Botconf 2013

Due to the substantially different ecosystem we have to deal with when it comes to mobile security, it makes it harder to detect and react to malware attacks if using conventional techniques. We introduce the concept of Participatory Honeypot, a privacy-by-design system where users becomes partner of the collection of meaningful information subsequently used for the analysis

In early 2011 we discovered some malware infected systems in our network. Starting from one A/V event we found several host- and network-based indicators to identify and confirm several infections within our company. A few weeks later the sinkholing of several known C&C domains showed the botnet was very big (several million bots). Quickly I got obsessed with analyzing and hunting this malware, which could infect fully patched systems protected by firewalls, IPS and multi-layered A/V without using exploits (only social engineering).
The malware got some media attention in June 2012 with titles such as “printer virus”, “printer bomb” or “Trojan.Milicenso: A Paper Salesman’s Dream Come True”. A/V detection names for this malware vary greatly and there may be as little as one registry key in common as indicator for all infected hosts. Over time the infection and C&C domains, IPs and URL patterns changed to avoid detection.

In late 2012 a “anti-sinkholing technique” was introduced in using C&C domains. Just recently I discovered how this technique can be overcome to allow sinkholing of botnet domains again. Unfortunately the currently used C&C domains are not as well known as they were after the incident and analysis in 2011.

The Internet has become over the past fifteen years the medium of choice for people to communicate with each other. As Boase & Wellman (2002) have predicted, we are now firmly in the era of networked individualism where each person creates his own personal social network and interacts with numerous circles of individuals who have very different backgrounds and live in different time zones.

This telecommunication revolution has forever changed how people communicate in both legitimate and illegitimate parts of society. Past research (Wall, 2007; Décary-Hétu, 2013) has shown that the balance of power between guardians, victims and criminals has shifted over the past few years in favour of the later. Indeed, it is now easier than ever for a criminal to find willing co-offenders and to offload stolen financial data on the black market (Holt & Lampke, 2010). To do so, criminals can use online forums and IRC chat rooms to post messages about what they need or have for sale. Possible business partners can then privately communicate in order to negotiate a satisfactory agreement.

While the Internet has solved many of the networking issues criminals were facing, it has also created new ones. As no one will share (or is able to prove) past criminal activities, criminals have had to rely on signs and signals that others send or display in order to decide whether or not to trust someone with a co-offending opportunity or with a business transaction. Signs and signals (Gambetta, 2009) such as clothing, tattoos and ethnicity that were commonly used to assess the trustworthiness of individuals are difficult to translate in the virtual world. In the context of the Internet, it is considerably easier to fake any of the aforementioned signs and signals and they therefore lose most of their significance.

To offset this problem, the administrators and moderators of online criminal forums and IRC chat rooms have adopted reputation scales that work just like the ones on popular merchant sites like eBay and Amazon (Motoyama et al., 2011). Users and administrators can then rate each other and provide a sense of the trustworthiness of others in the criminal community. Past research (Décary-Hétu, 2013) has shown that this reputation is not distributed randomly among the criminal population. To the contrary, many predictors of higher reputation can be identified and only a few individuals manage to outperform others in this regards. Those that accumulate the most reputation capital can then use it to increase their sales of illicit goods and services (Décary-Hétu, 2013).

This presentation aims to build on this research and provide a new understanding of how individuals accumulate reputation by looking at an illicit forum where participants talk about botnets and buy/sell botnet-related services. To do so, we have collected data on all of the forum members as well as their reputation level over a period of several months. Using Nagin et al.’s (2006) life-course trajectories approach, we have developed a model that identifies the different paths that members follow when they accumulate reputation in this online forum. This approach takes into account multiple predictors to classify each individual into a single group of offenders based on how they accumulate reputation points. Our results confirms that reputation is not distributed randomly but extends past research by demonstrating that there are differences in how people accumulate reputation. This enables us to better understand the careers of these individuals and to create tools that would identify key players in the online criminal underground before they have reached their full potential.

Earlier this year Mandiant published a report about a hacking group called APT1. Paul’s presentation focuses on his own in-depth analysis of this group, based on the information provided by Mandiant. Paul discovered numerous C&C (Command & Control) servers located in China running the same software that is highlighted in the Mandiant report. He managed to penetrate the infrastructure using vulnerabilities identified in the C&C server. Paul’s research provides a rare insight into activities and methodologies used by these attackers. This presentation will identify the infrastructure, tools, and malware used by the group to perform unscheduled backups of company data and intellectual property.

We will present a general-purpose laboratory for large-scale botnet experiments. We reveal how several key points have been implemented, e.g., realistic simulation of the Internet or total observability within the laboratory. As a case study, we demonstrate the feasibility of our approach in simulating a large-scale takedown of the Citadel botnet. Additionally, we will show a screencast of the Citadel takedown.

This presentation aims to explain how works MalwareTrap, a DNS resolution traffic analysis platform deployed into a major French company’s network. MalwareTrap was created to complete internal anti-malwares protections. It constantly listens to the internal DNS resolution traffic between workstations and Internal DNS. When it spots a DNS request for a domain name considered by MalwareTrap as a security threat, the internal DNS replies not the domain name’s real IP but the IP of the MalwareTrap’s entry point. The suspicious workstation then talks to MalwareTrap as if it were the server behind the domain name.

Exploit Krawler is a device that will allow us to grab the tools from miscellaneous exploit kits (applet java,pdf..) in order to make their analysis easier. These exploit kits are more and more numerous on Internet and are more and more used to drop malwares and build botnets. One problem for the security researchers is to reproduce the infections and access the while infection chain. The Exploit Krawler framework goal is to answer these problems at a large scale. Exploit Krawler is a cluster of Selenium instrumented browsers. Browsers are driven in different virtual machines; each virtual machine is monitored to detect an intrusion through its browser.

Monitoring is implemented through the hypervisor. The hypervisor API is used to dump the memory, dump the disks and also launch actions on the virtual machine. Process, socks and DLL which are added or removed during the crawl are checked. Each VM reaches the web pages through Honeyproxy. So all the accesses are logged and the proxy downloads the whole set of web transactions (page, applet, executable,…).
The initial URL list is shared inside the cluster and every newly found URL is distributed through a demultiplexer; the goal is to run different browsers on the same URL with different or identical referrers to trigger the infection, as some exploit kits only triggers on a given Referer and/or for a given browser.

The cluster is spread on different continents in order to come from different networks, because some exploit kits also trigger depending on the browser location. When a browser finds a trapped page, it will follow the whole infection chain (redirection, Javascript callback) and the virtual machine will be freezed as soon as the first control channel with the central server will be up. Meanwhile, the proxy has registered the whole infection and grabbed the miscellaneous infection vectors (executable, Java applet…) which exploited the browser vulnerabilities. Once the virtual machine is freezed, the whole memory is dump for analysis, and the whole file system as well. The virtual machine will be released to let the compromission go on and all the connections to the control channel will be registered to get the whole chain.

The problem of tracking botnets is not a new one, but still proves to be an important and fruitful research topic. We have been tracking many botnets for years using an internally built tracking system, which has undergone a number of significant improvements and changes over the years. The basic tenet is a language for implementing botnet command-and-control mechanisms and tracking the resulting infiltrated botnets. This paper will cover the evolution of this system, which offers a vignette of the evolution of the modern day botnet itself. With this historical backdrop, we discuss our current monitoring mechanisms and selected botnet family case-studies, highlighting results we have obtained from our system and conclude with offering a toolkit which allows others to conduct similar investigations.

Since their first signs of existence in the early 2000’s, botnets have been a subject of interest for information security researchers. Considering the technological advancements in the latest releases of most common botnets, it can be said that their impact in the cyber-landscape is not only technical, but also financial and sociological. Nowadays, botnets are a real game-changer in the underground economy, providing criminals with the infrastructure they need to perpetrate a wide array of crimes: spam, click jacking, carding and denial-of-service attacks are some well-known examples.

There are several methods to study botnets – some of them stem from classical malware analysis techniques, like reverse engineering, behavioral analysis, and others are closer to computer and network forensic science. Since botnets are usually operated according to important financial incentives, open-source investigation techniques (a.k.a. ‘good old detective work’) are also a way to gather interesting intelligence on botnets and their handlers.

Botnets have a very specific characteristic that makes them unique: they’re a social malware. Just as social animals must interact with each other in order to survive, bots belonging to a same botnet must communicate, between bots or towards a central command and control (C&C) point in order to run. Bots can hide, but they must run. This has great consequences on their resilience, and also on how complicated it is to create and maintain one. Remember that bots can hide, but they must run; no matter how complex or advanced, they will eventually have to reach out to their peers. Botnets’ communication channels and protocols as well as C&C infrastructures will be our main focus throughout the presentation.

I will expose my point of view on how network traffic and botnets’ communication protocols can be analyzed to understand how they operate and establish proper strategies for identification, containment, and countermeasures against botnet attacks. I’ll start by giving a brief overview of the evolutions of botnets’ network architecture throughout history, usually following closely the habits of corporate and personal computer users. With the important financial motives behind them, botnets are becoming increasingly complex; different botnets use different C&C topologies – centralized, decentralized, multi-server, hierarchical, peer-to-peer, fluxing… we’ll take a look at these architectures and see what kind of information we can extract when analyzing their communications, and which countermeasures are best for each case. I will also introduce Malcom, a malware communications analysis tool that I created to obtain real-time visualizations of a given malware’s network communications. Malcom allows us to determine – in a whisk – what kind of topology is in use, and track eventual changes as they are being made by the botmasters.

Actionable intelligence is great to have when dealing with botnets. But knowing where to strike, which servers to take down, or which addresses to avoid is not enough if that information is not fresh. We’ll see how Malcom can be used to track and correlate malicious elements in botnets, and how that information can be used to build a profile on the botherders or malware family, by using Whois, emails, URLs, or AS information. Sharing that kind of information with other entities dealing with this kind of threats (such as CERTs) is a crucial step in the fight against malware. We’ll also see how Malcom can allow such information to be shared in a safe and anonymous way, so as to make incident response as swift as possible.