Download to read offline
Botnet takeover
- 1. Analysis of aBotnet Takeover Harry Kim
- 2. Terminology Bot •An application that performs some action or set of actions on behalf of a remote controller Botnet •Networks of malware-infected machines controlled by an adversary Command and Control (C&C) Channel •Used to send commands to bots, and obtain results and status messages •IRC, HTTP, HTTPs, Peer to Peer
- 3. Botnet? Why itis important? •Root cause of security problem How to investigate? •Running Torpig Botnet
- 4.
- 5. Mebroot • Itis used as a “platform” in Botnet • Rootkit distributed by Neosploit exploit kit • Spread via drive-by-downloads: hidden iframe on website executes obfuscated JavaScript to download Mebroot on victim’s machine •Mebroot overwrites the master boot record of the machine, circumventing most anti-virus tools (back then)
- 6.
- 7. Botnet Takeover •Domain flux Botnet authors have identified several ways to make these schemes more flexible an d robust against take-down actions, e.g., by using fast-flux techniques However, fast-flux uses only a single domain name, which constitutes a single point of failure • Authors registered the .com and .net domains that were to be used by the bo tnet from January 25th, 2009 to February 15th, 2009. • However, on February 4th, 2009, the Mebroot controllers distributed a new Torpig binary that updated the domain algorithm – Worked for 10 days!
- 8.
- 9. Conclusion • First,a naïve evaluation of botnet size based on the count of distinct IPs yields grossly overestimated results. • Cultural Problem? The victims of botnets are often users with poorly maint ained machines that choose easily guessable passwords to protect access to sensitive sites. Education or better Social Engineering? • Ethics and Law issues interacting with registrars, hosting facilities, victim inst itutions, and law enforcement is a rather complicated pr ocess.