Lecture Outline Finish broader notions relating to authentication: - - PowerPoint PPT Presentation

▶
lecture outline
SMART_READER_LITE
LIVE PREVIEW

Lecture Outline Finish broader notions relating to authentication: - - PowerPoint PPT Presentation

Dec 29, 2023 133 likes •803 views

Lecture Outline Finish broader notions relating to authentication: Multi-party identities (Ecommerce, web advertising) Bot-or-Not (CAPTCHAs) Project status reports Botnets: Basic structure More sophisticated

slide-1
SLIDE 1

Lecture Outline

  • Finish broader notions relating to authentication:

– Multi-party identities (Ecommerce, web advertising) – Bot-or-Not (CAPTCHAs)

  • Project status reports
  • Botnets:

– Basic structure – More sophisticated C&C – Bulletproof hosting – Pay-per-Install (PPI)

slide-2
SLIDE 2

Multi-Party Identities, con’t

slide-3
SLIDE 3

S⟶M: place_order.html [M inserts ID and price into database; status=PENDING] M⟶S⟶C: get_payment? SIGNM(ID=X,price=Y,merch=M,shop=S) [C verifies signature; records payment info, generates # T] C⟶S⟶M: finish? SIGNC(ID=X,price=Y,merch=M,shop=S,PAID) [M verifies signature and PAID is indicated, etc.] [M retrieves orderID=X from database; if order status = PENDING → mark as PAID; ship X]

Better Fix for CAAS Attack #2

Principle: always sign all the information that went into a decision

slide-4
SLIDE 4

… S⟶M: checkout?ID=X&price=Y [M sets session_status[S] ⟵ confirm_with_C(shop=S,ID=X,price=Y) ] M⟶S⟶M: update_status?SIGNM(ID=X) [M validates signature; if session_status[S]= CONFIRMED → session_status[S]= PAID; ship X]

CAAS Attack #3 ?

slide-5
SLIDE 5

S⟶M: checkout?ID=X1&price=Y1 [M sets session_status[S] ⟵ confirm_with_C(…,X1,Y1) ⟵ FAILED] M⟶S: update_status?SIGNM(ID=X1) S⟶M: checkout?ID=X2&price=Y2 Y2≪ Y1 [M sets session_status[S] ⟵ confirm_with_C(…,X2,Y2) ⟵ CONFIRMED] S⟶M: update_status?SIGNM(ID=X1) [M validates signature; if session_status[S]= CONFIRMED → session_status[S]= PAID; ship X1]

CAAS Attack #3 !

slide-6
SLIDE 6

S⟶M: checkout?ID=X1&price=Y1 [M sets session_status[S, X1] ⟵ confirm_with_C(…,X1,Y1) ⟵ FAILED] M⟶S: update_status?SIGNM(ID=X1) S⟶M: checkout?ID=X2&price=Y2 Y2≪ Y1 [M sets session_status[S, X2] ⟵ confirm_with_C(…,X2,Y2) ⟵ CONFIRMED] S⟶M: update_status?SIGNM(ID=X1) [M validates signature; if session_status[S, X1]= CONFIRMED → session_status[S]= PAID; ship X1]

Fix for CAAS Attack #3

slide-7
SLIDE 7

S⟶M: checkout?ID=X1&price=Y1 [M sets session_status[S, X1, Y1] ⟵ confirm_with_C(…,X1,Y1) ⟵ FAILED] M⟶S: update_status?SIGNM(ID=X1, Y1) S⟶M: checkout?ID=X2&price=Y2 Y2≪ Y1 [M sets session_status[S, X2, Y2] ⟵ confirm_with_C(…,X2,Y2) ⟵ CONFIRMED] S⟶M: update_status?SIGNM(ID=X1, Y1) [M validates signature; if session_status[S, X1, Y1]= CONFIRMED → session_status[S]= PAID; ship X1]

Better Fix for CAAS Attack #3

slide-8
SLIDE 8

Imposing Identity, Part 1

How web-based advertising is supposed to work:

1. You have a web site about say kittens 2. In it, you link to Amazon kitten products 3. If a user clicks on the link, it includes your affiliate ID 4. Amazon notes ID, reflects it in a cookie sent to user

slide-9
SLIDE 9

Imposing Identity, Part 1

How web-based advertising is supposed to work:

1. You have a web site about say kittens 2. In it, you link to Amazon kitten products 3. If a user clicks on the link, it includes your affiliate ID 4. Amazon notes ID, reflects it in a cookie sent to user 5. … (user leaves your site, time passes) … 6. If user subsequently buys (broadly interpreted), cookie gives you credit 7. Profit!

slide-10
SLIDE 10

Suppose instead you have (a) no kitten web site and (b) no scruples:

1. But you have some sort of site that gets some traffic …

1'. … or you say send spam to get users to execute your HTML

Imposing Identity, Part 2

slide-11
SLIDE 11

Suppose instead you have (a) no kitten web site and (b) no scruples:

1. But you have some sort of site that gets some traffic …

1'. … or you say send spam to get users to execute your HTML

2. Your HTML causes the users browser to automatically visit Amazon w/ your affiliate ID 3. Amazon notes ID, reflects it in a cookie sent to user 4. … (user leaves your site/junks your spam, time passes)… 5. If user happens to subsequently buy (broadly interpreted) for whatever reason, cookie gives you credit 6. Profit!

Imposing Identity, Part 2

slide-12
SLIDE 12

Cookie Stuffing

Very hard to defend against ☹. Can’t rely on Referer (HTTPS). No indication in HTTP GET of

  • rganic vs. automation.
slide-13
SLIDE 13

Bot-or-Not: CAPTCHAs

slide-14
SLIDE 14
slide-15
SLIDE 15

Solveable by Google Street View in 2014

slide-16
SLIDE 16

Solveable by Google Street View in 2014

slide-17
SLIDE 17

Properties of Identities: Human or Bot?

  • Issues with CAPTCHAs?

– Arms race: getting harder & harder for humans to solve – Accessibility – Enabling benign robots – Core problem: outsourcing

slide-18
SLIDE 18
slide-19
SLIDE 19

Research question: how can we discover who’s solving these so cheaply?

slide-20
SLIDE 20

Researchers purchased CAPTCHA solving from a range of services

slide-21
SLIDE 21

Solving accuracy varied by program and web service (e.g., Paypal or Gmail) … but generally nearly 90%

slide-22
SLIDE 22

Also created custom CAPTCHAs requiring providing transcription of digits spelled in different languages

slide-23
SLIDE 23

Enables inference of workforce demographics

slide-24
SLIDE 24

The best (and most $$) service’s workers even managed to learn some Klingon!

slide-25
SLIDE 25

Outsourcing makes bot-or-not problem fundamentally hard

slide-26
SLIDE 26

Project Status Reports

  • Due: Fri. Apr 10 (evening)
  • Goal is diagnostic (not graded)
  • Along with initial sketch/reminder of project:

– What work completed – What remains – Open issues – Need for a potential meeting

  • Presentation (Zoom) slot preferences:

– Tue Apr 21, Fri Apr 24, Tue Apr 28, Fri May 1

slide-27
SLIDE 27

Botnets

slide-28
SLIDE 28

Botnets: Subversion-at-Scale

  • Similar to worms:

– Spreading ⊥ C&C ⊥ Employment (if C&C flexible)

  • Grew out of IRC wars/vandals (late 90s/00s)
  • Broadcast-based message protocol provided

easy path for control protocols

slide-29
SLIDE 29

Channel for bots running on MIPS architecture

slide-30
SLIDE 30

Stop what you’re doing and reset for new commands

slide-31
SLIDE 31

These commands are

  • nly for US/European bots
slide-32
SLIDE 32

Polling parameters for individual bots

slide-33
SLIDE 33

These are only about 1/3

  • f the possible commands
slide-34
SLIDE 34

These Particular Fearsome IRC Bots?

slide-35
SLIDE 35

Controlled spreading

slide-36
SLIDE 36

Also looks for vulnerable servers, sniffs traffic for username/passwords

slide-37
SLIDE 37

More Sophisticated C&C

slide-38
SLIDE 38

Welcome to Storm!

slide-39
SLIDE 39

The Storm botnet

Overnet P2P (UDP)

Reachability check

Each bot generates its own 128-bit Overnet ID (OID) Existing Overnet node checks new bot for reachability (= no NAT) Finds Overnet peer with closest OID

slide-40
SLIDE 40

Infected machines Hosted infrastructure

TCP HTTP

HTTP proxies Workers Proxy bots Botmaster

The Storm botnet

Messages to activate proxies are signed using RSA

slide-41
SLIDE 41
slide-42
SLIDE 42
slide-43
SLIDE 43

How Big Was Storm?

Bots make 16 calls to this, taking bottom 8 bits each time, to construct 128-bit OID

Issues?

Only 32,767 possible OIDs!

slide-44
SLIDE 44

Lots of poisoning/probing

Do All OIDs Come From Limited Pool?

slide-45
SLIDE 45

How Big Was Storm?

slide-46
SLIDE 46

Infected machines Hosted infrastructure

TCP HTTP

HTTP proxies Workers Proxy bots Botmaster

The Storm botnet

Vulnerabilities?

Researchers can analyze proxies in order to locate & take down these

slide-47
SLIDE 47

Other Ways to Find C&C Infrastructure?

Huh what happens if we google on pages that look just like this?

slide-48
SLIDE 48

Botmaster countermeasures to avoid C&C server takedown? (in addition to DGAs)

slide-49
SLIDE 49

Bulletproof hosting

slide-50
SLIDE 50

$125-225/month

slide-51
SLIDE 51

Infected machines Hosted infrastructure

TCP HTTP

HTTP proxies Workers Proxy bots Botmaster

The Storm botnet

Exotic location of Storm’s bulletproof hosting?

“Intercage” colo in … San Francisco

slide-52
SLIDE 52
slide-53
SLIDE 53
slide-54
SLIDE 54

How Bulletproof Hosting Looks in Recent Times

slide-55
SLIDE 55
slide-56
SLIDE 56
slide-57
SLIDE 57
slide-58
SLIDE 58
slide-59
SLIDE 59
slide-60
SLIDE 60
slide-61
SLIDE 61
slide-62
SLIDE 62
slide-63
SLIDE 63
slide-64
SLIDE 64
slide-65
SLIDE 65