Good Bot, Bad Bot, Ugly Bot. Battle of the Bots!

Transcription

1 SESSION ID: TTA-R08 Good Bot, Bad Bot, Ugly Bot. Battle of the Bots! John Ellis 周 由 安 Chief Strategist, Cyber Security (APJ) Akamai

2 About me Kiwi (New Zealander) 20+ years experience in IT security (trained sheep to hack) Have worked in defence, telecommunications and banking Consider myself a student, but love to share what I know 9 years in Singapore, and see we re still trying to find the Asian solution to the Asian problem (talk to me afterwards if you want to know more). Still trying to learn Mandarin.might one day get there 2

3 Cyber buzz bingo Cyber SaaS Threat Intel Cloud BOYD IoT Cyber Kill Chain Innovation Big Data Breach TTPs Signal to noise Cross-Platform SMAC Next-gen APT China Data Driven Thought Leaders Cyber Attack BOT Game Changer PaaS Cyber Crime Hacktivist

4 What is a bot? A software application that automates tasks that are simple and structurally repetitive at much higher rates or precision than a human.

5 Bot trends & environment Good Bad Bots Account for 29% of all website visits 22% fraud activity Bad 3.5% Hacking tools Search engine, crawlers, spider bots Vulnerability scanner, Site performance bots Partner bots Aggregator, media bots 44% Human traffic Spam bots 56% Bot traffic Scraper bots 3% scrapers Hacker, Fraud bots 0.5% Spammers DDoS bots Good Bots Account for 27% of all website visits Source: Incapsula / Akamai

6 Good bots Search engine optimization (SEO) Marketing Vulnerability Scanners Performance analysis tools

7 Bad bots Fraud Vulnerability scanners Malware Scrapers (your competitors) Spam (it ain t ham) DDoS attacks Did I mention malware?

8 Ugly naughty bots Scrapers Want to know everything about you Price Aggregators Crawlers Too Friendly Malicious? Maybe, Maybe not

9 SPAM Bots Target marketing Improve SEO Malware distribution Fraud 9

10 Scraper Bots (an example) Scraping Service / Tools Aggregator Website 10

11 Commercial Scraping Services / Tools kimono 11

12 The BOT evolution Cloud Server Mobile Desktop Internet of Things (IoT) 12

13 DDoS Bots DDoS attacks instances plotted over time Q113-Q115 Source: Akamai SOTI Security Report Q

14 Top 10 Source Countries for DDoS Attacks China 1.4 billion people Italy 8.38% 642 million people online German 17.3% China 23.45% Russia 5.95% France 6.03% U.K. 6.17% Korea 6.23% India 6.93% Over 50% of systems infected with viruses 9 out 10 Windows systems pirated Spain 7.29% 70% of Windows systems never patched 14 U.S %

15 DDoS 4 Bitcoin (DD4BC) Who, What, Where & How DD4BC (DDoS For Bitcoins) Online ransom group Not ransomware No other attribution Publicly available DDoS toolkits & rented botnets in the underground Who are the targets? 4% 7% Banking & Credit Unions 15% Gaming Media & Entertainment 74% Payment Processing 15

16 Great Canon (GC) of China An in-path system, capable of injecting traffic and directly suppressing traffic Acting as a full man-in-themiddle for targeted flows Harnesses legitamate web browsing traffic for attack capability and capacity Coding error provides clue as to how to detect and filter traffic. Example of cat and mouse game Targets of http get flood DDoS attack Source: 16

17 Value of a hacked PC (Brian Kerbs) Phishing site Malware download site Warez / Piracy server Child pornography server Spam site Web Server Bot activity Spam zombie DDoS extortion zombie Click fraud zombie Anonymization proxy Captcha solving zombie Webmail spam Stranded aboard scam Harvesting accounts Harvesting associated accounts Online gaming characters Online gaming goods PC game licenses OS licence keys Webmail Virtual goods Spam zombie DDoS extortion zombie Click fraud zombie Anonymization proxy Captcha solving zombie Account credentials Financial credentials Ebay / paypal fake auction Online gaming creds Skype / VoIP creds Website / FTP creds Client side encrypt certs Bank account data Credit card data Stock trading account data Mutual fund account data Facebook Twitter Linkedin Google+ Reputation hacking Hostage attacks Source: account ransom Fake antivirus Ransomware Web cam extortion

18 Using Botnets to access market insights Investors Legal return on investment Illegal access to information Managers / Analysts Legion / infantry / operators Source: Interpol 18

19 Account checkers and Fraud How does this evil deed typically happen? Builds tools server Cultivate list of open proxies Acquire compromised logins Check / alter compromised accounts Make fraudulent purchase Compromise Attackers use variety of server tools to Obtain rapidly Attackers check may list obtain the modify of web validity the harvested proxies shipping of the / accounts. address of the victim and make Use Open stolen bulletproof proxies credentials allow hosting from route sites with Accounts that work are marked, and proxies around such the The attackers merchandise as IP pastebin, log blacklists in sent using to or the an from address near the attacker and picked up. underground credentials. sites. did Proxies Recently someone gift need cards, to both mention be physical of and the Once logged in, the attackers can cloud? sufficient Many electronic collect the underground have been key items user s length personal to mask forums purchase as they are easily available, data and Load attack sell credit difficult such card to trace information and easy to to use transport. for further fraud scripts ready to go purchases with their stored information. Source: 19

20 Account checkers and Fraud 20

21 How to manage em BOTS

22 Block, Mitigate or Manage? Blocking BOTS causes them to go underground, mutate and harder to detect Not sure if bot...or Management strategies vary depending on the nature of the BOT and it s goal Stupid human?

23 Aggressiveness TTPs for the Good, Bad and Ugly Reduce Impact Terminate with extreme prejudice Welcome Bots Client Validation Desirable Degrees of Desirability Undesirable

24 BOT Response Methods Solution Landscape (what can you buy) From a technology perspective: Slow BOT/ Serve Alt./ etc. HTML Obscuring/ Rewriting BOT Obfuscation Cloud WAFs Avoid data theft and downtime by extending the security perimeter outside the data-center and protect from increasing frequency, scale and sophistication of web attacks. CAPTCHA Cloud BOT Mgt. On Prem WAFs Alert/ Deny No BOT Detection Rate Based Detection Cross Customer Header/IP Based Tracking BOT Detection Methods Cross Customer Fingerprint Based Tracking Advanced BOT Evasion Traps

25 Cooking your BOT management program Detection Avoid data theft and downtime by extending the security perimeter outside the data-center and protect from increasing frequency, scale and sophistication of web attacks. Learnings Mitigation

26 Bot Detection Methods Client reputation Client and browser fingerprinting HTTP header anomaly detection JavaScript Injection JS BOT evasion traps Behavioral Analysis

27 Bot Response Methods IP blocking Geo blocking Rate controls Web Application Firewall Rules Obfuscation for HTML, JS, URL and Form Serve slow, stale, alternate, tar pit CAPTCHA challenge

28 Bot Learnings BOT scoring, categorization and trends Crowd sourcing of new BOTS Resource usage by BOT Input into evolving your detection and mitigation tactics Understand the cost of your mitigation strategies

29 7 Key Ingredients to Succeed (today) 1. Scale your defenses with a Cloud WAF Extend your perimeter beyond your site 2. Reverse Proxy Automatically drops traffic not on port 80 or port 443 Avoid data theft and downtime by extending the 3. Geo-based blocking security perimeter outside the data-center and Refuse requests from customer-selected list of countries protect from increasing frequency, scale and 4. sophistication Validate against of web known attacks. list of attackers Positive or negative security model (black or white lists) 5. Rate Controls Block requests that are too fast or too slow (anomaly scoring) 6. Data driven WAF WAF rules continuously refined based on visibility into web 7. Caching Dynamic and static caching to serve requests

30 Looking ahead Good Bots are an essential part of our Internet ecosystem It s an arms race, and you need to have a clear strategy If you don t have a WAF.get one!!! Threat intel (bingo) is vital in understanding. Learn from others Now you ve got a strategy, have a plan and rehearse it! It s hard but understand what normal looks like (try..please) Think active defense be smart in how you operate

31 Friend or Foe? You need to decide

32 I would like to thank Mike Smith (Akamai APJ Security CTO) Patrick Laverty (Akamai CSIRT) Mike Kun (Akamai CSIRT) Dave Lewis (Akamai Global Security Advocate).and Akamai s customers and competitors (they keep me honest) 我 也 感 谢 我 的 太 太 ( 大 熊 猫 ) 32