How CNCERT/CC fighting to Botnets. Dr.Mingqi CHEN CNCERT/CC March 31, Beijing

Transcription

1 How CNCERT/CC fighting to Botnets Dr.Mingqi CHEN CNCERT/CC March 31, Beijing

2 Part 1 Content New security threats Part 2 How to detect and handle BotNets Part 3 Fighting BotNets Activities Part 4 Suggestions for Cooperation

3 1 Botnet at China Background: At China, the internet: 111 million Netizens Near 694 thousand websites 136,106 M international bandwidth (from CNNIC, 17 th survey till Dec ) New threats: Phishing/Spyware/Botnet

4 Phishing Top 3 Hosting Countries: U.S:34.67%. Korea:9.83%, China:8.98%

5 Spywares of China Oct.9-Dec : For 30+ Spywares,700, 000+ host at China Mainland What they are doing? -collect information and send back to servers -get key words form servers -down load files from servers Control servers: -most at foreign countries -such as: U.S 42 Korea 26

6 Selling Zombies Online

7 Providing DDoS Attack Service DDoS Attack Service! Prices List: -No FW:100RMB/H -100M Hardware FW:300RMB/H -1000M Hardware FW:600RMB/H -10,000+ chickens is guaranteed

8 Botnets detected at 2005 Number Number distrubution of Botnets at 2005 (more than 1000 infected hosts) 143 Botnets>5000 infected hosts Biggest: infected hosts 120 What they are doing? >10 万 5-10 万 3-5 万 1-3 万 Botnet's Scale

9 2 How to detect and handle Botnet Network structure of a BotNet -IRC based

10 Methods to detect Botnets 1 Honeynet Honeypot/Honeywall Log analysis+bot sample analysis -honeynet project 2 IDS +IRC protocol analysis NetSec Monitoring Platform 3 BOT Beahvior Fast joining bots Long standing connection Not talkative -DdoSVax Porject

11 Comparision of detecting methods of IRC Botnets Scope and bot type Information Type Information granularity HoneyPot 监 测 点 上 有 感 染 传 播 能 力 的 bot bot 收 到 / 发 出 的 所 有 消 息 很 细, 但 只 限 于 bot 收 发 的 信 息 IRC protocol 监 测 范 围 内 活 动 的 bot 符 合 已 知 的 (IRC) 协 议 监 测 条 件 的 网 络 通 信 内 容 掌 握 整 体 信 息 和 一 些 特 定 命 令 信 息 ; 如 : 可 以 发 现 控 制 者 和 控 制 服 务 器 之 间 的 信 息, 但 缺 乏 报 文 内 容 信 息 Bot behaviour 监 测 范 围 内 发 现 较 大 规 模 的 且 严 格 使 用 IRC 协 议 的 botnet 不 适 合 收 集 具 体 信 息 掌 握 整 体 信 息 ; 不 适 合 收 集 具 体 信 息

12 Secret Life Cycle of Botnets 1 Botnet creation By SPAM/Social Enginering/Website with Malicious Codes Bt Botnets/worms:Deloder/Mytob/Zotob 2 Botnet spread TOPIC ##asn-new## :.advscan asn1smb r -b s 3 Botnet transfer( IRC Server transfer) a. Physical host transfer b. Logical host transfer(dds) c. Host Internal transfer

13 Secret Life Cycle of Botnets (cont.) 4 Botnet update By TOPIC 或 PRIVMSG update file: PRIVMSG ##em :!upadfkadf stolen By increase or decease module: PRIVMSG #NotaBot :.spread.add.module vnc_scan\r\n 2005 年 09 月 19 日 02 点 5 Botnet Activity Attack activities:ddos/download spywares/info.stealing/scaning&spreading TOPIC ##bla :.ddos.random *.* // 发 动 拒 绝 服 务 攻 击 Sep.27 8PM 6 Botnet decease a C&C servers not available b bot cleaned by user or AV product c.remove/.uninstall by hacker or others d take the control by other bots

14 3 Preconditions of Botnets handling As Sun Tzu says: 知 己 知 彼, 百 战 不 殆 Known the enemy and yourself and you can fight a hindered battles with no danger of defeat ---The art of war C&C server info.: -DNS/IP Port Access password(if); Channel Info.: -Name Access password(if); Control password Coding rules: -Controller ID authentication: login password -Coding rules& controller in Bot Command set supported by Bot: -Authentication update self-delete commands. Such as login.update.download.uninstall etc.

15 Botnets handling 一 Control whole botnet 擒 贼 先 擒 王 模 拟 控 制 者, 对 僵 尸 网 络 进 行 完 全 控 制 Final Solution: Analysis the bot code Locate C&C server with the authortion or agree of user Send false update command( 吃 毒 丸 ) ; Send self-delete command ( 集 体 自 杀 ); Precondition:get the authentication information of controller 二 Cut communication channel of zombies and C&C server 釜 底 抽 薪 切 断 用 户 主 机 和 控 制 服 务 器 的 联 系 : Blcok C&C server with the accurate info.of C&C server 在 局 域 网 边 界, 阻 断 与 控 制 服 务 器 之 间 的 通 信 条 件 : 掌 握 控 制 服 务 器 的 准 确 信 息 Cancel DN serverce with : 取 消 域 名, 无 法 解 析 ; 条 件 : 得 到 授 权 三 Clean bot and patch system 攘 外 必 先 安 内 清 除 用 户 终 端 上 的 Bot 程 序, 打 补 丁 : By User: 手 工 查 杀 By AV product: 专 杀 工 具 或 升 级 杀 毒 程 序

16 Our actions 1. Keep Detecting Botnets through our platform, since Dec Exchange Botnets Data, especially C&C Server --Form Our partners --Form some CERTs teams 3.With the help of Local Branch and ISPs, with the agree of the Host owner of C&C server: close down the C&C server. 4. Through Information sharing channel, inform users of zombies, provide clean tools for some botnets. 5. Share bot codes and analysis results 6. Proactively work with all relevant departments to strike the criminal behaviors: creating, spreading and using malicious Bots.

17 Network Security Drills Dec.20, 2005: -MII & all backbone carriers of China joined -Deputy Minster of MII and 50+ officials Two Scenarios: -Critical Infrastructure attacked by Hackers -DDoS Attack driven by Botnets Dec.21,2005:APCERT security Drills

18 Incident Classification Standard Guidelines for Classification of Information Security Incidents (Draft Stage) - Make and Spread Bot/Trajon/Worm/Virus/other Macilious Code - Mass PII Incident(proposed) -

19 Typical Cases of CNCERT/CC - In Dec 2004, CNCERT/CC detected and broke down a IRC BotNet of 170,000+ hosts, which was used for a DDOS attack.(media Number: 60,000 hosts, Reported last year) - Aug ,CNCERT/CC found a Botnet of 150,000+ hosts -find clues of hackers : 昵 称 为 gunit 的 用 户 曾 经 登 陆 该 网 络 并 向 多 个 频 道 发 送 控 制 命 令, 命 令 为 扫 描 某 种 漏 洞 (2005 年 8 月 29 日 ) - Oct ,W32/Toxbot incident, 290,000+ host, reported by SURFnet

20 CERTs level 4 Suggestions 1 Malicious code share and analysis 2 BotNets elimination: - Exchange C&C Server and clients information - Cooperation to break down BotNets 3 Information sharing Unaware victim information

21 No safe homeland without safe neighbors! Thanks!