Published: USENIX HotBots, 2007 Presented: Wei-Cheng Xiao 2016/10/11

Outline Introduction Background and history Case study: Trojan.Peacomm Related Work Conclusions and future work 2016/10/12

IRC-based Botnet Pros Large base of knowledge and source codes for bot development Centralized C&C, efficient communication Cons Centralized mechanism, easy to be conquered 2016/10/13

Motivation and Goals Motivation A peer-to-peer structure for botnet communication is beginning to appear. More attackers will move to the P 2 P botnet because it is difficult to be incapacitated. Goals To increase the understanding of P 2 P botnets and hope to help detect, mitigate, and eliminate P 2 P botnets in the future 2016/10/14

Contributions Providing an overview and historical perspective of botnets Presenting a case study of a Trojan.Peacomm bot 2016/10/15

Outline Introduction Background and history Case study: Trojan.Peacomm Related Work Conclusions and future work 2016/10/16

History 2016/10/17

Goals of Botnets The three primary goals of botnets Information dispersion Spam, DoS attacks, dispersion of false information Information harvesting identity, password, credit card number, friend list Information processing CPU, memory resources 2016/10/18

Outline Introduction Background and history Case study: Trojan.Peacomm Related Work Conclusions and future work 2016/10/19

Trojan.Peacomm Use the Overnet protocol, which implements a distributed hash table on Kademlia The initial bot Appears as an attachment “FullVideo.exe” in malicious s Targets Windows systems Add “wincom 32.sys” to the system and inject it into services.exe Turn off the ICF/ICS service, open some ports 2016/10/110

Overnet A common 128 -bit numeric space is used. Node IDs are within the numeric space. Values are mapped into the numeric space with keys. (key, value) pairs are stored on the closest nodes, which is calculated by an XOR function. List of nodes is kept for each bucket in the numeric space. 2016/10/111

The Five Steps in Communication 1. Connect to Overnet Bootstrap onto the P 2 P network based on a hard- coded node list with 146 nodes in wincom32.ini 2. Download secondary injection URL Use keys to search for and download a value, which is an encrypted URL The keys are generated from the date and a random number [ 0…31 ] using a built-in algorithm 3. Decrypt secondary injection URL 4. Download secondary injection from a web server or other peers 5. Execute secondary injection 2016/10/112

Secondary Injections Include Rootkit components spamming components address harvester propagation components DDoS tools Update itself periodically by searching through the P 2 P network These primitives provide a C&C mechanism. 2016/10/113

Network Trace Analysis The Overnet packet include 10,105 unique IPs. The bot in the experiement contacts about 4200 hosts. 2016/10/114

Findings of The Key Search A node is asked to search for its own ID hash ( h 1 ) periodically to know the closest nodes. The command latency is not high (i.e., 3~6 seconds). The search results come from 4 responders, but their infection statuses are uncertain. It is difficult to detect other infected hosts in Overnet just from the trace data. 2016/10/115

Outline Introduction Background and history Case study: Trojan.Peacomm Related Work Conclusions and future work 2016/10/116

Related Work The zombie roundup: Understanding, detecting, and disrupting botnets. USENIX SRUTI, 2005 Points out the potential threat posed by P 2 P-based botnets Identifies some fundamental techniques for botnet analysis An inside look at botnets. Advances in Information Security, 2006 Gives an overview of some famous botnets, such as Agobot Highlights the sophistication and diverse capabilities of botnets 2016/10/117

Outline Introduction Background and history Case study: Trojan.Peacomm Related Work Conclusions and future work 2016/10/118

Conclusions and Future Work There is a recent trend in increased development of P 2 P botnets because of the difficulty to detect and eliminate them. An overview and a case study of the P 2 P botnet is presented. The future work includes P 2 P botnet detection and analysis of P 2 P botnet resilience. 2016/10/119