Monitoring botnets from within Students: Yevgeni Sabin, Alexander Chigirintsev Supervisor: Amichai Shulman Technion - Israel Institute of Technology COMPUTER SCIENCE DEPARTMENT Project in Computer Security (236349)

Background Botnet – a group of computers infected by malicious code, connected to the Internet and controlled by attacker via command and control center (IRC server). In our case infected machines are web servers.

Background RFI – remote file inclusion is a type of attack in which “dynamic file include” mechanism is exploited. Attacker includes malicious code, and takes control over the server. $url=$_SERVER['REQUEST_URI']; $file = parse_url($url, PHP_URL_QUERY); include $file

Methodology Setup:  Virtual Machine (VMware) on home PC:  OS: Windows XP SP3  Apache HTTP server + PHP 5.3  Mail Server  Simple vulnerable site  Wireshark

Methodology Links to malicious code were received from supervisor or found on the Internet. Each link were remotely included in our fake site. All network communication were recorded by network analyzer and analyzed later.

Infection process IRC Find a victim

IRC Command and Control Server

Finding vulnerable servers PRIVMSG #b0yz :!rfi /index.php?DOCUMEN_ROOT= "netcat_files“

Finding vulnerable servers PRIVMSG #b0yz :!rfi /index.php?DOCUMEN_ROOT= "netcat_files“ PRIVMSG #b0yz :.9,1[.15rfi.9].[AsK] 403 PRIVMSG #b0yz :.9,1[.15rfi.9].[SaPo] 1055 PRIVMSG #b0yz :.9,1[.15rfi.9].[oNeT] 52 PRIVMSG #b0yz :.9,1[.15rfi.9].[YahOo] 1222 PRIVMSG #b0yz PRIVMSG #b0yz PRIVMSG #b0yz

What infected machine can do? * COMMANDS: * *.user //login to the bot *.logout //logout of the bot *.die //kill the bot *.restart //restart the bot *.mail //send an *.dns //dns lookup *.download //download a file *.exec // uses exec() //execute a command *.sexec // uses shell_exec() //execute a command *.cmd // uses popen() //execute a command *.info //get system information *.php // uses eval() //execute php code *.tcpflood //tcpflood attack *.udpflood //udpflood attack *.raw //raw IRC command *.rndnick //change nickname *.pscan //port scan *.safe // test safe_mode (dvl) *.inbox // test inbox (dvl) *.conback // conect back (dvl) *.uname // return shell's uname using a php function (dvl) */ Sending spam DDoS attack Test for vulnerabilities Download and execude

Getting direct access to the server Example: MODE #preman +v [A]b0yz848 PRIVMSG #preman :.user setan PRIVMSG #preman :[.Auth.]: OK b0yz_JbX You Are Ready... My OwnER !!!!!!!!!!!!!!!!!!!! PRIVMSG #preman :.info PRIVMSG #preman :[.info.]: Windows NT MYSEREVE-E176B7 5.1 build 2600 (Windows XP Professional Service Pack 3) i586 (safe: off) PRIVMSG #preman :[.vuln.]: PRIVMSG #preman :.download mail.php PRIVMSG #preman :[.download.]: Arquivo. baixado para.mail.php.

Botnet example Botnet #rafflesia (by room name) Monitoring time: 5 days number of bots: ~150 Joins per day: ~60 Leaves per day: ~70 Number of bots on same system: ~3 Maximal bots on same system: 37 ( hetzner.de – VDS provider )

Botnet example ~150 participants scanners

Botnet example Botnet #rafflesia (by room name) Number of scanners: 6 Can look for ~15 vulnerabilities: – RFI, LFI, SQL injection, Word Press – osCommerce, Zen Cart® Ecommerce,e107 and more

Botnet example Botnet #rafflesia (by room name) Number of scanners: 6 Can look for ~15 vulnerabilities: – RFI, LFI, SQL injection, Word Press – osCommerce, Zen Cart® Ecommerce,e107 and more Search engines in use: 32 – GooGLe, ReDiff, Bing, ALtaViSTa, AsK, UoL, CluSty, GutSer, ExaLead, VirgiLio, WebDe, AoL, SaPo, DuCk, YauSe, BaiDu, KiPoT, GiBLa, YahOo, HotBot, LyCos, LyGo, BLacK, oNeT, SiZuka, WaLLa, DeMos, RoSe, SeZnaM, TisCali, NaVeR

Botnet example Botnet #rafflesia (by room name) Number of scanners: 6 Can look for ~15 vulnerabilities: – RFI, LFI, SQL injection, Word Press – osCommerce, Zen Cart® Ecommerce,e107 and more Search engines in use: 32 – GooGLe, ReDiff, Bing, ALtaViSTa, AsK, UoL, CluSty, GutSer, ExaLead, VirgiLio, WebDe, AoL, SaPo, DuCk, YauSe, BaiDu, KiPoT, GiBLa, YahOo, HotBot, LyCos, LyGo, BLacK, oNeT, SiZuka, WaLLa, DeMos, RoSe, SeZnaM, TisCali, NaVeR Scans per day: 48 Looked for vulnerabilities: Word Press (88%), RFI (12%) Vulnerable sites found per day: ~155

Botnet example Botnet #rafflesia (by room name) Vulnerable sites found per day: ~155

Compromised site example

Conclusions 1.Main usage of PHP botnets is searching and infecting vulnerable sites. PHP botnet gives good ready-to-use infrastructure for this purpose. 2.Almost no “traditional” activity of botnets were observed. Traditional attacks as DDoS is hard to make due to low number of participants. 3.Low variety of bots used (manly “pBot”). Most of their functionality is not used. 4.Known (old) vulnerabilities used to infect the systems – only sites that are not maintained well can be infected.

Further steps 1.Improve the honey pot – more realistic site, that holds interesting information for attacker. Small online store is very attractive for hackers. 2.Try to infect the system in the normal way the botnets do - thru the scanners (get to Google search results). 3.More observation time (few weeks)