The current state of botnet research and tools and techniques to mitigate an attack.

1. Botnets
CI450
MattVieyra

2. Fighting Botnets with Sinkholes
• Also known as DNS Sinkholes or DNS Blackholes
• Spoof DNS servers to prevent resolving host names of specified URLs
• Most botnets rely on Command and Control servers (C&C)
• One way to deal with them is to seize control.

3. • Data flow for DNS
resolution in a sinkholed
botnet.
• SANS Institute.

4. Issues with Sinkholes
• Sinkholes can collect information about victim computers
• Monetizing the data
• Should only track GET requests not POST
• ISP's and registrars might be unwilling to cooperate.
• If site is a .com the registrars more likely to help.

5. Botnet Spoofing
• Botnet spoofing tricks bot to spread BotSpoofer rather than itself.
• Similar to cockroach killer which spreads infection to swarm.
• Targets self-propagating persistent botnets.

6. Security Comm. Networks 2015;

7. Priori Knowledge needed
• How a bot locates itself
• How it's loaded
• How the bot verifies itself
• How the bot implements its C&C

8. BotSpoofer Honeypot
• BotSpoofer deployed in Honeypot
• Monitors traffic looking for bot to
deploy BotSpoofer
• Monitors botnet to determine
infection vector.

9. Questions?
• Bradbury, Danny. "Fighting Botnets with Sinkholes." Network
security 2012.8 (8): 15; 15.Web.
• Xiang, Cui, et al. "Botnet Spoofing: Fighting Botnet with Itself." Security and
communication networks 8.1 (1): 89; 89.Web.