1. Measurement and Analysis of Hajime: a Peer-to-peer IoT Botnetby
Stephen Herwig (UMD), Katura Harvey (MPI), George Hughey (UMD), Richard Roberts (MPI), Dave Levin (UMD)
Presented by
Himanshu Gandhi (2015ANZ7550)

2. What are botnets, by the way ?

3. What is a Botnet ?
Impact:The impact of botnets becomes very evident in light of the havoc caused by the recent attack using Mirai botnet. As per McAfee's Threat Report . Mirai botnet infected 2.5 million devices, adding 5 IP addresses each minute to the botnet. The Mirai botnet target was flooded by 1.2 Tbps of traffic, the highest volume of DDoS traffic ever recorded. Incidentally, Mirai and its variants are offered as Botnet-as-a-Service, with charges ranging from $50 to$700 . Mirai botnet had also been used in earlier attacks in 2016, where the impact ranged from shutting down Internet traffic in Liberia (Lodestar) , bringing down DNS root servers provided by DYN, thereby crippling Internet traffic in entire eastern US, incapacitating French telecom operator OVH in a devastating DDoS attack.

4. Structural Variants

5. So, what is Hajime ?

6. Characteristics of an “uncharacteristic” Botnet
Resilient
Smart
Continuously Evolving
No Attack so far !!!

7. Hmmm, tell me more about Hajime !

8. Important “Problems” for a Botnet Controller?
Find out currently infected machine
Infect new machines
Which machine ?
Deploy current attacks
Update attacks ?
Attack files ?
Hajime uses BitTorrent based Distributed Hash Tables for both questions.

9. Bot Discovery announce hash(F) announce bot(F) announce hash(.i)
Hosting file F
announce bot(F)
announce hash(.i)
lookup hash(F)
lookup bot (F)
Downloading file F
lookup file (.i)

10. Announce Date File Type Architecture Daily (midnight)
.i (implant/ infect)
.atk (attack)
Architecture
MIPS Big Endian
MIPS Little Endian
ARM v5
ARM v6
ARM v7

11. Lookup Hosting Key Exchange UTP Keys provide long-lived IDs
Downloading

12. Thus: Resilient BitTorrent Based Discovery P2P
Difficult to take down Hajime without bringing down BT !!
P2P
Difficult to centrally monitor and control

13. More about Measurement and Analysis

14. Measurement Botnet Size Code RE List all peers exhaustively
Every 16 minutes for 4 months
- 5.4M IP addresses
- 10.5M keys
Datasets available at
Botnet Size
List all peers exhaustively
Used unique keys to get botnet size
Why not IP
NAT undercounts
IP reassignments and multi-homed devices => overcount
Code RE
47 modules – 34 .atk, 13 .i

15. Hajime Size

16. Hajime Geo-Distribution
MaxMind IP Geolocation DB used

17. Hajime Architectural Distribution
Based on .atk files usage
Censys Database (IP-uTP key used for device fingerprinting)

18. Hajime Architectural + Geography Distribution

19. Hajime Architectural + Geography Distribution

20. Hajime Architectural + Geography Distribution

21. Hajime – Impact of new Vulnerabilities

22. Hajime – Speed of Updates

23. Attacks and DNS Backscatter

24. Vulnerable Device Attack (CWMP)

25. Non-Vulnerable Device Attack

26. Contribution

27. What’s New ? Novel way of measuring and analyzing botnet
Insights about botnets’ ability to evolve
Honeypots need to be architecture specific

28. What’s more in the paper ?
More details on the botnet internals
Insights about device fingerprinting and bot lifetime
CWMP DNS backscatter based geographical distribution

29. Thank You :)