About Botnet, and the influence that Botnet gives to broadband ISP

Transcription

1 About net, and the influence that net gives to broadband ISP Masaru AKAI BB Technology / SBB-SIRT

2 Agenda Who are we? What is net? About Telecom-ISAC-Japan Analyzing code How does net work? BB Technology Corp. 2

3 Who are we? Now I am in a BB Technology 1. Known as Yahoo! BB in Japan over 5,000,000 subscribers ADSL service in Japan. 2. We service BB Phone VoIP Service over 4,800,000 subscribers 3. We service BBTV Multicast Broad casting and Video on Demand Services 4. We service BB Mobile Point HotSpot(802.11b/11Mbps) service 5. We service Softbank Mobile Former Vodafone Japan over 15,000,000 subscribers BB Technology Corp. 3

4 What is? A bot is common parlance on the Internet for a software program that is a software agent. A bot interacts with other network services intended for people as if it were a person. One typical use of bots is to gather information. The term is derived from the word "robot," reflecting the autonomous character in the "virtual robot"-ness of the concept. The most common bots are those that covertly install themselves on people's computers for malicious purposes, and that have been described as remote attack tools. BB Technology Corp. 4

5 What is net? net is a jargon term for a collection of software robots, or bots, which run autonomously. This can also refer to the network of computers using distributed computing software. While the term botnet can be used to refer to any group of bots, such as IRC bots, the word is generally used to refer to a collection of compromised machines running programs, usually referred to as worms, Trojan horses, or backdoors, under a common command and control infrastructure. BB Technology Corp. 5

6 Japanese carriers fight against net A company s web site regularly received the DDoS attack by Virus software. They tried to conceal appearance of Web server from the world of DNS, and to ward off attack. However, unexpected and a serious side effect were caused through this medium. A large load was caused in the DNS server of Internet Service BB Technology Provider. Corp. 6

7 Japanese carriers fight against net But the Web server of A company was not able to be retrieved with DNS, infected PC with Virus software was not lost. Infection PC continuously generated a large amount of DNS query, and it became the result of several usual times the load hanging to the DNS server on ISP sides by the condition of making an error of it and returning. Telecom-ISAC Japan decided to take contacting in A company, and to hit the action of the problem jointly. Since this problem, Telecom-ISAC-Japan fight against net etc. BB Technology Corp. 7

8 What is Telecom-ISAC-Japan? BB Technology Corp. 8

9 Telecom-ISAC Japan *Telecom-ISAC Japan must be managed as an independent and reliable organization. *We collect, share, analyze, and provide information on Incidents through cooperation and coordination among Members. *Telecom-ISAC Japan takes immediate actions or preventive measures against Incidents to minimize the effect on Members telecommunication services and other important infrastructures. Source X Source Y Source Z Threats Analysis Storing Subject for protection Incidents Collection of information Immediate actions Telecom-ISAC Japan Preventive measures Collection and provision of information Contribution to the industry security Member A Member B Member C Incidents Threats 9

10 Overview of Telecom-ISAC Japan General user Member , fax, etc. Portal site Security information Links What s new Events information Glossary For members Vulnerability info Industry info Technical info Delivery of urgent information Telecom-ISAC Japan 1. Provision of vulnerability and alerts information 2. Operation of a portal site (Provision of general security information, etc) 3. Incident Collecting Systems * Incident handling system * Wide-area monitoring system 4. Construction and operation of Analysis Center and ISAC Operations Center 5. Cooperation and coordination with other organizations (JPCERT, NIRT, etc.) 6. Establishment of technical forum Information Management on Wide-area monitoring system Information Management on Incident Handling Database of vulnerability and alerts information Information Management on Controls and Analyses Function of information collection National Incident Response Team , fax, etc. NIRT Members Sensors Domestic related sites (JPCERT, IPA, etc.) Foreign related sites (CERT, ISAC, etc.) 10

11 Analyzing code How does net work?

12 net investigation of actual conditions result Observation record of net The majority of subspecies of cannot be detected even with the latest pattern file. One person in Internet users is infected with. When unmeasured PC connect to the net, it is infected in 4 minutes. The bandwidth being occupied by is several Gbps in Japan.

13 net investigation of actual conditions result Breeding record of net Wild is obtained. Change to livestock to My (Construction of net for investigation environment) The art was trained.(ability measurement examination) Check Action, Power and Ability Is there a method of exterminating net? 13

14 Operation My net Building

15 Environment for constructed net investigation IRC-1 IRC-2 Web DNS Herder Mail Spammer Fake Internet Target host 15

16 Download Source code of 16

17 Parameters of bot source code Set item concerning IRC Server IRC Server s IPAddress, Service port Backup IRC Server s IPAddress, Service port Herder s Auth Password IRC Server connection password IRC Channel Name, JOIN Password Setting concerning operation of bot Check of TOPICCMD etc. 17

18 Connect IRC Server as HERDER HERDER s name is foo 18

19 Bury bot and execution IRC-1 IRC-2 Web DNS Herder Mail Spammer Fake Internet Target host 19

20 expands infection, net is constructed. Herder Spammer IRC-1 IRC-2 Web DNS Fake Internet When infected, does the infection activity to adjoin IP addresses automatically. Mail The main body program is downloaded when succeeding in infection and it completes making. Target host 20

21 Complete to build My net s IP logging IRC-1 IRC-2 Web DNS Herder Mail Spammer Fake Internet Target host 21

22 Complete to build my net 22

23 My net Ability investigation

24 Investigation result of Source code(agobot Agobot) Circulation of source Auth/Encryption polymorphic BOT Generator IRC Anti AntiVirus Version up Original channel Anti Debugger/VM Maintenance Control Self defense HERDER Can change anytime BOT Windows Linux Information gathering Account FTP, IRC, PAYPAL AOL connection with vulnerable Clients , Product Key Infection activity Using vulnerability Using Network sharing Using Virus Attack DDoS Exploited PCs SPAM Relay 24

25 Investigation of Attack function (Ability)

26 SPAM Mail Sending IRC-1 IRC-2 Web DNS Spammer Mail Herder Ramdom/tcp 25/tcp Mail Spammer Fake Internet Target host 26

27 DDoS Attack IRC-1 IRC-2 Web DNS Herder Target host Spammer Fake Internet 27

28 Investigation of net operation

29 Recovery of My net Completed ÜIRC-1 IRC-2 Web DNS Herder Mail Spammer Fake Internet Target host 29

30 Herder Form of use of IRC server IRC-1 IRC-2 IRC-3 IRC-4 Control channel Management channel Fake Internet 30

31 Conclusion net is GREAT system. We should also deal seriously because cracker is serious. It is serious as the information leakage tool. doesn't notice the fact that information flows out and an infected fact. There is no specific medicine. It is need to correct vulnerability as the Internet system. (vulnerable PCs & Servers) infected PC C&C servers Download servers HERDER 31

32 Situation of BB Technology I cannot talk many of things from the viewpoint of the information protection... These data are on site person only. BB Technology Corp. 32

33 Are you ready? Hereafter, broadband network will advance in most countries. At that time, can you defend the users from net and other Malware? Keep secure (Routers, Servers, etc.) Source address validation ACL (Bogon Filter, etc.) urpf, etc. Create security community BB Technology Corp. 33

34 Q&A BB Technology Corp. 34

35 Thank you! About net, and the influence that net gives to broadband ISP Masaru AKAI SBBSIRT BB Technology Corp. BB Technology Corp. 35