By Areej Al-Bataineh University of Texas at San Antonio MIT Spam Conference 2009

3/27/2009Areej Al-Bataineh - Botnet-generated Spam 2

Botnets: “A Global Pandemic” 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 3 Botnet is a network of compromised machines (Bots) under the command and control (C&C) of one person (master) Machines become infected when users click on attachments or URLs, visit malicious/legitimate web sites, or install software from untrusted sources C&C protocols include IRC, HTTP, P2P Botnets used for attacks like DDoS, spamming, phishing, identity theft, …etc According Panda Labs, in 2Q 2008, 10 million bot computers were used to distribute spam and malware across the Internet each day

Botnets are mostly used for spamming! According to Marshal’s TRACE center : In the 1Q of 2008, about 85% of spam is generated by 6 Botnets: Mega-D, Srizbi, Storm, Pushdo, Rustock, Cutwail. 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 4 According to Symantec’s Message Labs Intelligence: The McColo ISP shutdown

Questions  How does a typical spamming botnet work?  How do botnets transmit spam?  What can be done to make it nearly impossible for botnets to deliver spam?  What tools and policies can be utilized at network edges?  What tools and policies can be utilized at mail servers? 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 5

Spamming Botnet 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 6 Botnet Master Control Servers Spammer templates lists DNS MX records Binary updates …

Questions  How does a typical spamming botnet work?  How do botnets transmit spam?  What can be done to make it nearly impossible for botnets to deliver spam?  What tools and policies can be utilized at network edges?  What tools and policies can be utilized at mail servers? 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 7

Transmission 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 8 MUA MTA MX Server MUA AliceBob

3/27/2009Areej Al-Bataineh - Botnet-generated Spam 9 Spam Transmission 1 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 9 MUA Relay Server MX Server MUA SpambotVictim Spambot forwards to an open relay server Spambot composes message according to the given template Open Relay Mail server relays to recipient mail server

3/27/2009Areej Al-Bataineh - Botnet-generated Spam 10 Spam Transmission 2 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 10 Proxy Client Proxy ServerMX Server MUA SpambotVictim Proxy server forwards traffic to a mail server Spambot initiate a proxy connection (HTTP/SOCKS) Open Proxy

Areej Al-Bataineh - Botnet-generated Spam 11 Spam Transmission 3 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 11 Proxy Client Proxy Server MX Server MUA SpambotVictim Proxy server forwards traffic through mail server of its own domain Spambot initiate a proxy connection (HTTP/SOCKS) ProxyLock MX Server

3/27/2009Areej Al-Bataineh - Botnet-generated Spam 12 Spam Transmission 4 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 12 MUA+MTA MX Server MUA Spambot Victim Spambot initiate SMTP connection with recipient mail server Direct-To-MX

Questions  How does a typical spamming botnet work?  How do botnets transmit spam?  What can be done to make it nearly impossible for botnets to deliver spam?  What tools and policies can be utilized at network edges?  What tools and policies can be utilized at mail servers? 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 13

Spam Control 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 14 MTAMX Server Message Transmission Path Router

Questions  How does a typical spamming botnet work?  How do botnets transmit spam?  What can be done to make it nearly impossible for botnets to deliver spam?  What tools and policies can be utilized at network edges?  What tools and policies can be utilized at mail servers? 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 15

Egress Spam control at Routers 1. Manage port 25 traffic (MAAWG 2008)  Block mail traffic except from designated servers In some networks, this cannot be adopted!! 2. Monitor DNS queries (Romana et al. 2008)  Identify spambots within a network  based on their frequent DNS queries for MX records Some botnets maintains DB for MX records 3. DBSpam (Xie et al. 2006)  Block/throttle spam laundry traffic  Discover proxy bots inside the network Detect proxy traffic, not regular spam traffic 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 16

Ingress Spam Control at Routers 1. Local and dynamic Blacklists (Cook et al. 2006)  Identify IPs of spambots based on spam filters  Keep IPs in blacklists for a chosen period of time Spambots have dynamic IP addresses 2. Spam streams classification (Argawal et al. 2005)  Identify bulk streams based on message similarities  Classify them as spam using a Bayesian classifier Template-based spam messages do not look similar 3. SpamFlow (Beverly & Sollins 2008)  Identify distinguishing features of spam TCP flows (RTT, idle, FIN)  Use machine learning classifier trained on open relay MTA mail connections Choosing the right features is key 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 17

Summary – Control at Routers 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 18 MethodDirectionEffect CookIn Block traffic from locally- blacklisted sources ArgawalInDetect bulk spam traffic SpamFlowInDetect spam TCP flows Manage Port 25Out Drop traffic except from legitimate outbound servers RomanaOutDetect spambots DNS MX queries DBSpamIn/OutBlock/Throttle proxy traffic

Questions  How does a typical spamming botnet work?  How do botnets transmit spam?  What can be done to make it nearly impossible for botnets to deliver spam?  What tools and policies can be utilized at network edges?  What tools and policies can be utilized at mail servers? 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 19

Spam Control at MTAs 1. forwarding best practices  Specify inbound/outbound mail servers  Different port number (not 25) and user authentication spambot knows the port # and the user credentials 2. SMTP transaction Delay  Impose delay on suspicious requests  Suspicion based on SMTP RFCs compliance checks This delay will not affect spambots 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 20

Incoming Spam Control 1. Source IP address checking  Authorized mail server (SPF, DKIM, Sender ID) Spambots domain may not have such DNS records  Blacklists 35% of spam comes from sources not listed in any blacklist 2. Greylisting  Refuse first delivery attempt, accept the second one Spambots can adapt and include this feature 3. SMTP session abort 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 21

Summary – Spam Control at Servers 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 22 MethodDirectionEffect Reject open relays In/OutBlock open relay attempts Forwarding best practices Out Drop from unauthorized users SMTP delayIn Delay spam and reduce its volume Source IP checking In Drop from untrusted servers GreylistingIn Refuse delivery attempts by untrusted sources SMTP abortIn Refuse delivery attempts from known suspicious sources

Review Anti-spam is improving, but … Why the spam volume is not decreasing? Answer: Botnets  Efficient Generation  Guaranteed Delivery Solutions: Spam control at …  Routers or network edges  Mail servers 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 23

Conclusions  Botnet-generated spam:  Brings out new challenges  Opens new directions for solutions  Intercepting spam while in transit is crucial  New solutions should consider the nature of botnet-generated spam:  Distributed  Anonymous 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 24

3/27/ Areej Al-Bataineh - Botnet-generated Spam Questions? Comments? Ideas?

3/27/ Areej Al-Bataineh - Botnet-generated Spam Extra Slides

Experiments  For each of the top spam botnet  Get a binary  Analyze it with CWSandbox  Analyze packet trace manually  Describe delivery method used 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 27

Top Spam Botnets 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 28 BotnetsizeControlRootkitSMTP engine Cutwail Pandex, Mutant (related to: Wigon, Pushdo) 175,000HTTP with encryption, multiple TCP ports YesTemplate based Rustock RKRustok, Costrat, Meredrop 130,000HTTP with encryption, TCP port 80 Yes DonBot Bachsoy 125,000Custom protocol on high TCP port No Ozdok Mega-D 120,000encrypted, TCP port 443No XarVester Rlsloup, RUcrzy 60,000HTTP on high portsYes Grum Tedroo 50,000HTTP on TCP port 80Yes Cheg Tosfee 50,000Encrypted on TCP ports 443 and 533 No CimBot Unknown 10,000encrypted, TCP ports 80 and 443 No Waledac Waled 10,000AES and RSA-encrypted, encapsulated in HTTP No A from-scratch rewrite of Storm

Botnet Activity 3/27/2009Areej Al-Bataineh - Botnet-generated Spam 29 Adopted from Damballa’s website on March 24 th, 09