Power Projection Systems Department Zombie Scan Judy Novak Vern Stark David Heinbuch June 12, 2002

Power Projection Systems Department SubSeven Incident June 29, 2001 ~ 12:00 Shadow reveals massive scan Hundreds of hosts concurrently scan SubSeven port of Class B network Flood, DDoS, scan? Similar scan on July 2, 2001 ~ 16:00 June 26, 2001 SANS reports of W32.leave.worm –Windows hosts –Spread via hosts listening on port –Zombies used in DDoS attacks and Earthlink for port 27374

Power Projection Systems Department Sample tcpdump Output 12:16: ool-18bd69bb.dyn.optonline.net.4333 > : S : (0) win (DF) (ttl 117, id 13444) 12:16: ool-18bd69bb.dyn.optonline.net.4334 > : S : (0) win (DF) (ttl 117, id 13445) 12:16: > : S : (0) win (DF) (ttl 117, id 54912) 12:16: hsacorp.net.4939 > : S : (0) win (DF) (ttl 117, id 39621) 12:16: ool-18bd69bb.dyn.optonline.net.4335 > : S : (0) win (DF) (ttl 117, id 13446) 12:16: cc18270-a.essx1.md.home.com.4658 > : S : (0) win 8192 (DF) (ttl 117, id 8953) 12:16: > : S : (0) win (DF) (ttl 117, id 54914) 12:16: cc18270-a.essx1.md.home.com.4659 > : S : (0) win 8192 (DF) (ttl 117, id 9209) 12:16: > : S : (0) win (DF) (ttl 117, id 54915) 12:16: cc18270-a.essx1.md.home.com.4660 > : S : (0) win 8192 (DF) (ttl 117, id 9465)

Power Projection Systems Department Source Hosts Total Packets Unique Source Hosts DNS Registered June , ** July 2 157, ** **Not spoofed source IP’s

Power Projection Systems Department Scanning Host Networks Cable/dial-in modem providers

Power Projection Systems Department Destination Hosts Target network Class B: 65,535 possible IP addresses –June 29: 32,367 unique destination IP’s scanned –July 2 : 36,638 unique destination IP’s scanned Prior reconnaissance of live destination hosts? –Missing Class C subnets Different for both scans –Many IP numbers not live hosts Zombies not active or responsive during scan

Power Projection Systems Department Number of Unique Scanning Hosts per Destination Host

Power Projection Systems Department Scanning Rates Sustained activity for 5 or 6 minutes Peak activity for 2 minutes June 29 scan: 7.2 Mbps maximum July 02 scan: 8.6 Mbps maximum Maximum volume not enough for DoS on our network

Power Projection Systems Department Packets Per Minute (hh:mm)

Power Projection Systems Department Temporal Variability of Zombie Scan

Power Projection Systems Department Initial Wave of TCP Packets

Power Projection Systems Department Initial SYN Packets

Power Projection Systems Department Initial SYNs and Retries

Power Projection Systems Department Scanning Conclusions Scanning hosts carefully synchronized Waves of initial SYNs and TCP retries result in highly variable bandwidth consumption SYN’s sent in waves 11.5 seconds apart “Thoughtful” scan –Each source host assigned a range of destination hosts –Assigned time frame and frequency to scan

Power Projection Systems Department Scanning Hosts Operating Systems Examine “passive” fingerprints –Arriving Time to Live (TTL) values –Scanning host TCP window size –Scanning host TCP options

Power Projection Systems Department Fingerprint Values by OS (courtesy Honeynet Project) OS VERSIONPLATFORMTTLWINDOW Windows 9x/NTIntel AIX 4.3.x IBM/RS AIX 4.2.x IBM/RS Cisco IRIX 6.x SGI Linux2.2.xIntel OpenBSD 2.xIntel Solaris 8 Intel/Sparc Windows9x/NTIntel Windows 2000 Intel Cisco Solaris2.xIntel/Sparc

Power Projection Systems Department June 29 Arriving TTL Values 10 – 22 hops8 – 25 hops8 – 22 hops

Power Projection Systems Department July 2 Arriving TTL Values 12 – 22 hops12 – 21 hops8 – 27 hops

Power Projection Systems Department Scanning Host TCP Window Size Windows 9X/NT Windows 2K Unknown Solaris

Power Projection Systems Department Scanning Host Maximum Segment Size Ethernet PPP/ISDN PPPOE(DSL)

Power Projection Systems Department SubSeven Scan Conclusions Very efficient scan Conducted by zombie hosts –Most are Windows –Other operating systems involved –Representative of normal distribution on Internet? Thoughtful scan –Redundant scanners –Timing parameters –Ranges of destination hosts