Reliable Recon in Adversarial Peer-to-Peer Botnets Dennis Andriesse Christian Rossow Herbert Bos VU University Amsterdam Saarland University, Germany VU University Amsterdam The Netherlands [email protected] The Netherlands [email protected] saarland.de [email protected] ABSTRACT sinkholing, which target all bots in the network [28]. Due The decentralized nature of Peer-to-Peer (P2P) botnets pre- to the high resilience of P2P botnet architectures, many cludes traditional takedown strategies, which target dedi- high-profile botnets have migrated from centralized to P2P cated command infrastructure. P2P botnets replace this networks. Among the most resilient of these are Sality [10] infrastructure with command channels distributed across and P2P (GameOver) Zeus [2]. the full infected population. Thus, mitigation strongly re- The recent takedown of GameOver Zeus underscores the lies on accurate reconnaissance techniques which map the resilience of botnets like these. This notorious banking trojan botnet population.While prior work has studied passive dis- has been active since 2011, and has survived despite multiple turbances to reconnaissance accuracy —such as IP churn intensive sinkholing efforts [28, 4], until finally being crippled and NAT gateways—, the same is not true of active anti- in May 2014, following a massive collaboration between the reconnaissance attacks. This work shows that active attacks FBI, VU University Amsterdam, Saarland University, Crowd- against crawlers and sensors occur frequently in major P2P strike, Dell SecureWorks, and other agencies, universities and botnets. Moreover, we show that current crawlers and sen- malware analysis labs [5, 3]. sors in the Sality and Zeus botnets produce easily detectable Attacks against botnets like these are fundamentally based anomalies, making them prone to such attacks. Based on on knowledge about the composition of the botnet [28]. For our findings, we categorize and evaluate vectors for stealthier instance, sinkholing attacks disrupt C2 connections between and more reliable P2P botnet reconnaissance. bots, and thus require a view of the botnet connectivity graph. Similarly, banks use P2P botnet mappings to identify infected customers, and several nations are currently setting Categories and Subject Descriptors up centralized repositories for reporting infected IPs [31]. D.4.6 [Operating Systems]: Security and Protection—In- Knowledge about the nodes in a botnet and the connections vasive Software; C.2.0 [Computer-Communication Net- between them is obtained using intelligence gathering (recon- works]: General—Security and Protection naissance/recon) techniques. Reliable recon techniques for P2P botnets are thus crucial for both invasive attacks (e.g., General Terms sinkholing) and non-invasive countermeasures (e.g., infection notifications). All recent P2P botnet takedowns required Security accurate recon, including the ZeroAccess and GameOver Zeus attacks [5, 3, 22, 35, 19]. Note that connectivity graph- Keywords agnostic Sybil attacks, which could effectively disrupt early DHT-based P2P botnets [6], are not effective against modern Peer-to-Peer Botnet, Crawling, Reconnaissance unstructured networks like Sality and Zeus, which use dense, dynamic connectivity graphs to propagate signed commands 1. INTRODUCTION between bots. The decentralized nature of Peer-to-Peer (P2P) botnet To maximize the reliability of reconnaissance results, prior architectures eliminates the need for centralized Command- work has studied a myriad of passive disruptive factors, such and-Control (C2) servers. As a result, P2P botnets are im- as bots behind NAT gateways and IP address aliasing [28, mune to traditional takedown strategies, designed to disrupt 17]. In contrast, very little attention has been devoted in the centralized C2 channels. Instead, takedown efforts against literature to the hardening of recon against active disruption P2P botnets require large-scale distributed attacks, such as by botnet operators. We believe this issue calls for closer analysis, as botmas- Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed ters increasingly implement active anti-recon strategies in for profit or commercial advantage and that copies bear this notice and the full citation P2P botnets, largely in response to recent successful take- on the first page. Copyrights for components of this work owned by others than the downs. These upcoming anti-recon strategies are aimed at author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or compromising the intelligence gathered by malware analysts republish, to post on servers or to redistribute to lists, requires prior specific permission in P2P botnets, using attacks such as (automatic) black- and/or a fee. Request permissions from [email protected]. listing [2], reputation schemes [10], and even DDoS against IMC’15 , October 28-30 2015, Tokyo, Japan Copyright is held by the owner/author(s). Publication rights licensed to ACM. recon nodes [4]. Botmasters use anti-recon strategies to aug- ACM 978-1-4503-3848-6/15/10 ...$15.00. ment previously disabled botnets, and redeploy hardened DOI: http://dx.doi.org/10.1145/2815675.2815682. 129 versions of them, which are more difficult to take down. For a instance, the Hlux botnet has already respawned three times, each time with additional hardening strategies [35, 19, 11]. e b These patterns suggest that next-generation P2P botnets will incorporate stronger anti-recon techniques. Because take- down and disinfection efforts against P2P botnets hinge on cd reliable reconnaissance, our work is aimed at proactively in- vestigating the full extent of anti-recon implemented by P2P Figure 1: An example botnet connectivity graph. An arrow from botmasters, and the range of possible defenses to safeguard node a to node b indicates that a knows b. Non-routable nodes reconnaissance in next-generation botnets. are shaded. We show that recon tools used by malware analysts to monitor high-profile botnets suffer from serious protocol de- ficiencies, making them easily detectable. Specifically, we 2. RECON IN P2P BOTNETS infiltrate the Sality v3 and GameOver Zeus botnets by insert- Reconnaissance methods for P2P botnets can be divided ing passive sensors, which scan incoming traffic for anomalies into two classes, namely crawler-based and sensor-based and deviations from the botnet protocol. Additionally, we methods (though hybrids are feasible [28]). This section use active peer list requests to locate sensor nodes which introduces both of these classes, and compares their tradeoffs do not actively initiate communication. (At the time of our and resilience to passive disruption. We discuss active recon analysis, the attack against GameOver Zeus had not yet disruption in Section 3. been launched.) We identify 21 Zeus crawlers, 10 distinct Throughout this paper, we consider a botnet to be a Zeus sensors, and 11 Sality crawlers belonging to well-known digraph G = (V, E), where V is the set of vertices (e.g. malware analysis laboratories, network security companies, bots), and E is the set of edges (e.g. is-neighbor connections and CERTs. We find that all of these have shortcomings between bots). We refer to the number of outgoing edges which make them easy to identify among the bot populations from a bot v as its out-degree deg+(v), and the number of (200.000 bots for Zeus, and 900.000 for Sality) [28]. incoming edges as in-degree deg−(v). At first glance, it may seem that the situation could be remedied by eliminating syntactic protocol deficiencies in 2.1 Crawlers crawlers and sensors. We show that this is not so; even syn- Crawler-based reconnaissance relies upon the peer list tactically sound recon tools can be detected by anomalous in- exchange mechanism available in all P2P botnets [28, 2, 10, or out-degrees. This is commonly true especially for crawlers, 13, 33, 35]. In P2P botnets, every bot maintains a list of as they strive to contact as many bots in as short a time span addresses of other peers it has been contacted by or has as possible. To evaluate the magnitude of this problem, we learned about from other bots. To maintain connectivity design and implement a novel distributed crawler detection with the network despite the constant churn of bots that model, and show that it can automatically detect all crawlers join and leave the botnet, peers regularly exchange (parts in GameOver Zeus without false positives. We illustrate that of) their peer list with their neighbors. Support for peer list the algorithm is applicable not only to Zeus, but also to other exchanges is typically implemented through special request P2P botnets, including Sality. Based on these results, we messages included in the botnet protocol, called peer list propose and evaluate techniques to evade out-degree-based requests, which each bot can use to request a set of peer detection, such as rate limiting and distributed crawling, addresses from another. Crawlers abuse this mechanism and we measure the impact of these techniques on crawling by recursively requesting peer lists from all bots they learn accuracy and completeness. about, starting from an initial bootstrap peer list (usually We also discuss an alternative reconnaissance strategy obtained from a bot sample). which has been widely proposed for use in P2P botnets, Due to its simplicity and ability to rapidly request peers namely Internet-wide scanning [9]. We show that it is applica- from many bots, crawling is a highly popular intelligence ble to some P2P botnets, but is unfortunately not compatible gathering method used by malware analysts [15, 28]. Never- with all P2P botnet protocols. theless, crawlers have been reported to suffer from a myriad Summarizing, our main contributions are: of inaccuracy problems. For instance, address aliasing can 1. We identify and classify anti-recon attacks taking place occur with bots that use dynamic IP addresses, leading to in current P2P botnets, and generalize to potential significant botnet size overestimations if the crawling period attacks which could be implemented in future botnets.