1. Measurements and Mitigation of Peer-to-peer Botnets: A Case Study on Storm Worm Thorsten Holz, Moritz Steiner, Frederic Dahl, Ernst Biersack, Felix Freiling

2. What is a botnet? A bot is a hacked computer with some remote control mechanism A botnet is a network of these machines. Typically under the control of one person or group.

3. How are they used? Spam DDOS Phishing

4. How are machines compromised? Worms Trojans (Storm)‏ Links to malicious sites (Storm)‏

5. Tracking Botnets Best technique is to use honeypots A bot must contain information on how to bootstrap itself within the botnet. Obtain information on how to connect Craft a special client to do so

6. Botnet Control Mechanisms IRC HTTP A custom method P2P (the latest and greatest)‏

7. Storm Botnet Propagates solely through email Named from the Kyrill Storm in Europe At one point, responsible for ~10% of all spam Changes social engineering theme in emails frequently P2P

8. Storm Botnet, cont. Very sophisticated binary packer Rootkit Time synchronized with NTP

9. P2P Botnets Storm botnet uses P2P. Publish/subscribe style of communication Unauthenticated

10. Publish/Subscribe Information is not directly sent An information provider publishes a piece of information, i, by using an identifier that is derived solely from i. A consumer can subscribe to that information by using a filter on the identifiers The identifiers are usually derived from specific content or a hash function The P2P system matches the published items to the subscriptions and delivers the information

11. Storm P2P Scheme Uses the Overnet DHT (Distributed Hash Table) Routing Protocol Also starting to use Stormnet, which is encrypted by XORing with a 40-byte key. Still unauthenticated Each client generates a 128-bit ID

12. Routing Lookup Uses prefix matching Node a forwards a query to a node d in its routing table that has the smallest XOR distance with d. XOR distance is done on the DHT ids A peer stores more contacts that are closer

13. Routing Query Done iteratively. A node sends route requests to 3 peers, and they may or may not return peers that are even closer to the DHT ID. These closer peers are then queried in the same manner.

14. Publishing in Depth Uses a key to identify and retrieve information To deal with node churn, a key is published on 20 peers and is periodically republished. Infected machines search for keys that the controller publishes.

15. Storm Communication To find other Storm machines, a bot subscribes to a key based off the function of the current day and a random number between 0 and 31. f(d, r) = key

16. Storm Publish Method On Overnet, the Storm bots publish information in the following format: *.mpg;size=*

17. Infiltrating a botnet Can be dangerous Craft a special P2P client Goal is to defeat the control structure

18. Crawling the Botnet After building a custom P2P client, they can crawl the botnet by using a BFS. Issue route requests to find all the peers. Takes 20 to 40 seconds.

19. Spying on the Botnet Use a Sybil attack. Introduce malicious peers to the botnet to gain control of parts or all of the network Can monitor traffic or reroute requests to the wrong peers

20. Mitigation When the attack wants to issue a command, he publishes the information on the network Because the information is unauthenticated, any member of the p2p network can publish information From this, we can publish our own information to try to disrupt the communication channel

21. Eclipse Attack Position sybils closely around a keyword K. Make the DHT IDs of the sybils close to the hash value of K. Announce these sybils to the peers to poison the tables. Does not completely eclipse a particular keyword. Overnet uses the entire hash space for a keyword.

22. Polluting Publish a very large number of files using the keyword K. This overwrites the real content previously published under K. Their results showed that this is very effective.

23. Pollution Results As more polluted content is published, the true content decreases and is virtually eliminated.

24. QUESTIONS??????