3)

39. Manipulating online Polls/Games • Since every bot has a distinct IP address, every vote will have the same credibility as a vote cast by a real person. • Online games can be manipulated in a similar way. • Currently we are aware of bots being used that way, and there is a chance that this will get more important in the future.

40. Mass Identity Theft • Often the combination of different functionality described above can be used for large scale identity theft, one of the fastest growing crimes on the Internet. • Bogus emails ("phishing mails") that pretend to be legitimate (such as fake PayPal or banking emails) ask their intended victims to go online and submit their private information. • These fake emails are generated and sent by bots via their spamming mechanism. • These same bots can also host multiple fake websites pretending to be ebay, PayPal, or a bank, and harvest personal information. • Just as quickly as one of these fake sites is shut down, another one can pop up. • In addition, keylogging and sniffing of traffic can also be used for identity theft.

41. What Is IRC, and How Does It Work? [David Caraballo et al.] • IRC (Internet Relay Chat) provides a way of communicating in real time with people from all over the world. • It consists of various separate networks (or "nets") of IRC servers, machines that allow users to connect to IRC. • The largest nets are • EFnet (the original IRC net, often having more than 32,000 people at once), • Undernet, • IRCnet, • DALnet, • and NewNet.

42. IRC Client • Generally, the user (such as you) runs a program (called a "client") to connect to a server on one of the IRC nets. • The server relays information to and from other servers on the same net. • Recommended clients: • UNIX/shell: ircII • Windows: mIRC • Macintosh clients

43. IRC Bot [wikepedia] • An IRC bot is a set of scripts or an independent program that connects to Internet Relay Chat as a client, and so appears to other IRC users as another user. • It differs from a regular client in that instead of providing interactive access to IRC for a human user, it performs automated functions.

44. IRC Channels • Once connected to an IRC server on an IRC network, you will usually join one or more "channels" and converse with others there. • On IRC, channels are where people meet and chat. • You may know them as "chat rooms". • Channel names usually begin with a #, as in #irchelp. • Conversations may be • public (where everyone in a channel can see what you type) or • private (messages between only two people, who may or may not be on the same channel).

45. Scheme of an IRC-Network [wikipedia] normal clients bots bouncers

46. Command and Control(C&C) System • C&C works as follows. • A botmaster sets up a C&C server, typically an IRC server. • After a bot virus infects a host, it will connect back to the C&C server and wait on the botmaster’s command. • In a typical IRC botnet, the bot will join a certain IRC channel to listen to messages from its master.

47. Categories of C&C • C&C systems can be roughly categorized into three different models • the centralized model, • the peer-to-peer (P2P) model • the random model • P.S.: • But there is possibility that future botnets may use new command and control systems that are completely different from any of them, noting the quickly evolving nature of botnets.

48. Centralized C&C Model • In the centralized model, a botmaster selects a single high bandwidth host to be the contacting point (C&C server) of all the bots. • The C&C server, usually a compromised computer as well, would run certain network services such as IRC, HTTP and etc. • When a new computer is infected by a bot, it will join the botnet by initiating a connection to the C&C server. • Once joined to the appropriate C&C server channel, the bot would then wait on the C&C server for commands from the botmaster. • Botnets may have mechanisms to protect their communications. • For example, IRC channels may be protected by passwords only known to bots and their masters to prevent eavesdropping.

49. Popularity of the Centralized C&C Model • The centralized model is the predominant C&C model used by early botnets. • Many well known bots, such as AgoBot, SDBot and RBot, fall into the category of the centralized C&C model.

50. Why the Centralized C&C Model (1) ? • Due to the rich variety of software tools (e.g., IRC bot scripts on IRC servers and IRC bots), the centralized C&C model is rather simple to implement and customize. • Notice that a botmaster can easily control thousands of bots using the centralized model. • Botmasters are profit driven; hence, they are more interested in the centralized C&C model which allows them to control as many bots as possible and maximize their profit.