Presentation is loading. Please wait.

Presentation is loading. Please wait.

Article presentation for: The Dark Cloud: Understanding and Defending against Botnets and Stealthy Malware Based on article by: Jaideep Chandrashekar,

Published byAshlie Arnold Modified over 9 years ago

Similar presentations

Presentation on theme: "Article presentation for: The Dark Cloud: Understanding and Defending against Botnets and Stealthy Malware Based on article by: Jaideep Chandrashekar,"— Presentation transcript:

1 Article presentation for: The Dark Cloud: Understanding and Defending against Botnets and Stealthy Malware Based on article by: Jaideep Chandrashekar, Steve Orrin, Carl Livadas, Eve M. Schooler Available at: http://download.intel.com/technology/itj/2009/v13i2/pdfs/ITJ9.2.9-Cloud.pdf This presentation by: Adrian Crenshaw http://Irongeek.com

2 Background A little information to get you up to speed on botnets http://Irongeek.com

3 So, what is a Botnet? A collection of compromised computers that can be sent orders Individual hosts in a Botnet are know as bots or zombies The administrator of the Botnet is often known as a “Bot Herder” A few examples of Botnets include: Storm Kraken Conficker http://Irongeek.com

4 Botnet life cycle (As outlined by the article) Spread Phase –SE Spam, Web drive bys, Network worm functionality, etc. Infection Phase –Polymorphism –Rootkitting Trojan binaries Library hooking Command and Control Phase Attack Phase http://Irongeek.com

5 How do hosts become part of a Botnet? Drive by malware installs via web browsers Automated or targeted network vulnerability attacks End users socially engineered to install them via phishing attacks, or confusing browser messages Other vectors… http://Irongeek.com

6 Botnet Source Code Families Lots of source code is out there: –Agobot –Rxbot –SDBot –Spybot –Others… http://leetupload.com Search for BotNet.Source.Codes.rar http://Irongeek.com

7 How are Botnets controlled? Decentralized Command and Control Channels (C&C) Decentralization is important to make C&C harder to shutdown By using Command and Control Channels, “bot herders” can change what their Botnet is tasked to do, and update the Botnet’s nodes http://Irongeek.com

8 Illustration of C&C Image Source: Intel Technology Journal; Jun2009, Vol. 13 Issue 2, p130-147 http://Irongeek.com

9 Illustration of C&C: Another take bot Herder IRC Server bot http://Irongeek.com IRC Server

10 Illustration of C&C: Yet another take bot Herder Middle Layer bot http://Irongeek.com

11 Illustration of C&C: Blind drop bot Herder Middle Layer bot Could be a web site, forum posting, image, etc http://Irongeek.com

12 Economics of Bot Herding So, why would some one want a Botnet? –Distributed Denial Of Service (DDoS) Personal vendettas Protection money –Spam (both email and web posts) –Adware –Click Fraud –Harvested identities (Sniffers, Key Loggers, Etc.) They can also be rented out for tasks BBC show Click rents a Botnet: http://www.tudou.com/programs/view/13Cx-LNrTfU/ http://Irongeek.com

13 Problems with detecting/removing a Bot installation Main points from the article: Polymorphism Rootkitting Only periodic communications back to controller Others: Retaliation Denial of Service Distributed Fast Flux Encrypted channels http://Irongeek.com

14 Article’s proposal: Canary Detector Made with three main strategies (paraphrased): 1.Establish a baseline for the network. 2.Use end-host detection algorithm to determine botnet C&C channel, based on destinations that are regularly contacted. 3.Aggregate information across nodes on the network to find commonality. http://Irongeek.com

15 Canary Detector: Atoms Uses the tuple: –destIP/dstService = Host being contacted –destPort = Port number –proto = UDP or TCP Examples: –(google.com, 80, tcp) –(208.67.222.222, 53, udp) –(ftp.nai.com, 21:>1024, tcp) –(mail.cisco.com,135:>1024,tcp) http://Irongeek.com

16 Canary Detector: Persistence Look for “temporal heavy hitters” –Not so concerned about amount of traffic –Concerned about regularity Starting with a small tracking window (w) time, track if an Atom was contacted or not Set an observational time window (W), for example W=10w in duration The authors also use multiple time scales 1 through 5 http://Irongeek.com

17 Canary Detector: Commonality How common is a destination Atom amongst network nodes? The more common the Atom, the more important it is http://Irongeek.com

18 Canary Detector: Whitelists Ignore “safe” Atoms to easy computation 1.Observe traffic during training period to see common, regularly contacted Atoms (Windows update servers might be an example) 2.Set nodes to ignore, adjust as needed. 3.Whitelists are established at both the host and network level. http://Irongeek.com

19 Canary Detector: Alarm Types p-alarms (persistence): When a destination Atom not contained in the host’s whitelist becomes persistent. More for local use, whitelist or flag. c-alarms (commonality): When a destination atom is observed at a large number of end-hosts in the same window and is identified as common. More for network use, whitelist or flag. http://Irongeek.com

20 Using the information Article defines thresholds for persistence and commonality (p* and c*) for when to take note Suspicious alarms can be acted upon –Nullrouting –Investigation –Cleanup http://Irongeek.com

21 Tested against real bots SDBot: Controlled over IRC, but easy to spot because of connecting to irc.undernet.org. Scans ports scans on ports 135, 139, 445, 2097 looking to spread. Zapchast: Five IRC service atoms (about 13 distinct IPs). Mostly NetBIOs attack traffic. Storm: P2P based. The traces were two orders of magnitude larger than the other botnets tested. http://Irongeek.com

22 Graph of botnet Atom persistence SDBot (Triange) Zapchast (Dimonds) Storm (Blue Dots) –Note that they only graphed 100 atoms Image Source: THE DARK CLOUD: UNDERSTANDING AND DEFENDING AGAINST BOTNETS AND STEALTHY MALWARE Intel Technology Journal, Jun2009, Vol. 13 Issue 2, p130-147, 18p, 3 charts, 3 diagrams Diagram; found on p144 http://Irongeek.com

23 Links for more research The Dark Cloud: Understanding and Defending against Botnets and Stealthy Malware http://download.intel.com/technology/itj/2009/v13i2/pdfs/ITJ9.2.9-Cloud.pdf Shadow Server http://www.shadowserver.org SANs Internet Storm Center http://isc.sans.org/ Honeynet Project http://www.honeynet.org LAN of the Dead http://www.irongeek.com/i.php?page=security/computerzombies http://Irongeek.com

24 Conclusions/Questions How difficult is it to choose good thresholds for persistence/commonality? What if Botnets varied their call back times? System overhead? Whitelisting of services that have become blind drops? Audience questions? http://Irongeek.com

Download ppt "Article presentation for: The Dark Cloud: Understanding and Defending against Botnets and Stealthy Malware Based on article by: Jaideep Chandrashekar,"

Similar presentations

Wenke Lee and Nick Feamster Georgia Tech Botnet and Spam Detection in High-Speed Networks.

Wenke Lee and Nick Feamster Georgia Tech Botnet and Spam Detection in High-Speed Networks.
Thank you to IT Training at Indiana University Computer Malware.

Thank you to IT Training at Indiana University Computer Malware.
Zombie or not to be: Trough the meshes of Botnets - Guillaume Lovet AVAR 2005 Tianjin, China.

Zombie or not to be: Trough the meshes of Botnets - Guillaume Lovet AVAR 2005 Tianjin, China.
MOSQUITO BREEDING ATTACK: Spread of bots using Peer To Peer INSTRUCTOR: Dr.Cliff Zou PRESENTED BY : BHARAT SOUNDARARAJAN & AMIT SHRIVATSAVA.

MOSQUITO BREEDING ATTACK: Spread of bots using Peer To Peer INSTRUCTOR: Dr.Cliff Zou PRESENTED BY : BHARAT SOUNDARARAJAN & AMIT SHRIVATSAVA.
 What is a botnet?  How are botnets created?  How are they controlled?  How are bots acquired?  What type of attacks are they responsible for? 

 What is a botnet?  How are botnets created?  How are they controlled?  How are bots acquired?  What type of attacks are they responsible for? 
BotMiner Guofei Gu, Roberto Perdisci, Junjie Zhang, and Wenke Lee College of Computing, Georgia Institute of Technology.

BotMiner Guofei Gu, Roberto Perdisci, Junjie Zhang, and Wenke Lee College of Computing, Georgia Institute of Technology.
Wide-scale Botnet Detection and Characterization Anestis Karasaridis, Brian Rexroad, David Hoeflin.

Wide-scale Botnet Detection and Characterization Anestis Karasaridis, Brian Rexroad, David Hoeflin.
1 Understanding Botnet Phenomenon MITP 458 - Kevin Lynch, Will Fiedler, Navin Johri, Sam Annor, Alex Roussev.

1 Understanding Botnet Phenomenon MITP Kevin Lynch, Will Fiedler, Navin Johri, Sam Annor, Alex Roussev.
Bots and Botnets CS-431 Dick Steflik. DDoS ● One of the most common ways to mount a Distributed Denial of Service attacks is done via networks of zombie.

Bots and Botnets CS-431 Dick Steflik. DDoS ● One of the most common ways to mount a Distributed Denial of Service attacks is done via networks of zombie.
Detecting Botnets Using Hidden Markov Models on Network Traces Wade Gobel Bio-Grid, Summer 2008.

Detecting Botnets Using Hidden Markov Models on Network Traces Wade Gobel Bio-Grid, Summer 2008.
UNCLASSIFIED Secure Indirect Routing and An Autonomous Enterprise Intrusion Defense System Applied to Mobile ad hoc Networks J. Leland Langston, Raytheon.

UNCLASSIFIED Secure Indirect Routing and An Autonomous Enterprise Intrusion Defense System Applied to Mobile ad hoc Networks J. Leland Langston, Raytheon.
Botnets Usman Jafarey Including slides from The Zombie Roundup by Cooke, Jahanian, McPherson of the University of Michigan.

Botnets Usman Jafarey Including slides from The Zombie Roundup by Cooke, Jahanian, McPherson of the University of Michigan.
Botnets Abhishek Debchoudhury Jason Holmes. What is a botnet? A network of computers running software that runs autonomously. In a security context we.

Botnets Abhishek Debchoudhury Jason Holmes. What is a botnet? A network of computers running software that runs autonomously. In a security context we.
LittleOrange Internet Security an Endpoint Security Appliance.

LittleOrange Internet Security an Endpoint Security Appliance.
Borrowed from Brent ByungHoon Kang, GMU. A Network of Compromised Computers on the Internet IP locations of the Waledac botnet. Borrowed from Brent ByungHoon.

Borrowed from Brent ByungHoon Kang, GMU. A Network of Compromised Computers on the Internet IP locations of the Waledac botnet. Borrowed from Brent ByungHoon.
Internet Relay Chat Chandrea Dungy Derek Garrett #29.

Internet Relay Chat Chandrea Dungy Derek Garrett #29.
1. Introduction The underground Internet economy Web-based malware The system analyzing the post-infection network behavior of web-based malware How do.

1. Introduction The underground Internet economy Web-based malware The system analyzing the post-infection network behavior of web-based malware How do.
1 E LECTRICAL E NGINEERING AND C OMPUTER S CIENCES U NIVERSITY OF C ALIFORNIA Berkeley Combating Stealth Malware and Botnets in Higher Education Educause.

1 E LECTRICAL E NGINEERING AND C OMPUTER S CIENCES U NIVERSITY OF C ALIFORNIA Berkeley Combating Stealth Malware and Botnets in Higher Education Educause.
BOTNETS & TARGETED MALWARE Fernando Uribe. INTRODUCTION  Fernando Uribe   IT trainer and Consultant for over 15 years specializing.

BOTNETS & TARGETED MALWARE Fernando Uribe. INTRODUCTION  Fernando Uribe   IT trainer and Consultant for over 15 years specializing.
Botnets Uses, Prevention, and Examples. Background Robot Network Programs communicating over a network to complete a task Adapted new meaning in the security.

Botnets Uses, Prevention, and Examples. Background Robot Network Programs communicating over a network to complete a task Adapted new meaning in the security.

Similar presentations

Ads by Google