1 Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling - Proceedings of the First USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET'08), Reporter: 高嘉男 Advisor: Chin-Laung Lei 2009/08/04

2 Outline Introduction Botnet tracking adapted tp P2P botnets ◦ Class of botnets considered ◦ Botnet tracking extended Inside Storm Worm ◦ Propagation mechanism ◦ Network-level behavior Case study: tracking Storm Worm Conclusion

3 Introduction IRC based botnet Botnet tracking ◦ Acquire and analyze a copy of a bot ◦ Infiltrate the botnet ◦ Identify the central IRC server P2P botnet ◦ Storm Worm

4 Class of Botnets Considered Unauthenticated content-based publish/subscribe style communication ◦ Peer-to-peer network architecture ◦ Content-based publish/subscribe-style communication ◦ Unauthenticated communication

5 Botnet Tracking Extended Step 1: Exploiting the P2P bootstrapping process ◦ Getting hold of a bot by honetpot Step 2: Infiltration and analysis ◦ Join the botnet to retrieve connection information Step 3: Mitigation ◦ Can’t send information directly

6 Propagation Mechanism of Storm Worm Similar to mail worms Spamtraps: addresses not used for communication but to lure spam s Client honeypots to exam the links Only webbrowers with a specific HTTP request header field will be exploited Send different exploits to install a copy of the Storm binary The exploit code changes periodically The binary itself is also polymorphic

7 Routing Lookup OVERNET and Stormnet DHT ID: randomly generated 128 bit ID XOR-distance: d (a,b) = a  b Query from a to b: ◦ To the node in its routing table that has the smallest XOR-distance with b ◦ Route requests to three peers ◦ Route responses containing new peers even closer to the DHT ID of b

8 Publishing and Searching Key: an identifier used to retrieve information A key is published on twenty different peers Search procedure uses the routing lookup to find the peer(s) closest to the key searched for Four important message type: ◦ Hello ◦ Route request/response(kid), ◦ Publish request/response ◦ Search request/response(key)

9 Storm Worm Communication Infected machine searches for specific keys The controller publishes commands at these keys The key is generated by a function f(d,r) Capture the keys the bot searches for ◦ Reverse engineered the bot binary and identified the function that computes the key ◦ Repeatedly force a bot to re-connect the network The actual content published in OVERNET at these keys contains a characteristic filename pattern

10 Exploiting the P2P Bootstrapping Process Use spamtraps to collect spam mails Client honeypots to visit the URLs Obtain a binary copy of the malware Obtain the current peer list used by the binary Observe the keys that Storm Worm searches for

11 Infiltration and Analysis -Crawling the P2P Network To measure the number of peers within the whole P2P network Crawler: issue route requests to find the peers currently participating ◦ Thread1: send the route request ◦ Thread2: receive and parse the route response

12 Infiltration and Analysis-Spying in OVERNET and Stormnet Sybil attack: introduce malicious peers, the sybils, to gain control over a fraction of the P2P network Implement the spy: ◦ Crawl the DHT ID space ◦ Send hello requests to the peers ◦ When a route request initiated by non-sybil peer P reaches a sybil, that request will be answered with a set of sybils whose DHT IDs are closer to the target ◦ Store the content of all the requests received

13 Results for Crawling and Spying Upped bound of Storm bots in OVERNET ◦ ~ concurrent online peers in OVERNET (October 2007 ~ February 2008) Lower bound of Storm bots in OVERNET ◦ 5000 ~ 6000 distinct peers that publish Storm related content per day

14 Size Estimation for Stormnet

15 Search Activity & Publish Activity in Stormnet

16 Mitigation Polluting ◦ Overwrite the content previously published under key K ◦ Publish files to all those peers having at least the first 4 bits in common with K ◦ A search for K will receive so many results (our fake announcements) that it is going to stop the search very soon

17 Experiment Polluting a hash used by Storm and searching at the same time for that hash

18 Conclusion Extend the method of botnet tracking to P2P based botnets Demonstrate the applicability by performing a case study of Storm Worm, thereby being the first to develop ways to mitigate Storm Worm. Present the first empirical study of P2P botnets giving details about their propagation phase, their malicious activities, and other features

19 References T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling, "Measurements and mitigation of peer- to-peer-based botnets: A case study on storm worm.", In Proceedings of the First USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET'08), 2008.