[ Pobierz całość w formacie PDF ]
Attack Trends
Elias Levy, aleph1@securityfocus.com
Iván Arce, ivan.arce@coresecurity.com
A Short Visit to the Bot Zoo
bot
: n [common on IRC, MUD, and among gamers; from “robot”]
1. An IRC or MUD user who is actually a program. On IRC, typically the robot provides some useful service.
Examples are NickServ, which tries to prevent random users from adopting nicks already claimed by others,
and MsgServ, which allows one to send asynchronous messages to be delivered when the recipient signs on.
—The Jargon File,
version 4.4.7
T
his past year has seen a new attack trend emerge: bots.
sages they receive here as com-
mands. This structure is usually
secured with the help of pass-
words to connect to the server,
join a specific channel, or issue
commands. Several bots also use
SSL-encrypted communication.
• In other situations, such as when
some bots avoid IRC and use covert
communication channels, the con-
troller uses, for example, communi-
cation channels via an HTTP or
DNS tunnel instead of an inappro-
priate IRC protocol. They can, for
example, encode commands to the
bots inside HTTP requests or
within DNS TXT records. An-
other possibility is to hide com-
mands in images (steganography).
After a successful compromise, the attacker installs a bot
(also called a zombie or drone) on the system; this small
program enables a remote control mechanism to then
command the victim. Attackers use this technique repeatedly to
T
HORSTEN
H
OLZ
RWTH
Aachen
University
form networks of compromised ma-
chines (botnets) to further enhance
the effectiveness of their attacks.
manipulate infected machines. Bots
currently implement several differ-
ent approaches for this mechanism:
A short history of bots
The first bots programs were used in
Internet Relay Chat (IRC) net-
works; they reacted to events in
IRC channels and offered services
to users. Inappropriate behavior
started to evolve around 1993,
resulting in the IRC wars that
caused the first distributed denial-
of-service (DDoS) attacks.
In recent years, malicious bots have
become commonplace, with botnets
in particular posing a severe threat to
the Internet community. Attackers
primarily use them for DDoS attacks,
mass identity theft, or sending spam. A
detailed introduction to botnets, how
they work, and who uses them ap-
pears elsewhere (see http://honey
net.org/papers/bots/).
• Typically, the bots controller uses
a central IRC server for com-
mand and control (C&C). All
bots join a specific channel on this
server and interpret all the mes-
Bot characteristics
Three attributes characterize a bot: a
remote control facility, the imple-
mentation of several commands, and
a spreading mechanism to propagate
it further. Let’s look at each one in
more detail.
A remote control lets an attacker
76
PUBLISHED BY THE IEEE COMPUTER SOCIETY
■
1540-7993/05/$20.00 © 2005 IEEE
■
IEEE SECURITY & PRIVACY
Attack Trends
• Some bots use peer-to-peer (P2P)
communication mechanisms to
avoid a central C&C server be-
cause it’s a single point of failure.
Expect to see more bots imple-
ment P2P communication similar
to the protocol Slapper used.
1
shares and then drops its copy. Some
bots propagate by using P2P file-
sharing protocols, such as Kazaa and
Bear Share; using interesting file-
names, the bot drops copies of itself
into these programs’ shared folders. It
generates the filename by randomly
choosing from sets of strings.
An additional characteristic ap-
plies to bots that the German Hon-
eynet Project captured in the wild:
most of them have at least one
exe-
cutable packer
, a small program that
compresses/encrypts the actual bi-
nary. Typically, the attacker uses tools
such as UPX (http://upx.source
forge.net/) or Morphine (http://hx
def.czweb.org/download/Mor
phine27.zip) to pack the executable.
Table 1. New bot variants by month.
MONTH
AGOBOT
SDBOT
May 2004
543
332
June 2004
249
654
July 2004
339
1018
August 2004
133
977
Typically, two types of com-
mands are implemented over the re-
mote control network: DDoS at-
tacks and updates. DDoS attacks
include SYN and UDP flooding or
more clever ones such as spidering
attacks—those that start from a
given URL and follows all links in a
recursive way—against Web sites.
Update commands instruct the bot
to download a file from the Internet
and execute it. This lets the attacker
issue arbitrary commands on the
victim’s machine and dynamically
enhance the bot’s features. Other
commands include functions for
sending spam, stealing sensitive in-
formation from the victim (such as
passwords or cookies), or using the
victim’s computer for other nefari-
ous purposes.
The remote control facility and
the commands that can be executed
from it differentiate a bot from a
worm
, a program that propagates it-
self by attacking other systems and
copying itself to them. But similar to
a worm, most bots also include a
mechanism to spread further, usually
by automatically scanning whole
network ranges and propagating
themselves via vulnerabilities. These
vulnerabilities usually appear in the
Windows operating system, the
most common being DCOM
(MS03-026, buffer overrun in RPC
interface could allow code execu-
tion) and LSASS (MS04-011, secu-
rity update for Microsoft Windows).
Attackers also integrate recently
published exploits into their bots to
react quickly to new trends.
Propagation via network shares
and weak passwords on other ma-
chines is another common tech-
nique. The bot uses a list of passwords
and usernames to log on to remote
September 2004
123
818
October 2004
158
1111
November 2004
113
1156
December 2004
196
1637
January 2005
227
1539
February 2005
97
2010
March 2005
200
1689
which makes it easy to add commands
or scanners for other vulnerabilities.
For remote control, this family of
bots typically uses a central C&C
IRC server. Some variants also use
P2P communication via the decen-
tralized WASTE network (http://
waste.sourceforge.net/), thus avoid-
ing a central server.
Agobot and its variants use a
packet-sniffing library (libpcap) and
Perl-compatible regular expressions
to sniff and sort network traffic pass-
ing through the victim’s computer.
This malware can use the New
Technology File System (NTFS) al-
ternate data stream and offers rootkit
capabilities such as file and process
hiding to hide its own presence on a
compromised host. As an added
complication, reverse engineering
this malware is difficult because it in-
cludes functions to detect debuggers
and virtual machines, and it encrypts
the configuration in the binary.
On startup, the program attempts
to run a speed test for Internet con-
nectivity. By accessing several servers
and sending data to them, the bot
tries to estimate the victim’s available
bandwidth. Fortunately, this activity
can help us estimate the actual num-
ber of hosts compromised by this
particular bot: essentially, we look at
the log files. If Agobot uses www.
belwue.de as one of the domains for
a speed test, for example, the do-
main’s administrators can make an
Examples
and classification
Let’s examine some specific bots in
more detail. Table 1 gives a quantita-
tive overview of the evolution of dif-
ferent bot types. It shows that
Agobot, the bot that dominated the
year 2004, is now less common. In
contrast, attackers are increasingly
using SDBot, and new variants ap-
pear daily.
Agobot and variants
Probably the best-known family of
bots is Agobot/Gaobot, and its
variants Phatbot (www.lurhq.com/
phatbot.html), Forbot, and Xtrm-
Bot. The antivirus vendor Sophos
currently lists more than 1,100
known different versions of
Agobot, and this number is steadily
increasing. Agobot’s source code
was published on various Web sites
in April 2004, leading to new vari-
ants every week since.
A young German man using the
pseudonym Ago first wrote Agobot
in 2003; in May 2004, German au-
thorities arrested and charged him
with creating malicious computer
code under the country’s computer
sabotage law. The bot is written in
C++ with cross-platform capabilities,
and it shows a high abstract design. It’s
structured in a very modular way,
77
77
www.computer.org/security/
www.computer.org/security/
■
■
IEEE SECURITY & PRIVACY
IEEE SECURITY & PRIVACY
Attack Trends
educated guess about the bot’s de-
ployment by monitoring how often
the speed test is performed. In May
2004, the University of Stuttgart’s
Computer Emergency Response
Team (RUS-CERT) identified ap-
proximately 300,000 unique IP ad-
dresses per day in this fashion.
2
This type of malware can also ter-
minate the processes that belong to
antivirus and monitoring applica-
tions; some variants can even modify
the host file (which contains the
host-name-to-IP-address map-
pings). The malware appends a list of
Web site addresses—of antivirus
vendors, for example—and redirects
them to the loopback address, pre-
venting the infected user from ac-
cessing the specified location.
ants RBot, UrBot, UrXBot, and
Spybot, are the most active bots in
the wild. The whole family is writ-
ten in C, and literally thousands of
different versions exist because the
source code is public. SDBot’s
source code isn’t as well designed or
written as Agobot’s, but it offers sim-
ilar features, although the command
set isn’t as large, nor the implementa-
tion as sophisticated.
We can see bot evolution
through time by looking at this par-
ticular family of bots: each new ver-
sion integrates new features, and
each new variant results in major en-
hancements. Attackers integrate
new vulnerabilities quickly, and
once one version has a new spread-
ing capability, all the others integrate
it immediately. Moreover, small
modifications that can implement
specific features (such as password
encryption within the malware) can
be integrated in all variants.
mIRC-based bots
We subsume all mIRC-based bots
into the category of GT-bots: so
many different versions of them exist
that giving an overview of all the forks
would be close to impossible. mIRC
is a popular IRC client for Windows,
and GT is an abbreviation for
global
threat
, which is the common name
used for all mIRC-scripted bots.
GT-bots launch an instance of
the mIRC chat client with a set of
scripts and other binaries. One bi-
nary we usually find is a
Hide-
Window
executable that hides the
mIRC instance from the user. The
other binaries are mainly dynamic
link libraries (DLLs) linked to
mIRC that add some new features
that the mIRC scripts can use to
SDBot and variants
At the moment, SDBot and its vari-
ADVERTISER / PRODUCT INDEX MAY/JUNE 2005
Advertiser
Page Number
Advertising Personnel
Black Hat Briefings 2005
Cover 3
Marion Delaney
IEEE Media, Advertising Director
Phone: +1 212 419 7766
Fax: +1 212 419 7589
Email: md.ieeemedia@ieee.org
Marian Anderson
Advertising Coordinator
Phone: +1 714 821 8380
Fax: +1 714 821 4010
Email: manderson@computer.org
Sandy Brown
IEEE Computer Society,
Business Development Manager
Phone: +1 714 821 8380
Fax: +1 714 821 4010
Email: sb.ieeemedia@ieee.org
John Wiley & Sons
Cover 2
Morgan KaufmannPublishers
13
Naval Reserve
Cover 4
Boldface denotes advertisements in this issue.
Advertising Sales Representatives
Mid Atlantic (product/recruitment)
Dawn Becker
Phone: +1 732 772 0160
Fax: +1 732 772 0161
Email: db.ieeemedia@ieee.org
Midwest (product)
Dave Jones
Phone: +1 708 442 5633
Fax: +1 708 442 7620
Email: dj.ieeemedia@ieee.org
Will Hamilton
Phone: +1 269 381 2156
Fax: +1 269 381 2556
Email: wh.ieeemedia@ieee.org
Joe DiNardo
Phone: +1 440 248 2456
Fax: +1 440 248 2594
Email: jd.ieeemedia@ieee.org
Midwest/Southwest (recruitment)
Darcy Giovingo
Phone: +1 847 498-4520
Fax: +1 847 498-5911
Email: dg.ieeemedia@ieee.org
Northwest/Southern CA (recruitment)
Tim Matteson
Phone: +1 310 836 4064
Fax: +1 310 836 4067
Email: tm.ieeemedia@ieee.org
New England (product)
Jody Estabrook
Phone: +1 978 244 0192
Fax: +1 978 244 0103
Email: je.ieeemedia@ieee.org
Southwest (product)
Josh Mayer
Phone: +1 972 423 5507
Fax: +1 972 423 6858
Email: jm.ieeemedia@ieee.org
Japan
Tim Matteson
Phone: +1 310 836 4064
Fax: +1 310 836 4067
Email: tm.ieeemedia@ieee.org
New England (recruitment)
Robert Zwick
Phone: +1 212 419 7765
Fax: +1 212 419 7570
Email: r.zwick@ieee.org
Northwest (product)
Peter D. Scott
Phone: +1 415 421-7950
Fax: +1 415 398-4156
Email: peterd@pscottassoc.com
Europe (product)
Hilary Turnbull
Phone:
Southeast (recruitment)
Thomas M. Flynn
Phone: +1 770 645 2944
Fax: +1 770 993 4423
Email: flynntom@mindspring.com
+44 1875 825700
Fax:
+44 1875 825701
Email:
impress@impressmedia.com
Connecticut (product)
Stan Greenfield
Phone: +1 203 938 2418
Fax: +1 203 938 3211
Email: greenco@optonline.net
Southern CA (product)
Marshall Rubin
Phone: +1 818 888 2407
Fax: +1 818 888 4907
Email: mr.ieeemedia@ieee.org
Southeast (product)
Bill Holland
Phone: +1 770 435 6549
Fax: +1 770 435 0243
Email: hollandwfh@yahoo.com
78
IEEE SECURITY & PRIVACY
■
MAY/JUNE 2005
 Attack Trends
control the bot. The bots can access
the spreading functions in the DLLs
and thus enable further propagation.
GT-bots spread by exploiting
weaknesses on remote computers
and uploading themselves to com-
promised hosts. One handicap is
their large file size—they’re some-
times bigger than a megabyte.
spread further. Likewise, Q8Bot and
kaiten are small bots, consisting of
only a few hundred lines of source
code, but they have an additional
noteworthiness: they’re written for
Unix/Linux systems. These programs
implement all common bot features:
dynamic updating via HTTP-down-
loads, various DDoS attack capabili-
ties, execution of arbitrary com-
mands, and many more. In the version
we’ve captured, the spreaders are
missing, but we assume other versions
of these bots have spreaders. Many dif-
ferent versions of simple bots based on
the programming language Perl exist,
but these bots usually contain only a
few hundred lines of source code and
offer a rudimentary set of commands
(most often just for DDoS attacks).
This type of bot is typically used on
Unix-based systems.
troller, new remote control mecha-
nisms in the form of P2P communi-
cation, and other innovative ideas
demonstrate that bots constitute an
emerging security concern. The
German Honeynet Project’s current
research focuses on automated ways
to collect and analyze malware. We’re
developing techniques to observe
botnets and to learn more about bots.
As these threats continue to adapt and
change, so too must the security
community.
Other types of bots
Although some bots aren’t as wide-
spread as the ones we’ve just exam-
ined, some of them have interesting
features that are worth reviewing.
Xot and its successor XT Bot im-
plement a feature called
dynamic re-
mote settings stub
. DRSS hides the
communication flow between at-
tacker and bots by embedding the
commands in a file (for example,
within an image). The attacker then
uploads this file to a server, and the
bot on the victim’s computer down-
loads it, extracts the information,
and interprets the commands.
The Dataspy Network X bot is
written in C++ and has a conve-
nient interface that lets attackers
write scanners and spreaders as plug-
ins and extend the bot’s features.
This bot has a major disadvantage—
the default version doesn’t come
with any spreaders—but plugins are
available to overcome this gap. Addi-
tional plugins also offer services such
as DDoS attacks, portscan interface,
or hidden HTTP server.
Bobax uses HTTP requests as its
communication channel and thus
implements a stealthier remote con-
trol than IRC-based C&C. It also
implements mechanisms to spread
further by downloading and execut-
ing arbitrary files. In contrast to
other bots, Bobax’s primary purpose
is to send spam. A detailed analysis of
it appears elsewhere (www.lurhq.
com/bobax.html).
aIRCBot is very small (only 2,560
bytes); it’s not a typical bot because it
implements a rudimentary remote
control mechanism, and it only un-
derstands raw IRC commands. It also
completely lacks the functions to
References
1. I. Arce and E. Levy, “An Analysis
of the Slapper Worm,”
IEEE Secu-
rity & Privacy
, vol. 1, no. 1, 2003,
pp. 82–87.
2. T. Fischer, “Botnetze,”
Proc. 12th
DFN-CERT Workshop
, DFN-
CERT Services, 2005, p. E1–E7.
Thorsten Holz
is a research student at
the Laboratory for Dependable Distrib-
uted Systems at RWTH Aachen Univer-
sity. His research interests include the
practical aspects of secure systems, but
he’s also interested in more theoretical
considerations of dependable systems.
Holz is one of the founders of the German
Honeynet Project. Contact him at holz@
i4.informatik.rwth-aachen.de.
B
ots are constantly evolving: at-
tackers can integrate new vul-
nerabilities within an incredibly short
time span, sometimes in a matter of
hours or days. Furthermore, new
techniques to hide the communica-
tion channel between bot and con-
2005
2005
EDITORIAL CALENDAR
EDITORIAL CALENDAR
JAN./FEB.: Economics of Information Security
MAR./APR.: Trusted Computing
MAY/JUN.: Infrastructure Security
JUL./AUG.: Enterprise Security Management
SEPT./OCT.: Policy and Regulation
NOV./DEC.: Consumer Devices
www.computer.org/security/
79
www.computer.org/security/
■
IEEE SECURITY & PRIVACY
  [ Pobierz całość w formacie PDF ]