1. Host and Application Security Lesson 17: Botnets

2. Almost done with Malware  Now that you’re done with traditional malware, let’s look at an important class or two we’ve ignored: rootkits and botnets

3. Rootkit  Actually, a pretty loose definition  Can think of it as a piece of malware that is designed to allow an attacker privileged access to a computer Rootkits usually allow access via the network Rootkits usually are very stealthy, and provide ways an attacker can hide on the box

4. Botnet  Really, a form of rootkit, but the emphasis is on remote control

5. The Botnet Lifecycle RecruitmentManagementExploitation

6. Recruitment  Machines get recruited into botnets a large number of ways  Typically, web or email based exploit  This installs the bot on the machine

7. Command and Control  This can be thought of as the “Achilles heel” of the botnet  A botnet needs remote control  Thus, if we can detect the network traffic, we can detect the botnet  However, the botherder makes a large effort to protect his (her) investment

8. Exploitation  Lots of uses: DDoS attacks Adware installation Spyware installation Spam Click fraud Spread to other machines ID theft …

9. C2 Techniques  Simple: IRC  Complicated: Domain flux Generate different candidate domain names every day Bots “check in” with new domains every day Not all domains need to be registered for this approach to work

10. C2 features  Can break down into: Topology: hub and spoke? P2P? Rallying Mechanism: How new bots locate and join the botnet. Communication Protocol: The underlying protocol used… Control Mechanism: How new commands are sent. Callback? Polling? Command Authentication Mechanism: How can we tell if a command is really from the botherder?

11. To Do  Download and read “Your botnet is my botnet: Analysis of a Botnet Takeover”  Questions about this could be on the final…

12. Questions?