Anti-Bot Countermeasures in Japan
Total Page:16
File Type:pdf, Size:1020Kb
Joint Workshop on Security 2008, Tokyo Anti-Bot Countermeasures in Japan - Introducing Cyber Clean Center - 25 March 2008 Telecom-ISAC Japan Planning and Coordination Division K. Arimura Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved. What is Telecom-ISAC Japan? https://www.telecom-isac.jp/ ● ●Japan’sJapan’s first first ISAC ISAC established established in in July July 2002. 2002. ● ●MembersMembers including including telecommunicati telecommunicationsons carriers carriers collect, collect, analyze analyze and and share share informat informationion and and take take timelytimely measures measures to to ensure ensure trouble trouble free free and and stable stable op operationserations of of services. services. Pres. : KDDI Corp. Members The companies in green are ISPs and carriers. VP’s : NTT Communications Corp., NIFTY Corp. Members : NEC Corp., SOFTBANK TELECOM Corp., Internet Initiative Japan Inc., Hitachi, Ltd., z Cooperative Matsushita Electric Industrial Co., Ltd., Oki Electric Industry Co., Ltd., activities and SOFTBANK BB Corp., Yokogawa Electric Corp., Matsushita Electric Works, Ltd., information NIPPON TELEGRAPH AND TELEPHONE EAST Corp., sharing are NIPPON TELEGRAPH AND TELEPHONE WEST Corp., NTT VISUAL centered on COMMUNICATIONS Corp., KDDI R&D Laboratories, NEC BIGLOBE, Ltd. working NIPPON TELEGRAPH AND TELEPHONE Corp., FUJITSU LIMITED groups. Alliance members: Little eArth Corporation Co., Ltd., Intec NetCore Inc., Trend Micro Inc., z The color of T- ISAC-J IBM Japan Co., Ltd./ISS activities are Observers : Ministry of Internal Affairs and Communications, reflected in the National Institute of Information and Communications Technology, etc. WGs. z Responses to DDoS attacks z Wide area monitoring Main z Monitoring of BGP routing information activities of z Measures to counter Antinny WGs 9 Research and Investigation of infection by botnets in Japan 1 9 Measures to counter bot programs / Operation of the website CCC etc. Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved. Anti-bot Measures The Anti-bot Measures Project was launched in December 2006. ・Our portal site: Cyber Clean Center https://www.ccc.go.jp/ • Promotion and collaboration among 2 ministries (MIC and METI). • Organized by Telecom-ISAC Japan, JPCERT/CC and IPA. • Co-operation with 65 ISPs who are ISAC members (currently) and antivirus vendors in the anti-bot measures workflow. • From FY 2006 to 2010 • Main objectives: To reduce the number of bot-infected users To make removal tools that specialize in bots that are widespread in Japan To provide specimens to security vendors participating in the project. 2 Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved. Bots in Japan: Survey Results About 80% of malware programs The estimated infection rate is observed on Japanese telecom 2%-2.5% networks are classified as bot Equivalent to 400k - 500k programs people (computers) 【Estimate from the results of studies by T-ISAC-J and JPCERT/CC in 2005】 【Estimate from the results of studies by T-ISAC-J and JPCERT/CC in 2005】 It takes about 4 minutes on About 100 types of bots are average for an unprotected captured in our honey-pot as PC to be infected when connected to the Internet. unknown types per day. 【Number of bot programs with unique hash 【From experiments conducted by T-ISAC-J and capturing by CCC】 JPCERT/CC in 2005】 And z It was revealed that traffic caused by botnets or viruses tops 300Mbps per IP. z A total of around 10Gbps of traffic from Japanese IP addresses are 3 wasted by botnets. (SPAM mail traffic via botnets are not included.) Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved. Why Countermeasures against Bot-infected Users? Herder (originator) C&C server (IRC server) Bot (Bot-infected PC) What should countermeasures target? ×× ○ ● ●Herders are difficult to Servers are located mainly ● Detect bot-infected PCs in locate. outside Japan. order to contact and alert ●Dealing with herders is the ● In some countries, C&C the PC users about bot workYes, of law enforcement It is serversThe are reason subject to infection,Yes, and urgeWE them to agencies. monitoring in order to take steps for bot-removal. ● Users must know how to ●It is believed to fall outside capture criminals. ● prevent re-infection and the scopeLEA’s of ISP operations. The situationwe are is like a cat- can take and-mouse game, since new increase their knowledge level regarding bots. C&C servers will appear after Job! ● Make careit harder toof be being upgradedhere! from bots infected by bots in Japan so every time current servers that users can connect their are eliminated. PCs to thethis! Internet at ease. ● Nevertheless, we want to ● It is absolutely necessary to use eliminate C&C servers in HoneyPots to collect bots and 4 Japan. locate infected PCs! Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved. Workflow for Countermeasures against Bot-infected Users [Reference 2] ISP ・・ ・・ ④Requesting ⑥Sending e-mail for alerting identification of about infection and infected PCs urging removal of bots ⑤Identifying infected PCs Cyber Clean Center Bot-infected PCs (Users of participating ISPs) ・・ Analysis InternetInternet !! Honey- ①Infection activities pots ⑦Accessing the ②Detection of infection countermeasures activities Capture of bot website analytes Counter- Analytes and measures ⑧Downloading the bot- [Reference 3] related information removal tools website ・・ Bot-infected PCs (General users) Accessing the disclosure website Disclosure ③ [Reference 1] Preparation of bot 5 website removal tools Downloading the bot-removal tools Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved. Roles of Three Organizations Cyber Clean Center Steering Committee (CCC-SC) Bot countermeasure system Bot countermeasure program Bot infection prevention operation group Organized by analysis group Organized by promotion group Organized by Bot specimens captured SuperSuper Bot specimens shared honeypotshoneypots InternetInternet Bot specimens collected SecuritySecurity VendorsVendors Removal tool creation Anti-virus products updated to provide Analysis of bot (CCC Cleaner) protection specimens Removal tool provided BotBot-removal-removal tooltool distributiondistribution Pattern files Operation test of removal tool sitesite provided to anti- virus customers InfectedInfected usersusers 6 ISP General users Notification of bot infection ISP General users Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved. CCC Public Site (Image) [Reference 1] Japanese Version http://www.ccc.go.jp/ Website for the public 7 English Version Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved. Security Alert E-mail Text (Image) [Reference 2] Subject: 【重要】悪性プログラム(BOT)駆除のお願い あんしん太郎様 平素はAnshin-Netをご利用いただき誠にありがとうございます。 セキュリティ担当 ○○と申します。 総務省・経済産業省の連携プロジェクトである「サイバークリーンセンター (以下、CCC)」より、ボット(BOT)※1感染者からの感染活動に伴う通信が検出 されたため、感染者に対しBOTの駆除を案内して欲しいとの連絡が弊社に寄せられました。 そのため、弊社においてCCCからの情報をもとに感染活動を実施しているOCN回線 を確認したところ、ご契約の回線(お客さま番号「${ISP_CUSTOMER_ID}」)であ ることが判明いたしました。 ボットは他のお客様に感染を広げるだけではなくお客様のパソコン内の情報を外 部に流出させる恐れもある非常に悪質なウイルスです。 Tracking ID つきましては、下記のボット対策サイトへアクセス後、サイト内の手順に従って ボット駆除の実施や再発防止の実施をお願い申し上げます。 given to each対応が完了しましたら、サイト内に設置された対策完了ボタンを押して頂くこと user で、弊社でもお客様の対策実施状況が確認できますので、ご協力お願い申し上げ ます。 To ■ボット(BOT)対策サイト ━━━━━━━━━━━━━━━━━━━━━━ Counter- https://taisaku.ccc.go.jp/7a4ckxkk3hakf2mf77t9c9iz9CLICK ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ measures |対策後は必ずサイト上で完了連絡をしていただきますようお願いいたします。 site |なお完了連絡がない場合は再度ご案内させていただくことがございます。 8 ~以下省略~ Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved. CCC Countermeasures Site [Reference 3] From the alert e-mail The Tracking ID [Step3] Results of running cleaner are displayed and sent to CCC + ①Survey Number of files Number of files searched cleaned Number of files number of files not cleaned infected by 【Step1】 viruses 【Step2】 + ②Bot-removal status ③ List of malware causing infection 9 [Sending Results of Running CCC Cleaner] Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved. Dec. 2006 - Jan. 2008 Results of CCC’s Activities (except for some data) ①① TotalTotal numbernumber ofof specimensspecimens ②②NumberNumber ofof uniuniqueque specimensspecimens::159,683159,683 ③③ NumberNumber ofof unknownunknown collected:collected: 6,534,8446,534,844 [Since[Since aa numbernumber ofof thethe specimensspecimens specimensspecimens::8,3778,377 [Specimens,[Specimens, suchsuch asas botbot collectedcollected areare thethe same,same, thosethose thatthat areare [Unique[Unique specimensspecimens areare programsprograms (binary(binary files)files) are are identicalidentical inin sizesize andand externalexternal examinedexamined usingusing collectedcollected fromfrom amongamong thethe characteristicscharacteristics areare removedremoved toto separateseparate commercialcommercial anti-virusanti-virus countlesscountless attacksattacks onon the the "honey-"honey- uniqueunique specimensspecimens (binary(binary files).]files).] software,software, thenthen thosethose thatthat pot.“]pot.“] areare undetectableundetectable are are separated.]separated.] ISP ⑥⑥ SecuritySecurity alerts:alerts: 6 Security alert e-mail Infected PC’s IP list ④Number of 197,035197,035 timestimes ・・・・ ④Number of specimens reflected [This[This isis thethe numbernumber Analysis of specimens reflected ofof securitysecurity alertsalerts thatthat source attacking inin removalremoval tools:tools: PCs infected by ・・ 6,915 cooperatingcooperating ISPsISPs Bot Programs 1 2 Isolation 6,915 providedprovided toto infectedinfected Supper [Unknown[Unknown specimensspecimens are are users.]users.] !!