All you know about Botnet
Download as DOCX, PDF1 like1,158 views
This document discusses botnets, which are networks of compromised computers ("bots") that are controlled remotely without the owners' knowledge to perform malicious activities. It describes how botnets are created by infecting vulnerable systems with malware, then propagating across networks. Botnets are controlled through centralized, peer-to-peer, or random command and control techniques using protocols like IRC. They pose major security threats by enabling large-scale spamming, DDoS attacks, phishing and more. Detecting and disrupting botnets is challenging due to their distributed nature and attackers' use of dynamic command channels.
All you know about Botnet
- 1. BOTNET What it is? And How does it spread? Submitted By: Naveen Titare
- 2. TABLE OF CONTENT 1. Abstract 2. Introduction 3. Botnet Creation & Propogation 4. Botnet Commands & communication Protocol 5. Security Threats from Botnet 6. Botnet Prevention, Detection & Disruption 7. Conclusion
- 3. ABSTRACT Among all media of communications, Internet is most vulnerable to attacks owing to its public nature and virtually without centralized control. With the growing financial dealings and dependence of businesses on Internet, these attacks have even more increased. Whereas previously hackers would satisfy themselves by breaking into someone as system, in today's world hackers' work under an organized crime plan to obtain illicit financial gains. Various attacks than include spamming, phishing, click fraud, distributed denial of services, hosting illegal material, key logging, etc. are being carried out by hackers using botnets. In this paper a detailed study of botnets vis-a-vis their creation, propagation, command and control techniques, communication protocols and relay mechanism is presented. The aim of this paper is to gain an insight of security threats that users of Internet are facing from hackers by the use of malicious botnets.
- 4. INTRODUCTION The term bot, derived from “ro-bot” in its generic form is used to describe a script or set of scripts or a program designed to perform predefined functions repeatedly and automatically after being triggered intentionally or through a system infection. Although bots originated as a useful feature for carrying out repetitive and time consuming operations but they are being exploited for malicious intent. Bots that are used to carry out legitimate activities in an automated manner are called benevolent bots and those that are meant for malicious intent are known as malicious bots. Benevolent bots among various other activities are used by search engines to spider online website content and by online games to provide virtual opponent (Cooke & et al – 2005). The first bot program Eggdrop created by Jeff Fisher in 1993 originated as a useful feature on Internet Relay Chat (IRC) (Green & et al – 2000) for text based conferencing on many machines in a distributed fashion. In a typical IRC setup (Oikarinen & Reed – 1993), a user running an IRC
- 5. client program connects to an IRC server in an IRC network. The default TCP service port for IRC is 6667 and generally IRC servers listen on port range of 6000-7000, though servers could be configured to run on any TCP port. All servers are interconnected and pass messages from one user to other. As IRC gained popularity among Internet users, attacks on IRC started, initially due to curiosity or seeking fame and later for illicit financial gain, resulting in its misuse. An IRC malicious bot program runs on an IRC host or client each time it boots in a hidden manner and controlled by commands given by other IRC bot(s). It is typically an executable file with a size of less than 15 KB in its compressed form. An IRC host computer running an IRC bot malware program becomes a Zombie or a drone (Choo – 2007). The first malicious IRC bot, Pretty Park Worm that appeared in 1999 contained a limited set of functionality and features, such as the ability to connect to a remote IRC server, retrieve basic system information e.g. operating system version, login names, email addresses, etc. (Puri – 2003). However, bots extend the basic functions of their predecessors and have become a very powerful tool in building large computer armies which is the key difference between bots and other programs like viruses and worms. This very large pool of such Zombie hosts running bot programs form a large network called a botnet run under the command and control of a single or a group of hackers known as botmaster. Any host on Internet that is compromised by the botmaster becomes part of this botnet. A typical botnet comprises of thousands of Zombie hosts and thus poses a tremendous threat to the Internet security and privacy (Schaffer – 2006). For creating a bigger and safer botnet that could remain up and running for large duration without detection, most vulnerable to bot infection are less monitored, high bandwidth home computers or University Servers (Vogt, Aycock & Jacobson – 2007). According to (MessageLabs - 2009) various notorious botnets that have been reported in the literature include Storm, Srizbi, Cutwail, Gheg, Mega-D, ASPROX, Rustuch, Warezor, Doubot, Ozdok, Xarvester and Bagle. Their estimated size of these botnets in terms of number of bot malware compromised computers varies from a few bots to a million bots. The average spam emails send through these bots per day ranges from a million messages to more than ten billion messages.
- 6. BOTNET CREATION & PROPOGATION The process of building a botnet requires minimum technical and programming skills. Besides this, some IRC channels offer specialized training programs (Lanelli & Hackworth – 2005) for creation, propagation and use of botnets. A brief two stage overview of building a botnet is outlined in this section. Bot Creation This stage largely depends on skills and requirements of an attacker. The attacker may choose to write its own code or simply extend or customize an existing bot. Readymade and highly configurable bots with step by step instructions on how to compromise systems are sold on Internet. The instructions include instructions to obtain packaging exploits, simple character and graphical user interfaces, and various other tools for gaining backdoor entry into networks (Barford & Yagneswaran – 2006). The bot code generally contains configurable components that include IRC server and channel information, remote IRC TCP service port, the location and name of the bot code file in the infected machine, and other components permitting the botmaster to dynamically change the attack behavior and to hide itself, list of botmasters and their credentials. The values pertaining to these components are supplied to the bots by the botmaster(s) using various Command and Control techniques (Barford & Yagneswaran – 2006). Bot Propagation In this stage vulnerable systems and tools to exploit them are located which are then used to gain backdoor access to these systems facilitating installation of bot malware by uploading or commanding the victim machine to download a copy of the bot malware (Shannon & Moore – 2004). This infection stage involves use of various direct and indirect techniques to spread bot malware. These include attack through software vulnerabilities, vulnerabilities caused by other infections, social engineering through the use of email, instant messaging and malicious web page content. The bot malware is also propagated through peer to peer networks, open file sharing, and direct client to client file exchange. Bot malware uses FTP, TFTP, HTTP protocol
- 7. based services to infect computers and spread it until a desired strength of botnet is assembled (Choo – 2007). Botnets are also created by other botnets called seed botnets. BOTNET COMMANDS & COMMUNICATION PROTOCOL Once bot malware is recruited on the victim machines, the botmaster has to discover these bot malware infected machines. Once discovered, the botmaster needs to control these victim machines through some form of communication to carry out the desired operations. One simple possible method of communication between bots and botmaster is through a direct control message communication link. However, such a direct link can easily locate the botmaster and as such this type of communication is not used. Instead several organized command languages and control protocols called botnet Command and Control (C&C) techniques are used to operate botnets remotely. Communication between bots and the C&C machine is the weakest link in a botnet, without which the victim cloud does not behave as a coordinated network (Barford & Yagneswaran – 2006). C&C system of botnets is unique and unlikely to change among bots and their variants, however; attackers are continuing to adapt and look for new botnet communication channels. In this section we discuss three different categories of command and control techniques namely centralized, peer to peer and random. Centralized Command & Control (C&C) Technique This C&C technique uses a central high bandwidth host called C&C server to forward messages between various bots (Govil & Dayanand – 2007). The C&C server in a botnet is a compromised computer that runs certain network services like IRC, HTTP, etc and which rallies the commands issued by the botmaster to each host in the botnet that join the C&C server channel. Botnets use various mechanisms to protect their communications which include the use of passwords set by the botmasters. The centralized C&C is most predominant C&C technique and many bots including AgoBot, RBot, SDBot, SpamThru and Zotob use this C&C technique. There are several advantages of using centralized C&C techniques out of which easy availability and greater productivity are most predominant. A great amount of resources are available online to create
- 8. a C&C based botnet that include IRC server and IRC bot scripts, simple CUI and GUI customization interfaces, etc. Centralized C&C allows controlling of as many bots as possible and thus maximizes the profit of the botmaster. Small message latency and lack of adequate countermeasures in fighting against botnets especially on unprotected and unmonitored networks have also motivated the botnet operators to use centralized C&C technique. The only drawback of centralized C&C technique is that C&C server is the weakest point in the entire botnet link as all communication passes through this single point. Once the central location is discovered, the entire botnet can be easily neutralized. P2P Command & Control (C&C) Technique The peer to peer C&C technique uses P2P communication with no real central server to forward messages between botnets which makes it more resilient to failures in the network (Cooke & et al – 2005). Unlike centralized C&C technique, P2P C&C technique is much harder to discover and destroy; even if one or more bots are neutralized, the botnet still continues to operate. Further, an anonymous P2P technique may be used to make it even more difficult to detect. However the botnet size supported by P2P systems is generally very low in comparison to centralized systems, which makes profit oriented botmasters to avoid using P2P technique. Also the propagation latency and guaranteed message delivery is lacking in P2P systems. Some examples of botnets that use P2P C&C technique include Phatbot and Sinit. Random Command & Control (C&C) Technique The idea of random C&C technique has been presented by Evan Cooke (Cooke & et al – 2005), however no botnet has been reported to have used this C&C technique. In this C&C technique no bot can know about the existence of more than one other bot thus making the detection of the botnet very difficult. A botmaster or a bot can send an encrypted message randomly which may be intercepted by other bot and a conversation could begin. In this command and control technique message latency is very high, however; unlike other command and control techniques it lags guaranteed message delivery. Botnets Communication Protocols and Rally Mechanisms
- 9. The command and control techniques described above use various communication protocols (Rajab & et al – 2006) and rally mechanisms (Govil & Dayanand – 2007). Botnets make use of some well defined network communication protocols that include more importantly IRC protocol, HTTP protocol and other protocols like IM and P2P protocols. The communication protocols used in botnets provide an understanding of the botnets origin and the possible software tools that may be used by the botnet. Besides this, knowledge of communication protocol used by a botnet provides an understanding for decoding the communication that takes place between bots and the botmasters. In an IRC protocol based botnet, the C&C server is installed as an IRC service on a host computer and botmaster creates a channel on the C&C server. The bots connect to this channel, receive commands from the botmaster and execute these instructions to carry out various types of malicious functions. The flexibility of IRC protocol to be used as a group communication or private communication system makes it possible for botmaster to command all bots or selectively select a group of bots in a botnet to carry out a malicious activity. Although IRC protocol is the most predominant method used in botnets, yet the monitoring of IRC traffic and the installation of firewalls to reduce the chances of falling victim to a botmaster, some botnets have been using different communication protocols including HTTP, IM and P2P protocols. IM and P2P protocols are used for creating botnet of relatively small size but HTTP protocol is used to create a large sized botnet. Although HTTP traffic generated by botnets is different from the normal HTTP traffic, yet it is difficult to detect it because it hides itself within huge legitimate HTTP traffic. Bots include either hard coded C&C server IP addresses or hard coded domain names to connect to the C&C servers. Inclusion of hard coded C&C server IP addresses with bot code makes it easy to detect, block the C&C server and neutralize the entire botnet. In order to evade detection, this type of rally mechanism is not used in bots. Bots include hard coded domain names assigned by dynamic DNS providers, so that even if the C&C server IP address is located botmaster can update the dynamic DNS entry to map the server at some other address
- 10. and continue operating the botnet. Some botmasters operate their own unauthorized distributed DNS servers that are used to resolve the IP addresses of the C&C servers. SECURITY THREATS FROM BOTNET With the growing sophistication of botnets and highly skilled and organized botmasters, a powerful threat as that from viruses, Trojan horses, network intrusion, worms and other familiar cyber threats (McCarty – 2003) persists to the Internet security and privacy. Botmasters are more numerous, sophisticated, harder to identify, have better tools and very large size of bot armies and thus can command the individual zombies to carry out various types of attacks that include but is not limited to distributed denial of services (DDoS), spamming, phishing, identity theft, click fraud, hosting of illegal material, disseminating malicious code, and a variety of other possible attacks (McKewan – 2006). Several studies and reports that include (Kandula & et al – 2005), (McAfee – 2005), (AHTCC – 2006), (Dunn – 2005), (David – 2006), (FCAC – 2006) and (Biever & Celeste - 2004) have reported the use of botnets in carrying out several types of attacks on one or the other service available on the Internet. Distributed Denial of Services (DDoS) Denial of Services (DoS) attack is an attempt on a computer system or network to make unavailable the computational resources to its intended user. A Distributed DoS (DDoS) attack is a DoS attack which involves use of multiple compromised systems to cause a loss of service to its intended users by depleting the bandwidth and other computational resources of the target system or network. Bandwidth depletion and resource depletion are two main variants of DdoS attacks. Flooding and reflection attacks are two primary types of bandwidth depletion attacks. Bandwidth depletion involves flooding a target machine with unwanted traffic as an attempt to overwhelm the processing power of the target machine. Flooding attack involves sending multiple packets to some target website simultaneously to congest traffic. The reflection attack involves sending many packets to many computers with a spoofed source address. Resource
- 11. depletion also called protocol exploitation involves a target that specifically attempts to deplete resources on the targeted computer or cause it to become unstable and crash. To launch a DdoS attack using botnet has several advantages that include magnifying impact of the attack without the requirement of any source IP address spoofing. A DDoS attack on the DNS servers of United States Department of Defense has been reportedly carried out in Feb, 2006. Spamming Loosely defining spam is any message or posting, regardless of its content, that is sent to multiple recipients who have not specifically requested the message (Opt-In). Spam can also be multiple postings of the same message to newsgroups or list servers that are not related to the topic of discussion. A person engaged in spamming is called spammer. Spam in blogs called blog spam or comment spam is a form of search engine spamming done manually or automatically by posting random comments, promoting commercial services, to blogs, wikis, guestbooks, or other publicly-accessible online discussion boards. Any web application that accepts and displays hyperlinks submitted by visitors may be a target of Link Spam. This is the placing or solicitation of links randomly on other sites, placing a desired keyword into the hyperlinked text of the backlink. Blogs, guest books, forums and any site that accepts visitors' comments are particular targets and are often victims of drive-by spamming, where automated software creates nonsense posts with links that are usually irrelevant and unwanted. Link spam dishonestly and deliberately manipulates link-based ranking algorithms of search engines like Google's PageRank to increase the rank of a web site or page so that it is placed as close to the top of search results as possible. Spam generally refers to email, rather than other forms of electronic communication. The term spim, for example, is used for unsolicited advertising via Instant Messaging. Spit refers to unsolicited advertising via Voice Over Internet Protocol (VOIP). Unsolicited advertising on wireless devices such as cell phones is called wireless spam. Spammers use various techniques and tools that include spoofing, spam botnets (Husna & et al – 2008), open proxies, open mail relays, untraceable Internet connections, and bulk email tools for sending unsolicited bulk email. Spammers operate as a creative group who work through secret networks to meet and share email addresses. The two most effective approaches to
- 12. gather or harvest emails are to monitor Internet use and to ask for email addresses. Some of the most popular methods of email harvesting are guessing, purchased lists, legitimate email lists, web pages, white/yellow page sites, web & paper forms, usenet posts, web browser, hacking, user profiles, irc and chat rooms. The significant increase in the spam volume mostly due to botnets has been the key development in the year 2008 (MessageLabs - 2009). Phishing and Identity Theft Phishing is used to describe spoof emails and other technical ploys to trick receipts into giving up their personal or their company’s confidential information such as social security number, financial account credentials and other identity and security information. Some phishing emails look extremely professional and realistic, while others are crude and badly constructed but have a common goal to steal information through deception. This form of identity theft (McCarty – 2003b) employs both social engineering and technical subterfuge to steal account access information, identity or other proprietary information that can be sold on to third party via specialized chat rooms established specifically for this purpose. Selling the information onwards reduces the risk of being apprehended by minimizing the direct link between the hacker and those using the information to gain unauthorized access to accounts and profiting from them. Social engineering schemes use spoofed emails to lead customers to counterfeit websites designed to trick recipients into divulging financial data. Technical subterfuge schemes plant crime ware onto computers to steal credentials directly using keylogging systems. Pharming crimeware misdirects users to fraudulent sites or proxy servers, typically through Domain Name System (DNS) hijacking or poisoning. The term “phishing” evolved from the word “fishing” and follows a very similar approach. Fraudsters and scammers, the “fishermen”, send out large quantities of deceptive emails, the “bait”, to mostly random address across the Internet. Phishing is a serious and increasingly prolific form of spam, and is one of the main tactics employed in business and consumer identity theft. Phishing actually comprises of two online identity thefts which are the identity of the target company and its unsuspecting customers. Target Company is commonly a bank, online payment service or other reputable business
- 13. organization. A typical phishing attack is made up of two components: an authentic looking email and a fraudulent Web page. This form of spam of email frequently has a professional look that includes company logos, colors, graphics, font styles, and other elements to successfully spoof the sender. The content of the phishing email is usually designed to confuse, upset, or excite the recipient. Typical email topics include account problems, account verifications, security updates/upgrades, and new product or service offerings. Recipients of email are prompted to react immediately and click on a link provided in the email body, which actually directs them to the phishing Web page. The intent is to lure recipients into revealing sensitive information such as usernames, passwords, account IDs, ATM PINs, or credit card details. Like the phishing email, the phishing Web page almost always possesses the look and feel of the legitimate site that it copies, often containing the same company logos, graphics, writing style, fonts, layout, and other site elements. This spoofed Web page may also include a graphical user interface (GUI) intended to lure the user into entering their bank account information, credit card number, social security number, passwords, or other sensitive information. Either the phisher, or an anonymous remote user that is sent the information, can then use the stolen information. Phishing approaches used for identity thefts are constantly growing and new variants are tried and used to attack business organizations, financial institutions, and customers. Some of the most prevalent types of phishing and identity theft attacks include deceptive phishing, malware based phishing, key loggers, screen loggers, session hijacking, web Trojans, hosts file poisoning, system reconfiguration attacks, data theft, DNSbased phishing also called pharming, content injection phishing, man-in-the-middle phishing, search engine phishing, spear phishing, vishing or voice phishing. The phishing “ecosystem” consists of a collection of individuals who play various roles within the phishing space, ranging from the financially-motivated botnet creators to those who actively pursue and prosecute the cybercriminals. In this ecosystem, a large industry of buying and selling - a “microeconomy” - exists within the phishing underground, involving botnet creators, perpetrators, and enablers. However, these three player groups are complex and intertwined: a single individual or multiple perpetrators can play separate or simultaneous roles. Botnets, with an army of thousands of bots awaiting their instructions can use packet
- 14. sniffers to watch for sensitive information like usernames and passwords on the machine it has intruded and accordingly send this to the botmaster (FCAC – 2006). Other Security Threats Although botmasters need not to be highly technical yet some are skilled, organized and are getting smarter day by day. Further, they have thousands of bot compromised computers at their disposal and thus can launch variety attacks other than those detailed above. Online games and polls can easily fall victim to botnets where bots can manipulate the results. Bots can be levered to steal the online software license by transferring the same to some other computer. Key loggers can be deployed with bots to retrieve sensitive and secret data. Bots can use packet sniffing to watch for clear text data passing by compromised machines and retrieve sensitive data such as usernames and passwords. Botnets can setup a fake website with advertisements thus leading to click fraud. Bots are used to download and execute harmful executive files via FTP or HTTP and thus spread new malware and viruses. The growing access to Internet through mobile phones can prompt hackers to attack cellular network system and create botnets on this system which may cause inconvenience to millions of cell phone users. BOTNET PREVENTION, DETECTION & DISRUPTION Botnets present significant new challenges for the Internet community as the attackers come up with new and improved tools. Protection against falling victim to a botnet and detecting the location of botmaster is very challenging owing to various facts that include i) the mechanism used in constructing and maintenance of botnets and that used in its possible attack are independent of each other, ii) Every Zombie in a botnet is a source of attack and iii) Botnets remain in a silent state until they are leveraged to launch a specific attack (Strayer & et al – 2006). Preventing a system on Internet from falling victim to a botnet requires a high level of awareness about online security and privacy. Besides this, the system must be kept up to date by installation of various Operating System updates and patches. Use of pirated software, games, and other illegal material available online are always a source of malicious code and
- 15. thus presents a grave security threat and as such users should restrict themselves from accessing such web sites. Further, software firewalls and antivirus/anti-spyware programs should be installed and periodically updated on systems to prevent them from being infected. The use of CAPTCHA tests has been suggested for website and other services for prevention against bots and other malicious agents. Detecting the bot activity on a system or on a network is dominant to the study of botnets. The use of honeypot has been the most popular method of setting a trap to detect botnet activity (HoneyNet – 2005). Honeypot is generally an isolated and protected system that appears to be part of a network and having valuable information stored on it. It allows itself to be infected by a bot and become part of botnet. The honeypot is next used to capture the bot malware and detect the bot controller. Various reactive and proactive techniques have been suggested to detect and identify botnets. Detection of botnet by monitoring the network and host activity in terms of number of users per channel service ports used or abnormal ratio of invisible to visible users, etc have been suggested. In (Strayer & et al – 2006) examination of flow characteristics such as bandwidth, duration and timing is suggested for detection of botnet C&C activity. (Cooke & et al – 2005) suggests use of secondary bot behavior such as propagation and attack for detecting botnets. In (Akiyama& et al – 2007) three metrics namely relationship, response and synchronization have been proposed for detecting botnets through analyzing their behavior. On detecting a botnet immediate mitigation goals are to neutralize the zombie by removing the bot infection and more importantly to disrupt the C&C Server of the entire botnet. Disrupting the botnet C&C server is significant because bot infected system is only part of very large zombie army controlled by C&C Server and thus disrupting this controller will reutilize the entire botnet.
- 16. CONCLUSION Increasing number of Internet users and its commercial character naturally bring in proportionate number of criminal minded people to the scene who pose potential threats to legitimate users, Internet infrastructure and timeliness of services offered by it. The aim of this paper is to document Internet Security threats so that general understanding about the malicious users and the malware is increased. The paper presents a detailed study of technology involved in the design and control of botnets and threats posed by them. The main focus of this paper is Botnet which enfolds all other attacks in one way or the other. The paper has not presented any solution to the Internet Security threats but hopefully will generate an intense interest among researchers to undertake research in this area.