ITU Workshop on Frameworks for National Action:
Cybersecurity and Critical Information
Infrastructure Protection
Geneva, Switzerland - 17 September 2007
Document CYB-WS07/4-E
17 September 2007
Original: English
For more detailed information, please see the workshop website at www.itu.int/ITU-D/cyb/events/2007/Geneva/

September 2007
Suresh Ramasubramanian & Robert Shaw
<cybmail@itu.int>
ICT Applications and Cybersecurity Division
Policies and Strategies Department, BDT
International Telecommunication Union
International
Telecommunication
Union
ƒ What is a Botnet?
¾ A collection of infected and compromised computing devices harnessed together and remotely controlled for malicious purposes
ƒ How powerful is a Botnet?
¾ Like supercomputers created through distributed computing systems
ƒ e.g., BOINC: used for SETI@Home, Atomic Physics
ƒ People agree to donate spare computing resources
¾ Botnets: a special case of distributed computing
ƒ Without consent of computer owner (a zombie)
ƒ Hijacking of computing resources
September 2007 2
1

ƒ Botnets are a worldwide menace, widely used by spammers and cyber criminals
ƒ Use of botnets for cybercrime has increased and become more refined since 2002-3 when first mass mailer worms such as Sobig and Sober were released
September 2007 3
ƒ 2007 generation botnets such as Zhelatin (Storm
Worm) are particularly aggressive using advanced techniques such as fast-flux networks to make it harder to shut down and even striking back with denial of service (DDOS) attacks against security researchers or vendors trying to mitigate the botnet
¾ "Fast-flux service networks are a network of compromised computer systems with public DNS records that are constantly changing, in some cases every few minutes.
These constantly changing architectures make it much more difficult to track down criminal activities and shut down their operations.“
ƒ Honeynet Project & Research Alliance
September 2007 4
2

September 2007
Source: Wired Magazine
5
ƒ Virus Writers, Botherders, Clients
¾ Virus writer writes malware, infects computers to create botnet
¾ Botherder operates the botnet
“command and control” (C&C)
¾ Clients hire botnets to distribute spam, launch
Distributed Denial of Service (DDoS) attacks, to conduct identity theft
ƒ Highly developed underground channels of communication
¾ “Secret” forums/chat rooms that shift location
¾ Access on a need to know basis, new entrants may need to be vouched for by existing participant
September 2007 6
3

ƒ Botherders now offer “service level agreements” to clients
¾ Guaranteed replacement of botnet in case anti-virus researchers release fix for malware or botnet is taken down
ƒ Organized crime involved in all stages of ecosystem
¾ Employ virus writers to create malware
¾ Carry out spam campaigns, espionage, ID theft, cyber-attacks
¾ Laundering of money stolen from victims
September 2007 7
ƒ C&C centers harder to trace
¾ Originally hosted on public IRC channels
¾ Now encrypted, access restricted C&C software
ƒ C&C centers may be hosted on botnets
¾ Increased redundancy
¾ Makes takedown harder
ƒ New “headless” single use botnets
¾ No centralized control or C&C required
ƒ new generation of P2P botnets
¾ Instructions embedded into malware
¾ New malware and botnet created for a new task
¾ Cannot stop botnet by taking down its C&C
September 2007 8
4

ƒ Self-propagating: infected hosts infect other hosts
¾ Infection vectors include email, P2P networks, open shared network folders, Skype, visiting infected website
¾ Newer malware spreads faster than older generations
ƒ Spread resembles global pandemic (SARS, Bird Flu)
¾ Can similar threat models/mitigation mechanism theories be applied?
ƒ Analysis, Detection and Removal more difficult
¾ Self-destruct mechanisms to destroy data if malware removed
¾ “Droppers” malware download more payload onto compromised host
¾ Encryption and debuggers / Virtual Machine (VM) traps to prevent forensic analysis
September 2007 9
ƒ Send spam
¾ Most visible use of botnets
¾ Botnets can host entire spam campaign
ƒ Including DNS servers, website hosting, spam sending
ƒ Content can change location from PC to PC, country to country, in minutes
¾ “Take” from a spam run can be reused
ƒ 419 scam artists now buying lists of compromised accounts from botherders, using these to spam
¾ But spam is just the tip of the iceberg
September 2007 10
5

What else can you do with a Botnet?
ƒ Attack a country’s Internet infrastructure
¾ Estonia: 128 unique DDoS attacks in two weeks
ƒ Extortion/Blackmail
¾ Threaten to DDoS/cripple e-commerce websites
ƒ Identity theft and Industrial Espionage
¾ Steal credit cards, passwords, etc. from infected PCs
¾ Use computing power of a botnet to break into secured networks and steal data, credit cards
ƒ Stock “Pump and Dump” scams
¾ Use spam from botnet PCs to advertise stock
¾ Trade in this stock using online share trading accounts from infected PCs, artificially boost prices
September 2007 11
ITU Botnet Mitigation Project originally inspired by Australian Internet Security Initiative (AISI)
ƒ Australian Communications and Media Authority (ACMA) partnership with 25 Australian ISPs
¾ ACMA collects data on IPs emitting malware
ƒ Identifies IPs operated by participating Australian ISPs
ƒ Notifies ISP responsible for affected IPs
¾ ISPs undertake to mitigate malware activity from infected
IPs on their networks
ƒ Notify infected customers
ƒ Change security and filtering policies as necessary
ƒ AISI project working internationally to fight botnets and has agreed to assist ITU project and extend AISI to other ITU
Member States
September 2007 12
6

ƒ Identify coordination agency for a nationwide botnet mitigation strategy
¾ Multi-stakeholder, Multi-pronged Approach (like OECD spam toolkit)
¾ Public-Private Partnership
¾ Make best possible use of existing initiatives and structures
ƒ Infrastructure for botnet scanning, measurement and mitigation
¾ Capacity building on tools and techniques to track botnets
¾ Identification of trusted interlocuters (e.g., international security and AV research community, CERT teams) for incident reporting
September 2007 13
ƒ Detection and takedown of botnet hosts and related infrastructure
¾ Infected PCs (automate as far as possible), C&C hosts, domains registered for botnet, payment gateways used by botnets, etc
ƒ Build awareness of security best practices for ISPs, e-commerce sites
ƒ Promote general Internet safety through end-user awareness programmes, engagement of civil society for assistance and grassroots penetration
September 2007 14
7

ƒ Framework for national botnet related policy, regulation and enforcement
ƒ Multi-stakeholder international cooperation and outreach
¾ Phase 1 (2007): Downloadable toolkit/guidelines for
ITU Member States
¾ Phase 2 (2008/2009): Targeted national/regional assistance initiatives
ƒ Discussions with Malaysia, India
¾ Cooperation with other partners?
ƒ LAP, APEC-TEL/OECD, MAAWG, APWG, Interpol?
September 2007 15
ƒ ITU-D ICT Applications and Cybersecurity Division
¾ www.itu.int/itu-d/cyb/
ƒ ITU Botnet Project Website
¾ www.itu.int/ITU-D/cyb/cybersecurity/projects/botnet.html
ƒ Botnet Mitigation Toolkit Overview
¾ www.itu.int/ITU-D/cyb/cybersecurity/docs/itu-botnetmitigation-toolkit.pdf
ƒ Regional Workshop on Frameworks for Cybersecurity and Critical Information Infrastructure Protection
¾ www.itu.int/ITU-D/cyb/events/
ƒ Cybersecurity Publications
¾ www.itu.int/ITU-D/cyb/publications/
September 2007 16
8

Helping the World Communicate
September 2007 17
9