Botnets

Dr. Neminath Hubballi

IIT Indore © Neminath Hubballi

Introduction

    Bot: A program performing automated task  A bot itself is not bad A botnet is a collection of computers, which are connected and work under the instruction of a master in order to accomplish something  Typically botnets are used for committing computer crimes A botnet is controlled by a person or a group of people Usually has monetary interests  Advertisement companies  Spam sending companies: outsource the work to bots IIT Indore © Neminath Hubballi

Motivation

    A report from Dhamballa, 2010 – number of infections increased at the rate of 8% per week Almost every botnet newly created overtaking the previous largest Financial profits  User credential stealing  Click fraud  Political interests Illegal activity include  DDoS attacks      Spamming Traffic sniffing Spreading malware Port scanning Key loggers etc..

IIT Indore © Neminath Hubballi

Components of a Botnet Infrastructure

  Command and Control Infrastructure  Centralized  Client server model  Distributed  Works more autonomously  Also called as peer to peer botnets  Crucial     Have to maintain a stable connectivity Robust Stable Reaction time Communication protocol IIT Indore © Neminath Hubballi

Centralized Control

 Multiple communication channels with master Courtesy:

Botnets: Detection, Measurement, Disinfection & Defense, Europian Network and Information Security Agency

IIT Indore © Neminath Hubballi

Decentralized Control

 Each bot will propagate commands to others Courtesy:

Botnets: Detection, Measurement, Disinfection & Defense, Europian Network and Information Security Agency

IIT Indore © Neminath Hubballi

Botnets Types

 There are 2 types of botnets  Operate through IRC   Operate through web server Operate as Peer-to-Peer network IIT Indore © Neminath Hubballi

Internet Relay Chat (IRC) based

      Uses a Push model of communication Master pushes commands for execution to the Bots All Bots receive commands through IRC PRIVMSG, understand the instruction and execute the command and send back results In order to issue commands Botmaster first authenticates herself with a username and password Advantages  Open source  Easy for modification  Two way communication  Real-time connectivity  Public and private mode interaction Disadvantages   Single point of failure Easily detectable IIT Indore © Neminath Hubballi

Communication Over IRC

     

Sequence of Events

Master authenticates Master queries info about botnet –version number Master queries system information Issue instruction to scan other potentially vulnerable machines Bot replies with scan results Courtesy: Botsniffer: Detecting Botnet Command and Control Channels in Network Traffic IIT Indore © Neminath Hubballi

HTTP based

    This type of Botnet uses HTTP as a communication medium Uses a pull method of interaction  Bots periodically poll the master requesting new commands to be issued Through a HTTP post method Bots connect to the master  Usually used for form submissions Advantage of using HTTP    It becomes difficult to detect Port 80 is open in all firewalls Normally encryption is used to avoid detection and eavesdropping IIT Indore © Neminath Hubballi

Role of DNS in Botnet

   DNS has an important role to play in Botent networks It allows changes to be done to the Botnet infrastructure transparently Fast Flux Networks      Create a domain evil.com Authoritative DNS server for the network evil.com is owned by attacker Attacker has multiple infected machines in her possession The RR mapping is changed at a very high frequency Each time the client connects to a different infected machine or Bot machine   All of these machines or Bots act as a proxy to the Bot server Increases the resiliency of Botnet infrastructure IIT Indore © Neminath Hubballi

Fast Flux Network

Courtesy:

Botnets: Detection, Measurement, Disinfection & Defense, Europian Network and Information Security Agency

IIT Indore © Neminath Hubballi

Who Suffers from Botnet

  Three entities    Victim – suffers directly ISP – have to carry lot of malicious traffic Third party – effect of malware Defense    Victim- corporates have to protect their IT assets ISP – detect malicious traffic Third party – keep the machine clean IIT Indore © Neminath Hubballi

Threat Characterization

     Botnet Size and Origin   Footprint- Number of infected machines indicates scaling factor Live Population – How many of infected machines are able to interact using CC infrastructure currently Spam throughput: Received spam emails per unit of time Freshness of IP address in spam emails –fresh one is better Bandwidth usable for DDoS attacks Harvested personal data – more data approximately leads to more financial gain IIT Indore © Neminath Hubballi

Botnet Detection



There are two types of detection mechanisms

 Passive techniques  Activity can be tracked without interfering with environment  No disturbance  Active techniques  Blocking malicious domains and identifying infected machines IIT Indore © Neminath Hubballi

Source of Data for Passive Detection

  Packet analysis    Shell code detection Protocol filed Combination of some fields etc.

Drawbacks     Full packet inspection is difficult Scaling is a factor Only known patterns are detected If the attack code is split across multiple packets, streams it is far more difficult to detect IIT Indore © Neminath Hubballi

Source of Data for Passive Detection

 Flow Record Analysis   Flow is a summary of what transpired in communication Typical attributes are:  Source and destination address      Related port numbers Protocol used inside the packets Duration of the session Cumulative size and Number of transmitted packets.  Drawbacks  Payload is ignored   Keep track of all sessions Switches and routers do it for you Courtesy: BotGrep IIT Indore © Neminath Hubballi



Source of Data for Passive Detection

Use of DNS Data   Identify Fast Flux Networks  Collect DNS queries and responses and do an offline analysis Identify “typo squatting” domain names in the data  Ex. Goggle.com  Malicious domain name can be blocked by domain registrars  Currently not happening  If a domain is identified as a malicious domain  In all likelihood the queries to that domain are from infected machines  It helps to track down even those machines IIT Indore © Neminath Hubballi

Source of Data for Passive Detection



Use of spam email analysis

 Botnets often run spam campaigns  All spam emails will have similarity     In contents Pattern Length of mail Source IP address used (often they reuse the IP addresses) 

Antivirus software feedback

 Collect information from many sensors IIT Indore © Neminath Hubballi

Active Countermeasures



Shinkholing –Changing the records of malicious domain to point to a good node

Courtesy:

Botnets: Detection, Measurement, Disinfection & Defense, Europian Network and Information Security Agency

IIT Indore © Neminath Hubballi

Active Countermeasures

 Identifying infected Machines through DNS Cache Snooping  This will help identify whether any machines in the local network are part of a malicious domain  Issue a query to a DNS server for a domain which is suspicious   Verify the TTL value If any other machine has already visited that domain, it is likely that TTL value has decreased w.r.t the default TTL value given by authoritative name server  Another variation is through by setting RD flag off IIT Indore © Neminath Hubballi

Active Countermeasures

Courtesy:

Botnets: Detection, Measurement, Disinfection & Defense, Europian Network and Information Security Agency

IIT Indore © Neminath Hubballi