Big Bad Botnet Day! Xeno Kovah In association with the Corporation for Public Botcasting, and Viewers Like You! Xeno Kovah In association with the Corporation for Public Botcasting, and Viewers Like You!

What is a bot? botnet? G A “bot” in the botnet sense of the word is a program which was installed by a malicious 3rd party to control the computer G Each bot can accept commands from a controlling entity G When many bots can be controlled simultaneously to perform specific actions, this is a botnet G A “bot” in the botnet sense of the word is a program which was installed by a malicious 3rd party to control the computer G Each bot can accept commands from a controlling entity G When many bots can be controlled simultaneously to perform specific actions, this is a botnet

History. How did we get here?  First D DoS tools (trinoo, TFN2k, Stacheldraht) + G Trojans (BackOrifice, BO2k, SubSeven, others) + G Worms (Code Red, Blaster, Sasser) + G IRC Bots  = “ Bots ” or “ Zombies/Drones ” or “ Trojans ” depending on which “ expert ” you ’ re asking what EXACTLY it does(subtle) or it ’ s context  First D DoS tools (trinoo, TFN2k, Stacheldraht) + G Trojans (BackOrifice, BO2k, SubSeven, others) + G Worms (Code Red, Blaster, Sasser) + G IRC Bots  = “ Bots ” or “ Zombies/Drones ” or “ Trojans ” depending on which “ expert ” you ’ re asking what EXACTLY it does(subtle) or it ’ s context

Infection vector G EVERYTHING! :) G virii, IE browsing exploits, remote exploits, social engineering, trojaned binaries, etc G EVERYTHING! :) G virii, IE browsing exploits, remote exploits, social engineering, trojaned binaries, etc

What do they COMMONLY do? G DDoS (origin) G SPAM G Phishing/Identity Theft G Keystroke logging G Stealing registration keys or files G Click fraud G Whatever you pay for them to do! Or whatever makes money or is fun for the operator. G DDoS (origin) G SPAM G Phishing/Identity Theft G Keystroke logging G Stealing registration keys or files G Click fraud G Whatever you pay for them to do! Or whatever makes money or is fun for the operator.

Botnet economics 101 G Extortion = $$$ (IF you pick a good target) G SPAM = $$ (easy money, but beware supply & demand) G Phishing = $$ G Click fraud = $ (likely to be shut down) G The feeling of intoxicating raw power commanding an army of undead computers to do your every bidding? Priceless G Extortion = $$$ (IF you pick a good target) G SPAM = $$ (easy money, but beware supply & demand) G Phishing = $$ G Click fraud = $ (likely to be shut down) G The feeling of intoxicating raw power commanding an army of undead computers to do your every bidding? Priceless

Typical botnet topology G IRC based (hence the name ;) G Centralized control G Stepping stones to get to control G Exact machine controlling can be changed thanks to handy dandy free dynamic DNS services G password protected control (sort of, mainly just obscurity) G Customized/stripped down IRC clients G IRC based (hence the name ;) G Centralized control G Stepping stones to get to control G Exact machine controlling can be changed thanks to handy dandy free dynamic DNS services G password protected control (sort of, mainly just obscurity) G Customized/stripped down IRC clients

Botnet using only strait lines! Entire Chain(s) observed, All zombies identified

Emergent control structure? G Gao/Ago/Phatbot added P2P control G Phatbot allows WASTE… G BUT it’s kinda pointless stripped out the good bits, presumably for “ease of use”, and from the looks of it it’s still centralized, but you just might not need a dyn-DNS provider G Ago’s P2P technique? G Gao/Ago/Phatbot added P2P control G Phatbot allows WASTE… G BUT it’s kinda pointless stripped out the good bits, presumably for “ease of use”, and from the looks of it it’s still centralized, but you just might not need a dyn-DNS provider G Ago’s P2P technique?

Improved topology? Tricky G P2P is both good and bad, depending on assumptions G Good: distributed C&C, possible better anonymity (integrated mixnets/tor?) G Bad: distributed C&C :), more information about network structure directly available to good guys IDS, overhead, typical p2p problems like partitioning, join/leave, etc G P2P is both good and bad, depending on assumptions G Good: distributed C&C, possible better anonymity (integrated mixnets/tor?) G Bad: distributed C&C :), more information about network structure directly available to good guys IDS, overhead, typical p2p problems like partitioning, join/leave, etc

Detection/Prevention G Detection: fairly easy G MINDS cheated!, but it COULD do G Honeynet G Harder if P2P? Maybe G Prevention/Shutting down entire network: very hard G Much harder if P2P G Detection: fairly easy G MINDS cheated!, but it COULD do G Honeynet G Harder if P2P? Maybe G Prevention/Shutting down entire network: very hard G Much harder if P2P

Anti-anti-virus & anti- debugging/disassembly G (quick word on malware “best practices” ;) G Terminate known AV software processes G Refuse to run in debugging/VM environment G Rootkit obfuscation G (quick word on malware “best practices” ;) G Terminate known AV software processes G Refuse to run in debugging/VM environment G Rootkit obfuscation

On innovation G Major families of bots have had their source code “leaked” at some point G Therefore there’s a LOT of code reuse G Previously it was all about recognition G Becoming profit driven  (just like the “security industry”!) :P G Major families of bots have had their source code “leaked” at some point G Therefore there’s a LOT of code reuse G Previously it was all about recognition G Becoming profit driven  (just like the “security industry”!) :P

Related Buzzwords! G OS hardening G IPS/IDS G Stepping Stones G Sybil Attack G Encrypted, Obfuscated, or Anonymous P2P G DDoS G Worm prevention (in particular flash worms) G Many others G OS hardening G IPS/IDS G Stepping Stones G Sybil Attack G Encrypted, Obfuscated, or Anonymous P2P G DDoS G Worm prevention (in particular flash worms) G Many others

Refs G / (Germans being germane ) / G (1 yr old) G (kinda old, but still fairly informative about the IRC aspect)  G Lots of little news articles found by googling & searching The Register G / (Germans being germane ) / G (1 yr old) G (kinda old, but still fairly informative about the IRC aspect)  G Lots of little news articles found by googling & searching The Register