A Historical Evaluation of C&C Complexity

Total Page:16

File Type:pdf, Size:1020Kb

A Historical Evaluation of C&C Complexity Rochester Institute of Technology RIT Scholar Works Theses Thesis/Dissertation Collections 2012 A Historical evaluation of C&C complexity Conzetti Finocchiaro Follow this and additional works at: http://scholarworks.rit.edu/theses Recommended Citation Finocchiaro, Conzetti, "A Historical evaluation of C&C complexity" (2012). Thesis. Rochester Institute of Technology. Accessed from This Thesis is brought to you for free and open access by the Thesis/Dissertation Collections at RIT Scholar Works. It has been accepted for inclusion in Theses by an authorized administrator of RIT Scholar Works. For more information, please contact [email protected]. A Historical Evaluation of C&C Complexity By Conzetti N. Finocchiaro Committee Members Dr. Peter Lutz Dr. Jim Leone Dr. Bo Yuan Thesis submitted in partial fulfillment of the requirements for the degree of Master of Science in Networking and System Administration Rochester Institute of Technology B. Thomas Golisano College of Computing and Information Sciences August 20, 2012 Rochester Institute of Technology B. Thomas Golisano College of Computing and Information Sciences Master of Science in Networking and System Administration Thesis Approval Form Student Name: Conzetti Finocchiaro Thesis Title: A Historical Evaluation of C&C Complexity Thesis Committee Name Signature Date Peter Lutz Chair Jim Leone Committee Member Bo Yuan Committee Member Table of Contents Abstract .................................................................................................................................................................... 1 1. Introduction ........................................................................................................................................................ 1 2. Related Work &Background .............................................................................................................................. 4 2.1 Related Work ............................................................................................................................................... 4 2.1.1 Botnet Detection ................................................................................................................................... 4 2.1.2 Botnet Evaluation ................................................................................................................................. 5 2.2 Botnet C&C Architecture ............................................................................................................................. 5 2.2.1 Centralized Architecture ........................................................................................................................ 6 2.2.2 Decentralized Architecture ..................................................................................................................... 7 2.3 Botnet Selections & Overview ..................................................................................................................... 9 2.3.1 Agobot .................................................................................................................................................. 9 2.3.2 Asprox .................................................................................................................................................. 9 2.3.3 Bagle .................................................................................................................................................. 10 2.3.4 Bobax ................................................................................................................................................. 10 2.3.5 Conficker ............................................................................................................................................ 10 2.3.6 iKee .................................................................................................................................................... 10 2.3.7 GTbot ................................................................................................................................................. 10 2.3.8 Nugache.............................................................................................................................................. 11 2.3.9 Peacomm ............................................................................................................................................ 11 2.3.10 Phatbot ............................................................................................................................................. 11 2.3.11 SDbot ............................................................................................................................................... 11 2.3.12 Sinit .................................................................................................................................................. 11 2.3.13 Waledac ............................................................................................................................................ 11 2.3.14 Zeus .................................................................................................................................................. 12 3. Evaluation Methodology .................................................................................................................................. 12 3.1 Manual C&C Evaluation Tools & Processes ............................................................................................. 12 3.1.1 Infection Point .................................................................................................................................... 12 3.1.2 Imaging .............................................................................................................................................. 13 3.1.3 Packet Analysis .................................................................................................................................. 13 3.1.4 Evaluation Criteria ............................................................................................................................. 13 3.2 Lab Topology ............................................................................................................................................. 14 3.3 Botnet C&C Evaluation ............................................................................................................................. 14 i 3.3.1 Agobot ................................................................................................................................................ 15 3.3.2 Asprox ................................................................................................................................................ 16 3.3.3 Bagle .................................................................................................................................................. 18 3.3.4 Bobax ................................................................................................................................................. 19 3.3.5 Conficker ............................................................................................................................................ 20 3.3.6 iKee .................................................................................................................................................... 21 3.3.7 GTbot ................................................................................................................................................. 22 3.3.8 Nugache.............................................................................................................................................. 23 3.3.9 Peacomm ............................................................................................................................................ 24 3.3.10 Phatbot ............................................................................................................................................. 25 3.3.11 SDbot ............................................................................................................................................... 26 3.3.12 Sinit .................................................................................................................................................. 27 3.3.13 Waledac ............................................................................................................................................ 28 3.3.14 Zeus .................................................................................................................................................. 29 3.4 Complexity Matrix ..................................................................................................................................... 31 3.4.1 C&C Characteristic Definitions ......................................................................................................... 32 4. Historical Data ................................................................................................................................................. 34 4.1 Complexity Score ....................................................................................................................................... 34 5. Limitations & Future Work.............................................................................................................................. 35 6. Conclusion ......................................................................................................................................................
Recommended publications
  • Synthesizing Near-Optimal Malware Specifications from Suspicious
    Synthesizing Near-Optimal Malware Specifications from Suspicious Behaviors Somesh Jha∗, Matthew Fredrikson∗, Mihai Christodoresu†, Reiner Sailer‡, Xifeng Yan§ ∗University of Wisconsin–Madison, †Qualcomm Research Silicon Valley, ‡IBM T.J Watson Research Center, §University of California–Santa Barbara Abstract—Behavior-based detection techniques are a promis- and errors. ing solution to the problem of malware proliferation. However, We make the observation that behavioral specifications they require precise specifications of malicious behavior that do not result in an excessive number of false alarms, while still are best viewed as a form of discriminative specification.A remaining general enough to detect new variants before tradi- discriminative specification describes the unique properties tional signatures can be created and distributed. In this paper, of a given class, in contrast to the properties exhibited by we present an automatic technique for extracting optimally discriminative specifications a second mutually-exclusive class. This paper presents an , which uniquely identify a class automated technique that combines program analysis, graph of programs. Such a discriminative specification can be used by a behavior-based malware detector. Our technique, based mining, and stochastic optimization to synthesize malware on graph mining and stochastic optimization, scales to large behavior specifications. We represent program behaviors as classes of programs. When this work was originally published, graphs that are mined for discriminative patterns. As there the technique yielded favorable results on malware targeted are many ways in which malware can accomplish the same towards workstations (~86% detection rates on new malware). goal, we use these patterns as building blocks for construct- We believe that it can be brought to bear on emerging malware- based threats for new platforms, and discuss several promising ing discriminative specifications that are general across vari- avenues for future work in this direction.
    [Show full text]
  • Cyber Warfare a “Nuclear Option”?
    CYBER WARFARE A “NUCLEAR OPTION”? ANDREW F. KREPINEVICH CYBER WARFARE: A “NUCLEAR OPTION”? BY ANDREW KREPINEVICH 2012 © 2012 Center for Strategic and Budgetary Assessments. All rights reserved. About the Center for Strategic and Budgetary Assessments The Center for Strategic and Budgetary Assessments (CSBA) is an independent, nonpartisan policy research institute established to promote innovative thinking and debate about national security strategy and investment options. CSBA’s goal is to enable policymakers to make informed decisions on matters of strategy, secu- rity policy and resource allocation. CSBA provides timely, impartial, and insight- ful analyses to senior decision makers in the executive and legislative branches, as well as to the media and the broader national security community. CSBA encour- ages thoughtful participation in the development of national security strategy and policy, and in the allocation of scarce human and capital resources. CSBA’s analysis and outreach focus on key questions related to existing and emerging threats to US national security. Meeting these challenges will require transforming the national security establishment, and we are devoted to helping achieve this end. About the Author Dr. Andrew F. Krepinevich, Jr. is the President of the Center for Strategic and Budgetary Assessments, which he joined following a 21-year career in the U.S. Army. He has served in the Department of Defense’s Office of Net Assessment, on the personal staff of three secretaries of defense, the National Defense Panel, the Defense Science Board Task Force on Joint Experimentation, and the Defense Policy Board. He is the author of 7 Deadly Scenarios: A Military Futurist Explores War in the 21st Century and The Army and Vietnam.
    [Show full text]
  • The Botnet Chronicles a Journey to Infamy
    The Botnet Chronicles A Journey to Infamy Trend Micro, Incorporated Rik Ferguson Senior Security Advisor A Trend Micro White Paper I November 2010 The Botnet Chronicles A Journey to Infamy CONTENTS A Prelude to Evolution ....................................................................................................................4 The Botnet Saga Begins .................................................................................................................5 The Birth of Organized Crime .........................................................................................................7 The Security War Rages On ........................................................................................................... 8 Lost in the White Noise................................................................................................................. 10 Where Do We Go from Here? .......................................................................................................... 11 References ...................................................................................................................................... 12 2 WHITE PAPER I THE BOTNET CHRONICLES: A JOURNEY TO INFAMY The Botnet Chronicles A Journey to Infamy The botnet time line below shows a rundown of the botnets discussed in this white paper. Clicking each botnet’s name in blue will bring you to the page where it is described in more detail. To go back to the time line below from each page, click the ~ at the end of the section. 3 WHITE
    [Show full text]
  • An Analysis of the Asprox Botnet
    An Analysis of the Asprox Botnet Ravishankar Borgaonkar Technical University of Berlin Email: [email protected] Abstract—The presence of large pools of compromised com- motives. Exploitable vulnerabilities may exist in the Internet puters, also known as botnets, or zombie armies, represents a infrastructure, in the clients and servers, in the people, and in very serious threat to Internet security. This paper describes the way money is controlled and transferred from the Internet the architecture of a contemporary advanced bot commonly known as Asprox. Asprox is a type of malware that combines into traditional cash. Many security firms and researchers are the two threat vectors of forming a botnet and of generating working on developing new methods to fight botnets and to SQL injection attacks. The main features of the Asprox botnet mitigate against threats from botnets [7], [8], [9]. are the use of centralized command and control structure, HTTP based communication, use of advanced double fast-flux service Unfortunately, there are still many questions that need to networks, use of SQL injection attacks for recruiting new bots be addressed to find effective ways of protecting against the and social engineering tricks to spread malware binaries. The threats from botnets. In order to fight against botnets in future, objective of this paper is to contribute to a deeper understanding of Asprox in particular and a better understanding of modern it is not enough to study the botnets of past. Botnets are botnet designs in general. This knowledge can be used to develop constantly evolving, and we need to understand the design more effective methods for detecting botnets, and stopping the and structure of the emerging advanced botnets.
    [Show full text]
  • Iptrust Botnet / Malware Dictionary This List Shows the Most Common Botnet and Malware Variants Tracked by Iptrust
    ipTrust Botnet / Malware Dictionary This list shows the most common botnet and malware variants tracked by ipTrust. This is not intended to be an exhaustive list, since new threat intelligence is always being added into our global Reputation Engine. NAME DESCRIPTION Conficker A/B Conficker A/B is a downloader worm that is used to propagate additional malware. The original malware it was after was rogue AV - but the army's current focus is undefined. At this point it has no other purpose but to spread. Propagation methods include a Microsoft server service vulnerability (MS08-067) - weakly protected network shares - and removable devices like USB keys. Once on a machine, it will attach itself to current processes such as explorer.exe and search for other vulnerable machines across the network. Using a list of passwords and actively searching for legitimate usernames - the ... Mariposa Mariposa was first observed in May 2009 as an emerging botnet. Since then it has infected an ever- growing number of systems; currently, in the millions. Mariposa works by installing itself in a hidden location on the compromised system and injecting code into the critical process ͞ĞdžƉůŽƌĞƌ͘ĞdžĞ͘͟/ƚŝƐknown to affect all modern Windows versions, editing the registry to allow it to automatically start upon login. Additionally, there is a guard that prevents deletion while running, and it automatically restarts upon crash/restart of explorer.exe. In essence, Mariposa opens a backdoor on the compromised computer, which grants full shell access to ... Unknown A botnet is designated 'unknown' when it is first being tracked, or before it is given a publicly- known common name.
    [Show full text]
  • Computer Security Fundamentals Third Edition
    Computer Security Fundamentals Third Edition Chuck Easttom 800 East 96th Street, Indianapolis, Indiana 46240 USA Computer Security Fundamentals, Third Edition Executive Editor Brett Bartow Copyright © 2016 by Pearson Education, Inc. All rights reserved. No part of this book shall be reproduced, stored in a retrieval system, or Acquisitions Editor transmitted by any means, electronic, mechanical, photocopying, recording, or otherwise, Betsy Brown without written permission from the publisher. No patent liability is assumed with respect Development Editor to the use of the information contained herein. Although every precaution has been taken in Christopher Cleveland the preparation of this book, the publisher and author assume no responsibility for errors or omissions. Nor is any liability assumed for damages resulting from the use of the information Managing Editor contained herein. Sandra Schroeder ISBN-13: 978-0-7897-5746-3 ISBN-10: 0-7897-5746-X Senior Project Editor Tonya Simpson Library of Congress control number: 2016940227 Copy Editor Printed in the United States of America Gill Editorial Services First Printing: May 2016 Indexer Brad Herriman Trademarks All terms mentioned in this book that are known to be trademarks or service marks have Proofreader been appropriately capitalized. Pearson IT Certification cannot attest to the accuracy of this Paula Lowell information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark. Technical Editor Dr. Louay Karadsheh Warning and Disclaimer Publishing Coordinator Every effort has been made to make this book as complete and as accurate as possible, but Vanessa Evans no warranty or fitness is implied.
    [Show full text]
  • C&C Botnet Detection Over
    C&C Botnet Detection over SSL Riccardo Bortolameotti University of Twente - EIT ICT Labs masterschool [email protected] Dedicated to my parents Remo and Chiara, and to my sister Anna 2 Abstract Nowadays botnets are playing an important role in the panorama of cyber- crime. These cyber weapons are used to perform malicious activities such fi- nancial frauds, cyber-espionage, etc... using infected computers. This threat can be mitigated by detecting C&C channels on the network. In literature many solutions have been proposed. However, botnet are becoming more and more complex, and currently they are trying to move towards encrypted solutions. In this work, we have designed, implemented and validated a method to detect botnet C&C communication channels over SSL, the se- curity protocol standard de-facto. We provide a set of SSL features that can be used to detect malicious connections. Using our features, the results indicate that we are able to detect, what we believe to be, a botnet and ma- licious connections. Our system can also be considered privacy-preserving and lightweight, because the payload is not analyzed and the portion of an- alyzed traffic is very small. Our analysis also indicates that 0.6% of the SSL connections were broken. Limitations of the system, its applications and possible future works are also discussed. 3 4 Contents 1 Introduction 7 1.1 Problem Statement . .9 1.2 Research questions . 10 1.2.1 Layout of the thesis . 11 2 State of the Art 13 2.1 Preliminary concepts . 13 2.1.1 FFSN .
    [Show full text]
  • Emerging Threats and Attack Trends
    Emerging Threats and Attack Trends Paul Oxman Cisco Security Research and Operations PSIRT_2009 © 2009 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Agenda What? Where? Why? Trends 2008/2009 - Year in Review Case Studies Threats on the Horizon Threat Containment PSIRT_2009 © 2009 Cisco Systems, Inc. All rights reserved. Cisco Public 2 What? Where? Why? PSIRT_2009 © 2009 Cisco Systems, Inc. All rights reserved. Cisco Public 3 What? Where? Why? What is a Threat? A warning sign of possible trouble Where are Threats? Everywhere you can, and more importantly cannot, think of Why are there Threats? The almighty dollar (or euro, etc.), the underground cyber crime industry is growing with each year PSIRT_2009 © 2009 Cisco Systems, Inc. All rights reserved. Cisco Public 4 Examples of Threats Targeted Hacking Vulnerability Exploitation Malware Outbreaks Economic Espionage Intellectual Property Theft or Loss Network Access Abuse Theft of IT Resources PSIRT_2009 © 2009 Cisco Systems, Inc. All rights reserved. Cisco Public 5 Areas of Opportunity Users Applications Network Services Operating Systems PSIRT_2009 © 2009 Cisco Systems, Inc. All rights reserved. Cisco Public 6 Why? Fame Not so much anymore (more on this with Trends) Money The root of all evil… (more on this with the Year in Review) War A battlefront just as real as the air, land, and sea PSIRT_2009 © 2009 Cisco Systems, Inc. All rights reserved. Cisco Public 7 Operational Evolution of Threats Emerging Threat Nuisance Threat Threat Evolution Unresolved Threat Policy and Process Reactive Process Socialized Process Formalized Process Definition Reaction Mitigation Technology Manual Process Human “In the Automated Loop” Response Evolution Burden Operational End-User “Help-Desk” Aware—Know End-User No End-User Increasingly Self- Awareness Knowledge Enough to Call Burden Reliant Support PSIRT_2009 © 2009 Cisco Systems, Inc.
    [Show full text]
  • Zerohack Zer0pwn Youranonnews Yevgeniy Anikin Yes Men
    Zerohack Zer0Pwn YourAnonNews Yevgeniy Anikin Yes Men YamaTough Xtreme x-Leader xenu xen0nymous www.oem.com.mx www.nytimes.com/pages/world/asia/index.html www.informador.com.mx www.futuregov.asia www.cronica.com.mx www.asiapacificsecuritymagazine.com Worm Wolfy Withdrawal* WillyFoReal Wikileaks IRC 88.80.16.13/9999 IRC Channel WikiLeaks WiiSpellWhy whitekidney Wells Fargo weed WallRoad w0rmware Vulnerability Vladislav Khorokhorin Visa Inc. Virus Virgin Islands "Viewpointe Archive Services, LLC" Versability Verizon Venezuela Vegas Vatican City USB US Trust US Bankcorp Uruguay Uran0n unusedcrayon United Kingdom UnicormCr3w unfittoprint unelected.org UndisclosedAnon Ukraine UGNazi ua_musti_1905 U.S. Bankcorp TYLER Turkey trosec113 Trojan Horse Trojan Trivette TriCk Tribalzer0 Transnistria transaction Traitor traffic court Tradecraft Trade Secrets "Total System Services, Inc." Topiary Top Secret Tom Stracener TibitXimer Thumb Drive Thomson Reuters TheWikiBoat thepeoplescause the_infecti0n The Unknowns The UnderTaker The Syrian electronic army The Jokerhack Thailand ThaCosmo th3j35t3r testeux1 TEST Telecomix TehWongZ Teddy Bigglesworth TeaMp0isoN TeamHav0k Team Ghost Shell Team Digi7al tdl4 taxes TARP tango down Tampa Tammy Shapiro Taiwan Tabu T0x1c t0wN T.A.R.P. Syrian Electronic Army syndiv Symantec Corporation Switzerland Swingers Club SWIFT Sweden Swan SwaggSec Swagg Security "SunGard Data Systems, Inc." Stuxnet Stringer Streamroller Stole* Sterlok SteelAnne st0rm SQLi Spyware Spying Spydevilz Spy Camera Sposed Spook Spoofing Splendide
    [Show full text]
  • Downloading and Running
    City Research Online City, University of London Institutional Repository Citation: Meng, X. (2018). An integrated networkbased mobile botnet detection system. (Unpublished Doctoral thesis, City, Universtiy of London) This is the accepted version of the paper. This version of the publication may differ from the final published version. Permanent repository link: https://openaccess.city.ac.uk/id/eprint/19840/ Link to published version: Copyright: City Research Online aims to make research outputs of City, University of London available to a wider audience. Copyright and Moral Rights remain with the author(s) and/or copyright holders. URLs from City Research Online may be freely distributed and linked to. Reuse: Copies of full items can be used for personal research or study, educational, or not-for-profit purposes without prior permission or charge. Provided that the authors, title and full bibliographic details are credited, a hyperlink and/or URL is given for the original metadata page and the content is not changed in any way. City Research Online: http://openaccess.city.ac.uk/ [email protected] AN INTEGRATED NETWORK- BASED MOBILE BOTNET DETECTION SYSTEM Xin Meng Department of Computer Science City, University of London This dissertation is submitted for the degree of Doctor of Philosophy City University London June 2017 Declaration I hereby declare that except where specific reference is made to the work of others, the contents of this dissertation are original and have not been submitted in whole or in part for consideration for any other degree or qualification in this, or any other University. This dissertation is the result of my own work and includes nothing which is the outcome of work done in collaboration, except where specifically indicated in the text.
    [Show full text]
  • City Research Online
    City Research Online City, University of London Institutional Repository Citation: Acarali, D., Rajarajan, M., Komninos, N. and Herwono, I. (2016). Survey of Approaches and Features for the Identification of HTTP-Based Botnet Traffic. Journal of Network and Computer Applications, doi: 10.1016/j.jnca.2016.10.007 This is the accepted version of the paper. This version of the publication may differ from the final published version. Permanent repository link: https://openaccess.city.ac.uk/id/eprint/15580/ Link to published version: http://dx.doi.org/10.1016/j.jnca.2016.10.007 Copyright: City Research Online aims to make research outputs of City, University of London available to a wider audience. Copyright and Moral Rights remain with the author(s) and/or copyright holders. URLs from City Research Online may be freely distributed and linked to. Reuse: Copies of full items can be used for personal research or study, educational, or not-for-profit purposes without prior permission or charge. Provided that the authors, title and full bibliographic details are credited, a hyperlink and/or URL is given for the original metadata page and the content is not changed in any way. City Research Online: http://openaccess.city.ac.uk/ [email protected] Journal Logo 00 (2016) 1{19 Survey of Approaches and Features for the Identification of HTTP-Based Botnet Traffic Dilara Acaralia, Muttukrishnan Rajarajana, Nikos Komninosa, Ian Herwonob aSchool of Engineering and Mathematical Science, City University London, London, United Kingdom. bSecurity Futures Practice, Research & Innovation, British Telecom, Ipswich IP5 3RE, United Kingdom. Abstract Botnet use is on the rise, with a growing number of botmasters now switching to the HTTP-based C&C infrastructure.
    [Show full text]
  • Executive Summary a High-Performance Preventive Security System Protects Your Network from Infections
    A Multi-Layered Approach W H I T E P A P ER to Preventing Viruses Executive Summary A high-performance preventive security system protects your network from infections. As virus writers create increasingly sophisticated malicious code and find TABLE OF CONTENTS ever more effective methods to propagate, enterprises find themselves 1 Executive Summary scrambling to keep their networks, servers, and end-user computers safe from new threats. 2 Emerging Anti-Virus Strategies 3 A Comprehensive Approach Traditional anti-virus applications work by searching the contents of files Global Traffic Data 3 and looking for a recognized pattern of data (a “signature”) that is the virus Threat Operations Center 4 Dynamic Quarantining 4 program itself. However, virus writers have come up with various methods The Essence of Time 5 to escape detection by changing their programs, making it harder for virus 6 IronPort Systems Email Security scanners to recognize them as viruses. Today’s viruses are either polymor- Solutions phic or metamorphic and can actually change themselves as they propagate. 7 Appendix: The Sober Virus/ The increasing sophistication of malicious code is therefore making pattern Worm/Trojan recognition technologies less and less effective. This decline in effective virus defense is taking a toll on businesses. The often long delay between the time when a virus attack is launched and when a signature is available can result in hundreds of thousands of infected mes- sages being delivered to enterprise networks and communities of ISP users. Even when the end effects of the virus are minimal, such widespread infec- tion results in major costs.
    [Show full text]