Malicious Bots : an Inside Look Into the Cyber‑Criminal Underground of the Internet / Ken Dunham and Jim Melnick
Total Page:16
File Type:pdf, Size:1020Kb
An Inside Look into the Cyber-Criminal Underground of the Internet KEN DUNHAM JIM MELNICK Boca Raton London New York CRC Press is an imprint of the Taylor & Francis Group, an informa business AN AUERBACH BOOK Auerbach Publications Taylor & Francis Group 6000 Broken Sound Parkway NW, Suite 300 Boca Raton, FL 33487-2742 © 2009 by Taylor & Francis Group, LLC Auerbach is an imprint of Taylor & Francis Group, an Informa business No claim to original U.S. Government works Printed in the United States of America on acid-free paper 10 9 8 7 6 5 4 3 2 1 International Standard Book Number-13: 978-1-4200-6903-7 (Hardcover) This book contains information obtained from authentic and highly regarded sources. Reasonable efforts have been made to publish reliable data and information, but the author and publisher can- not assume responsibility for the validity of all materials or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint. Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers. For permission to photocopy or use material electronically from this work, please access www.copy- right.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that pro- vides licenses and registration for a variety of users. For organizations that have been granted a photocopy license by the CCC, a separate system of payment has been arranged. Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identification and explanation without intent to infringe. Library of Congress Cataloging-in-Publication Data Dunham, Ken. Malicious bots : an inside look into the cyber-criminal underground of the internet / Ken Dunham and Jim Melnick. p. cm. Includes bibliographical references and index. ISBN 978-1-4200-6903-7 (alk. paper) 1. Computer crimes--Case studies. 2. Internet. I. Melnick, Jim. II. Title. HV6773.D86 2008 364.16’8--dc22 2008010309 Visit the Taylor & Francis Web site at http://www.taylorandfrancis.com and the Auerbach Web site at http://www.auerbach-publications.com Dedication We give thanks to God, who makes all things possible: For all have sinned, and come short of the glory of God. Romans 3:23 For the wages of sin is death; but the gift of God is eternal life through Jesus Christ our Lord. Romans 6:23 God demonstrates His own love for us, in that while we were yet sinners Christ died for us! Romans 5:8 If you confess with your mouth Jesus as Lord, and believe in your heart that God raised Jesus from the dead, you shall be saved; for with the heart man believes, resulting in righteousness, and with the mouth he confesses, resulting in salvation. Romans 10:9–10 To our families, we thank you for your unconditional love and support, making this book possible. iii Contents Preface ............................................................................................................ix Acknowledgments and Permissions ...............................................................xi About the Authors .......................................................................................xiii 1 Introduction to Bots ...............................................................................1 2 Thr34t Security Krew and the TK Worm ...............................................7 2.1 The Investigation of the Thr34t Krew .................................................9 La n Ce M u e lle r 2.1.1 First DYn Dn S a ccount (BestIce) ........................................12 2.1.2 Second DYn Dn S a ccount (Phreeze) ...................................16 2.1.3 Third DYn Dn S a ccount (D00M) .......................................19 2.1.4 Seth Fogie .............................................................................21 2.1.5 Help with a dditional Technical Details ................................23 2.1.6 a Trip a cross the Pond..........................................................23 2.1.7 Sitexec ...................................................................................25 2.1.8 DiSice....................................................................................26 2.1.9 Xan iTH ...............................................................................28 2.1.10 Sitexec ...................................................................................30 2.1.11 Second Search Warrant Sweep ..............................................30 2.1.12 Jadaka ...................................................................................30 2.1.13 Mr40 .....................................................................................31 2.1.14 Thr34t Krew Investigation: Concluding Comments .............31 3 Demonstration: How a Hacker Launches a Botnet Attack ..................33 3.1 Step 1: Find, Modify, and Build a Bot ..............................................33 3.2 Step 2: Customize the Binary for a ttack ..........................................35 3.3 Step 3: Launch the a ttack ................................................................37 3.4 Step 4: Managing the Botherd ..........................................................37 3.5 Step 5: Payloads, with an e mphasis on “Pay”....................................39 i ◾ Contents 4 Introduction to the Use of Botnets in Criminal Activity .....................41 4.1 Timeline ...........................................................................................41 4.2 Bots: a Pathway to Criminalization of the Information a ge ........... 44 4.3 Bots: The Integrated Business Solution for Criminals .......................45 4.4 “Botmasters” Who Were Caught ..................................................... 46 4.4.1 International Botnet Task Force Conferences ........................47 4.4.2 Operation “Bot r oast” I and II .............................................47 4.5 How Big Do Botnets n eed to Be to Pose a Serious Threat? ..............48 4.6 Peering Inside the Ir C Botnet ..........................................................50 4.7 Post-Ir C-Based Bots ........................................................................50 4.7.1 Botnet a ttack Statistics .........................................................52 4.8 Botnet Features and the Criminal e nterprise ....................................54 4.8.1 a Modular a pproach to Botnets: a Major a id to Criminals ..............................................................................54 4.8.2 Granular Spreading Capabilities ...........................................55 4.8.3 a “Service Bot” .....................................................................55 4.8.4 The Degradation Feature of Botnets and Its Impact on Criminal a ctivity ..................................................................56 4.9 Botherds Through the e yes of a Criminal Mind ...............................57 4.10 Criminal Vectors u tilizing Bots .......................................................57 4.10.1 Theft of Sensitive Information ...............................................57 4.10.2 DDoS a ttacks and e xtortion ................................................58 4.10.3 Bot for r ent or Hire ............................................................. 60 4.10.4 Spam .....................................................................................63 4.11 Spam Bots and Criminalization ........................................................65 4.11.1 Pump-and-Dump Fraud ...................................................... 66 4.11.2 Covert Communications .......................................................67 4.11.3 Click Fraud and a ffiliate a buse ............................................68 4.11.4 a dware a buse .......................................................................69 4.11.5 Taking Out the Competition ................................................70 5 Botnets and the eCrime Cycle: The iSIGHT Partners’ Approach.........71 6 Technical Introduction to Bots ............................................................75 6.1 Common Ports .................................................................................75 6.2 Command and Control Strategies ....................................................76 6.2.1 Ir C C&C .............................................................................76 6.2.2 Peer-to-Peer C&C .................................................................79 6.2.3 Web-Based C&C ................................................................. 80 6.2.4 u se of e ncryption or Obfuscation ........................................ 84 6.2.5 Types of Distributed Denial of Service (DDoS) a ttacks .......85 6.2.6 Introduction to Selected Bots ................................................86 6.2.6.1 a goBot ..................................................................89 Contents ◾ ii 6.2.6.2 SDBot ...................................................................91