Please enable JavaScript.

Coggle requires JavaScript to display documents.

C&C (Advanced C&C (Anonymity (The darknet (1-hop proxy (Advantages…

- - - - Keep alive
        
        Bot
        
        Master
        
        Bots
      - … while
        
        Maintaining the ability of locating the master
        and/or the other peers (bots)
      - Approach
        
        Rely on robust infrastructures
    - - IRC. Ancient history
      - DNS
        
        Some C&C remain active using DNS protocol
        
        Fast Flux (FF)
        
        Web-based load balancing and proxy redirect
        
        Ever-changing network of compromised hosts
        
        Flavours
        
        Single flux
        
        Double flux
        
        Domain Flux (DF)
      - Blind proxy redirection
      - Find C&C and alternate them
      - Domain generation algorithm (DGA)
      - Social Bots (some popularity)
        
        Turing test and human mimmicking
      - Malicious social bots
        
        Difficult to gain access
        
        Arduous to find
  - - - Anonymous = not being identifiable within a set
        of subject (the AS)
    - - hiding relationship between items
        
        Sender anonymity
        
        A message cannot be linked to a sender
        
        Recipient anonymity
        
        A message cannot be linked to a recipient
        
        Relationship anonymity
    - - 1-hop proxy
        
        Legitimate paid server = Compromised Machine
        
        Advantages
        
        Simple infrastructure
        
        Might be enough
        
        Disadvantages
        
        on single point of failure
      - N-hop proxy
        
        Advantage
        
        Incoming and outgoing messages cannot be related
        
        Disadvantage
        
        More complex infrastructure
        
        Limited number of hops in the same order
        
        Mix-Net
      - N-hop proxy with rnd routing
        
        Tor
  - - - Covert bots I
        
        Detecting Covert Botnets Using
        Communication Patterns
      - Covert bots II
        
        Local network awareness
      - Malicious social bots
        
        Act like a human, think like a bot
      - Parasitic overlay
        
        Skype botnet
        
        Devices!
        
        Reddit botnet
      - Other stealthy techniques
        
        Slow rate bots
        
        Timing bots
        
        Context-aware bots
      - Use of legitimate but compromised services
      - Two-stage C&C
        
        To balance stealth and scalability
      - Several C&C domains
        
        Change frequently
        
        URL expiration
    - - Polymorphic downloader bot
      - Installs various forms of malware
      - 12.000 computers infected
      - 195 computers
  - - - Structured Based Detection
        
        Signature Based Detection
        
        DNS/etc. Based Detection
      - Behavior Based Detection
        
        Anomaly Based Detection
        
        Communication Pattern of Botnet
      - Signature based detection
        
        The first and most widely
        
        Only successful for already known Botnets
        
        Two way
        
        list of IRC nicknames and applied n-gram
        analysis
        
        IP addresses
      - DNS based detection
        
        DNS queries
        
        High or intense queries
        
        NXDOMAIN reply rates
        
        Passive analysis of DNS based Black-hole
        list (DNSBL) lookup traffic
        
        High false positive
        
        Cannot detect distributed inspection
      - Anomaly based detection
        
        Model
        
        Network latency
        
        Volumes of traffic
        
        Traffic on unusual ports
        
        Unusual system behavior
        
        Problem
        
        False positives
  - - - Static characteristics
        
        header
      - Dynamic characteristics
        
        arrival, departure, throughput, and burst time of
        payload information
      - Problem
        
        Use of normal communication channels
        
        Twitter
- - - - master control the bots
    - - same role master and bots