A General-purpose Laboratory for Large-scale Botnet Experiments

Size: px

Start display at page:

Download "A General-purpose Laboratory for Large-scale Botnet Experiments"

Harvey Owens
10 years ago
Views:

1 A General-purpose Laboratory for Large-scale Botnet Experiments Thomas Barabosch, Sebastian Eschweiler, Mohammad Qasem, Daniel Panteleit, Daniel Plohmann and Elmar Gerhards-Padilla Cyber Defense Fraunhofer FKIE

Mohammad Qasem, Daniel Panteleit, Daniel Plohmann

2 2

3 3

4 4

5 Botnet Analysis Approaches Mathematical modelling Stochastic simulation Real world data analysis In-laboratory emulations 5

6 Reasons for us to design a new laboratory Previous work already exists, e.g. Deter or SecSI/LHS labs Need for own laboratory due to confidentiality requirements Complementary analysis to our in-house reverse engineering process Long term goal: improving the state-of-the-art 6

7 Design of our Botnet Analysis Laboratory 7

8 Design Criteria Design criteria based on Calvet et. Al, Isolated virtualised clusters: testbeds for high-risk security experimentation and training Security Scale Realism Flexibility Sterilizability 8

9 Architectural key aspects Realistic simulation of selected parts of the Internet Total isolation of the laboratory Total observability within the laboratory 9

10 10

11 11

12 12

13 13

14 Network nodes Virtualization 14

15 Network topology 16

16 Architectural key aspects Realistic simulation of selected parts of the Internet Total isolation of the laboratory Total observability within the laboratory 17

17 Experiment control 18

18 Usability 19

19 Security 20

20 Sensor infrastructure 21

21 Sensor infrastructure 22

22 Sensor infrastructure 23

23 Architectural key aspects Realistic simulation of selected parts of the Internet Total isolation of the laboratory Total observability within the laboratory 24

24 Using our Botnet Analysis Labratory 25

25 Setting up an experiment: infrastructure Select network-template and VM templates Experimenter can also provide his own templates In case additional infrastructure is needed Provide entities Adjust DNS 26

26 Setting up an experiment: information gathering Network-based sensors Choose routers that should capture network traffic Easy adjustment using BPF syntax Host-based sensors Choose/add plugins to Agent 27

27 Setting up an experiment: roll out Once properly configured: roll it out! Initial setup time 32 VMs ~ 50 minutes 512 VMs ~ 7 hours 28

28 29

29 CASE STUDY CITADEL 30

30 What is Citadel? Zeus Zeus 31

31 Communication with C&C server 3 CnC server Citadel bot 2 1 DNS 32

32 Countermeasure Takedown via domain replacement CnC server Citadel bot What shall I do? Benign action 5 DNS DNS entry 1 citadel-cnc.com -> Sinkhole

33 EXPERIMENTS WITH CITADEL 34

34 Network infrastructure of the experiment 35

35 SETTING UP A BOTNET 36

36 37

37 Architectural key aspects Realistic simulation of selected parts of the Internet Total isolation of the laboratory Total observability within the laboratory secure analysis of malware secure testing of countermeasures 38

38 BOTNET TAKEDOWN 39

39 Countermeasure Takedown via domain replacement Malicious DNS entry is replaced by benign DNS entry at certain point in time DNS DNS entry citadel-cnc.com ->

40 41

41 Architectural key aspects Realistic simulation of selected parts of the Internet Total isolation of the laboratory Total observability within the laboratory secure analysis of malware secure testing of countermeasures 42

42 CONCLUSION & OUTLOOK 43

43 Conclusion & Outlook Presentation of a general-purpose laboratory for large-scale botnet experiments Realistic simulation of selected parts of the Internet Total isolation of the laboratory Total observability within the laboratory Future work Integration of bare-metal machines Automatic provisioning of basis templates 44

44 45

NTT R&D s anti-malware technologies

NTT R&D s anti-malware technologies Jan. 21, 2015 NTT Secure Platform Laboratories Takeo HARIU Threats causes most of cyber attacks Major infection routes are web browsing, URL links in email messages,