Driving in the Cloud: An Analysis of Drive-by Download Operations and Abuse Reporting

Driving in the Cloud: An Analysis of Drive-by Download Operations and Abuse Reporting A.Nappa, M.Z.Rafique, J.Caballero IMDEA Software Institute Madrid, Spain July 18, 2013

Drive-by-downloads 1 Visit to a malicious page Exploit 2 Malware 3 2 / 32

Drive-by-downloads 1 Visit to a malicious page Exploit 2 Malware 3 3 / 32

Drive-by-Downloads Ecosystem Victims Traffic Sources Exploit Pack Developer Exploit Servers Malware Owners Redirection EaaS Exploit Pack Developer HIY PPI Affiliate 4 / 32

Drive-by Downloads Operations Operation A drive-by download operation is a group of exploit servers managed by the same entity. 5 / 32

Drive-by Downloads Operations Operation A drive-by download operation is a group of exploit servers managed by the same entity. 5 / 32

Reporting REPORTER Find Abuse Mailbox NO Found? YES Abuser Report and Monitor? ISP/Hoster 6 / 32

Dataset Malicia Dataset We have collected 11,000 malware from 500 servers over a period of 11 months. We are making this dataset available to the community http://malicia-project.com 7 / 32

Contributions We propose a technique to identify drive-by operations by grouping exploit servers based on their configuration and the malware they distribute. We report on aspects of drive-by operations such as the number of servers they use, their hosting infrastructure, their lifetime, and the malware families they distribute. We analyze the abuse reporting procedure by sending reports on exploit servers. We build a dataset with the collected malware, their classification, and associated metadata. We make this dataset available to other researchers. 8 / 32

Table of Contents Introduction Approach Analysis Related Work Conclusion 9 / 32

Architecture overview MDL URL Query Feeds Proxies 1 Milking Honey Milkers Clients Malware Store Exploit Servers Execution Server Binaries 2 Execution 3 Classification 4 Clustering Operations Summaries Features 5 Reporting URL, Landing Page, Landing IP, SHA1, Size Traffic Screenshots Icons Family SHA1 File Hash BH_ID ConIP Domains ICON Abuse Report DB 10 / 32

Milking 11 / 32

Milking Milking 11 / 32

Milking Milking Specialized Milkers. 11 / 32

Milking Milking Specialized Milkers. Honeyclient. 11 / 32

Milking Milking Specialized Milkers. Honeyclient. Periodic Milking. 11 / 32

Periodic Milking 12 / 32

Malware Classification 13 / 32

Malware Classification Execution in a contained environment. 13 / 32

Malware Classification Execution in a contained environment. Extraction of the icon from the executable. 13 / 32

Malware Classification Execution in a contained environment. Extraction of the icon from the executable. (a) winwebsec (b) securityshield (c) zbot 13 / 32

Malware Classification (2) 14 / 32

Malware Classification (2) Capture of the screenshot of the execution. 14 / 32

Malware Classification (2) Capture of the screenshot of the execution. 14 / 32

Malware Classification (2) Capture of the screenshot of the execution. Capture of the network traffic. 14 / 32

Icons and Screenshots Classification (Number of Icons = 5698) Feature Clus. Precision Recall Time I avghash 126 99.7% 91.3% 1.6s I phash 135 99.8% 89.5% 47.5s (Number of Screenshots = 9152) Feature Clus. Precision Recall Time S avghash 60 99.1% 65.3% 7m32s S phash 51 98.2% 67.2% 11m5s 15 / 32

Operations Clustering The features that we chose for server clustering are: Domain. 16 / 32

Operations Clustering The features that we chose for server clustering are: Domain. Landing URL http://liordooanleg.com/index.php?tp=001e4bb7b4d7333d http://oisdrculor.com/index.php?tp=001e4bb7b4d7333d. 16 / 32

Operations Clustering The features that we chose for server clustering are: Domain. Landing URL http://liordooanleg.com/index.php?tp=001e4bb7b4d7333d http://oisdrculor.com/index.php?tp=001e4bb7b4d7333d. File hash. 16 / 32

Operations Clustering The features that we chose for server clustering are: Domain. Landing URL http://liordooanleg.com/index.php?tp=001e4bb7b4d7333d http://oisdrculor.com/index.php?tp=001e4bb7b4d7333d. File hash. Icons. 16 / 32

Operations Clustering The features that we chose for server clustering are: Domain. Landing URL http://liordooanleg.com/index.php?tp=001e4bb7b4d7333d http://oisdrculor.com/index.php?tp=001e4bb7b4d7333d. File hash. Icons. Family. 16 / 32

Table of Contents Introduction Approach Analysis Related Work Conclusion 17 / 32

MALICIA dataset Malware executables milked 45,646 Unique executables milked 10,600 Domains milked 596 Servers milked 488 ASes hosting servers 263 Countries hosting servers 57 Total Uptime days 338 Table: Summary of milking operation. 18 / 32

Exploit server lifetime The median lifetime of a server is 19 hours. 13% of exploit servers live only for an hour. 60% are dead before one day. 10% live more than a week. 5% more than two weeks. Server Lifetime CDF 1 0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 0 4 8 16 24 32 40 48 56 64 72 80 Days 19 / 32

Malware families 20 / 32

Operation Analysis Algorithm Feat. Clusters Largest Singletons Aggressive 5 106 87 66 PAM 5 185 31 130 Table: Clustering results. Results 2/3 of the operations use a single server 1/3 of the operations use multiple servers, replacing dead servers with fresh ones 21 / 32

Hosting Providers ASN URL/Name CC ES IPv4 Orig. 16276 ovh FR 19 944,896 47869 netrouting NL 18 22,016 28762 awax RU 15 6,400 21788 burst US 11 286,976 46816 directspace US 10 8,192 12695 di-net RU 9 244,480 6830 lgi AT 8 9,479,936 16265 leaseweb NL 8 337,408 36351 softlayer US 8 1,214,976 197145 infiumhost RU 8 9,728 Table: Top ASes by number of exploit servers (ES) milked compared with the number of IPv4 addresses they originate 22 / 32

Driving in the Cloud Turning to the cloud 60% of the monitored servers are Virtual Private Servers (VPS). 23 / 32

Driving in the Cloud Turning to the cloud 60% of the monitored servers are Virtual Private Servers (VPS). Why? 23 / 32

Driving in the Cloud Turning to the cloud 60% of the monitored servers are Virtual Private Servers (VPS). Why? Fast registration process 23 / 32

Driving in the Cloud Turning to the cloud 60% of the monitored servers are Virtual Private Servers (VPS). Why? Fast registration process Fairly anonymous subscription process 23 / 32

Driving in the Cloud Turning to the cloud 60% of the monitored servers are Virtual Private Servers (VPS). Why? Fast registration process Fairly anonymous subscription process Short leases available (i.e., daily billing) 23 / 32

Abuse Reporting Abuse Reporting We reported 19 long-lived servers 61% of the reports were not acknowledged. On average an exploit server lives 4.3 days after a report. Servers whose report produced a reply lived for 3.0 days. 24 / 32

Table of Contents Introduction Approach Analysis Related Work Conclusion 25 / 32

Related Work Drive-by Downloads Wang et al. (NDSS 2006) Provos et al. (HotBots 2007) Grier et al. (CCS 2012) Malware Classification Anderson et al. (USENIX Security 2007) Bayer et al. (NDSS Security 2009) Perdisci et al. (NSDI 2010) 26 / 32

Table of Contents Introduction Approach Analysis Related Work Conclusion 27 / 32

Conclusion We propose a technique to identify drive-by operations by grouping exploit servers based on their configuration and the malware they distribute. We report on aspects of drive-by operations such as the number of servers they use, their hosting infrastructure, their lifetime, and the malware families they distribute. We analyze the abuse reporting procedure by sending reports on exploit servers. We build a dataset with the collected malware, their classification, and associated metadata. We make this dataset available to other researchers. 28 / 32

MALICIA DATASET MALICIA DATASET Are you interested in our Dataset? http://malicia-project.com 29 / 32

Questions MALICIA DATASET Are you interested in our Dataset? http://malicia-project.com 30 / 32

Operation Analysis Phoenix Operations Using both PAM and aggressive all 21 Phoenix servers are grouped in the same cluster with no other (BlackHole) servers. All servers in this cluster distribute zbot. Winwebsec Operations We observe the winwebsec fake AV affiliate program distributed through 11 different servers, which both algorithms group into 8 clusters. 31 / 32

Operation Analysis (2) Winwebsec Operations We confirm that the winwebsec program manages their own exploit servers through external means. We found 108 executables were winwebsec executables for different affiliates. Zeroaccess Operations Zeroaccess is also an affiliate program. There are four cluster distributing zeroaccess: 3 of them distribute a single affiliate identifier, while the other distributes multiple affiliates. 32 / 32