1. A Distributed DoS in Action
Client Hacker
Broadcast
Host
Master
Master Control
Programs
Agents
Registration Phase
Verify
Registration
PONG
*Hello*
png
The Internet
When the Master Control Programs are loaded and run, they just listen at TCP port for any messages coming from the Client Hacker, and they listen at UDP port for any messages coming from the hundreds of Broadcast Agents. Any messages coming from the Client Hacker will require a password, as well, to be accepted by the Master Control Program.
When the Broadcast Agents are loaded, they contain a small encrypted list of IP addresses for the locations of all the Master Control Programs. When the Broadcast Agent is first run, it sends a short UDP packet containing the word “*HELLO*” to these IP addresses (port 31335, of course) so they will, in effect, register with the Master Control Program that they are ready. The Master Control Programs will record the IP address of the sender (the location of the Broadcast Agent). The Broadcast Agents then just listen at UDP port for any future commands coming from the Master.
Prior to initiating the attack, the Client Hacker can, optionally, send a command to the Master Control Programs to verify that the Broadcast Agents are still ready (and that they have not been discovered or the host taken offline). The Master Control Programs sends a UDP packet containing the word “png” to all the Hundreds of Broadcast Agent IP addresses (at port 27444). Agents that are still active will respond back with the word “PONG” (to port on the Master).

2. The Attack Phase Client Hacker The Internet Agents Target Attack
Broadcast
Host
Agents
Attack
Target
Attack
Target
The Internet
When the Hacker is ready to begin the attack, he sends the command, along with the password and list of IP addresses to target, to the Master Control Programs (to TCP port 27665).
The Master Control Programs then send the command and IP address list to hundreds of Broadcast Agents they have registered all over the Internet (to UDP port ).
The hundreds of Broadcast Agents then begin their attack and flood random ports of the target host(s) with simple UDP packets.
Additionally, in the case of stacheldraht, the packets sent have a spoofed source IP address. This way the attacks looks like they are coming from a complete different source, which now involves yet another party in the attack.
Trinoo comes with 6 different commands that the Master will accept from the Client Hacker. They include:
Setting a timer to begin the attack at a future time
Begin DoS attack at one IP target
Begin DoS attack at multiple IP targets
Kill all Broadcast Agents registered
Verify that registered Agents are still ready (the “png”-”pong”)
Set size of UDP packet to use in the flood attack
UDP Flood
Attack
UDP Flood
Attack
COLLATERAL DAMAGE

3. How CODE RED Works First infected system
Cod Red exploits the vulnerable index service Internet Service API (ISAPI), a remote buffer overflow vulnerability that affects all versions of Microsoft IIS.
First infected systems attempts to connect to other systems via port 80 (web)

4. Scans to find new victims
How CODE RED Works
First infected system
Scans to find new victims
100 system probes

5. Scans to find new victims
How CODE RED Works
First infected system
Scans to find new victims

6. - Each new victim starts scanning process over again
- From the 20th to the EOM, attempts to launch a DOS against ( by sending large junk packets
- Each new victim starts scanning process over again
- 20th to EOM, primary target is

7. How NIMDA Works First infected system
NIMDA attempts to infect using the following methods:
IIS Extended Unicode Directory Traversal Vulnerability
IIS Escaped Character Decoding Command Execution Vulnerability
Previous backdoors left by Code Red II and Sadmind infections
First infected systems attempts to connect to other systems via port 80 (web)

8. tftp Admin.dll from attacking system (contains NIMDA payload)
How NIMDA Works
First infected system
tftp Admin.dll from attacking system
(contains NIMDA payload)
- Once the victim has been infected, it uses the trivial file transfer protocol (similar to ftp) to retrieve “Admin.dll” from the attacking system. Admin.dll contains the NIMDA code.
Attacking system

9. vulnerable IIS web servers
How NIMDA Works
First infected system
Sends infected
attachment
NIMDA propagates
via open file shares
Infected system
scans network for
vulnerable IIS web servers
Once infected with NIMDA the victim system will:
Scan the network for vulnerable IIS web servers
harvests addresses from the Windows address book and sends infected “readme.exe” attachment
attaches a copy of NIMDA, named “README.EML” to all web related files (.html, .htm, etc)
attempt to copy NIMDA to all open file shares
NIMDA attaches
to web pages on
infected server

10. How NIMDA Works - NIMDA prefers to target its neighbors
NIMDA targets systems in its own IP space; it will only attack a completely random target IP with a 25% probability
NIMDA chooses targets having the same first octet (only) with 25% probability
NIMDA chooses targets having the same first two octets with 50% probability
- NIMDA prefers to target its neighbors
- Very rapid propagation