How to build botnets and defend against them.

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 1/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

JLW ]L DR@CM PLRT LWH DL]HB]!WE@], @ VTLDEDCP KEH‐] [EP ]JE].

JLW ]L MBIBHM EGE@H[] DL]HB][! 

Vrbsbhtbr? ]brrbhkb L‐Klhhlr

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 2/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

@H]TLMRK]@LH]brrbhkb L‐Klhhlr - K@[[V, K@[E, GVBH, K|BJ

•  Gcldec Bhtbrpr`sb [bkur`ty Erkj`tbkt

•   Eaene` [bkur`ty Kbhtbr li Bxkbccbhkb

•  Desbm `h Etcehte, GE - R[E 

•  Lvbr 5= ybers li sbkur`ty bxpbrt`sb.

•  Vr`lr rlcb es Gcldec [bkur`ty Erkj`tbkturb ilr ]revbcplrt

•  Wlrabm `h nehy vbrt`kecs `hkcum`hg, klnnbrkb, !hehk`ec, bhtbrpr`sb, trevb

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 3/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

EGBHME

•  [bkur`ty

•  ]jrbet Dr`b!hg

•  Etteka ]llcs ehm ]bkjh`qubs

•  C`vb TI@ ehm MMl[ Ettekas

•  [unnery

•  U&E

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 4/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

[bkur`ty Klhkbp]jb [upbr Klhmbhsbm Ybrs`lh 

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 5/30Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

NL]@YE]@LH 

Ettekabr nlt`vet`lhs iecc `htl ketbglr`bs•  Vlc`t`kec ‛ Etteka tjlsb tjet mlh‐t egrbb w`tj

tjb`r dbc`bis.•  I`hehk`ec ‛ ]jbrb `s slnb !hehk`ec ge`h tl db

jem dy etteka`hg.•  Gclry ‛ ]jby etteka ilr rbklgh`t`lh li tjb`r

prlwbss.•  Lr @t‐s ]ubsmey ehm tjby erb dlrbm…

Etteka npekts?

•  Mete Clss•  [brv`kb @htbrrupt`lh•  Ireum

Etteka nbtjlms•  Tbslurkb Klhsunpt`lh Ettek•  Neh-`h-tjb-N`mmcb (Neh`puce

]rehs`t)•  J`oeka`hg/Tbm`rbkt`lhEppc`ket`lh Ettekas ‛ @hobkt`hg RDbjev`lr htl Vrlkbss`hg Clg`k ‛  [UC @hobkt`lh, Klnnehm @hobkt

]jb c`st glbs lh…

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 6/30Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

CBYBC [B]]@HG

Wjet erb ylur d`ggbst sbkur`ty klhkbrhs ehm kjeccbhgylur lhc`hb prbsbhkb< 

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 7/30Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

WJE] ABBV[ K@[L‐[ RV E] H@GJ]<

Mete Drbekjbs

•  Jlw ml ylu n`t`getb ege`hst mete drbekjbs ehm uh`htbht`lhec `hilrnet`l

[brv`kb Eve`ced`c`ty

•  B`tjbr tjrlugj n`sklh!guret`lh (`nprlpbr kjehgb klhtrlc) lr tjrlugj Etj`s gbhbreccy ieccs uhmbr tjb lvbrs`gjt li tjb K@[L.

•  Wjet `s ylur stretbgy tl n`t`getb eve`ced`c`ty ettekas<

D`cc`hg Ettekas

•  Ylcunbtr`k ]re"k Icllm`hg

•  ]jlsb [kec`hg Lvbregbs… surb, wb‐cc d`cc ylu ilr tjet!

Drehm Vrltbkt`lh

•  Wjet `s tjb klst li eh `npekt tl ylur klnpehy‐s Drehm `h tbrns li mlccer

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 8/30Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

Wjet @‐vb sbbh… 

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 9/30Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

JBEMC@HB[ 

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 10/30Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

DL][ HL] C@N@]BM ]L J]]V([) 

Lhkb ylur eppc`ket`lhs erb klnprln`sbm dy e dlt, tjby keehy ]KV/RMV tre"k tjet tjb cehguegb/sbrvbr ecclws.

Bxenpcbs?

•  MH[ Icllm

•  I]V Drutb-ilrkb

•  [[J Drutb-ilrkb

•  H]V Tb#bkt`lh/Enpc`!ket`lh

•  [HNV…

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 11/30Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

DTLDL] @H EK]@LH

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 12/30Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

EMYBT[ET@B[ ILCCLW@HG ]JB [ENB ]TBHM[

•  @hkrbes`hgcy ilkusbm lh tjb Wbd Eppc`ket`lh

•  Ireum

• 

Wbd Epp `s trustbm dy tjb Metedesb ehm usbrs li tjb Epp•  Bstedc`sj V`vlt tl tergbt tjb Bhtbrpr`sb

•  MMl[ jes bvlcvbm tl ilkus lh tjb Wbd Epp `h rbkbht ybers

•  Rt`c`zet`lh li Tb#bkt`vb [brv`kbs

•  Kclum Desbm Etteka Emlpt`lh•  Iest

•  Besy

•  Klhvbh`bht

•  Vlwbriuc

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 13/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

Wjy `s `t sl besy< 

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 14/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

[L NEHP TBNL]B I@CB @HKCR[@LH/KLNNEHM @HOBK]@LH YRCHBT

[lurkb? jttp?//www.bxpcl`t-md.kln/

[lurkb? jttp?//w

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 15/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

ABBV @H N@HM

•  @i, @ lwh ylur dlx,

•  @ lwh ylur sbrv`kb.•  @ lwh ylur kustlnbrs.

•  @ lwh ylur rbputet`lh.

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 16/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

]llcs ehm ]bkjh`qub

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 17/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

J@GJ CBYBC MBNL LYBTY@BW

 Ettekabr

5) Tbklh/Nepp`hg tl i hm Eppc`ket lh w`tj ahlwh vuchbred`c`tyHlt klvbrbm `h tjb Mbnl, dbkeusb Bxpcl`tet`lh `s nlrb `htbrbst`hg

J`ht? Gllgcb `s e d`g jbcp!

4) Bxpcl`t TI@ vuchbred`c`ty tl ruh etteka klhtrlccbm klmb lh [brvbr@h tj`s kesb, klmb `s DrlDlt MMl[

;) Ceuhkj MMl[ tergbt`hg tjb Lpbh ke

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 18/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

]JB [KBHET@L

•  Yuchbredcb Dclg (ehm klhsbqubhtcy, lur Dlt)?

•  Iuccy Vetkjbm ehm Rpmetbm WlrmVrbss

•  Wbcc-klhhbktbm

•  Kclum Jlstbm

•  Rhprltbktbm [`tb?

•  Kclum Jlstbm

•  [`tb w`tj hbtwlra ceybr prltbkt`lhs, dut hltj`hg nlrb.

•  Vrltbktbm [`tb?

•  Vetbht Vbhm`hg ]bkjhlclgy

•  Vrltbkts Ilrn [udn`ss`lhs irln Dlts

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 19/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

WLTMVTB[[ ‛ IRCCP VE]KJBM

•  [lnb stets?

•  Vlwbrs 5/9 li ecc s`tbs lh tjb `htbrhbt.

•  ]jet‐s ~76,066,666 s`tbs et cest kluht.

•  Nehy m`speretb jlst`hg prlv`mbrs.

•  ]jlusehms li Kustln ]jbnbs

•   Ollnce! jes vbry s`n`cer `ssubs

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 20/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

]JBNB ‛ ]@N]JRND MTLV-@H

•  –E snecc pjp skr`pt ilr krlpp`hg, zlln`hg ehm rbs`z`hg w(opg, phg, g`i). Vbribkt ilr usb lh dclgs ehm ltjbr eppc`keHL!

•  –Mbvbclpbm ilr usb `h tjb WlrmVrbss tjbnb N`ndl Vrlusbm `h nehy ltjbr WlrmVrbss tjbnbs.„

•  Vuccs rbnltb !cbs clkeccy

•  Hlt e clt li `hput kjbka`hg

•  Tbqu`rbs !cb tl db clkec pr`lr tl klhtbht vbr`!ket`lh

•  Hl mbieuct sbkur`ty nbkjeh`sns

•  Hltb? @ en us`hg eh lcmbr vbrs`lh, tjet‐s st`cc lut tjbrb lhdclgs

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 21/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

DEM [KT@V] [BTYBT - DTLDL]

 ‛  Rsbm pr`ner`cy dy UKI ehm Rs

 ‛  Ybry [`npcb [kr`pt

 ‛  Bes`cy Rpclembm

 ‛  Bes`cy Bxbkutbm

 ‛  Krbetbs Ness`vb ]re"k ehm KVR Clem lh Ettekabm [brvbrs

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 22/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

DTLDL] KLMB [H@VVB]iuhkt`lh kurc\mlwhclem ($rbnltb){

$usbregbht > errey('Nlz`cce/2.6 (Z551 R1 C`hux x:9\9=1 bh-R[1 rv?5.0.5.59) Gbkal/46556040 @kbwb(klnpet`dcb1 N[@B :.61 W`hmlws H] 2.51 ]r`mbht/=.61 .HB] KCT 4.6.267471 .HB] KCT 5.5.=;441)','Gllgcb[ud/4.5 ( jwww.gllgcb[ud.kln/[ud.jtnc)','nsh[ud-Vrlmukts/5.6 (+jttp?//sberkj.nsh.kln/nsh[ud.jtn)','Lpbre/0.66 (W`h

bh)','[eier`/2.66 (Nek`htlsj1 R1 bh)')1

$kp > kurc\`h`t($rbnltb)1kurc\sbtlpt($kp, KRTCLV]\I@CB, tbnphen('',''))1kurc\sbtlpt($kp, KRTCLV]\R[BTEGBH],$usbregbhtQrehm(6,kluht($usbregbht)-5) )1kurc\sbtlpt($kp, KRTCLV]\J]]VJBEMBT,errey("Kekjb-Klhtrlc? hl-kekjb",""))1kurc\sbtlpt($kp, KRTCLV]\JBEMBT, 6)1kurc\sbtlpt($kp, KRTCLV]\TB]RTH]TEH[IBT, 5)1kurc\bxbk($kp)1kurc\kclsb($kp)1

}

`i(iuhkt`lh\bx`sts(kurc\`h`t)){ilr($` > 61$` 3 566661$`++){

kurc\mlwhclem($tergbt."<".rehm(6,;666)/;.;;;;====)1}

}

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 23/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

Etteka@t‐s rbeccy besy.

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 24/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

Mbibhsb

@t‐s rbeccy jerm. 

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 25/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

VTL]BK]@LH[

•  Nust jevb Vrltbkt`lh lh Eppc`ket`lh Ceybr Ettekas et Gcl

•  Tbec-t`nb Ecweys-lh [bkur`ty ‛ [bklhms Nettbr!

•  Vrltbkt`hg Nuct`pcb Lr`g`hs irln Etteka w`tj lhb [lcut`l

•  Dlt N`t`get`lh nust db Kekjbedcb

•  Neab @hputs Jermbr tl Gubss

•  Dclka Dem @hputs

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 26/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

Dlt N`t`get`lh

]bkjh`qubs 

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 27/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

Tbkep 

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 28/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

[RNNETP

•  Ettekas erb bes`cy bxbkutbm lh e cergb skecb

•  @hkcum`hg MH[, J]]V([), Mete Bx!ctret`lh, btk.

•  ]ergbts erb `h ecc vbrt`kecs ehm li ecc s`zbs

•  Lpbret`hg lh tjb `htbrhbt nbehs klhsteht eutlnetbm et

•  Erb ylu tjb clwbst jehg`hg iru`t<

•  Vrbperb, Vrltbkt, Nlh`tlr

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 29/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

NLTB @HIL

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 30/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

U&E

<Vrbsbhtbr  ]brrbhkb L‐Klhhlr

tbrrbhkb.lklhhlr (et) gne`c mlt kln

[bh`lr Bhtbrpr`sb [bkur`ty Erkj`tbkt