How to Own the Internet in Your Spare Time

1. How to Own the Internet in Your Spare Time Giannis Kapantaidakis University of Crete CS558 (Stuart Staniford Vern Paxson Nicholas Weaver )

2. What could you do if you 0wn’d a million hosts? • Distributed DOS attacks • Access sensitive information • Confuse-Corrupt the information Makes it valuable tool in Cyber warfare

3. How to 0wn a million hosts? Worms • Programs that self-propagate across the Internet exploiting security flaws in widely-used services (As opposed to viruses, which require user action to spread.)

4. Code Red I • Initial version released July 13, 2001. • Exploited known bug in Microsoft IIS Web servers. • But: failure to seed random number generator.All worms attempted to compromise the same sequence of hosts. • Linear spread, didn’t get very far

5. Code Red I v2 • Released July 19, 2001. • Same codebase but: • random number generator correctly seeded. • DDoS payload targeting IP address of www.whitehouse.gov • That night, Code Red dies (except for hosts with inaccurate clocks!) • It just takes one of these to restart the worm come the first of the next month!

6. Random Constant Spread Model • N: Total number of Vulnerable servers in Internet • K: Initial Compromise Rate: Rate at which a infected host is able to infect new hosts at the start of the incident • a: Proportion of machines already compromised • T: Time at which the incident happens • Equation: Nda = (Na)K(1-a)dt • Solution: a = e (K(t-T)) / 1 + e (K(t-T)) • Good enough model (Works for Code Red I)

7. K=1.8 T=11.9 • Max probe rate:510.000 scans per hour • Came close to saturation before turning off

8. Reawake on Aug 1st , K=0.7 • Number of vulnerable systems was less than 40% as many as the first time • Code Red more or less followed the model.

9. Code Red II • Released August 4, 2001. • Comment in code: “Code Red II.”But in fact completely different code base. • Payload: a root backdoor allowing unrestricted remote access • Bug: crashes NT, only works right on Windows 2000. • Used localized scanning strategy

10. Localized Scanning • Attempt to infect addresses close to it • With probability 3/8 it chooses a random IP from with the class B address space of the infected machine • With probability ½ from class A • And with probability 1/8 from the whole internet • Localized spreading works - hosts around it are often similar,topologically faster,spreads fast in internal network once it gets through the firewall

11. Nimda • Released September 18, 2001. • Multi- mode spreading: • attack IIS servers via infected clients. • email itself to address book as a virus • copy itself across open network shares • modifying Web pages on infected servers in order to infect clients • scanning for Code Red II and sadmind backdoors (!)

12. Average - 100 connections per second • About 3X number of Code Red probes • Full functionality still not known!

13. Since Nimda spreads by multiple vectors,the counts shown for it may be an underestimate

14. Why Red Code I continues to gain strength each month remains unknown

15. Ways of reducing time • Hit List scanning • Permutation scanning • Topological Scanning • Internet scale hit-lists

16. Hit List scanning Idea: reduce slow startup phase. • The author of the worm collects the list of around 10,000 -50,000 potentially vulnerable machines ideally the ones with very good network connection, before releasing the worm • The worm when released initially attacks these machines .So the initial infection is higher.When it infects a machine it divides the hit-list in half

17. Ways to get Hit list • Distributed Scanning - use zombies • Stealthy Scan- spread it over several months • DNS searches - e. g., www. domain. com • Spiders - ask the search engines • Just Listening-P2P, or exploit existing worms

18. Permutation Scanning Idea: reduce redundant scanning. • Permutation allows a worm to detect when a host is already infected. • Worms share a common permutation of the IP address space. • An infected machine starts scanning just after their position in the permutation. When the worm sees an infected machine is chooses a new random start point.

19. Warhol Worm • Based on: • Hit List & • Permutation Scanning • Simulation Environment • Results of Simulation

20. So now we already have methods to attack most vulnerable targets in <15 minutes.

21. Topological Scanning • Alternative to hit-list scanning • Use addresses available on victim’s machines. • Use this as a start point before using Permutation Scanning. • Peer to peer systems are highly vulnerable to this kind of scanning

22. Flash Worms:The Real Danger • Idea: use an Internet- sized hit list. (entire address space scan roughly 2hr) • Initial copy of the worm has the entire hit list. • Each generation, infects nfrom the list, gives each 1/n. (Or, point them to a well- connected servers that serves upportions of the list.) • If n=10 requires 7 generations to infect 10^7 hosts (less than 30 seconds! )

23. Still need better worms • All those worms use singular communication patterns • This forms the basis for automatic detection • How can we remove that weakness from worms?

24. Contagion Worms • Suppose you have two exploits: • Es : exploit in web server • Ec: exploit in client • You infect a server (or client) with Es (Ec) • Then you…wait. (Perhaps you bait, e. g., host porn.) • When vulnerable client arrives, infect it. • You send over both Es and Ec • As client happens to visit other vulnerable servers infects • Clearly there are no unusual communication patterns to be observed (other than slightly larger- than- usual transfers)

25. Contagion Worms • They become Dangerous with P2P systems because: • Likely only need a single exploit, not a pair. • Often, peers running identical software. • Often used to transfer large files. • Often give access to user’s desktop rather than server. • and can be Very Large

26. Contagion Worms • KazaA: 9 million distinct IP connections with university hosts (5800) in a single month • If you 0wn’d a single university, then in November, 2001you could have 0wn’d 9 million additional hosts. • How fast? Faster than 1 month.

27. Updating and control • Distributed control • Each worm has a list of other copies • Ability to create encrypted communication channels to spread info • Commands cryptographically signed by author. • Each worm copy, confirms signature,spreads to other copies and then executes the command • Programmatic Updates • Operating systems allow dynamic code loading • New encrypted attack modules from Worm author

28. Centre for Disease Control • Roles it is expected to perform • Identifying outbreaks • Rapidly Analyzing pathogens • Fighting Infections • Anticipating new vectors • Resisting future threats

29. How open? • Have a open website (accessible to all)? • Drawbacks: • Attacker targets the site • How correct an information placed on site is • Attacker also gains understanding • Some sources may not be willing to make their information public • How International.