1. Zhiyu Wan and Shunxing Bao BOTNET ATTACKS ON CYBER-PHYSICAL SYSTEM

2. OUTLINES Botnet Introduction Botnet Demonstrations Defending Botnet Attacks Cyber-Physical System (CPS) Introduction Simulation of Botnet Attacks on CPS

3. WHAT IS A BOTNET Virus: Self reproduce quickly in one computer Trojan horse: Hide themselves as safe files Worm: Propagate through internet quickly Remote Control Software: Legal, desktop user Botnet: Integration of all above

4. HOW A BOTNET WORKS Zombie: Student John Botmaster: Prof. Smith Bot: Final Project

5. HOW A BOTNET WORKS Ordinary User: Other Students Victim: Dean C&C Server: Coordinator

6. INFECTION

7. PROPAGATION

8. ATTACK COMMAND

9. ATTACK

10. SPAM E-MAIL

11. INFORMATION THEFT

12. DDOS

13. BOTNET HISTORY Botnets are big business! Date arrivedEstimate no.Spam capacityName 2006(around)150,00030 billion/dayRustock 2007(March)450,00060 billion/daySrizbi 2008(November)10,500,000++10 billion/dayConficker 2009(around)560,00039.9 billion/dayGrum

14. 14 botmaster 192.168.3.203 Reflection Server huigezi.3322.org 192.168.2.55 Download bot 192.168.4.201 huigezi.3322.org 192.168.4.202192.168.4.203192.168.4.204192.168.4.205192.168.4.206192.168.4.207192.168.4.208192.168.4.209 All zombies are waiting for control command from botmaster! huigezi.3322.org Download bot Scan Scanning Scan Command Attack Connection Victim Wire Gpigeon Botnet DDoS Attack Scenario Browse malicious website Webpage Trojan Server DNS Server 202.117.0.20 Domain Name Provider www.3322.org Update bot 192.168.2.55 ftp://192.168.2.55/ip.txt 192.168.3.203 Log in Update ip.txt Update domain name Scan

15. P2P BOTNET To avoid single point of failure Botmaster encrypts commands using private key Zombies decrypt them using public key

16. COUNTERMEASURES 12/4/2012 FALL 2012 CS388 MODEL-INTEGRATED COMPUTING - FINAL PRESENTATION 16 Honeypot – Know your Enemy Modeling of Honeynet to defend Botnet attacks using GME

17. REMOTE CONTROL DEMO Remote Control Tool: Gpigeon Platform: Vmware Attack: Information Theft

18. DDOS DEMO DDoS tools: TFN2K, TRINOO Platform: Deterlab Attack: TCP SYN flood, UDP flood, ICMP flood

19. WHAT IS NETWORK SIMULATION Real life Simulated life

20. WHY SIMULATION It is not practical to conduct controlled experiments directly on the network Real-system not available, is complex/costly or dangerous Quickly evaluate design alternatives Remove uncertain factors

21. NS ADVANTAGES Low cost(sometimes) Debug Variables

22. NS DRAWBACKS Reflect reality? Maybe slow Uncertain factor

23. CYBER-PHYSICAL SYSTEM(CPS) Cyber-physical systems (CPS) are physical and engineered systems whose operations are monitored, coordinated, controlled and integrated by a computing and communication core. This intimate coupling between the cyber and physical will be manifested from the nano-world to large-scale wide-area systems of systems. And at multiple time-scales. transform how we interact with the physical world

24. HEALTHCARE SYSTEMS

25. HEALTHCARE SYSTEMS CON. In this case, we combine the network with the real device to build the a small cyber physical system, to simulate the scenario that operating room connect with the doctor and the hospital’s server.

26. OMNET++ OMNeT++ is an extensible, modular, component-based C++ simulation library and framework, primarily for building network simulators. “Network” is meant in a broader sense that includes wired and wireless communication networks, on-chip networks, queueing networks, and so on. Domain-specific functionality such as support for sensor networks, wireless ad-hoc networks, Internet protocols, performance modeling, photonic networks

27. INET FRAMEWORK It is a networks simulation package for OMNet++ It contains models for several wired and wireless networking protocols, including UDP, TCP, SCTP, IP, IPv6, Ethernet, PPP, 802.11, MPLS, OSPF, etc. Body Area Networks, low-power embedded devices

28. PLATFORM IMPLEMENTATION

29. SIMPLE MODULE Attacker CommandAndControl Zombie1-10 VictimHospital Operatingroom1-3

30. ATTACK STEPS Step1: Build botnet Step2: Make command Step3: Start SYN flood attack Step4: Crash the hospital server

31. FUTURE GOAL