CSE543 - Introduction to Computer and Network Security Module: - - PowerPoint PPT Presentation

▶
cse543 introduction to computer and network security
SMART_READER_LITE
LIVE PREVIEW

CSE543 - Introduction to Computer and Network Security Module: - - PowerPoint PPT Presentation

Oct 24, 2022 37 likes •289 views

slide-1
SLIDE 1

฀฀฀฀ ฀

  • ฀฀฀฀

฀฀฀฀฀ ฀฀฀฀฀฀

CSE543 - Introduction to Computer and Network Security Page

CSE543 - Introduction to Computer and Network Security Module: Botnets

Professor Patrick McDaniel Fall 2008

1

slide-2
SLIDE 2

CSE543 - Introduction to Computer and Network Security Page

Story

2

slide-3
SLIDE 3

CSE543 - Introduction to Computer and Network Security Page

  • A botnet is a network of software robots

(bots) run on zombie machines which run are controlled by command and control networks

  • IRCbots - command and control over IRC
  • Bot herder - owner/controller of network
  • "scrumping" - stealing resources from a

computer

  • Surprising Factoid: the IRC server is exposed.

Botnets

3

slide-4
SLIDE 4

CSE543 - Introduction to Computer and Network Security Page

  • The actual number of bots, the size of the

botnets and the activity is highly controversial.

  • As of 2005/6: hundreds of thousands of bots
  • 1/4 of hosts are now part of bot-nets
  • Growing fast (many more bots)
  • Assertion: botnets are getting smaller(?!?)

Statistics (controversial)

4

slide-5
SLIDE 5

CSE543 - Introduction to Computer and Network Security Page

What are botnets being used for?

5

  • 50 botnets

– 100-20,000 bots/net

  • Clients/servers

spread around the world

– Different geographic concentrations

Activities we have seen Stealing CD Keys: ying!ying@ying.2.tha.yang PRIVMSG #atta :BGR|0981901486 $getcdkeys BGR|0981901486!nmavmkmyam@212.91.170.57 PRIVMSG #atta :Microsoft Windows Product ID CD Key: (55274-648-5295662-23992). BGR|0981901486!nmavmkmyam@212.91.170.57 PRIVMSG #atta :[CDKEYS]: Search completed. Reading a user's clipboard: B][!Guardian@globalop.xxx.xxx PRIVMSG ##chem## :~getclip Ch3m|784318!~zbhibvn@xxx-7CCCB7AA.click-network.com PRIVMSG ##chem## :- [Clipboard Data]- Ch3m|784318!~zbhibvn@xxx-7CCCB7AA.click-network.com PRIVMSG ##chem## :If You think the refs screwed the seahawks over put your name down!!! DDoS someone: devil!evil@admin.of.hell.network.us PRIVMSG #t3rr0r0Fc1a :!pflood 82.147.217.39 443 1500 s7n|2K503827!s7s@221.216.120.120 PRIVMSG #t3rr0r0Fc1a :\002Packets\002 \002D\002one \002;\002>\n s7n|2K503827!s7s@221.216.120.120 PRIVMSG #t3rr0r0Fc1a flooding....\n Set up a web-server (presumably for phishing): [DeXTeR]!alexo@l85-130-136-193.broadband.actcom.net.il PRIVMSG [Del]29466 :.http 7564 c:\\ [Del]38628!zaazbob@born113.athome233.wau.nl PRIVMSG _[DeXTeR] :[HTTPD]: Server listening on IP: 10.0.2.100:7564, Directory: c:\\.

piracy mining attacks hosting

slide-6
SLIDE 6

CSE543 - Introduction to Computer and Network Security Page

  • SPAM relays
  • Click fraud
  • Spamdexing
  • Adware

Other goals of a botnet ...

6

slide-7
SLIDE 7

CSE543 - Introduction to Computer and Network Security Page

IRC botnets

  • An army of compromised hosts (“bots”) coordinated via a

command and control center (C&C). The perpetrator is usually called a “botmaster”.

“A botnet is comparable to compulsory military service for windows boxes”

  • - Bjorn Stromberg

7

IRC Server Bots (Zombies)

Find and infect more machines!

slide-8
SLIDE 8

CSE543 - Introduction to Computer and Network Security Page

Typical (IRC) infection cycle

8

  • ptional

Bots usually require some form of authentication from their botmaster

slide-9
SLIDE 9

CSE543 - Introduction to Computer and Network Security Page

  • Worms, Tojan horses, backdoors
  • Note: the software on these systems is updated
  • Bot theft: bot controllers penetrate/"steal" bots.

Infection

9

slide-10
SLIDE 10

CSE543 - Introduction to Computer and Network Security Page

  • 1988 - one-to-many or many-to-many chat (for BBS)
  • Client/server -- TCP Port 6667
  • Used to report on 1991 Soviet coup attempt
  • Channels (sometimes password protected) are used to

communicate between parties.

  • Invisible mode (no list, not known)
  • Invite only (must be invited to participate)

IRC

10

Server Server Server Server Server

slide-11
SLIDE 11

CSE543 - Introduction to Computer and Network Security Page

Not only for launching attacks ...

  • Some botmasters pay very close attention to

their bots

  • hence covert infiltration is important
  • In many cases, Botmasters “inspect” their bots

fairly regularly, and isolate certain bots (“cherry picking”)

11

#HINDI-FILMZ :#1 294x [698M] [Movie] Dil Bechara Pyar Ka Mara DvD-RiP [ Full / AVI / 2001 ] #HINDI-FILMZ :#2 126x [141K] [English Subtitles] Dil Bechara Pyar Ka Mara #HINDI-FILMZ :** 2 packs ** 3 of 3 slots open, Record: 45.3KB/s #HINDI-FILMZ :** Bandwidth Usage ** Current: 0.0KB/s, Record: 304.5KB/s #HINDI-FILMZ :** To request a file type: /"/msg [HF]-[Street-Hunk]-30 xdcc send #x/" ** #HINDI-FILMZ :** -= #Hindi-Filmz=- ** #HINDI-FILMZ :** I M 100% Desi !! ** #HINDI-FILMZ :Total Offered: 698.5 MB Total Transferred: 206.57 GB #HINDI-FILMZ :#1 294x [698M] [Movie] Dil Bechara Pyar Ka Mara DvD-RiP [ Full / AVI / 2001 ] #HINDI-FILMZ :#2 126x [141K] [English Subtitles] Dil Bechara Pyar Ka Mara #HINDI-FILMZ :** 2 packs ** 3 of 3 slots open, Record: 45.3KB/s #HINDI-FILMZ :** Bandwidth Usage ** Current: 0.0KB/s, Record: 304.5KB/s #HINDI-FILMZ :** To request a file type: /"/msg [HF]-[Street-Hunk]-30 xdcc send #x/" ** #HINDI-FILMZ :** -= #Hindi-Filmz=- ** #HINDI-FILMZ :** I M 100% Desi !! ** #HINDI-FILMZ :Total Offered: 698.5 MB Total Transferred: 206.57 GB

That’s a lot of movies served! ( ~ 300)

slide-12
SLIDE 12

CSE543 - Introduction to Computer and Network Security Page 12

Lots of bots out there

  • Level of botnet threat is supported by the conjecture that

large numbers of bots are available to inflict damage

  • Press Quotes
  • “Three suspects in a Dutch crime ring hacked 1.5 million

computers worldwide, setting up a “zombie network””, Associated Press

  • “The bot networks that Symantec discovers run anywhere

from 40 systems to 400,000”, Symantec

slide-13
SLIDE 13

CSE543 - Introduction to Computer and Network Security Page 13

Measuring botnet size

  • Two main categories
  • Indirect methods: inferring

botnet size by exploiting the side-effects of botnet activity

(e.g., DNS requests)

  • Direct methods: exploiting

internal information from monitoring botnet activity

slide-14
SLIDE 14

CSE543 - Introduction to Computer and Network Security Page 14

Indirect Methods

  • Mechanism
  • DNS blacklists
  • DNS snooping
  • What does it provide?
  • DNS footprint
  • Caveats
  • DNS footprint is only a lower bound of the actual infection

footprint of the botnet

  • DNS records with small TTLs
  • DNS servers blocking external requests (~50%)
slide-15
SLIDE 15

CSE543 - Introduction to Computer and Network Security Page

  • The value of a bot is related to its status on the

DNS blacklists

  • Compromised hosts often used as SMTP servers for

sending spam.

  • DNS blacklists are lists maintained by providers that

indicate that SPAM has been received by them.

  • Organizations review blacklists before allowing mail

from a host.

  • A "clean" bot (not listed) is worth a lot
  • A listed bot is largely blocked from sending SPAM

DNS Blacklist

15

A B C D E F ...

slide-16
SLIDE 16

CSE543 - Introduction to Computer and Network Security Page

  • Observation: bot controllers/users need to query for BL

status of hosts to determine value.

  • Idea: if you watch who is querying (and you can tell the

difference from legitimate queries), then you know something is a bot

  • Understanding the in/out ratio:
  • Q: what does a high ration mean? Low?

DNSBL Monitoring

16

λn = dn,out dn,in

slide-17
SLIDE 17

CSE543 - Introduction to Computer and Network Security Page

Results

17

slide-18
SLIDE 18

CSE543 - Introduction to Computer and Network Security Page

Direct Methods

  • Mechanisms
  • Infiltrate botnets and directly count online bots
  • DNS redirection (by Dagon et al.)
  • What do they provide?
  • Infection footprint & effective size (infiltration)
  • Infection footprint (DNS redirection)
  • Caveats
  • Cloning (infiltration)
  • Counting IDs vs. counting IPs (infiltration)
  • Measuring membership in DNS sinkhole (DNS redirection)
  • Botmasters block broadcasts on C&C channel (infiltration)

18

slide-19
SLIDE 19

CSE543 - Introduction to Computer and Network Security Page

  • DNS redirection “sinkhole”
  • Identify, then self poison DNS entries
  • DNS cache hits
  • Idea: query for IRC server to see if in cache
  • If yes, at least one bot in the network within

the TTL (see [14])

  • Limitations: TTL, not all servers answer,

lower bound on bots

Estimating size [Monrose et. al]

19

slide-20
SLIDE 20

CSE543 - Introduction to Computer and Network Security Page

  • Approach: infiltration templates based on collected

honeynet data, e.g., observing compromised hosts that are identified within the channel

  • How many?
  • 1.1 million distinct user IDs used
  • 425 thousand distinct IP addresses
  • Issues:
  • NAT/DHCP?
  • “Cloaked” IP address (SOCKS proxies?)
  • Botnet membership overlap

How many bots?

20

slide-21
SLIDE 21

CSE543 - Introduction to Computer and Network Security Page

Botnet size, what does it mean?

  • Infection Footprint: the total number of infected bots throughout a

botnet’s lifetime

  • Relevance: how wide spread the botnet infection
  • Effective Botnet Size: the number of bots simultaneously connected

to the command and control channel

  • Relevance: the botnet capacity to execute botmaster commands

(e.g., flood attacks)

  • An Example:
  • While a botnet appeared to have a footprint of 45,000 bots, the

number of online bots (i.e. its effective size) was < 3,000

21

slide-22
SLIDE 22

CSE543 - Introduction to Computer and Network Security Page

Botnet footprint estimates

  • Redirection results:
  • Botnets with up to 350,000 infected hosts [Dagon et al.]

22

slide-23
SLIDE 23

CSE543 - Introduction to Computer and Network Security Page 23

Large botnets may not be so big!

Footprints Effective size

slide-24
SLIDE 24

CSE543 - Introduction to Computer and Network Security Page 24

Are we counting unique infections?

Temporary migration

  • Cloning activity observed in 20% of the botnets tracked (moving

between bot channels)

  • 130,000 bots created more than 2 million clones during our tracking

period

Cloning

slide-25
SLIDE 25

CSE543 - Introduction to Computer and Network Security Page 25

Summary

  • Size estimation is harder than it seems
  • Botnet size should be a qualified term
  • Different size definitions lead to radically different estimates
  • Current estimation techniques are laden with a number of caveats
  • Cloning, counting method, migration, botnet structures, DHCP,

NAT, etc.

  • A prudent study of the problem requires persistent multifaceted

tracking of botnet activity