Botnets, malware and network attacks

49
Botnets, malware and… …network attacks Pablo González Carmen Torrano Juan Antonio Calles

TAGS:

description

Presentation about Flu project, malware, botnets and some network attacks. SBC2012

Transcript of Botnets, malware and network attacks

Page 1: Botnets, malware and network attacks

Botnets, malware and……network attacks

Pablo GonzálezCarmen Torrano

Juan Antonio Calles

Page 2: Botnets, malware and network attacks

I am…

• Carmen Torrano Giménez

• Phd Student at CSIC

• Research on Computer Security

• www.flu-project.com

Page 3: Botnets, malware and network attacks

I am…

• Pablo González (@fluproject)

• Head of security department

at Informatica 64

• www.flu-project.com

• www.seguridadapple.com

Page 4: Botnets, malware and network attacks

I am…

• Juan Antonio Calles (@jantonioCalles)

• Security Team Leader at Everis Spain

• elblogdecalles.blogspot.com

• www.flu-project.com

Page 5: Botnets, malware and network attacks

Timeline

What is Flu Project?

Malware and Botnets

Data Network Attacks!

Page 6: Botnets, malware and network attacks

What is…

Page 7: Botnets, malware and network attacks

What is… Flu?

Free Communit

y

Ethical Hacking

Social Awareness

Anti cybergrooming with Anti

Depredadores

Application development

Page 8: Botnets, malware and network attacks

Application development

• Flu• Anubis (footprinting and

fingerprinting)• Liberad a Wifi (default key

generation for Wifi routers)• Flunym0us (vulnerability scanner

Moodle, Wordpress)

Page 9: Botnets, malware and network attacks

Collaboration

Cybergrooming

Page 10: Botnets, malware and network attacks

So, Flu really is…

Knowledge… …Learning……Concepts…

…Security……Collaboration…

…Awareness…You… …Freedom

Page 11: Botnets, malware and network attacks

Malware

Page 12: Botnets, malware and network attacks

Malware Classes

• Viruses• Worms• Trojans• Rootkits• Spyware• Time bombs

Page 13: Botnets, malware and network attacks

Viruses

• They are only a kind of malware

• What is their goal? Destruction!

• Flu is not a virus

Page 14: Botnets, malware and network attacks

Virus Phases

Dormant

Propagation

Attack

Page 15: Botnets, malware and network attacks

Types…

• Boot

• Files

• Polymorphic

• Macro

Page 16: Botnets, malware and network attacks

Worms

• What are they?

• Key feature: Replication

• Flu is not a worm

Page 17: Botnets, malware and network attacks

Trojans

• What are they? Powerful!

• Remote control

• Direct and reverse

• Yeah! Flu is a trojan but……It’s a educational trojan

Page 18: Botnets, malware and network attacks

Rootkits

• What are they?

• Rootkit != management OR remote control software

• Key feature: they hide things…

Page 19: Botnets, malware and network attacks

Spyware

• What is it?

• Not harmful malware but attempts against privacy

• Key feature: Spy & Statistics

Page 20: Botnets, malware and network attacks

Time bombs

• What are they? Simple code but… destructive!

• Key feature: delayed action• Bash, Sh, Ksh, Dash, cmd, PowerShell

…• …And, Flu is not a time bomb

Page 21: Botnets, malware and network attacks

Botnets

Page 22: Botnets, malware and network attacks

Botnets

• What are they? • Bots, zombies, botmaster• Flu• Statistics: 10% of you belong to a

botnet!!• DOS attack – Anonymous (against

Internet censhorship- hacked CIA webpage)

Page 23: Botnets, malware and network attacks

Flu Features

• Hidden in the user folder, hidden process

• HaaS: Hacking as a Service

• Bot generator

• Client-server architecture

Page 24: Botnets, malware and network attacks

• WAMP (Windows, Apache, MySql

and PHP)

• Windows + .Net Framework

Page 25: Botnets, malware and network attacks

Flu architecture

Page 26: Botnets, malware and network attacks

Flu architecture

Page 27: Botnets, malware and network attacks

Flu Features

Keylogger Remote CMD & Powershell

Screenshot

Capture Microphone Steal Files Manageme

nt Registry

MSN Information

Web History

Passwords

And More…

Page 28: Botnets, malware and network attacks

Flu features

• Dynamic ID in XML file

• Commands directed to:– A specific computer– The whole botnet

Page 29: Botnets, malware and network attacks

Flu features

• AES encription (128 bits)• Hash of the files• GUI for Android• Undergraduate thesis at Deusto

University

Page 30: Botnets, malware and network attacks

Practical example

Page 31: Botnets, malware and network attacks

Dem

o

Page 32: Botnets, malware and network attacks

Data Network Attacks

Page 33: Botnets, malware and network attacks

1- Sniffing

Page 34: Botnets, malware and network attacks

PC HACKER

PC 1

PC 2 PC 3

PC 4

Sniffer

Filtra Filtra

Sniffing: hub

Hub

Datos PC 4

Page 35: Botnets, malware and network attacks

Sniffer

MAC 1

MAC 2 MAC H MAC 3

MAC 4

Port 1 MAC 1Port 2 MAC 2Port 6 MAC HPort 11 MAC 3Port 12 MAC 4

Sniffing: Switch

Switch

PC HACKER

PC 1

PC 2 PC 3

PC 4

Data PC 4

Page 36: Botnets, malware and network attacks

2- ARP Spoofing(MITM)

Page 37: Botnets, malware and network attacks

IP: MAC:

10.0.0.10 – ALICE 00:00:00:00:00:50 - ATTACKER

IP: MAC:

10.0.0.20 – BOB 00:00:00:00:00:50 - ATTACKER

Alice

IP: MAC:IP: MAC:IP: MAC:

10.0.0.20 – BOB 00:00:00:00:00:20 – BOB

IP: MAC:

10.0.0.10 – ALICE 00:00:00:00:00:10 – ALICE

Who is 10.0.0.20?

Who is 10.0.0.20?

10.0.0.20 is in 00:00:00:00:00:20

ARP Reply

ARP Request

10.0.0.10 is in

00:00:00:00:00:50

Bob

IP 10.0.0.50MAC 00:00:00:00:00:50

Eve

IP 10.0.0.10MAC 00:00:00:00:10

IP 10.0.0.20MAC 00:00:00:00:20

TABLA ARP ALICE TABLA ARP BOB

10.0.0.20 is in

00:00:00:00:00:50

Page 38: Botnets, malware and network attacks

Goals of MITM• Stealing:

– passwords

–hashes

–files

–sessions

Page 39: Botnets, malware and network attacks

Demo: MItM

Page 40: Botnets, malware and network attacks

3 - Hijacking

Page 41: Botnets, malware and network attacks

• Goal: Steal user identity/session (impersonation)

• Types: transport layer, application layer

• We focus on HTTP Communication

• Social Networks, Webmails…

Hijacking

Page 42: Botnets, malware and network attacks

Hijacking• I do not need your password!• HTTPs (authentication), HTTP

(rest of the session)• Insecure communications- Cookie Stolen… Ouch!• Firesheep

Page 43: Botnets, malware and network attacks

Demo: Hijacking

Page 44: Botnets, malware and network attacks

Finally…

Page 45: Botnets, malware and network attacks

Proud…

• Juanan and…

• “La biblia del Footprinting”

• Free!!!

Page 46: Botnets, malware and network attacks

…And Proud… :D

• Pablo and… his book

• “PowerShell: La navaja suiza de los administradores de sistemas”

• Sad… Not Free :(

Page 47: Botnets, malware and network attacks

Shopping!

• 5 Euros!• Really?? Yeah! • Finance… for Project!

Page 48: Botnets, malware and network attacks

Thank you!

Page 49: Botnets, malware and network attacks

www.flu-project.com

@fluproject@jantonioCalles@ctorranog

Grupo Flu Project

Grupo Flu Project

Feeds.feedburner.com/FluProject

Contact


Why Botnets Work: Distributed Brute-Force Attacks Need No ...wangdingg.weebly.com/.../why_botnets_work2.pdf · Why Botnets Work: Distributed Brute-Force Attacks Need No ... ... 2).

Why Botnets Work: Distributed Brute-Force Attacks Need No ...wangdingg.weebly.com/.../why_botnets_work2.pdf · Why Botnets Work: Distributed Brute-Force Attacks Need No ... ... 2).

Malware: Botnets and Worms

Malware: Botnets and Worms

IoT Botnets and DDoS Attacks

IoT Botnets and DDoS Attacks

Slide 1 Vitaly Shmatikov CS 361S Malware: Worms and Botnets.

Slide 1 Vitaly Shmatikov CS 361S Malware: Worms and Botnets.

The Rise of Social Botnets: Attacks and Countermeasuresghyan/papers/tdsc18.pdfThe Rise of Social Botnets: Attacks and Countermeasures Jinxue Zhang , Student Member, IEEE, Rui Zhang

The Rise of Social Botnets: Attacks and Countermeasuresghyan/papers/tdsc18.pdfThe Rise of Social Botnets: Attacks and Countermeasures Jinxue Zhang , Student Member, IEEE, Rui Zhang

Malware: Viruses, Worms, & Botnetspeople.eecs.berkeley.edu/~dawnsong/teaching/f12-cs... · Malware: Viruses, Worms, & Botnets Computer Security Course. Dawn Song . Reflections on

Malware: Viruses, Worms, & Botnetspeople.eecs.berkeley.edu/~dawnsong/teaching/f12-cs... · Malware: Viruses, Worms, & Botnets Computer Security Course. Dawn Song . Reflections on

SPAM/BOTNETS and Malware

SPAM/BOTNETS and Malware

Using Massively Distributed Malware in APT-Style Attacks

Using Massively Distributed Malware in APT-Style Attacks

Raimund genes from traditional malware to targeted attacks

Raimund genes from traditional malware to targeted attacks

Prevent Malware attacks with F5 WebSafe and MobileSafe

Prevent Malware attacks with F5 WebSafe and MobileSafe

Botnets Malware Spyware

Botnets Malware Spyware

Malware: Worms and Botnets

Malware: Worms and Botnets

Defending Web Infrastructures from Malware Attacks Giorgio ... · Document Banking Malware Attacks OWASP AppSecEU09 Poland Model and Evaluate exposure of Banking provided security

Defending Web Infrastructures from Malware Attacks Giorgio ... · Document Banking Malware Attacks OWASP AppSecEU09 Poland Model and Evaluate exposure of Banking provided security

CAP6135: Malware and Software Vulnerability Analysis Botnets Cliff Zou Spring 2012

CAP6135: Malware and Software Vulnerability Analysis Botnets Cliff Zou Spring 2012

Botnets: Infrastructure and Attacks

Botnets: Infrastructure and Attacks

Team 7 (Botnets and Malware)

Team 7 (Botnets and Malware)

VIRUS/SPYWARE BASICS Botnets, Malware, Trojans oh my…….

VIRUS/SPYWARE BASICS Botnets, Malware, Trojans oh my…….

Fast-flux Service Networks in botnet malware · Botnets have for several years chocked security companies and researchers - with good reason. Botnets are a very complex and powerful

Fast-flux Service Networks in botnet malware · Botnets have for several years chocked security companies and researchers - with good reason. Botnets are a very complex and powerful

New Malware Attacks 600 Merchants

New Malware Attacks 600 Merchants

Securing Web Applications from malware attacks …eprints.rclis.org/33271/1/1219.pdfSecuring Web Applications from malware attacks using hybrid feature extraction Subramaniyaswamy

Securing Web Applications from malware attacks …eprints.rclis.org/33271/1/1219.pdfSecuring Web Applications from malware attacks using hybrid feature extraction Subramaniyaswamy