. Malgorzata Debska September 22, 2015 CERT Polska faster c&c detection - strategies for finding algorithmically generated domain names
Introduction - what is DGA? Malicious usage in botnets Benign DGA - false alarms in detection systems Current detection techniques - classification Challenges and conclusion list of topics
. introduction - what is dga?
4 algorithmically generated domain names
• randomness of characters • characters set • distribution of frequency of character usage • length of generated domains • level of domain generation • utilized set of top level domains 5 diffrencies in generated domains:
• randomness of characters • characters set • distribution of frequency of character usage • length of generated domains • level of domain generation • utilized set of top level domains 5 diffrencies in generated domains:
• randomness of characters • characters set • distribution of frequency of character usage • length of generated domains • level of domain generation • utilized set of top level domains 5 diffrencies in generated domains:
• randomness of characters • characters set • distribution of frequency of character usage • length of generated domains • level of domain generation • utilized set of top level domains 5 diffrencies in generated domains:
• randomness of characters • characters set • distribution of frequency of character usage • length of generated domains • level of domain generation • utilized set of top level domains 5 diffrencies in generated domains:
• randomness of characters • characters set • distribution of frequency of character usage • length of generated domains • level of domain generation • utilized set of top level domains 5 diffrencies in generated domains:
dyre gameover-zeus banjori a3f6e2d182a40304a8874e994a294ec314.cc bnmtsemitismgavenuteq.com antisemitismgavenuteq.com hlrfrsensinaix.com xjsrrsensinaix.com 5bpzt0njqbkqlbwupc8vi3yt.org 1fhvdfa1hr7na1gu9vmv6r710j.biz 1yz3uuo1yg5zmf1u7goe81sy0xy9.net 1g22l018lpt4alpeypioqq24k.com cc466dc54278d8e0fe14bdd2038b927e6f.to b5191b0ad53da1f1fa66653610e7601856.ws 6 galin.eu puzej.eu qekol.eu lykef.eu safkylboxhb.com ctskthnhq.com mhrmhuxlcvkxay.com pttthldqrdt.net qeh2p2u9pd3i1.com fg4zstnd3ftwh.net jmqvlmmbred2e.com examples tinba-dga dircrypt simda
6 qekol.eu 1yz3uuo1yg5zmf1u7goe81sy0xy9.net 1g22l018lpt4alpeypioqq24k.com xjsrrsensinaix.com cc466dc54278d8e0fe14bdd2038b927e6f.to b5191b0ad53da1f1fa66653610e7601856.ws a3f6e2d182a40304a8874e994a294ec314.cc hlrfrsensinaix.com galin.eu puzej.eu lykef.eu 5bpzt0njqbkqlbwupc8vi3yt.org antisemitismgavenuteq.com safkylboxhb.com ctskthnhq.com mhrmhuxlcvkxay.com bnmtsemitismgavenuteq.com pttthldqrdt.net qeh2p2u9pd3i1.com fg4zstnd3ftwh.net jmqvlmmbred2e.com 1fhvdfa1hr7na1gu9vmv6r710j.biz examples tinba-dga dyre gameover-zeus dircrypt simda banjori
. malicious usage in botnets
Every second infected host try to connect with hundreds or thousands alghoritmically generated domain name • most of domains return NX response • attacker needs to have a couple of registered domains 8 c&c server’s name example
Every second infected host try to connect with hundreds or thousands alghoritmically generated domain name • most of domains return NX response • attacker needs to have a couple of registered domains 8 c&c server’s name example
• DNS communication • algorithm that generates domain names • shared seed between botmaster and clients • victims search C&C server by DNS query 9 dga botnet communication
• DNS communication • algorithm that generates domain names • shared seed between botmaster and clients • victims search C&C server by DNS query 9 dga botnet communication
• DNS communication • algorithm that generates domain names • shared seed between botmaster and clients • victims search C&C server by DNS query 9 dga botnet communication
• DNS communication • algorithm that generates domain names • shared seed between botmaster and clients • victims search C&C server by DNS query 9 dga botnet communication
10 generator’s seed Is it easy to predict and sinkhole DGA domains ahead?
Figure 1: Ramnit All domains generated alghoritmically are dependent on specified seed • date (CryptoLocker, Conficker, GameOverZeus) • currently trending Twitter hashtag (Torpig) • seed hardcoded in infected file (Tinba) • ... Seeds are globally consistent - victims use the same one at the same time 11 generator’s seed
Figure 1: Ramnit All domains generated alghoritmically are dependent on specified seed • date (CryptoLocker, Conficker, GameOverZeus) • currently trending Twitter hashtag (Torpig) • seed hardcoded in infected file (Tinba) • ... Seeds are globally consistent - victims use the same one at the same time 11 generator’s seed
Figure 1: Ramnit All domains generated alghoritmically are dependent on specified seed • date (CryptoLocker, Conficker, GameOverZeus) • currently trending Twitter hashtag (Torpig) • seed hardcoded in infected file (Tinba) • ... Seeds are globally consistent - victims use the same one at the same time 11 generator’s seed
Figure 1: Ramnit All domains generated alghoritmically are dependent on specified seed • date (CryptoLocker, Conficker, GameOverZeus) • currently trending Twitter hashtag (Torpig) • seed hardcoded in infected file (Tinba) • ... Seeds are globally consistent - victims use the same one at the same time 11 generator’s seed
Figure 1: Ramnit All domains generated alghoritmically are dependent on specified seed • date (CryptoLocker, Conficker, GameOverZeus) • currently trending Twitter hashtag (Torpig) • seed hardcoded in infected file (Tinba) • ... Seeds are globally consistent - victims use the same one at the same time 11 generator’s seed
Figure 1: Ramnit All domains generated alghoritmically are dependent on specified seed • date (CryptoLocker, Conficker, GameOverZeus) • currently trending Twitter hashtag (Torpig) • seed hardcoded in infected file (Tinba) • ... Seeds are globally consistent - victims use the same one at the same time 11 generator’s seed
All domains generated alghoritmically are dependent on specified seed • date (CryptoLocker, Conficker, GameOverZeus) • currently trending Twitter hashtag (Torpig) • seed hardcoded in infected file (Tinba) • ... Seeds are globally consistent - victims use the same one at the same time 11 generator’s seed Figure 1: Ramnit
All domains generated alghoritmically are dependent on specified seed • date (CryptoLocker, Conficker, GameOverZeus) • currently trending Twitter hashtag (Torpig) • seed hardcoded in infected file (Tinba) • ... Seeds are globally consistent - victims use the same one at the same time 11 generator’s seed Figure 1: Ramnit
12 • Cryptolocker AND MORE ... • Ramdo • Necrus • Flashback • Gozi • DirCrypt • Qakbot • BankPatch • Gozi • Emotet • Rovnix • Pykspa • Dyre • Shiotob • Necurs • Murofet • Bobax • Conficker • Ramnit • Pykpsa • Emotet • Pushdo • Matsu • Banjori • GameoverZeus is it a serious problem? what malware use dga?
• domain name contains random alphanumeric characters and words from dictionary • names are builds from english syllables 13 different techinques but still dga
• domain name contains random alphanumeric characters and words from dictionary • names are builds from english syllables 13 different techinques but still dga
. benign dga - false alarms in detection systems
0.0.0.0.1.0.0.4e.135jg5e1pd7s4735ftrqweufm5.avqs.mcafee.com 0.0.0.0.1.0.0.4e.13cfus2drmdq3j8cafidezr8l6.avqs.mcafee.com 0.0.0.0.1.0.0.4e.13kqas3qjj46ttkdhastkrdsv6.avqs.mcafee.com 0.0.0.0.1.0.0.4e.13pq3hfpunqn1d51pmvbdkk5s6.avqs.mcafee.com 0.0.0.0.1.0.0.4e.13qh71bf782qb54uzz9uhdz4mq.avqs.mcafee.com This higher level domain contains basic information about the file, its hash, version of the McAfee system and information about the execution environment 1 DNS Noise: Measuring the Pervasiveness of Disposable Domains in Modern DNS Traffic, Yizheng Chen et al. 15 requests of av tools Example 1
0.0.0.0.1.0.0.4e.135jg5e1pd7s4735ftrqweufm5.avqs.mcafee.com 0.0.0.0.1.0.0.4e.13cfus2drmdq3j8cafidezr8l6.avqs.mcafee.com 0.0.0.0.1.0.0.4e.13kqas3qjj46ttkdhastkrdsv6.avqs.mcafee.com 0.0.0.0.1.0.0.4e.13pq3hfpunqn1d51pmvbdkk5s6.avqs.mcafee.com 0.0.0.0.1.0.0.4e.13qh71bf782qb54uzz9uhdz4mq.avqs.mcafee.com This higher level domain contains basic information about the file, its hash, version of the McAfee system and information about the execution environment 1 DNS Noise: Measuring the Pervasiveness of Disposable Domains in Modern DNS Traffic, Yizheng Chen et al. 15 requests of av tools Example 1
• Now, IDNs are also used for malicious purposes • IDNs always begin with ’xn–’ prefix 16 internationalized domain name
• Now, IDNs are also used for malicious purposes • IDNs always begin with ’xn–’ prefix 16 internationalized domain name
Recommend
More recommend
