Team 7 (Botnets and Malware)

16
(Botnets and Malware) The Zbot attack Group 7: Andrew Mishoe David Colvin Hubert Liu George Chen John Marshall Buck Scharfnorth

Transcript of Team 7 (Botnets and Malware)

Page 1: Team 7 (Botnets and Malware)

(Botnets and Malware)The Zbot attack

Group 7:Andrew Mishoe

David ColvinHubert Liu

George ChenJohn Marshall

Buck Scharfnorth

Page 2: Team 7 (Botnets and Malware)

What Happened?Type of Attack

Botnet - refers to group of compromised computers able to be controlled by masterTargeted malware attack (Zeus Trojan)Zeus crimeware toolkitAbility to evade anti-virus softwareBanking/Financial institutes, small companies attacked

Toolkit CapabilityCustomized malware creationWebsite PhishingCommand and Control capabilityWeb Injection Scripts (monitoring tools)Kill OS Script (delays victim from realizing attack)Screenshots, Logging Keystrokes, Running Proxy Server, Hosting Phishing Websites, Spamming Campaign

Page 3: Team 7 (Botnets and Malware)

What Happened?Installs on machine and disables security softwareEmbeds configuration file from toolkitRetrieves data and uploads to remote URL

Page 4: Team 7 (Botnets and Malware)

What was the impact?

Spread - First became widespread in March 2009- In May 2009, a botnet operator spontaneously decided to render inoperable 100000 PC's - Named America's most pervasive computer Botnet virus by Network World magazine in July 2009- In October 2009, Facebook phishing e-mails were measured being sent out at over 500 per second.- In November 2009, 9 million e-mails were sent out over a two day period targetting Verizon customers.- Infiltrated Amazon's Cloud Computing network in December 2009.

Page 5: Team 7 (Botnets and Malware)

What was the impact?

Spread (cont.) - 3.6 Million Infections, measured July 2009- Accounted for 44% of all financial malware infections in September - Still very active today

Page 6: Team 7 (Botnets and Malware)

Why did this attack succeed?

Social Engineering (Human Ignorance)Infiltrated computers through phishing emails

FacebookMicrosoft UpdatesConflickr RemovalCDC VacinationsUPSDelta AirlinesSystem Administrator emails

Used authentic looking domain namesupdata-1.com, admin-data.com, 1-db.com, 1ssl-network.com, upd-central.comcentral-updates.com, admin-systems.com, db-1.net, cert1.net, admin-db.net

Easy deployment, used by a vast number of criminal organizations

Page 7: Team 7 (Botnets and Malware)
Page 8: Team 7 (Botnets and Malware)
Page 9: Team 7 (Botnets and Malware)

Malware Tacticts 

Infects Computer in multiple waysPhishingMalicious scripts in webpages

RootkitHides files and folders from viewInjects code into system processesHard to detect by security software

Disable securityCloses firewall and other security applications

Fast-Flux DNS

Page 10: Team 7 (Botnets and Malware)

What happened in the aftermath?

ZBot Server in Cayman Islands shutdown in June 2009Stored FTP login information for over 68,000 websitesMajor companies including

Amazon Bank of America BBCCiscoMcAfeemonster.comSymantec

Two suspects questioned by Manchester officials in November

Page 11: Team 7 (Botnets and Malware)

Attacks continue...Amazon disconnected the infected channel in its EC2 Cloud shortly after the discovery in DecemberNewer variants more difficult to detect

Virustotal.com reports only 6 out of 41 anti-virus programs detected the virus as of September 2009

Over 200 new ZBot servers have come online already this year, and there are over 1,000 currently active serversNew phishing e-mail starting to appear just this past week, probably from Russia

Page 12: Team 7 (Botnets and Malware)

What was done to make systems less vulnerable to this kind of threat?Common

Educate users about spam and TrojansListen to system warningsFrequent anti-virus updatesKeep windows and other software up to date

Home UsersKeep up to date on the threats that existDon't open email from unknown sendersDon't open files or click on links unless you are sureDon't open firewall ports unless you know about the application

Page 13: Team 7 (Botnets and Malware)

What was done to make systems less vulnerable to this kind of threat?Corporate users

Use signatures to verify the authenticity of sendersKeep users out of the administrator accountsDo risky/sensitive work on virtual machinesTighter Firewall Protection and traffic filtersWeb filtering to help guard against malicious controller domainsInternal Distribution of updatesThreat detection devices embedded in the network

Page 14: Team 7 (Botnets and Malware)

What chapter in the book will be helpful in understanding this event?

Chapter 3 - Program SecurityViruses and Other Malicious Code (3.3)Targeted Malicious Code (3.4)

Chapter 7 - Security in Networks Threats in Networks (7.2)

Page 15: Team 7 (Botnets and Malware)

Questions?

Page 16: Team 7 (Botnets and Malware)

Sourceshttp://community.ca.com/blogs/securityadvisor/archive/2009/12/10/zbot-reports-a-quot-possible-fraudulent-visa-card-transaction-quot.aspx

http://blog.trendmicro.com/zbot-targets-facebook-again/

http://www.symantec.com/connect/blogs/zeus-king-underground-crimeware-toolkits

http://community.trendmicro.com/t5/Web-Threat-Spotlight/Facebook-Phishing-Page-Leads-to-Exploits-and-ZBOT/ba-p/2237 http://www.securecomputing.net.au/News/149039,malicious-server-used-to-propagate-zbot-shut-down.aspx http://www.securecomputing.net.au/News/148759,ftp-login-credentials-at-major-corporations-breached.aspx http://news.bbc.co.uk/2/hi/uk_news/england/manchester/8366504.stm http://www.spamfighter.com/News-12877-New-Study-Finds-Computer-Virus-Zeus-Bot-in-Internet-Postcards.htm http://www.darkreading.com/security/antivirus/showArticle.jhtml?articleID=220000718

http://blog.fortinet.com/august-2009-threatscape-zbot-detected-in-record-levels-fresh-vulnerabilities-consistently-attacked/

http://www.scmagazineus.com/new-verizon-wireless-themed-zeus-campaign-hits/article/157848/

goog_1264533905713
goog_1264533905713
goog_1264533905713
goog_1264533905713
goog_1264533905713
goog_1264533905713
goog_1264533905713
goog_1264533905713
goog_1264533905713
goog_1264533905713
goog_1264533905713
goog_1264533905713
goog_1264533905713
goog_1264533905713
goog_1264533905713
http://www.spamfighter.com/News-12877-New-Study-Finds-Computer-Virus-Zeus-Bot-in-Internet-Postcards.htm
http://www.darkreading.com/security/antivirus/showArticle.jhtml?articleID=220000718
http://blog.fortinet.com/august-2009-threatscape-zbot-detected-in-record-levels-fresh-vulnerabilities-consistently-attacked/
http://www.scmagazineus.com/new-verizon-wireless-themed-zeus-campaign-hits/article/157848/

Installing & Maintaining Computer Hardware Anti Virus & Malware · 2019. 11. 25. · Viruses Trojans, Worms, Botnets, E-mail Viruses, Ransomware …. What do the group understand

Installing & Maintaining Computer Hardware Anti Virus & Malware · 2019. 11. 25. · Viruses Trojans, Worms, Botnets, E-mail Viruses, Ransomware …. What do the group understand

Billion Dollar Botnets - Virus Bulletin...malware contacts the remote URL, downloads malware will then and executes the GingerBreak exploit. 1 fail, but regardless attempt to download

Billion Dollar Botnets - Virus Bulletin...malware contacts the remote URL, downloads malware will then and executes the GingerBreak exploit. 1 fail, but regardless attempt to download

T-110.6220 Kernel Malware · • Storm, Srizbi, Pandex, various banking trojans and password stealers • Over half of the biggest spam botnets are kernel malware! [1] April 1, 2009

T-110.6220 Kernel Malware · • Storm, Srizbi, Pandex, various banking trojans and password stealers • Over half of the biggest spam botnets are kernel malware! [1] April 1, 2009

For Distribution Copyright 2006 Secure Science Corp. 1 Trojans & Botnets & Malware, Oh My! Shmoocon ‘06 Lance James Secure Science Corporation.

For Distribution Copyright 2006 Secure Science Corp. 1 Trojans & Botnets & Malware, Oh My! Shmoocon ‘06 Lance James Secure Science Corporation.

Fast-flux Service Networks in botnet malware · Botnets have for several years chocked security companies and researchers - with good reason. Botnets are a very complex and powerful

Fast-flux Service Networks in botnet malware · Botnets have for several years chocked security companies and researchers - with good reason. Botnets are a very complex and powerful

Computer Security Seminar Lecture 2orrd/CompSecSeminar/2013/... · Malware Backdoors Defense Viruses Worms Trojan Rootkits Botnets Computer Viruses One of the eldest malicious threats

Computer Security Seminar Lecture 2orrd/CompSecSeminar/2013/... · Malware Backdoors Defense Viruses Worms Trojan Rootkits Botnets Computer Viruses One of the eldest malicious threats

Computer Security Seminar — Lecture 3orrd/CompSecSeminar/2016/... · Malware Backdoors Defense Viruses Worms Trojan Rootkits Botnets Computer Viruses (cont.) As computer viruses

Computer Security Seminar — Lecture 3orrd/CompSecSeminar/2016/... · Malware Backdoors Defense Viruses Worms Trojan Rootkits Botnets Computer Viruses (cont.) As computer viruses

SPAM/BOTNETS and Malware

SPAM/BOTNETS and Malware

Security of Web Applications - University of Texas at Austinshmat/courses/cs380s_fall09/10... · • Attacks lead to malware installation (keyloggers, botnets), document theft, loss

Security of Web Applications - University of Texas at Austinshmat/courses/cs380s_fall09/10... · • Attacks lead to malware installation (keyloggers, botnets), document theft, loss

apnic-teamcymru-botnets-ph-dist-240209 - APRICOT · 2017. 2. 6. · 2/25/09 1 APRICOT/APNIC 27 APNIC Training Team Cymru Introduction to Botnets and Forensics Manila, Philippines

apnic-teamcymru-botnets-ph-dist-240209 - APRICOT · 2017. 2. 6. · 2/25/09 1 APRICOT/APNIC 27 APNIC Training Team Cymru Introduction to Botnets and Forensics Manila, Philippines

Modeling Botnets and Epidemic Malware Marco Ajelli, Renato Lo Cigno, Alberto Montresor DISI – University of Trento, Italy Locigno @ disi.unitn.it .

Modeling Botnets and Epidemic Malware Marco Ajelli, Renato Lo Cigno, Alberto Montresor DISI – University of Trento, Italy Locigno @ disi.unitn.it .

CAP6135: Malware and Software Vulnerability Analysis Botnets Cliff Zou Spring 2012

CAP6135: Malware and Software Vulnerability Analysis Botnets Cliff Zou Spring 2012

Detecting Botnets and Malware

Detecting Botnets and Malware

Malware Removal and Firewall Protection · Malware Removal and Firewall Protection VISIT SITESASSURE.COM FOR YOUR FREE MALWARE SCAN Our security team will clean your website of malware,

Malware Removal and Firewall Protection · Malware Removal and Firewall Protection VISIT SITESASSURE.COM FOR YOUR FREE MALWARE SCAN Our security team will clean your website of malware,

Malware: Viruses, Worms, & Botnetspeople.eecs.berkeley.edu/~dawnsong/teaching/f12-cs... · Malware: Viruses, Worms, & Botnets Computer Security Course. Dawn Song . Reflections on

Malware: Viruses, Worms, & Botnetspeople.eecs.berkeley.edu/~dawnsong/teaching/f12-cs... · Malware: Viruses, Worms, & Botnets Computer Security Course. Dawn Song . Reflections on

Botnets Malware Spyware

Botnets Malware Spyware

Botnets, malware and network attacks

Botnets, malware and network attacks

Malware – future trends Dancho Danchev - DDoS extortion ...infosecwriters.com/text_resources/pdf/malware_DDanchev.pdf · themselves, but hijacking botnets, or vulnerable infected

Malware – future trends Dancho Danchev - DDoS extortion ...infosecwriters.com/text_resources/pdf/malware_DDanchev.pdf · themselves, but hijacking botnets, or vulnerable infected

Slide 1 Vitaly Shmatikov CS 361S Malware: Worms and Botnets.

Slide 1 Vitaly Shmatikov CS 361S Malware: Worms and Botnets.

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware