1. Botnet Detection & Countermeasures

2. About Me – Kiran Ratnaker
IT Security Researcher
Certified Ethical Hacker
Certified Forensic Investigator
Certified Security Analyst
WatchGuard Certified Professional
Contact
Twitter

3. Agenda
What is BotNet
Botnet Detection
Countermeasures

4. Close Encounter with Botnet
Network of 150 Machines Dead
No Internet, No Local Server Access

5. Mac Flooding, ARP Poison, MITM, DDoS…
uses ports 16464, 16465, 16470, and / or The 

6. Worst Things No bot detection by AV Websense failed
Firewall proxy bottleneck
IP in exploit blacklist
Rootkit prevented detection, connecting the HDD to other fresh clean machine detected Botnet Zero Access, i.e. AV was compromised

7. How We Restored Network Operations?
Enabled Security features on LAN
ARP Spoofing Prevention, DoS Attack Prevention Settings, Broadcast...Multicast...Unicast Traps
Reduced network speed > Check for port utilizing high bandwidth > Shut it down > Format the machines

8. Challenges in Dev & QA Environment
Developer needs Admin Access
Innovation needs openness
QA Needs old versions
Port based applications is history
p2p apps on top & so as attacks

9. What is BotNet Botnet: Bot + Network
BotMaster
Botnet: Bot + Network
Compromised machine install programs which performs autonomus tasks, these Networked bots controlled by single botmaster with multiple command & control centers……. builds Botnet
C&C
C&C
Reference Video -
Bots
Bots

10. How Botnet Spreads itself ?
Peer to Peer

11. Cyber Crimes
Ransomware
Feck Id

12. 2016 Cyberattack
Denial-of-service attack on DYN (Distributed Network Services, Inc.)
On 21 October 2016 Dyn’s network attacked with DDos with load of 1.2 Terabits per second
Twitter,Reddit,GitHub,Amazon.com,Netflix,Spotify,BBC,PayPal,CNN become unreachable
Mirai botnet was used to launch a DDos attack
Mirai botnet consisting of more than 100,000 infected devices
Internet of Things-enabled(IoT) devices included in attack (Surveillance Cameras,Printers,Residential Gateways)
Mirai infected devices were spotted in 164 countries
Mirai’s C&C(command and control) code is coded in Go while its bots are coded in C programming.
Ref-
Mirai botnet -

13. Detection Symptoms Benchmark Machine Log L3 Switch Log Firewall Log
OS, AV, Wireshark

15. Benchmark TCP/IP Connections on Machine & Firewall
100 x 50 = 5000 Connections
What are the total Number of Machines as per Inventory & Logs
ARP on Switch = Number of Machines
ARP on L3, Firewall

16. Machine IP + Mac Address
+ VLAN Route + VLAN Broadcast on L3 Switch

17. Process Explorer

18. Wireshark

20. Countermeasures Daily Checks Enable AV Firewall + IPS
IP Black List, Concurrent Connections, Botnet Ports, Deny Packets, Geolocation, DNS
Enable AV Firewall + IPS
Update Security Patches
Firmware Updates
Machines, Network Switches, Printers, WAP, Firewall
Install only required applications

21. Process Explorer
Microsoft Netmon
Questions ?
Questions

22. Ashish Shanker ashish.shanker@synerzip.com @ShankerAshish 22

23. Synerzip
Your trusted outsourcing partner for Agile software product development.
Accelerate the delivery of your product roadmap
Address technology skill gaps
Save at least 50% with offshore software development
Augment your team with optional on-site professionals

24. Synerzip Clients

25. linkedin.com/company/synerzip
Connect with Synerzip
@Synerzip
linkedin.com/company/synerzip
facebook.com/Synerzip

26. Next Webinar Manging Software People & Teams
on Thursday, March 16, 2017 at Noon CST
Webinar Presenter:
Ron Lichty,
Author & Agile Consultant