Download
1 / 171
1.71k likes | 1.71k Views
The Attack and Defense of Computers Dr. 許 富 皓. Botnet [Trend Micro]. Historical List of Botnets (1) [ wiki ]. Historical List of Botnets (2) [ wiki ]. Definition of a Botnet.
E N D
The Attack and Defense of Computers Dr.許 富 皓
Definition of a Botnet • A botnet(zombie armyordrone army)refers to a pool of compromised computers that are under thecommand of a single attacker, or a small group of attackers, known as a botmaster.
Definition of a Bot • A botrefers to a compromised end-host, or a computer, which is a member of a botnet.
The Frist Botnet [Weltman] The first botnet was created by spammer Khan C. Smith, who was exposed in August, 2001, when Earthlink, the third largest Internet service provider at the time, filed a lawsuit against him.
Sizes of Botnets[Wikipedia] • Some botnets consist of only a few hundred bots. • In contrast to this, several large botnets with up to 50,000 hosts were also observed. • Botnets with over several hundred thousands hosts have been reported in the past. • Kraken botnet • On April 13, 2008, there were 495,000 computers in the Kraken botnet[Damballa]. • Storm botnet[Enright] • Conficker: 10,000,000[F-Secure]
A Hosts May be Infected by Several Botnets Simultaneously • A home computer which got infected by 16 different bots has been found.
Taxonomy of Botnets • Attacking behavior • C&C models • Rally mechanisms • Communication protocols • Observable botnet activities • Evasion Techniques
Attacking Behavior [Paul Bächer et al.] • Distributed Denial-of-Service Attacks • Spamming • Sniffing Traffic • Keylogging • Spreading new malware • Installing Advertisement Addons • Google AdSense abuse • Manipulating online polls/games • Mass identity theft
Distributed Denial-of-Service Attacks (1) • Often botnets are used for Distributed Denial-of-Service (DDoS) attacks. • A DDoS attack is an attack on a computer system or network • that causes a loss of service to users, typically the loss of network connectivity and services by • consuming the bandwidth of the victim network or • overloading the computational resources of the victim system or • crashing the victim host.
Distributed Denial-of-Service Attacks (2) • Further research showed that botnets are even used to run commercial DDoS attacks against competing corporations: • Operation Cyberslamdocuments the story of Jay R. Echouafni and Joshua Schichtel alias EMP. • Echouafni was indicted on August 25, 2004 on multiple charges of conspiracy and causing damage to protected computers. • He worked closely together with EMP who ran a botnet to send bulk mail and also carried out DDoS attacks against the spam blacklist servers. • In addition, they took Speedera - a global on-demand computing platform - offline when they ran a paid DDoS attack to take a competitor's website down.
Proxy • Some bots offer the possibility to open a SOCKS v4/v5 proxy on a compromised machine. • SOCKS v4/v5 proxy : a generic proxy protocol for TCP/IP-based networking applications (RFC 1928).
Spamming • After having enabled the SOCKS proxy, this machine can then be used for nefarious tasks such as spamming. • With the help of a botnet and thousands of bots, an attacker is able to send massive amounts of spam mails. • Often that spam you are receiving was sent from, or proxied through, an old Windows computer at home. • In addition, this can of course also be used to send phishing-mails since phishing is a special case of spam. • Some bots also implement a special function to harvest email-addresses.
Botnets Guilty for 89% of 2010 Global Spam Mail [Pingdom] • Approximately 89% of all emails are spam. • 1 in 284 emails contain malware. • 1 in 445 emails are phishing emails.
Global Spam Volume Per Day in 2012 [Symantec Cloud] The estimated projection of global spam volumes decreased by 29 percent, from 42 billion spam emails per day in 2011, to 30 billion in 2012.
Global Spam Rate – 2012 vs 2011 [Symantec] The overall average global spam rate for 2012 was 69 percent, compared with 75 percent in 2011.
Phishing Rate – 2012 vs 2011 [Symantec] Phishing rates have dropped drastically in 2012, in many cases less than half the number for that month in the previous year. The overall average phishing rate for 2012 was 1 in 414 emails, compared with 1 in 299 in 2011.
Proportion of Email Traffic in Which Virus Was Detected – 2012 vs 2011 [Symantec] Overall numbers declined, with one in 291 emails containing a virus. In 2011, the average rate for email-borne malware was 1 in 239
Grum Botnet [wikipedia] The Grum botnet, also known by its alias Tedroo and Reddyb, was a botnet mostly involved in sending pharmaceutical spam e-mails. Once the world's largest botnet, Grum can be traced back to as early as 2008. At the time its shutdown in July 2012, Grum was reportedly the world's 3rd largest botnet, responsible for 18% of worldwide spam traffic.
Fridge Caught Sending Spam Emails in Botnet Attack (1) [Michelle Starr] • Many of these internet-connected devices don't have malware protection. • Security company Proofpoint has discovered a botnet attack — that is, a cyber attack whereby the attacker hijacks devices remotely to send spam — incorporating over 100,000 devices between 23 December and 6 January, including • routers, • multimedia centres, • televisions and • at least one refrigerator.
Fridge Caught Sending Spam Emails in Botnet Attack (2) [Michelle Starr] The attack sent out over 750,000 spam emails, in bursts of 100,000 emails at a time, three times a day, with no more than 10 emails sent from any one IP address, making them difficult to block. Over 25 percent of the emails were sent from devices that weren't conventional computers or mobile devices.
Spam Accounts for 45% of All Emails Sent [Emily Bauer] That 45% equates to 14.5 billion spam messages that are sent globally each day.
The Most Common Type of Spam[Emily Bauer] • The most common type of spam is related to advertising. • 36% of all spam is some form of advertising. • This includes promotional sales content that the recipient did not explicit opt-in to receive. • The second most prevalent type of spam is adult-related content, which accounts for 31.7% of all spam. • Messages about financial matters rank third, making up about 26.5% of email spam.
Spam Response Rate [Adam Hartley] Spammers receive 1 reply for every 12,500,000 emails sent.
Sniffing Traffic • Bots can also use a packet sniffer to watch for interesting clear-text data passing by a compromised machine. • The sniffers are mostly used to retrieve sensitive information like usernames and passwords. • If a machine is compromised more than once and also a member of more than one botnet, the packet sniffing allows to gather the key information of the other botnet. Thus it is possible to "steal" another botnet.
Keylogging • If the compromised machine uses encrypted communication channels (e.g. HTTPS or POP3S), then just sniffing the network packets on the victim's computer is useless since the appropriate key to decrypt the packets is missing. • With the help of a keylogger it is very easy for an attacker to retrieve sensitive information. • An implemented filtering mechanism further helps in stealing secret data. • e.g. "I am only interested in key sequences near the keyword 'paypal.com" • And if you imagine that this keylogger runs on thousands of compromised machines in parallel you can imagine how quickly PayPal accounts are harvested.
Spreading New Malware • In most cases, botnets are used to spread new bots. • This is very easy since all bots implement mechanisms to download and execute a file via HTTP or FTP. • Spreading an email virus using a botnet is a very nice idea, too. • A botnet with 10,000 hosts which acts as the start base for the mail virus allows very fast spreading and thus causes more harm.
Installing Advertisement Addons • Botnets can also be used to gain financial advantages. • This works by setting up a fake website with some advertisements: • The operator of this website negotiates a deal with some hosting companies that pay for clicks on ads. • With the help of a botnet, these clicks can be "automated" so that instantly a few thousand bots click on the pop-ups. • This process can be further enhanced if the bot hijacks the start-page of a compromised machine so that the "clicks" are executed each time the victim uses the browser.
GoogleAdSense Abuse • A similar abuse is also possible with Google's AdSense program: • AdSense offers companies the possibility to display Google advertisements on their own website and earn money this way. • The company earns money due to clicks on these ads, for example per 10,000 clicks in one month. • An attacker can abuse this program by leveraging his botnet to click on these advertisements in an automated fashion and thus artificially increments the click counter. • This kind of usage for botnets is relatively uncommon, but not a bad idea from an attacker's perspective.
Click Fraud [Charlie Osborne] According to White Ops and the Association of National Advertisers' (ANA) latest Bot Baseline report, in the US, advertising fraud costed companies an estimated $6.5 billion globally in 2017, which is down 10 percent from approximately $7.2 billion in 2016.
Ampersands (&'s) in URLs [Liam Quinn ] • Always use & in place of & when writing URLs in HTML: • E.g.: <a href="foo.cgi?chapter=1&section=2&copy=3&lang=en">...</a>
Retrieve a URL form New Version of Google Search Results – using Chrome
Click Fraud (2) – Connect to the Google Server Directly • Attackers could launch the same attacks by • opening a HTTP connection to a Google server and • sending the URL in the previous slide to the above server directly.
Retrieve a URL form Latest Version of Google Search Results – using Chrome
