Cатсн²² (in)sесuяitу / ChrisJohnRiley

Botnet identification and remediation

Barry Irwin

Modern botnet trends have become increasingly sophisticated both in terms of the techniques used to avoid detection on compromised endpoints, but also in their varied communication channels. The use of IRC as the communications medium of choice for Command & Control (C2) activities has been replaced with sophisticated use of IP and domain fast-fluxing to avoid detection and increase resilience. These techniques largely bypass traditional network security detection and mitigation approaches such as blacklists and intrusion detection systems.

Gone are the days of owning a system, defacing it and getting your name up on zone-H. Today it’s all about monetizing these systems. In particular in South Africa the increase in connectivity over the past few years has exposed a large amount of systems to the internet that are unpatched and unprotected. A botmasters wet dream.

Botnet Evolution

Traditionally IRC used as C&C

New malware uses fast-flux to avoid detection and increase resilience (DNS Tunneling DNS C&C HTTP, P2P)

Mitigation

Not easy

Traditional approaches are resource intensive and difficult to automate. Closing the loop and applying remediation aren’t simple tasks.

Digital zombies… they keep coming back

Why bother?

• Isn’t this somebody elses problem?
• Its $vendors fault
• My AV is almighty
• It won’t happen to me

if you don’t care about the small things…

Detection

The DNS approach

• Hard coding IPs is a sure-fire way to lose your botnet.
• DNS is integrated into the TCP/IP protocol stack
• Commonly being used as a means of pointing to a C&C server
• Provides a fixed to volatile mapping
• Essential but commonly ignored
• Completely passive collection of DNS query data can be done on a network using taps or DNS servers themselves

Passive Lexical Analysis

• Actual domain names can be analysed and scored
• There is a difference between human created domain names and those created using an algorithm
• Malicious domains can be identified using an analysis of characters used in the domain itself.
• Does this look right? Can never be 100% certain
• Possible to calculate letter frequencies as they occur in DNS (research focused on English language, but not restricted)

Interactive Queries

• Data such as TTLs, A records, ASNs
• Easy to see differences from normal domains
• Content distribution networks look a lot like fast-flux DNS!
• Whois information looking at registrar info, registration date, country of registration
• A 10-year-old domain is probably not a fast-flux (unless they got owned)

URL Based Heuristics

Current Countermeasures

• Blacklists
• Google
• Spam haus
• Day old bread
• OpenDNS
• Phishtank
• …
• Automated classifications
• Host based
• Lexical
• Full Featured

Initial Perceptron Results

Remediation

Links:

• BruCON Talk Overview
• Barry Irwin research page 
• Day old Bread –> List of domains registered in the last 24 hours