back to the article index
Page feed
Botnets
Menu
Nature
Spreading mechanisms
Hiding/Resistance mechanisms
Analysis/Counter measures
- Detection
- Analysis
- Counter-measures
- Take-over
Motives/Context
- The Scrap Value of a Hacked PC by Brian Krebs, Security Fix, May 2009
- very complete overview including a mind-map to sum-up visually all the potential usages
- Direct business
- Data harvesting, mainly financial data (credit card numbers, passwords, ...)
- threats on service availability (extortion by stopping DDoS for money)
- spam
- Indirect business (Reselling, Renting)
- Warfare
- Cyber Weaponization: Analysis of Internet Arms Development, Jason Gordon, infectionvectors.com, 2008
- 25C3: Just Estonia and Georgia? by Gadi Evron, 25th Chaos Communication Congress, December 2008 and his older T242 - Estonia and Information Warfare, Defcon 15, 2007
- Carpet bombing in cyberspace - Why America needs a military botnet, in Armed Forces Journal, May 2008
- Kremlin-backed group behind Estonia cyber blitz by Charles Clover, FinancialTimes, March 2009
- Information Warfare Monitor by The Secdev Group and the Citizen Lab
- Analyst: cyberwarfare arms race with China imminent by Ryan Paul, Ars Technica, May 2009
- based on a report by Technolytics which published work on Cyber Military Resources/Weapons Threat Matrix/Warfare Doctrine/...
- Political activism
Evolution
Observations/General description
- Botnets in 2010 by Thorsten Holz, SIGINT10
- Chapter 7 : Bot networks of Crimeware: Understanding New Attacks and Defenses by Addison-Wesley, 2008
- Security Now! Podcast #193 : Conficker, GRC, April 2009
- An Analysis of Conficker C, SRI International (Last Update: 4 April 2009)
- Network Bluepill - stealth router-based botnet has been DDoSing dronebl for the last couple of weeks by nenolod, DroneBL Blog, March 2009
- Technical details of Srizbi's domain generation algorithm for FireEye Malware Intelligence Lab, November 2008
- Video Tutorials on Malware Analysis (botnets and rootkits) by WatchGuard
- Botnets according to Shadowserver Foundation, last modified on November 2007
- bots and botnet an overview by SANS, 2003
- Archived version of GRC report on bonet ~2001
- Build your own botnet with open source software, Enomaly, March 2008
- VX Chaos Bot and Botnets file server section, (2004-2008)
- How to Make a Botnet from Partyvan W/i/ki, started in October 2008, last update when checked in April 2009
- Visualizations
- Botnets, Part 1: Why They Strike and How to Defend Against Them > The Botnet Threat by Carolyn Meinel, InformIT, December 2008
- Botnets: The Killer Web App, Syngress, 2007
- pretty good coverage but (logically) quickly outdated
- The Enemy Within by Mark Bowden, The Atlantic June 2010
Other
Sources for news
Potential studies
- economy framework, value/utility of hosts
- h0 : based on quantity anyway so +1 bad is still +1
- but still server>cable>adsl>dialup (based on uptime+upload bandwidth)
- specialization mechanisms?
- knowledge transfer between botnet/p2p with an evolutionary epistemologic framework (see our drive page)
- its potential automation
- see "automated/boosted evolutions" later on
- evidences
- emergence of functionnalities/behavior on the running software and correlation with the appearance time in the other community
- studying social places (forum, chats, etc...) but that could be idealized so it shouldn't be limited to that
- can one side use the anticipated arm-race to gain a decisive edge?
- To transfer or not to transfer, NIPS 2005 Workshop on Transfer Learning
- "phylogenetic-like" study of the botnets (eventually inspired by ALife studies)
- what were the features kept over time
- the share source codes
- automated/boosted evolutions
- biomimicry
- Exploiting virtualization
- implementation of pattern of nodes as communication rather than message getting passed along or found in a central location (message = timing rather than content)
- benefits : much harder to reverse engineer as multiple protocols can be used and content of the packet do not matter anymore (it is not steganography)
- inspiration : video on reverse engineering in Recon'08 + brain neural network and absence (or at least not during the whole time) of symbols
- see the related : [0905.0363] Hiding Information in Retransmissions, May 2009
- RSTEG (Retransmission Steganography) to not acknowledge a successfully received packet in order to intentionally invoke retransmission. The retransmitted packet carries a steganogram instead of user data in the payload field.
- inclusion of automated services based on human labor hired on the fly for small tasks (AmazonTurk, Decaptcher, ...) within a botnet
- example : extracting financial data from a local node without having to centralize and involve the bot herder directly in "delicate" tasks
- related resource : our article on Online outsourcing
- inspiration : previous studies on AAI (Artificial Artificial Intelligence), AmazonTurk and finally the ractor network in The Diamond Age
- leveraging existing P2P networks
- social network mining
Schemas
(:pmgraphviz --
digraph {
"drive" -> "writing";
"drive" -> "injection" [label="use of existing code"];
"writing" -> "injection";
"injection" -> "propagation";
"propagation" -> "propagation" [label=" +=1 machine"];
"propagation" -> "stagnation";
"stagnation" -> "stagnation" [label=" stealth wait for request"];
"stagnation" -> "propagation";
"stagnation" -> "synchronization" [style=dashed];
"stagnation" -> "action";
"synchronization" -> "action" [style=dashed];
"stagnation" -> "upgrade" [style=dashed];
"writing" -> "upgrade" [style=dashed];
"upgrade" -> "stagnation" [style=dashed];
"synchronization" -> "stagnation" [style=dashed];
"action" -> "stagnation";
}
:)
| Drive | Writing | Injection | Propagation | Stagnation | Synchronization | Action | Upgrade |
| what motivates one to use a botnet | how can one build one, based on existing code or delegating it | how does one initiate it (bootstrap phase, injection in the network) | how does the botnet agents propagate from machine to machine to gather more agents | how each agent stay stealth while waiting for more commands | how all the agents synchronize themselves when organization are required (for example DDoS) which is mainly communication | finally doing one the possible action (the real payload) | being able to upgrade itself in order to do more action, stay more stealth, ...) |
See more detailed schemas to go further.
How I (probably) got there
- security (virii/worms)
- p2p
- distributed computing (seti@home)
- freenet
- the "curious yellow" philosophical idea
- "implementation of in-the-cloud technology which is the final result of years of experience using this community database technology [...] has helped many people by intercepting and blocking new infections days, weeks, before they could have been manually analyzed and a signature would have been added manually by an analyst." from Real-World Example of In-the-Cloud Technology by Marco Giuliani, Prevx, Januart 2009
- The White Botnet by nikunj, Odyssey, April 2009 (few mails exchanged and even a post from the reply ;)
- evolution of security?
- having a botnet tried to gather information on my newly bought server!
/w00tw00t.at.ISC.SANS.DFind:)
