– Social Media Posting Allowed – Tweeter, Facebook, LinkedIn, other social media posts are welcomed in this session if you: • Only post comments made by the speakers or panelists • Do not post comments or questions from the audience (but you can share the speakers’ responses to questions) • Do not post the name, position or company of other meeting attendees • Do not post conversations with attendees • M 3 AAWG is not a deliverability conference; we are: • An industry working group meeting • An anti-abuse conference, or • A gathering of security experts • All of the M 3 AAWG Membership, Trademarks and Logo guidelines apply ( https://www.m3aawg.org/members/how-promote-m3aawg#TrademarkGuidelines ) • Appreciate a shout out to @maawg and #m3aawg42 M3AAWG 42nd General Meeting | San Francisco | February 2018
Understanding the Mirai Botnet Manos Antonakakis ✝ , Tim April ◆ , Michael Bailey ★ , Matthew Bernhard ‡ , Elie Bursztein ✱ Jaime Cochran △ , Michalis Kallitsis ● , Damian Menscher ✱ , Zakir Durumeric ‡ Deepak Kumar ★ , Chad Seaman ◆ , J. Alex Halderman ‡ , Luca Invernizzi ✱ , Chaz Lever ✝ Zane Ma ★ , Joshua Mason ★ , Nick Sullivan △ , Kurt Thomas ✱ , Yi Zhou ★ ◆ Akamai Technologies, △ Cloudflare, ✝ Georgia Institute of Technology, ✱ Google, ● Merit Network ★ University of Illinois Urbana-Champaign , ‡ University of Michigan Understanding the Mirai Botnet ▪︎ Zane Ma 2
Internet of Things 2016 2020 6 - 9 Billion ~30 Billion Understanding the Mirai Botnet ▪︎ Zane Ma 3
IoT Botnets 2012 Carna Botnet 2015 BASHLITE / gafgyt 420,000 devices 1,000,000 devices Understanding the Mirai Botnet ▪︎ Zane Ma 4
Mirai Understanding the Mirai Botnet ▪︎ Zane Ma 5
Lifecycle Attacker • Fast, stateless port-scanning: �� Send command SYN w/ TCP seq # = dest IP Command Report �� Dispatch Loader • Check for SYN-ACKs where & Control Server Infrastructure TCP seq # = src IP + 1 �� Relay ��� Load � � Report • Raw socket, requires root Devices �� Scan Victim Bots • If port open, brute force telnet � Attack login credentials DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 6
Lifecycle Attacker • Reports successful IP:port, �� Send command username:password Command Report �� Dispatch Loader • Report server aggregates & Control Server Infrastructure results �� Relay ��� Load � � Report Devices �� Scan Victim Bots � Attack DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 7
Lifecycle Attacker • Asynchronous from scanning �� Send command + reporting Command Report �� Dispatch Loader • Supports building up potential & Control Server Infrastructure “hit list” �� Relay ��� Load � � Report Devices �� Scan Victim Bots � Attack DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 8
Lifecycle Attacker • Determines architecture, �� Send command wget/tftp 1 out of 9 archs. Command Report �� Dispatch Loader • Defensive - kills competing & Control Server Infrastructure Mirai, and any processes �� Relay ��� Load � � Report listening on HTTP/Telnet/SSH Devices �� Scan Victim • Obfuscates process name Bots and removes executable - � Attack does not survive reboots DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 9
Lifecycle Attacker • Simple attack API - �� Send command configurable duration, attack size (# bots), IP spoofing Command Report �� Dispatch Loader & Control Server Infrastructure • Supports 10 attack types, �� Relay ��� Load � � Report volumetric/TCP/application Devices �� Scan Victim Bots � Attack DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 10
Lifecycle Attacker • C&C resolves domains, �� Send command issues attacks on IPs Command Report �� Dispatch Loader & Control Server Infrastructure �� Relay ��� Load � � Report Devices �� Scan Victim Bots � Attack DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 11
Lifecycle Attacker • Attacks do not interrupt �� Send command scanning Command Report �� Dispatch Loader • Fingerprintable application & Control Server Infrastructure level packets �� Relay ��� Load � � Report • Configurable reflection / Devices �� Scan Victim amplification attacks Bots � Attack DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 12
Measurement Attacker Data Source Size �� Send command Network Telescope 4.7M unused IPs Command Report �� Dispatch Loader • 0.1% of IPv4 address space & Control Server Infrastructure �� Relay ��� Load � • 1.1M packets / min � Report • Look for Mirai fingerprint Devices �� Scan Victim Bots � Attack DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 13
Measurement Attacker Data Source Size �� Send command Network Telescope 4.7M unused IPs Command Report �� Dispatch Loader • 0.1% of IPv4 address space & Control Server Infrastructure �� Relay ��� Load � • 1.1M packets / min � Report • Look for Mirai fingerprint Devices �� Scan Victim Bots • Handling IP churn: look for active � Attack concurrent scans DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 14
Measurement Attacker Data Source Size �� Send command Network Telescope 4.7M unused IPs Active Scanning 136 IPv4 scans Command Report �� Dispatch Loader & Control Server Infrastructure • Application protocol banners �� Relay ��� Load � � Report (telnet, FTP, HTTP, etc.) Devices �� Scan Victim • Device attribution: NMap service Bots probes, manual labeling � Attack DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 15
Measurement Attacker Data Source Size �� Send command Network Telescope 4.7M unused IPs Active Scanning 136 IPv4 scans Command Report �� Dispatch Loader & Control Server Infrastructure • Application protocol banners �� Relay ��� Load � � Report (telnet, FTP, HTTP, etc.) Devices �� Scan Victim • Device attribution: NMap service Bots probes, manual labeling � Attack • Future work: Individual device DDoS Target fingerprinting Understanding the Mirai Botnet ▪︎ Zane Ma 16
Measurement Attacker Data Source Size �� Send command Network Telescope 4.7M unused IPs Active Scanning 136 IPv4 scans Command Report �� Dispatch Loader & Control Server Infrastructure Telnet Honeypots 434 binaries �� Relay ��� Load � � Report • Busybox shell that accepts any telnet login credentials Devices �� Scan Victim Bots • Used collected binaries to � Attack generate YARA rules DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 17
Measurement Attacker Data Source Size �� Send command Network Telescope 4.7M unused IPs Active Scanning 136 IPv4 scans Command Report �� Dispatch Loader & Control Server Infrastructure Telnet Honeypots 434 binaries �� Relay ��� Load � Malware Repository 594 binaries � Report • Found VirusTotal binaries Devices �� Scan Victim matching YARA rules Bots � Attack DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 18
Measurement Attacker Data Source Size �� Send command Network Telescope 4.7M unused IPs Active Scanning 136 IPv4 scans Command Report �� Dispatch Loader & Control Server Infrastructure Telnet Honeypots 434 binaries �� Relay ��� Load � Malware Repository 594 binaries � Report Active/Passive DNS 499M daily RRs Devices �� Scan Victim • Active = Thales DNS monitoring Bots system, using zone files, domain lists � Attack • Passive = Resource Records from DDoS Target large US ISP Understanding the Mirai Botnet ▪︎ Zane Ma 19
Measurement Attacker Data Source Size �� Send command Network Telescope 4.7M unused IPs Active Scanning 136 IPv4 scans Command Report �� Dispatch Loader & Control Server Infrastructure Telnet Honeypots 434 binaries �� Relay ��� Load � Malware Repository 594 binaries � Report Active/Passive DNS 499M daily RRs Devices �� Scan Victim C2 Milkers 64K issued attacks Bots • C&C doesn’t authenticate / � Attack validate connecting bots DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 20
Measurement Attacker Data Source Size �� Send command Network Telescope 4.7M unused IPs Active Scanning 136 IPv4 scans Command Report �� Dispatch Loader & Control Server Infrastructure Telnet Honeypots 434 binaries �� Relay ��� Load � Malware Repository 594 binaries � Report Active/Passive DNS 499M daily RRs Devices �� Scan Victim C2 Milkers 64K issued attacks Bots Krebs DDoS Attack 170K attacker IPs � Attack DDoS Target Understanding the Mirai Botnet ▪︎ Zane Ma 21
Recommend
More recommend
