3. Botnets

Question 1

What are bots/ botnets?

Answer 1

Bots: A bot is piece of malicious software with remote control capabilities
Botnet: A network of computers infected with a bot. The bot is controlled by C&C (Command and Control) Infrastructure. The attacker, which controls the botnet is called herder. The infected computer is called a zombie or drone.

Question 2

What are attacks mounted with the help of botnets?

Answer 2

-Distributing spam and phishing emails
-Mounting distributed denial of service (DDoS) attacks
-Conducting data theft with the help of spyware like key
loggers, webcam recording capabilities…
-Conducting click-fraud
-Spreading new malware

Question 3

What is the life-cycle of a bot from a herder point of view?

Answer 3

-Creation: Development of the botnet software often reusing existing code
Infection: via Software vulnerabilities, drive-by-downloads,
Trojan horses, email attachments,…
Rallying: Bots start up for the first time and attempt to contact the C&C server(s)
- Centralized: join IRC channel, connect to HTTP server
- Decentralized: bootstrapping protocol to detect other peers in the P2P
network
Waiting: Bots wait for commands from the botmaster through C&C
infrastructure
Executing: Bots execute commands received through the C&C
infrastructure
-E.g. scanning for new victims, downloading updates, sending DoS floods,….

Question 4

What is the life-cycle of a bot from a defense point of view?

Answer 4

-Detection
-Capturring
-Analysis
-Tear Down

Question 5

What are the C&C techniques?

Answer 5

Centralized:
- IRC (Internet Relay Chat)
- HTTP
Decentralized:
- P2P (Usually hybrid)

Question 6

How is a centralized botnet taken down?

Answer 6

-Locate C&C Server and take them down:
- Analyze network traffic of bots
-Make C&C Server unreachable
- Block DNS/ IP range
-**Find out which devices in your network are infected
-Use Sinkhole with DNS entry and see who connects

Question 7

How is the IP of a C&C Server hidden?

Answer 7

Domain Generating Algorithms (DGAs):
- Use a seed to generate domain names and query them
- Most domains are not registered, but some are
Fast Flux in DNS
- Multiple IP addresses on a single DNS record, cahnged quickly
- No one server to take down

Question 8

How is a P2P botnet taken down?

Answer 8

• More difficult then centralized Botnets, no simple solution
• Ultimately requires desinfection off all infected nodes
• If commands are not signed correctly: Command bots with cleanup tool

Question 9

How to track down botnet herders?

Answer 9

• No general method, dependend on C&C type
• Put network taps on C&C Server
• Social engineering: Pretend to be potential buyer

Question 10

Roles in organzied crime with Botnets

Answer 10

• Exploit Developers: Looks for exploits to infect computers
• Malware Programmers: Develop C&C server and bot client
• Botnet Herders: Operates the botnet and rents/ sells control
• Bot Users: Uses botnet to mount an actual attack

Question 11

How is money made from Botnets?

Answer 11

Stealing Information
- Selling bank account
- Selling identity information
Ransomware
DDOS

Question 12

What was the Mirai Botnet and how did it work?

Answer 12

• IoT Botnet with centralized C&C
• Infected DVRs, routers, IP cameras etc. with misconfigured ports or default credentials
• Used to DDOS e.g. OVH.com

Question 13

What is Stuxnet and how did it work?

Answer 13

• Targeted attack against SCADA networks, likely by intelligence organization
• Worm with C&C Server for updates
• Used 3 zero day exploits to infect Windows machines and looks for SCADA software