CloudBot: Advanced mobile botnets using ubiquitous cloud technologies Source: Pervasive and Mobile Computing, vol. 41, pp. 270-285, October 2017 Author: Wei Chen, Xiapu Luo, Chengyu Yin, Bin Xiao, Man Ho Au, Yajuan Tang Speaker: Chit-jie Chew Date: 3/15/2018

Outline Introduction Related works Proposed scheme Experimental results Conclusions

Introduction(1/2)

Introduction(2/3)

Cloud-based Push Service Cloud-based Storage Service Introduction(3/3)- Goals and challenges Download Channel Download Channel Cloud-based Push Service Bot Botmaster Upload Channel Upload Channel Cloud-based Storage Service

Related works(1/2)-Architecture of botnet Bots Botmaster Network Attack Victim Command Steal data Spam DDoS

Related works(2/2)-Communication Channels SMS Bluetooth HTTP

Proposed scheme(1/8)- Basic structure Contactinfo GPSinfo Pic-upload Applist … Push notification service Botmaster (b)Command+ Registration ID+ API keys (1)Identity information (a)Command (2)Registration ID (c)Push command to bot Sender ID (3)Registration ID C&C server Bot

Proposed scheme(2/8)- Flat structure (2.a)Command+ Registration ID list+ API keys from GCM (3a)Push Command to bots Group 1 C&C server (1)Command + Target bot list Group 2 (2.b)Command+ Registration ID list+ API keys from Parse (3b)Push Command to bots Botmaster

(2)Command+ Registration ID list+ API keys from GCM Proposed scheme(3/8)- Hybrid structure (2)Command+ Registration ID list+ API keys from GCM (5)Push command to bots Group 1 C&C server Group 2 (4)Relay command to bots in group (1)Command + Target bot list (3)Push command to servant bots ··· Group n Botmaster

Proposed scheme(4/8)- Hierarchy structure ······ ······ ······ C&C server Push service Servant bot Push service Push service Push service Client bot ······ ······ ······

Proposed scheme(5/8)- P2P structure Client bot Servant bot Client bot Push service Push service Client bot Servant bot Client bot Push service Push service Client bot Servant bot Client bot Push service Push service Client bot C&C server Client bot Push service Push service Client bot Servant bot Push service Servant bot

Proposed scheme(6/8)- Bots return data to botmaster via cloud storage

Proposed scheme(7/8)- Selection Push server selection 1(10) 2(10) Round-robin scheduling 1(10) 2(10) 3(10) Weight round-robin scheduling 4(10) 5(10) 6(10) 7(10) 8(10)

Proposed scheme(8/8)- Selection Push server selection Round-robin scheduling 1(4) 2(5) 3(10) Weight round-robin scheduling 4(15) 5(16) Servant bots selection 6(6) 7(12) LEACH(Low-energy adaptive clustering hierarchy) 8(12)

Experimental results(1/6)- Robustness mathematical analysis (a)Blocked probability with different accounts number (b)Disclosed probability when bots are captured

Experimental results(2/6)- Botnet traffic disperse among different push servers

Experimental results(3/6)- Command delay for mono-push-server botnet

Experimental results(4/6)- Command delay for CloudBot download channel

Experimental results(5/6)- Command delay for CloudBot upload channel

Experimental results(6/6) Attack demonstration (a)Attack demonstration (b)Applications list

Conclusions Robustness Controllability Scalability Concealment

Thanks for listening