[PPT] - Embedded Malware An Analysis of the Chuck Norris Botnet P. eleda, PowerPoint Presentation

SLIDE 1

Embedded Malware – An Analysis of the Chuck Norris Botnet

P. Čeleda, R. Krejčí, J. Vykopal, M. Drašar

{celeda|vykopal|drasar}@ics.muni.cz, radek.krejci@mail.muni.cz The sixth European Conference on Computer Network Defense – EC2ND 28-29 October 2010, Berlin, Germany

SLIDE 2

Part I Botnet Discovery

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 2 / 22

SLIDE 3

Motivation – What is happening in our network?

Internet

LAN LAN LAN LAN LAN

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 3 / 22

SLIDE 4

Motivation – What is happening in our network?

Internet

LAN LAN LAN LAN LAN Firewall

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 3 / 22

SLIDE 5

Motivation – What is happening in our network?

Internet

LAN LAN LAN LAN LAN Firewall AV protection

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 3 / 22

SLIDE 6

Motivation – What is happening in our network?

Internet

LAN LAN LAN LAN LAN Firewall AV protection

But what is happening here?

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 3 / 22

SLIDE 7

(In)visible Embedded Malware

Client-side anti-* protection is used and well known.

Internet

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 4 / 22

SLIDE 8

(In)visible Embedded Malware

Client-side anti-* protection is used and well known. What could happen if we attack infrastructure?

Internet Internet Chuck Norris Botnet Attack

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 4 / 22

SLIDE 9

Network Security Monitoring at Masaryk University

FlowMon probe FlowMon probe FlowMon probe NetFlow data generation

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 5 / 22

SLIDE 10

Network Security Monitoring at Masaryk University

FlowMon probe FlowMon probe FlowMon probe NetFlow data generation NetFlow collector NetFlow v5/v9 NetFlow data collection

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 5 / 22

SLIDE 11

Network Security Monitoring at Masaryk University

FlowMon probe FlowMon probe FlowMon probe NetFlow data generation NetFlow collector NetFlow v5/v9 NetFlow data collection NetFlow data analyses SPAM detection worm/virus detection intrusion detection

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 5 / 22

SLIDE 12

Network Security Monitoring at Masaryk University

FlowMon probe FlowMon probe FlowMon probe NetFlow data generation NetFlow collector NetFlow v5/v9 NetFlow data collection NetFlow data analyses SPAM detection worm/virus detection intrusion detection http mail syslog incident reporting mailbox WWW syslog server

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 5 / 22

SLIDE 13

Botnet Discovery

Worldwide TELNET scan attempts. Mostly comming from ADSL connections.

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 6 / 22

SLIDE 14

Part II Chuck Norris Botnet

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 7 / 22

SLIDE 15

Chuck Norris Botnet in a Nutshell

Linux malware – IRC bots with central C&C servers. Attacks poorly-configured Linux MIPSEL devices. Vulnerable devices – ADSL modems and routers. Uses TELNET brute force attack as infection vector. Users are not aware about the malicious activities. Missing anti-malware solution to detect it.

Discovered at Masaryk University on 2 December 2009. The malware got the Chuck Norris moniker from a comment in its source code [R]anger Killato : in nome di Chuck Norris !

P. Čeleda et al.

Embedded Malware – An Analysis of the Chuck Norris Botnet 8 / 22

SLIDE 16