A Distributed DoS in Action Client Hacker Broadcast Host Master Master Control Programs Agents Registration Phase Verify Registration PONG *Hello* png The Internet When the Master Control Programs are loaded and run, they just listen at TCP port 27665 for any messages coming from the Client Hacker, and they listen at UDP port 31335 for any messages coming from the hundreds of Broadcast Agents. Any messages coming from the Client Hacker will require a password, as well, to be accepted by the Master Control Program. When the Broadcast Agents are loaded, they contain a small encrypted list of IP addresses for the locations of all the Master Control Programs. When the Broadcast Agent is first run, it sends a short UDP packet containing the word “*HELLO*” to these IP addresses (port 31335, of course) so they will, in effect, register with the Master Control Program that they are ready. The Master Control Programs will record the IP address of the sender (the location of the Broadcast Agent). The Broadcast Agents then just listen at UDP port 27444 for any future commands coming from the Master. Prior to initiating the attack, the Client Hacker can, optionally, send a command to the Master Control Programs to verify that the Broadcast Agents are still ready (and that they have not been discovered or the host taken offline). The Master Control Programs sends a UDP packet containing the word “png” to all the Hundreds of Broadcast Agent IP addresses (at port 27444). Agents that are still active will respond back with the word “PONG” (to port 31335 on the Master).

The Attack Phase Client Hacker The Internet Agents Target Attack Broadcast Host Agents Attack Target Attack Target The Internet When the Hacker is ready to begin the attack, he sends the command, along with the password and list of IP addresses to target, to the Master Control Programs (to TCP port 27665). The Master Control Programs then send the command and IP address list to hundreds of Broadcast Agents they have registered all over the Internet (to UDP port 275444). The hundreds of Broadcast Agents then begin their attack and flood random ports of the target host(s) with simple UDP packets. Additionally, in the case of stacheldraht, the packets sent have a spoofed source IP address. This way the attacks looks like they are coming from a complete different source, which now involves yet another party in the attack. Trinoo comes with 6 different commands that the Master will accept from the Client Hacker. They include: Setting a timer to begin the attack at a future time Begin DoS attack at one IP target Begin DoS attack at multiple IP targets Kill all Broadcast Agents registered Verify that registered Agents are still ready (the “png”-”pong”) Set size of UDP packet to use in the flood attack UDP Flood Attack UDP Flood Attack COLLATERAL DAMAGE

How CODE RED Works First infected system Cod Red exploits the vulnerable index service Internet Service API (ISAPI), a remote buffer overflow vulnerability that affects all versions of Microsoft IIS. First infected systems attempts to connect to other systems via port 80 (web)

Scans to find new victims How CODE RED Works First infected system Scans to find new victims 100 system probes

Scans to find new victims How CODE RED Works First infected system Scans to find new victims

- Each new victim starts scanning process over again - From the 20th to the EOM, attempts to launch a DOS against 198.137.240.91 (www.whitehouse.gov) by sending large junk packets - Each new victim starts scanning process over again - 20th to EOM, primary target is www.whitehouse.gov

How NIMDA Works First infected system NIMDA attempts to infect using the following methods: IIS Extended Unicode Directory Traversal Vulnerability IIS Escaped Character Decoding Command Execution Vulnerability Previous backdoors left by Code Red II and Sadmind infections First infected systems attempts to connect to other systems via port 80 (web)

tftp Admin.dll from attacking system (contains NIMDA payload) How NIMDA Works First infected system tftp Admin.dll from attacking system (contains NIMDA payload) - Once the victim has been infected, it uses the trivial file transfer protocol (similar to ftp) to retrieve “Admin.dll” from the attacking system. Admin.dll contains the NIMDA code. Attacking system

vulnerable IIS web servers How NIMDA Works First infected system Sends infected email attachment NIMDA propagates via open file shares Infected system scans network for vulnerable IIS web servers Once infected with NIMDA the victim system will: Scan the network for vulnerable IIS web servers harvests email addresses from the Windows address book and sends infected “readme.exe” attachment attaches a copy of NIMDA, named “README.EML” to all web related files (.html, .htm, etc) attempt to copy NIMDA to all open file shares NIMDA attaches to web pages on infected server

How NIMDA Works - NIMDA prefers to target its neighbors NIMDA targets systems in its own IP space; it will only attack a completely random target IP with a 25% probability NIMDA chooses targets having the same first octet (only) with 25% probability NIMDA chooses targets having the same first two octets with 50% probability - NIMDA prefers to target its neighbors - Very rapid propagation