Leveraging Honest Users - machine learning – covert.io Honest... · 2020. 7. 24. · Leveraging...

Leveraging Honest Users:Stealth Command-and-Control of Botnets

Diogo MónicaINESC-ID/IST

diogo.monica@ist.utl.pt

Thursday, August 29, 13

Summary

• Motivation

• Problem statement

• Stealth C&C using browsers

• Final remarks

Motivation

• Botnets continue to evolve

• New strategies must be employed to avoid takedown and detection

• Our objective is to explore new directions future C&C infrastructure might take

Problem Statement

• Create a botnet that:

• Avoids infiltration, size estimation

• Reduces the likelihood of detection of individual bots

• Maintains Botmaster anonymity

Assumptions

• Pre-existing population of infected hosts

• Trust anchor in the binary (public key)

• Bots can receive commands from bot master through some open port

Basic Architecture

• No active participation from bots in a botmaster owned C&C

• Bots passively listen for commands

• Commands are signed by the botmaster and pushed out to all the bots

Basic Architecture

0x72e4b76 0xc52b7d0 0x80762b8 0xde3254e

Basic Architecture

• No C&C means:

• no infiltration

• no size estimation

Problems

• Command dissemination

• Botmaster doesn’t know IPs of bots

• Direct dissemination exposes the botmaster

• Disseminating commands takes too long

• Information retrieval

• Bots don’t know the IP of the botmaster

Command Dissemination

• Expendable layer of hosts

• No knowledge about the botmaster

• Do the “heavy lifting” of disseminating commands for the botmaster

Browsers!

• Browsers were created/optimized to do large number of requests per second

• Available crypto libraries in Javascript

• HTML5 brings new capabilities to the table

“Honest” intermediate layer

• Botmaster deploys (or infects) website with malicious code

Botmaster

0x72e4b76 0xc52b7d0 0x80762b8 0xde3254e

Vulnerable Web App

Web Users

• Command dissemination is not done by botmaster

• Reduces the vulnerability to detection

• Visitors of the infected website propagate commands

• Dissemination speed increase x #Web Users

• Detecting the existence of a bot is difficult

• Commands are received but not acknowledged

• Replaying the commands will only further spread the botmaster’s orders

• Intermediate layer is expendable and can expire quickly

• Once the page is closed, all traces of “infection” of the web-browser disappear

• It is hard for researchers to find the original malicious page

Analysis of Command Dissemination

• We created Javascript PoC

• Measured the number of AJAX requests per second

• Used EasyXDM to bypass Same-Origin-Policy

• Implemented public-key signatures for commands in Javascript

• N = #bots

• S = #ips in the address space

• r = #requests / second a browser can make

• d = #days the malicious website is active

• v = #visitors per day the website receives

• m = #minutes a user spends on the website

• N = 150000 bots

• S = 3086889768 (2^32 - Bogons)

• r = 250 requests/second

• d = 1day

30,000500 5000 10,000 15,000 20,000 25,000

Number of Hosts

f bots

● 10 minutes

▲ 15 minutes

■ 20 minutes

20 minutesw/ cooperation

Getting Visitors

• Create malicious website

• Advertise through spam email, twitter, search engine poisoning, abuse URL shortener, etc

• Infect existing website:

• XSS or SQL injection sufficient to get malicious code on legitimate websites

• Keeping users on the websites

• Tabnabbing, clickjacking

Information Upstream

• Botmasters want to send stolen data upstream (credit-cards, email accounts, SSN’s, etc)

• Our command dissemination infrastructure isolates each bot for robustness and stealthiness, but makes it difficult to create an upstream channel

• For spamming-only botnets a simple solution, send information encoded along with spam

• All information is encrypted with the botmaster’s public key, ensuring confidentiality of data

• The bot only has to do one thing: send spam

• Does not expose the botmaster

• Stealth operation

• Only the botmaster can extract data from the bots

• Botmaster creates website private/public key-pair and signs it with it’s own public key

• The malicious code sent to the browsers includes this key-pair

• Browsers can prove themselves as originating from a “legitimate” dissemination website

Bot Master (bm)

0x72e4b76 0xc52b7d0 0x80762b8 0xde3254e

Dissemination Website(W)

Dissemination Layer Host

Kbm, K-1w, {Kw}K-1

bm, {C}K-1bm

Kbm{Kw}K-1bm, {M}K-1

0x72e4b76 0xc52b7d0 0x80762b8 0xde3254e

BotDissemination

Layer Host

Dst IP, {C}K-1bmMessage M

{Kw}K-1bm, {M}K-1

AckMessage M'

Encrypted finger

Dissemination Layer Host

0x72e4b76 0xc52b7d0 0x80762b8 0xde3254e

Command Dissemination

0x72e4b76 0xc52b7d0 0x80762b8 0xde3254e

{A}Kbm {A}Kbm,{B}Kbm,{C}Kbm

{A}Kbm,{B}Kbm3

Accessing the overlay

0x72e4b76 0xc52b7d0 0x80762b8 0xde3254e

Encrypted fingerset by D1

Encrypted finger set by D2

0x72e4b76 0xc52b7d0 0x80762b8 0xde3254e

Dissemination Layer Hosts

Overlay connectivity

• Botmaster randomly scans the internet until it finds one host.

• Uses the encrypted fingers of this host to start crawling through the overlay.

• But...

0x72e4b76 0xc52b7d0

0x80762b8 0xde3254e

0x72e4b76 0xc52b7d0

0x80762b8 0xde3254e

0x72e4b76 0xc52b7d0

0x80762b8 0xde3254e

0x72e4b76 0xc52b7d0

0x80762b8 0xde3254e

0x72e4b76 0xc52b7d0

0x80762b8 0xde3254e

0x72e4b76 0xc52b7d0

0x80762b8 0xde3254e

0x72e4b76 0xc52b7d0

0x80762b8 0xde3254e

0x72e4b76 0xc52b7d0

0x80762b8 0xde3254e

0x72e4b76 0xc52b7d0

0x80762b8 0xde3254e

• Botmaster still needs to bounce through some nodes to guarantee anonymity when retrieving data

Final remarks

• Stealth C&C using browsers are feasible

• Increasing role of browsers in the malware landscape

• We should focus some IDS effort on the browsers

• We aren’t good enough at detecting malicious websites

Thank you

Questions?diogo.monica@ist.utl.pt

Leveraging Honest Users - machine learning – covert.io Honest... · 2020. 7. 24. · Leveraging...

Documents

Transcript of Leveraging Honest Users - machine learning – covert.io Honest... · 2020. 7. 24. · Leveraging...

The Honest Lawyer

Leveraging Honest Users: Stealth Command-and-Control of ...Leveraging Honest Users: Stealth Command-and-Control of Botnets Diogo Monica´ INESC-ID/IST Carlos Ribeiro INESC-ID/IST Abstract

Trafﬁcking Fraudulent Accounts - covert.io Role of... · – 1.5% of Facebook accounts fake [Facebook SEC 2012] • Emergence of underground services selling accounts – Abstract

Honest Medicine

Honest Presentation

Kodaline Honest

Honest money (9.35MB)

Honest Reviews of the Major Freelance Writer Online Job ... · Honest Reviews of the Major Freelance Writer ... An Honest Review of Textbroker.com ... Honest Reviews of the Major

HONEST - Overview

The Honest Woodcutter

Honest M1Y-235M.pdf

IT IS AN HONEST GHOST ITISAN HONEST GHOST

HONEST HISTORY | Supporting balanced and honest ...

- the honest company

Gd honest co

Honest look

Emmly Honest Flowers

Informally Honest

Honest Logos?

Counsel - Honest World