DOCSLIB.ORG

Understanding the Mirai Botnet

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Understanding the Mirai Botnet Understanding the Mirai Botnet Manos Antonakakis, Georgia Institute of Technology; Tim April, Akamai; Michael Bailey, University of Illinois, Urbana-Champaign; Matt Bernhard, University of Michigan, Ann Arbor; Elie Bursztein, Google; Jaime Cochran, Cloudflare; Zakir Durumeric and J. Alex Halderman, University of Michigan, Ann Arbor; Luca Invernizzi, Google; Michalis Kallitsis, Merit Network, Inc.; Deepak Kumar, University of Illinois, Urbana-Champaign; Chaz Lever, Georgia Institute of Technology; Zane Ma and Joshua Mason, University of Illinois, Urbana-Champaign; Damian Menscher, Google; Chad Seaman, Akamai; Nick Sullivan, Cloudflare; Kurt Thomas, Google; Yi Zhou, University of Illinois, Urbana-Champaign https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis This paper is included in the Proceedings of the 26th USENIX Security Symposium August 16–18, 2017 • Vancouver, BC, Canada ISBN 978-1-931971-40-9 Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIX Understanding the Mirai Botnet Manos Antonakakis Tim April‡ Michael Bailey† Matthew Bernhard/ Elie Bursztein◦ Jaime Cochran. Zakir Durumeric/ J. Alex Halderman/ Luca Invernizzi◦ Michalis Kallitsis§ Deepak Kumar† Chaz Lever Zane Ma†∗ Joshua Mason† Damian Menscher◦ Chad Seaman‡ Nick Sullivan. Kurt Thomas◦ Yi Zhou† ‡Akamai Technologies .Cloudflare Georgia Institute of Technology ◦Google §Merit Network †University of Illinois Urbana-Champaign /University of Michigan Abstract of factors—efficient spreading based on Internet-wide The Mirai botnet, composed primarily of embedded scanning, rampant use of insecure default passwords in and IoT devices, took the Internet by storm in late 2016 IoT products, and the insight that keeping the botnet’s when it overwhelmed several high-profile targets with behavior simple would allow it to infect many hetero- massive distributed denial-of-service (DDoS) attacks. In geneous devices—all played a role. Indeed, Mirai has this paper, we provide a seven-month retrospective anal- spawned many variants that follow the same infection ysis of Mirai’s growth to a peak of 600k infections and strategy, leading to speculation that “IoT botnets are the a history of its DDoS victims. By combining a variety new normal of DDoS attacks” [64]. of measurement perspectives, we analyze how the bot- In this paper, we investigate the precipitous rise of Mi- net emerged, what classes of devices were affected, and rai and the fragile IoT ecosystem it has subverted. We how Mirai variants evolved and competed for vulnerable present longitudinal measurements of the botnet’s growth, hosts. Our measurements serve as a lens into the fragile composition, evolution, and DDoS activities from Au- ecosystem of IoT devices. We argue that Mirai may rep- gust 1, 2016 to February 28, 2017. We draw from a resent a sea change in the evolutionary development of diverse set of vantage points including network telescope botnets—the simplicity through which devices were in- probes, Internet-wide banner scans, IoT honeypots, C2 fected and its precipitous growth, demonstrate that novice milkers, DNS traces, and logs provided by attack vic- malicious techniques can compromise enough low-end tims. These unique datasets enable us to conduct the first devices to threaten even some of the best-defended targets. comprehensive analysis of Mirai and posit technical and To address this risk, we recommend technical and non- non-technical defenses that may stymie future attacks. technical interventions, as well as propose future research We track the outbreak of Mirai and find the botnet directions. infected nearly 65,000 IoT devices in its first 20 hours before reaching a steady state population of 200,000– 300,000 infections. These bots fell into a narrow band of 1 Introduction geographic regions and autonomous systems, with Brazil, Columbia, and Vietnam disproportionately accounting for Starting in September 2016, a spree of massive distributed 41.5% of infections. We confirm that Mirai targeted a denial-of-service (DDoS) attacks temporarily crippled variety of IoT and embedded devices ranging from DVRs, Krebs on Security [46], OVH [43], and Dyn [36]. The ini- IP cameras, routers, and printers, but find Mirai’s ultimate tial attack on Krebs exceeded 600 Gbps in volume [46]— device composition was strongly influenced by the market among the largest on record. Remarkably, this overwhelm- shares and design decisions of a handful of consumer ing traffic was sourced from hundreds of thousands of electronics manufacturers. some of the Internet’s least powerful hosts—Internet of By statically analyzing over 1,000 malware samples, Things (IoT) devices—under the control of a new botnet we document the evolution of Mirai into dozens of vari- named Mirai. ants propagated by multiple, competing botnet operators. While other IoT botnets such as BASHLITE [86] and These variants attempted to improve Mirai’s detection Carna [38] preceded Mirai, the latter was the first to avoidance techniques, add new IoT device targets, and in- emerge as a high-profile DDoS threat. What explains troduce additional DNS resilience. We find that Mirai har- Mirai’s sudden rise and massive scale? A combination nessed its evolving capabilities to launch over 15,000 at- ∗Denotes primary, lead, or “first” author tacks against not only high-profile targets (e.g., Krebs USENIX Association 26th USENIX Security Symposium 1093 09/30/2016 Source code released 09/18/2016 11/26/2016 02/23/2017 OVH attacks 10/21/2016 Deutsche Telekom Deutsche Telekom begin Dyn attacks CWMP exploit attacker arrested Sept Oct Nov Dec Jan Feb 08/01/2016 09/21/2016 10/31/2016 01/18/2017 Mirai surfaces Krebs on Security Liberia Lonestar Mirai author peak attack attacks begin identified Figure 1: Mirai Timeline—Major attacks (red), exploits (yellow), and events (black) related to the Mirai botnet. on Security, OVH, and Dyn), but also numerous game release of Mirai’s source code on hackforums.net [4]. We servers, telecoms, anti-DDoS providers, and other seem- rely on this code to develop our measurement method- ingly unrelated sites. While DDoS was Mirai’s flavor ology (Section3). Furthermore, as we detail later (Sec- of abuse, future strains of IoT malware could leverage tion5), this source code release led to the proliferation access to compromised routers for ad fraud, cameras for of Mirai variants with competing operators. One notable extortion, network attached storage for bitcoin mining, variant added support for a router exploit through CPE or any number of applications. Mirai’s reach extended WAN Management Protocol (CWMP), an HTTP-based across borders and legal jurisdictions, and it infected de- protocol that enables auto-configuration and remote man- vices with little infrastructure to effectively apply security agement of home routers, modems, and other customer- patches. This made defending against it a daunting task. premises equipment (CPE) [15]. This exploit led to an out- Finally, we look beyond Mirai to explore the security age at Deutsche Telekom late November 2016 [47], with posture of the IoT landscape. We find that the absence of the suspected attacker later arrested in February 2017 [13]. security best practices—established in response to desk- In this work, we track Mirai’s variants and examine how top worms and malware over the last two decades—has they influenced Mirai’s propagation. created an IoT substrate ripe for exploitation. However, this space also presents unique, nuanced challenges in the Botnet structure & propagation We provide a sum- realm of automatic updates, end-of-life, and consumer no- mary of Mirai’s operation in Figure2, as gleaned from tifications. Without improved defenses, IoT-based attacks the released source code. Mirai spread by first entering are likely to remain a potent adversarial technique as bot- a rapid scanning phase (¬) where it asynchronously and net variants continue to evolve and discover new niches “statelessly” sent TCP SYN probes to pseudorandom IPv4 to infect. In light of this, Mirai seems aptly named—it is addresses, excluding those in a hard-coded IP blacklist, on Japanese for “the future.” Telnet TCP ports 23 and 2323 (hereafter denoted TCP/23 and TCP/2323). If Mirai identifies a potential victim, it en- tered into a brute-force login phase in which it attempted 2 The Mirai Botnet to establish a Telnet connection using 10 username and password pairs selected randomly from a pre-configured Mirai is a worm-like family of malware that infected list of 62 credentials. At the first successful login, Mirai IoT devices and corralled them into a DDoS botnet. We sent the victim IP and associated credentials to a hard- provide a brief timeline of Mirai’s emergence and discuss coded report server (­). its structure and propagation. A separate loader program (®) asynchronously in- Timeline of events Reports of Mirai appeared as fected these vulnerable devices by logging in, determining early as August 31, 2016 [89], though it was not until the underlying system environment, and finally, down- mid-September, 2016 that Mirai grabbed headlines with loading and executing architecture-specific malware (¯). massive DDoS attacks targeting Krebs on Security [46] After a successful infection, Mirai attempted to conceal and OVH [74] (Figure1). Several additional high-profile its presence by deleting the downloaded binary and ob- attacks later targeted DNS provider Dyn [36] and fuscating its process name in a pseudorandom alphanu- Lonestar Cell, a Liberian telecom [45]. In early 2017, the meric string. As a consequence, Mirai infections did not actors surrounding Mirai came to light as the Mirai author persist across system reboots. In order to fortify itself, was identified [49]. Throughout our study, we corroborate the malware additionally killed other processes bound our measurement findings with these media reports and to TCP/22 or TCP/23, as well as processes associated expand on the public information surrounding Mirai. with competing infections, including other Mirai vari- Another significant event in this timeline is the public ants, .anime [25], and Qbot [72].
Load more

Recommended publications
  • Botnets, Cybercrime, and Cyberterrorism: Vulnerabilities and Policy Issues for Congress
    Order Code RL32114 Botnets, Cybercrime, and Cyberterrorism: Vulnerabilities and Policy Issues for Congress Updated January 29, 2008 Clay Wilson Specialist in Technology and National Security Foreign Affairs, Defense, and Trade Division Botnets, Cybercrime, and Cyberterrorism: Vulnerabilities and Policy Issues for Congress Summary Cybercrime is becoming more organized and established as a transnational business. High technology online skills are now available for rent to a variety of customers, possibly including nation states, or individuals and groups that could secretly represent terrorist groups. The increased use of automated attack tools by cybercriminals has overwhelmed some current methodologies used for tracking Internet cyberattacks, and vulnerabilities of the U.S. critical infrastructure, which are acknowledged openly in publications, could possibly attract cyberattacks to extort money, or damage the U.S. economy to affect national security. In April and May 2007, NATO and the United States sent computer security experts to Estonia to help that nation recover from cyberattacks directed against government computer systems, and to analyze the methods used and determine the source of the attacks.1 Some security experts suspect that political protestors may have rented the services of cybercriminals, possibly a large network of infected PCs, called a “botnet,” to help disrupt the computer systems of the Estonian government. DOD officials have also indicated that similar cyberattacks from individuals and countries targeting economic,
    [Show full text]
  • The Downadup Codex a Comprehensive Guide to the Threat’S Mechanics
    Security Response The Downadup Codex A comprehensive guide to the threat’s mechanics. Edition 2.0 Introduction Contents Introduction.............................................................1 Since its appearance in late-2008, the Downadup worm has become Editor’s Note............................................................5 one of the most wide-spread threats to hit the Internet for a number of Increase in exploit attempts against MS08-067.....6 years. A complex piece of malicious code, this threat was able to jump W32.Downadup infection statistics.........................8 certain network hurdles, hide in the shadows of network traffic, and New variants of W32.Downadup.B find new ways to propagate.........................................10 defend itself against attack with a deftness not often seen in today’s W32.Downadup and W32.Downadup.B threat landscape. Yet it contained few previously unseen features. What statistics................................................................12 set it apart was the sheer number of tricks it held up its sleeve. Peer-to-peer payload distribution...........................15 Geo-location, fingerprinting, and piracy...............17 It all started in late-October of 2008, we began to receive reports of A lock with no key..................................................19 Small improvements yield big returns..................21 targeted attacks taking advantage of an as-yet unknown vulnerability Attempts at smart network scanning...................23 in Window’s remote procedure call (RPC) service. Microsoft quickly Playing with Universal Plug and Play...................24 released an out-of-band security patch (MS08-067), going so far as to Locking itself out.................................................27 classify the update as “critical” for some operating systems—the high- A new Downadup variant?......................................29 Advanced crypto protection.................................30 est designation for a Microsoft Security Bulletin.
    [Show full text]
  • Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G
    Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G. van Eeten, Delft University of Technology https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/asghari This paper is included in the Proceedings of the 24th USENIX Security Symposium August 12–14, 2015 • Washington, D.C. ISBN 978-1-939133-11-3 Open access to the Proceedings of the 24th USENIX Security Symposium is sponsored by USENIX Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere and Michel J.G. van Eeten Delft University of Technology Abstract more sophisticated C&C mechanisms that are increas- ingly resilient against takeover attempts [30]. Research on botnet mitigation has focused predomi- In pale contrast to this wealth of work stands the lim- nantly on methods to technically disrupt the command- ited research into the other side of botnet mitigation: and-control infrastructure. Much less is known about the cleanup of the infected machines of end users. Af- effectiveness of large-scale efforts to clean up infected ter a botnet is successfully sinkholed, the bots or zom- machines. We analyze longitudinal data from the sink- bies basically remain waiting for the attackers to find hole of Conficker, one the largest botnets ever seen, to as- a way to reconnect to them, update their binaries and sess the impact of what has been emerging as a best prac- move the machines out of the sinkhole. This happens tice: national anti-botnet initiatives that support large- with some regularity. The recent sinkholing attempt of scale cleanup of end user machines.
    [Show full text]
  • Internet Security Threat Report Volume 24 | February 2019
    ISTRInternet Security Threat Report Volume 24 | February 2019 THE DOCUMENT IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENT. THE INFORMATION CONTAINED IN THIS DOCUMENT IS SUBJECT TO CHANGE WITHOUT NOTICE. INFORMATION OBTAINED FROM THIRD PARTY SOURCES IS BELIEVED TO BE RELIABLE, BUT IS IN NO WAY GUARANTEED. SECURITY PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA REFERENCED IN THIS DOCUMENT (“CONTROLLED ITEMS”) ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER FOR YOU TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT SUCH CONTROLLED ITEMS. TABLE OF CONTENTS 1 2 3 BIG NUMBERS YEAR-IN-REVIEW FACTS AND FIGURES METHODOLOGY Formjacking Messaging Cryptojacking Malware Ransomware Mobile Living off the land Web attacks and supply chain attacks Targeted attacks Targeted attacks IoT Cloud Underground economy IoT Election interference MALICIOUS
    [Show full text]
  • Security Now! #664 - 05-22-18 Spectreng Revealed
    Security Now! #664 - 05-22-18 SpectreNG Revealed This week on Security Now! This week we examine the recent flaws discovered in the secure Signal messaging app for desktops, the rise in DNS router hijacking, another seriously flawed consumer router family, Microsoft Spectre patches for Win10's April 2018 feature update, the threat of voice assistant spoofing attacks, the evolving security of HTTP, still more new trouble with GPON routers, Facebook's Android app mistake, BMW's 14 security flaws and some fun miscellany. Then we examine the news of the next-generation of Spectre processor speculation flaws and what they mean for us. Our Picture of the Week Security News Update your Signal Desktop Apps for Windows & Linux A few weeks ago, Argentinian security researchers discovered a severe vulnerability in the Signal messaging app for Windows and Linux desktops that allows remote attackers to execute malicious code on recipient systems simply by sending a message—without requiring any user interaction. The vulnerability was accidentally discovered while researchers–amond them Juliano Rizzo–were chatting on Signal messenger and one of them shared a link of a vulnerable site with an XSS payload in its URL. However, the XSS payload unexpectedly got executed on the Signal desktop app!! (Juliano Rizzo was on the beach when the BEAST and CRIME attacks occurred to him.) After analyzing the scope of this issue by testing multiple XSS payloads, they found that the vulnerability resides in the function responsible for handling shared links, allowing attackers to inject user-defined HTML/JavaScript code via iFrame, image, video and audio tags.
    [Show full text]
  • Undergraduate Report
    UNDERGRADUATE REPORT Attack Evolution: Identifying Attack Evolution Characteristics to Predict Future Attacks by MaryTheresa Monahan-Pendergast Advisor: UG 2006-6 IINSTITUTE FOR SYSTEMSR RESEARCH ISR develops, applies and teaches advanced methodologies of design and analysis to solve complex, hierarchical, heterogeneous and dynamic problems of engineering technology and systems for industry and government. ISR is a permanent institute of the University of Maryland, within the Glenn L. Martin Institute of Technol- ogy/A. James Clark School of Engineering. It is a National Science Foundation Engineering Research Center. Web site http://www.isr.umd.edu Attack Evolution 1 Attack Evolution: Identifying Attack Evolution Characteristics To Predict Future Attacks MaryTheresa Monahan-Pendergast Dr. Michel Cukier Dr. Linda C. Schmidt Dr. Paige Smith Institute of Systems Research University of Maryland Attack Evolution 2 ABSTRACT Several approaches can be considered to predict the evolution of computer security attacks, such as statistical approaches and “Red Teams.” This research proposes a third and completely novel approach for predicting the evolution of an attack threat. Our goal is to move from the destructive nature and malicious intent associated with an attack to the root of what an attack creation is: having successfully solved a complex problem. By approaching attacks from the perspective of the creator, we will chart the way in which attacks are developed over time and attempt to extract evolutionary patterns. These patterns will eventually
    [Show full text]
  • Università Degli Studi Di Pisa
    Università degli Studi di Pisa DIPARTIMENTO DI INFORMATICA Corso di Laurea in Infor ati!a TESI DI LAUREA IDENTIF"ING AND REMO$IN# A%NORMAL TRAFFIC FROM T&E UCSD NET'OR( TELESCOPE Candidata) Relatore) Elif Beraat Izgordu Luca Deri Matricola: 491044 Anno A!!ademi!o *+,-.*+,/ Index , Introdu!tion 0 * Motivation and Related 'or1 - *2, UCSD Net3or1 Teles!ope 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 5 *2* Teles!ope Usage E6a ple 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 ,+ *27 IP Address Spoofing 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 ,* *20 Overloading Ca4ture Capa!it9 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 ,0 7 Ar!:ite!ture ,; 72, Colle!ted Statisti!s 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 ,/ 72,2, Port %ased Statisti!s 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 ,/ 72,2* S!anner Statisti!s 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 ,5 72,27 Receivers Statisti!s 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 ,< 72* Algorit: s and Data Stru!tures 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 ,< 0 I plementation ** 02, ndpiReader 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 ** 02* Original Contri=ution 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 ** 02*2, Statisti!s 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 *0 027 Memor9 Con!erns 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 */ 020 Filters 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 *5 0202, Filter for Pa!1et %urst 2 2 2 2 2 2 2 2 2 2 2 2 2
    [Show full text]
  • Cloud Down Impacts on the US Economy 02
    Emerging Risk Report 2018 Technology Cloud Down Impacts on the US economy 02 Lloyd’s of London disclaimer About Lloyd’s Lloyd's is the world's specialist insurance and This report has been co-produced by Lloyd's and AIR reinsurance market. Under our globally trusted name, for general information purposes only. While care has we act as the market's custodian. Backed by diverse been taken in gathering the data and preparing the global capital and excellent financial ratings, Lloyd's report Lloyd's does not make any representations or works with a global network to grow the insured world – warranties as to its accuracy or completeness and building resilience of local communities and expressly excludes to the maximum extent permitted by strengthening global economic growth. law all those that might otherwise be implied. With expertise earned over centuries, Lloyd's is the Lloyd's accepts no responsibility or liability for any loss foundation of the insurance industry and the future of it. or damage of any nature occasioned to any person as a Led by expert underwriters and brokers who cover more result of acting or refraining from acting as a result of, or than 200 territories, the Lloyd’s market develops the in reliance on, any statement, fact, figure or expression essential, complex and critical insurance needed to of opinion or belief contained in this report. This report underwrite human progress. does not constitute advice of any kind. About AIR Worldwide © Lloyd’s 2018 All rights reserved AIR Worldwide (AIR) provides risk modeling solutions that make individuals, businesses, and society more AIR disclaimer resilient to extreme events.
    [Show full text]
  • Analyzing Third Party Service Dependencies in Modern Web Services: Have We Learned from the Mirai-Dyn Incident?
    Analyzing Third Party Service Dependencies in Modern Web Services: Have We Learned from the Mirai-Dyn Incident? Aqsa Kashaf Vyas Sekar Yuvraj Agarwal Carnegie Mellon University Carnegie Mellon University Carnegie Mellon University [email protected] [email protected] [email protected] Abstract the Mirai Dyn attack [24], GlobalSign revocation error incident in Many websites rely on third parties for services (e.g., DNS, CDN, 2016 [21] and the Amazon DNS DDoS attack in 2019 [50] affected etc.). However, it also exposes them to shared risks from attacks a significant number of popular web services. These incidents raise (e.g., Mirai DDoS attack [24]) or cascading failures (e.g., GlobalSign broader questions about the robustness of the web ecosystem: • revocation error [21]). Motivated by such incidents, we analyze Are these singular occurrences or are there other types of third- the prevalence and impact of third-party dependencies, focusing party services that are also potential Achilles’ heels for affecting on three critical infrastructure services: DNS, CDN, and certificate popular web-services? For example, as services are concentrated, revocation checking by CA. We analyze both direct (e.g., Twitter is there a single provider whose failure will have a significant uses Dyn) and indirect (e.g., Netflix uses Symantec as CA which impact on many websites critically dependent on it? uses Verisign for DNS) dependencies. We also take two snapshots • Are there hidden transitive or indirect dependencies between in 2016 and 2020 to understand
    [Show full text]
  • GQ: Practical Containment for Measuring Modern Malware Systems
    GQ: Practical Containment for Measuring Modern Malware Systems Christian Kreibich Nicholas Weaver Chris Kanich ICSI & UC Berkeley ICSI & UC Berkeley UC San Diego [email protected] [email protected] [email protected] Weidong Cui Vern Paxson Microsoft Research ICSI & UC Berkeley [email protected] [email protected] Abstract their behavior, sometimes only for seconds at a time (e.g., to un- Measurement and analysis of modern malware systems such as bot- derstand the bootstrapping behavior of a binary, perhaps in tandem nets relies crucially on execution of specimens in a setting that en- with static analysis), but potentially also for weeks on end (e.g., to ables them to communicate with other systems across the Internet. conduct long-term botnet measurement via “infiltration” [13]). Ethical, legal, and technical constraints however demand contain- This need to execute malware samples in a laboratory setting ex- ment of resulting network activity in order to prevent the malware poses a dilemma. On the one hand, unconstrained execution of the from harming others while still ensuring that it exhibits its inher- malware under study will likely enable it to operate fully as in- ent behavior. Current best practices in this space are sorely lack- tended, including embarking on a large array of possible malicious ing: measurement researchers often treat containment superficially, activities, such as pumping out spam, contributing to denial-of- sometimes ignoring it altogether. In this paper we present GQ, service floods, conducting click fraud, or obscuring other attacks a malware execution “farm” that uses explicit containment prim- by proxying malicious traffic.
    [Show full text]
  • Lexisnexis® Congressional Copyright 2003 Fdchemedia, Inc. All Rights
    LexisNexis® Congressional Copyright 2003 FDCHeMedia, Inc. All Rights Reserved. Federal Document Clearing House Congressional Testimony September 10, 2003 Wednesday SECTION: CAPITOL HILL HEARING TESTIMONY LENGTH: 4090 words COMMITTEE: HOUSE GOVERNMENT REFORM SUBCOMMITTEE: TECHNOLOGY, INFORMATION POLICY, INTERGOVERNMENTAL RELATIONS, AND CENSUS HEADLINE: COMPUTER VIRUS PROTECTION TESTIMONY-BY: RICHARD PETHIA, DIRECTOR AFFILIATION: CERT COORDINATION CENTER BODY: Statement of Richard Pethia Director, CERT Coordination Center Subcommittee on Technology, Information Policy, Intergovernmental Relations, and the Census Committee on House Government Reform September 10, 2003 Introduction Mr. Chairman and Members of the Subcommittee: My name is Rich Pethia. I am the director of the CERTO Coordination Center (CERT/CC). Thank you for the opportunity to testify on the important issue of cyber security. Today I will discuss viruses and worms and the steps we must take to protect our systems from them. The CERT/CC was formed in 1988 as a direct result of the first Internet worm. It was the first computer security incident to make headline news, serving as a wake-up call for network security. In response, the CERT/CC was established by the Defense Advanced Research Projects Agency at Carnegie Mellon University's Software Engineering Institute, in Pittsburgh. Our mission is to serve as a focal point to help resolve computer security incidents and vulnerabilities, to help others establish incident response capabilities, and to raise awareness of computer security issues and help people understand the steps they need to take to better protect their systems. We activated the center in just two weeks, and we have worked hard to maintain our ability to react quickly.
    [Show full text]
  • Internet Infrastructure Review Vol.34
    Internet Infrastructure Review Mar.2017 Vol. 34 Infrastructure Security Ursnif (Gozi) Anti-Analysis Techniques and Methods for Bypassing Them Technology Trends The Current State of Library OSes Internet Infrastructure Review March 2017 Vol.34 Executive Summary ............................................................................................................................ 3 1. Infrastructure Security .................................................................................................................. 4 1.1 Introduction ..................................................................................................................................... 4 1.2 Incident Summary ........................................................................................................................... 4 1.3 Incident Survey ...............................................................................................................................11 1.3.1 DDoS Attacks ...................................................................................................................................11 1.3.2 Malware Activities ......................................................................................................................... 13 1.3.3 SQL Injection Attacks ..................................................................................................................... 17 1.3.4 Website Alterations .......................................................................................................................
    [Show full text]