ITU Zombie Botnet Mitigation
Project: Background & Approach
17 October 2007
Robert Shaw & Suresh Ramasubramanian
<cybmail@itu.int>
ICT Applications and Cybersecurity Division
Policies and Strategies Department, BDT
International Telecommunication Union
International
Telecommunication
Union
Botnets – An Overview
ƒ What is a Botnet?
¾ A collection of infected and compromised
computing devices, harnessed together and
remotely controlled for malicious purposes
ƒ How powerful is a Botnet?
¾ Supercomputers
¾ Distributed Computing Systems
ƒ BOINC – Used for SETI@Home, Atomic Physics
ƒ People agree to donate spare computing resources
¾ Botnets: A special case of Distributed Computing
ƒ Without the consent of the computers’ owners
ƒ More computing power than a supercomputer – for free
October 2007
2
The Botnet Economy
ƒ Virus Writers, Botherders, Clients
¾ Virus writer writes malware, infects computers to create a botnet
¾ Botherder operates the botnet’s “command and control” (C&C)
¾ Clients hire botnets to use for Spam, DDoS, Identity Theft
ƒ Highly developed underground economy
¾ Underground channels of communication
ƒ “Secret” forums and chat rooms that frequently shift location
ƒ Access shared on a need to know basis, new entrants may need to be
vouched for by an existing participant
¾ Botherders offer support contracts to clients
ƒ Guaranteed replacement of botnet in case antivirus researchers release
a fix for the malware, or the botnet is taken down
ƒ Organized crime involved in all stages of the economy
¾ Employ virus writers to create malware
¾ Carry out spam campaigns, espionage, ID theft, cyber attacks
¾ Launder money stolen from victims
October 2007
3
Evolution of Botnets
ƒ C&C centers harder to trace
¾ Originally hosted on public IRC channels
¾ Now encrypted, access restricted C&C software
ƒ C&C centers may be hosted on botnets
¾ Increased redundancy
¾ Makes takedown harder
ƒ New “headless” single use botnets
¾
¾
¾
¾
No centralized control or C&C required
Instructions embedded into the malware
New malware and botnet created for a new task
Cannot stop botnet by taking down its C&C
October 2007
4
Evolution of Malware
ƒ Malware is Self Propagating
¾ Infected hosts infect other hosts
ƒ Infection vectors include email, P2P networks, open shared network
folders, visiting an infected website
ƒ Newer malware spreads faster than older generations of malware
¾ Its spread resembles that of a global pandemic (SARS, Bird Flu)
ƒ Similar threat models and mitigation mechanisms can be applied
ƒ Malware is becoming increasingly sophisticated
¾ Earlier, mostly spread through infected floppy disks
¾ Spreads much faster over the internet
ƒ Email, IM, compromised websites, P2P, network shared folders)
¾ Principles of software engineering evident in recent malware
¾ Analysis, Detection and Removal more difficult
ƒ Self destruct mechanisms to destroy data if the malware is removed
ƒ “Droppers” download more malware onto a compromised host
ƒ Encryption and Debugger / VM traps to prevent forensic analysis
October 2007
5
What can you do with a Botnet?
ƒ Spam
¾ The most visible use of botnets
¾ Botnets can host an entire spam campaign
ƒ DNS servers, website hosting, spam sending
ƒ Content can change location from PC to PC,
country to country, in minutes
¾ “Take” from a spam run can be reused
ƒ 419 scam artists now buying lists of compromised
accounts from botherders, using these to spam
¾ Spam is just the tip of the iceberg.
October 2007
6
What else can you do with a botnet?
ƒ Attack a country’s Internet infrastructure
¾ Estonia – 128 unique DDoS attacks in two weeks
ƒ Extortion
¾ Threaten to DDoS and cripple ecommerce websites
ƒ Identity theft and Industrial Espionage
¾ Steal credit cards, passwords etc from infected PCs
¾ Use the computing power of a botnet to break into
secured networks and steal data, credit cards
ƒ Stock “Pump and Dump” scams
¾ Use spam from botnet PCs to advertise a stock
¾ Trade in this stock using online share trading
accounts from infected PCs, artificially boost prices
October 2007
7
Australian Internet Security Initiative
ƒ Watch, Warning & Incident Response System
¾ Public Private Partnership
ƒ ACMA, together with 25 Australian ISPs
¾ ACMA collects data about IPs emitting malware
ƒ Identifies IPs operated by participating Australian ISPs
ƒ Notifies the ISP responsible for affected IPs
¾ The ISP undertakes to mitigate malware activity
from the affected IPs on their networks
ƒ Notify infected customers
ƒ Change security and filtering policies as necessary
ƒ AISI to be shared with international partners
¾ Proposed strategic cooperation between ITU and ACMA
¾ Extend AISI to ITU member states
October 2007
8
Botnet Mitigation Package
ƒ Broadly parallels previous efforts such as the OECD Spam Toolkit
ƒ Identify nodal agency for a nationwide botnet mitigation strategy
¾ Multistakeholder, Multipronged Approach
¾ Public Private Partnership
¾ Make best possible use of existing initiatives and structures
ƒ Infrastructure for botnet scanning, measurement and mitigation
¾ Capacity building on tools and techniques to track botnets
¾ Identification of trusted reporters (international security and AV
research community, CERT teams et al) for incident reporting
ƒ Detection and Takedown of botnet hosts and infrastructure
¾ Infected PCs (automate as far as possible), C&C hosts, domains
registered for a botnet, payment gateways used by botnets etc
ƒ Awareness of security best practices for ISPs, ecommerce sites
ƒ Ensure public access to secure ICT, awareness of Internet safety
¾ Engage local civil society for assistance and grassroots penetration
ƒ Framework for botnet related policy, regulation and enforcement;
ƒ Multistakeholder international cooperation and outreach
¾ COE Cybercrime Convention, LAP, APECTEL/OECD, MAAWG, APWG
October 2007
9
Current Shortcomings – Policy
ƒ Lack of relevant Cybercrime and antispam legislation
¾ Existing Cybercrime / spam laws may need to be updated
or revised, keeping botnet related crime in mind
ƒ Capacity building for regulators, police, judiciary
¾ Training existing officials may be supplemented by coopting or active recruitment of technical experts
ƒ Paucity of international cooperation and outreach
¾ Participation in local, regional and international initiatives
¾ Engagement of relevant government, regulators, law
enforcement with their peers and other stakeholders
around the world
¾ Active outreach to countries and stakeholders known to be
particularly susceptible to Cybercrime issues
October 2007
10
Shortcomings: Industry, Public
ƒ ISPs, eCommerce vendors require capacity building
¾ Engagement with international industry groups
¾ Promotion of industry wide security best current practices
ƒ Antispam, Anti Malware, Credit Card Fraud, Network Security
¾ Suggested re-engineering of security policies
ƒ Education and access to secure ICT for users
¾ Awareness of common scams
¾ Availability and use of Firewalls, Antivirus Software
¾ Motivation to avoid the use of pirated software
ƒ Paucity of cooperation and public private partnerships
¾ Participation at grassroots, national and international levels
ƒ Participation has to be relevant, meaningful and informed.
ƒ Capacity building [and funding] for relevant stakeholders to ensure
meaningful participation in local, regional and international initiatives
ƒ Bridge the information and perception gaps between stakeholders
October 2007
11
Proposed Project Activities
ƒ Measures for botnet detection, measurement and mitigation
¾ Identify existing initiatives, best practices and stakeholders
ƒ Adapt existing best practices to suit local conditions, as necessary
¾ Build watch, warning and incident response systems
ƒ AISI, alerts from CERT and security research groups et al
¾ Maintain open and public channels of communication
¾ Integrate botnet mitigation with general ICT development
ƒ Pandemic treatment and mitigation vis a vis public health initiatives
ƒ Holistic approach required to improve the general “Internet Health”
ƒ Field mission to help extend AISI and other relevant measures
to a developing economy [as a pilot project]
ƒ Draft, in association with AISI, the national framework for
botnets mitigation, part 2 of the package
October 2007
12
Proposed activities (continued)
ƒ Organize workshop for botnets mitigation
¾ Bring representatives of existing initiatives and relevant
experts together with other stakeholders
¾ Promote and facilitate capacity building
ƒ Identify and share existing sources of information
¾ Make relevant best practice documents widely available
¾ Translate these into the official UN languages
¾ Encourage contribution of translations in other languages
ƒ Finalize the botnets mitigation package
¾ Translate and widely disseminate
ƒ Proposed annual forum on botnet mitigation
¾ Integrate with current WSIS C5 activities, thematic meets
¾ Possible cooperation with an existing international forum
October 2007
13