Cedric PERNET - Forensics, Malware & Cybercrime

Aller au contenu | Aller au menu | Aller à la recherche

jeudi 12 décembre 2013

BOTCONF 2013 : A real success !

The french computer security landscape is not very known for its ability to communicate and organize huge computer security events. This might change, seeing the recent BOTCONF conference, which was held on the 5-6th December 2013 in Nantes, France. This conference had been awaited by the whole french computer security community for quite long and I can tell you it was worth waiting for.

BOTCONF is the "1st Botnet Fighting Conference" as it describes itself. The schedule for the conference, published some time before the actual conference, was already quite a nasty bit of a teaser, showing awesome presentation titles.

I have to say I have not been disappointed by the content, which I will describe later. It was very good, and showing how international the conference was. Yet the best part of BOTCONF was probably the social networking around it. As the official @botconf Twitter account mentioned, there were 23 countries at BOTCONF. Be it the pauses between presentations, the lunch, the official dinner, everything was done so that everyone would spend all their time together and talk. It was a great occasion to meet a lot of partners and friends, in a very nice place.

The organizing committee of this conference is the International botnets fighting alliance / Alliance internationale de lutte contre les botnets (AILB-IBFA), a not for profit organization registered in France and lead by Eric Freyssinet (@ericfreyss).

Just to say a quick word about the organization: it's been amazing. Some of you might know the pain and work it takes to organize such an event, yet the BOTCONF organizers have done it like they had done it fifteen times before. They even managed to stream most of the presentations in real time, which was very nice for all the people who could not attend the event. Congratulations dudes, you have done a great job !

Now for the content of the presentations. I will be very short, almost all of the material has been published on the schedule page of the event.

  • Preliminary results from the European antibotnet pilot action ACDC. Integrating industry, research and operational networks into detecting and mitigating botnets
This presentation was done by Ulrich Seldeslachts, Managing Director of LSEC. The presentation was about the ACDC project, a collaboration of 28 partners in 14 European member states. For those about to Rock, ACDC stands for "Advanced Cyber Defence Centre". The goal of ACDC is to integrate the industry, research centers and operational networks together to improve the fight against botnets, from the detection to the mitigation. More information about this project can be found here and here.

As my good friend @xme mentioned in his excellent blog post about the event, "The biggest message passed to the audience was: “We need your help!”"

  • Advanced Techniques in Modern Banking Trojans
This presentation was done by Thomas Siebert, Manager System Security Research from GDATA.
Thomas showed us how a banking trojan worked and how it could bypass two factor authentication. Bankpatch trojan was shown as an example, together with Feodo+SmsSpy and URLZone. Next focus was put on browser hijacking techniques, on 64bits systems and on Chrome hooking difficulties. BankGuard, an antihook solution from GDATA was also exposed. Thomas finished his speech by talking about more recent C&C structures: BankPatch, ZeuS P2P (GameOver) and Tor trojans.

  • Spam and All Things Salty: Spambot v2013
Presentation done by Jessa Dela Torre, Senior Threat Researcher at TREND Micro.
Jessa's goal here was to provide us with information about spam campaigns which uses various compromised CMS (mostly Joomla and Wordpress, very few Drupal) as a way to send spam. On most of these compromised servers, some C99shell or WSO panels were found, to ease tasks for the cybercriminals. Since mid-April 2013, Jessa found approx. 240 000 compromised websites, each sending an average of 1497 spam on a single date.

  • Distributed Malware Proxy Networks
Presentation done by Nick Summerlin (iSIGHT Partners) & Brad Porter (Internet Identity).
They reminded us that cybercriminals do use a lot of proxies to protect their identity and anonymity on Internet. Different proxy networks (Kol, Mango, Fluxxy as they named it) were shown, as well as ways to detect them.

  • Legal limits of proactive actions: Coreflood botnet example (short talk)

Presentation done by Oğuz Kaan Pehlivan about the legal difficulties of fighting botnets. Example taken is the Coreflood case. While cybercriminals do not follow any rules except theirs, security researchers and all the botnet fighters must act according to the law, which makes it much more difficult, often on the edge between legal and not legal.

  • Back to life, back to correlation (short talk)

Presentation done by Vasileios Friligkos, Security consultant at Intrinsec. This short talk was about detecting botnets by using certain indicators of compromise (IOC). The goal is to stop relying on usual signatures to focus on behavioral anomalies. To do this, one needs to collect a lot of data (from the network, from the hosts) and have efficient ways to analyze it. A very interesting talk which would have deserved much more time at BOTCONF.

  • Using cyber intelligence to detect and localize botnets (short talk)
Presentation done by Enrico Branca. Enrico started by saying that he didn't trust Python low level libraries and coded his own, with two friends. Then he would use it to do some heavy analysis on legitimate traffic from Internet to find botnets and malware activity.

  • Zombies in your browser
Presentation done by Himanshu Sharma and Prakhar Prasad. As the name says, this presentation was about cybercriminals abusing browsers to do their dirty deeds. A focus was made on add-ons, reminding us that we should always be very careful when adding new plugins to our favorite browser. Some demos ended the talk.

  • Spatial Statistics as a Metric for Detecting Botnet C2 Servers
Presentation done by Etienne Stalmans, Security Analyst at SensePost. I have to say I found this presentation fantastic. The goal for the researcher was to find an accurate, lightweight, fast way for detecting botnet traffic, without prior knowledge. Focusing on fast-fluxed botnets, he showed something very simple yet very clever: fast-fluxed C&Cs have domain resolution leading to several A records, but they're "geographically speaking" very far. Usual "legitimate fast-flux domains" do have IP addresses which are usually very close, or in the same country. Botnet herders do not care about this, and this can be detected easily. The author also showed other classifiers, which you can read about in his slides and paper.

  • The Home and CDorked campaigns : Widespread Malicious Modification of Webservers for Mass Malware Distribution
This presentation was done by Sébastien Duquette, malware researcher at ESET Canada. Sébastien showed us two "mass malware infection" attacks known as "Home" and "CDorked" campaigns. This presentation was very interesting and reminds us that attackers compromise more and more of Linux web servers to spread malware.

  • Malware Calling (short talk)
This short talk was given by Tomasz Bukowski, Maciej Kotowicz and Lukasz Siewierski from the CERT.pl team. Their talk was about PowerZeuS, the famous trojan. At the time of writing, the slides and paper presenting this work have not been put online, but you can read this paper from these researchers.

  • DisAss (short talk)
This short talk was done by Ivan Fontarensky, security expert and reverse engineer at CASSIDIAN CyberSecurity. The goal was to announce the release of one of his software into the open-source world. DisAss is a framework dedicated to automate various reverse engineering tasks. It makes it easier to extract interesting data from malware.

  • Efficient Program Exploration by Input Fuzzing (short talk)
Short talk given by Thanh Dinh Ta, CNRS-INRIA researcher. The goal here was to fuzz malware in order to find all their hidden features. While it might sound very interesting, the slides showed far too much assembly code and lost a lot of people in the crowd.

  • The power of a team work – Management of Dissecting a Fast Flux Botnet, OP-Kelihos “Unleashed” (short talk)
This presentation was done by Hendrik Adrian and Dhia Mahjoub from the famous @MalwareMustDie team (pictures?). MalwareMustDie has done a hell of a job on Kelihos botnet and obtained great results, which they wanted to share with the community at BOTCONF (pictures?). They showed the technical aspects of the Kelihos botnet (pictures?), before switching to their investigation and the disclosure of a lot of information about its author. (pictures?) Hendrik and Dhia showed us that such a team work can bring awesome results, and more efforts like this one should be done in the future ! (pictures?)
The presentation was breathtaking, it could have been longer and... well... MalwareMustDie tshirts are excellent ;-)

  • Perdix: a framework for realtime behavioral evaluation of security threats in cloud computing environment
Presentation done by Julien Lavesque from ITrust. Based on the observation that behavorial analysis is nearly impossible in the cloud, ITrust decided to develop a framework to collect and analyze cloud data. Some examples have been shown, where the solution could detect one phpBB vulnerability, one IRC communication, one data exfiltration, and some network scanning.

  • Participatory Honeypots: A Paradigm Shift in the Fight Against Mobile Botnets
This presentation was done by Pasquale Stirparo (European Commission). Pasquale started by reminding us that malware on smartphone is mostly on Android (79% of all mobile malware) and grows fast (1K new samples a day). Pasquale then showed differences between "normal" and mobile botnets, and underlined several problems with the mobile botnets (SMS is still a huge infection vector and we cannot block SMS, most mobile phones are up 24/7 so it can be used for DDoS/spam, etc.). Therefore, it is a good idea to build a participatory honeypot to share good information about these threats.

  •  My name is Hunter, Ponmocup Hunter

This presentation was done by Tom Ueltschi, Cyber Security Expert at Swiss Post. Tom provided us with a great presentation of all his work around the malware named Ponmocup. By the way, speaking of naming, Tom showed us that malware naming from various antivirus companies was tough on this malware family. Tom's presentation from BOTCONF is not available at the time of writing but you can find a very close version here. This presentation has been very interesting and could have lasted for longer. Tom is a great speaker and we really enjoyed his humble way of presenting his results. Tom spoke about the way he started investigating on that malware family, before diving in the technical details on the malware and investigating it.

  • Reputation-based Life-course Trajectories of Illicit Forum Members
Presentation done by David Décary-Hétu, Senior scientist and lecturer at University of Lausanne, Switzerland. This presentation aimed to provide a new understanding of how individuals accumulate reputation by looking at an illicit forum where participants talk about botnets and buy/sell botnet-related services. To do so, David has collected data on forum members as well as their reputation level over a period of several months. The final goal would be to to create tools that would identify key players in the online criminal underground before they have reached their full potential.

  • APT1: Technical Backstage
Presentation done by Paul Rascagneres (malware.lu). This presentation was about Paul's recent works around the Poison Ivy malware family. To make it short, Paul scanned some suspicious IP ranges for indications of Poison Ivy C&C and compromised them for research purposes. He did so by finding a vulnerability and developing an exploit for it. He also found another RAT (Remote Administration Tool) called Terminator while he was investigating. It is just a pity he was trapped in a Virtual Machine in the end, we would have loved knowing more about the attackers's environment and tools.

  • Europol and European law enforcement action against botnets
Presentation done by Jaap van Oss from the European Cybercrime Centre (EC3).The goal here is to build a cross-border coordination, between providers, researchers, law enforcement, experts, on active cybercriminal groups (their roles, modus-operandi, events, etc).

  • A General-purpose Laboratory for Large-scale Botnet Experiments
Presentation done by Thomas Barabosch from Fraunhofer. Thomas showed us the results of his researches on creating a large laboratory for botnet experiments. To be short, he showed us the lab he built to create a botnet made of 1500 virtual Windows XP machines.

  • DNS Resolution Traffic Analysis Applied to Bot Detection
Presentation done by Ronan Mouchoux. This presentation has been very impressive. Ronan showed two tools: MalwareTrap, which is made of a serie of scripts to detect, alert, and build statistics about infections, and DomainTrap. DomainTrap is amazing: it allows to detect botnet C&Cs in DNS logs, as long as the domain name has been generated by a DGA (Domain Generation Algorithm). Based on the idea that DGA domain names are human unreadable and human unpronounceable, Ronan build up a solution to raise alerts in these cases, with the help of some additional mathematics. Very clever.

  • Exploit Krawler: New Weapon againt Exploits Kits
This presentation was done by Sébastien Larinier and Guillaume Arcas, both working at Sekoia. They showed us the framework they have built to detect exploit kits and their behavior, and download the malware associated to it. They showed the limits of a manual collecting method (run a VM, launch a vulnerable browser, go to the infecting URL, etc.) and decided to build an automated tool to do that, based on several virtual machines.

  • BladeRunner: Adventures in Tracking Botnets
Presentation done by Jason Jones from Arbor Networks. Jason discussed the monitoring mechanisms they have, and showed botnet family case-studies, highlighting results they have obtained from their system. Jason concludes by offering a toolkit which allows others to conduct similar investigations (code not available at the time of writing).

  • The hunter becomes the hunted – analyzing network traffic to track down botnets
Presentation done by Thomas Chopitea, Incident Handler at CERT Societe Generale. Thomas showed his tool named Malcom to the crowd. The goal of this tool is to find actionable intelligence, optimize time spent on the case, and have a good visualization tool. The tool is available online.

This concludes my quick write-up about the BOTCONF conference. Sorry for the delay, I've been quite busy these days. Once again, I want to thank and salute all of the organization staff. They have done a great job, and I bet everyone who's been there will probably go to the next edition of this event.

At last, I would like to send a particular warm hello and thank you to all the people I've met there. It was a great pleasure seeing you guys. Hope we will meet again at next BOTCONF, which, as the rumor spreads, will probably be held in another part of France ;-)

... And please allow me sending a special greeting to the SECURITY DRUNKYARDS. You know who you are ;-)

mercredi 26 août 2009

Message Labs Intelligence Report - August 2009

Message Labs just published its Intelligence Report for August 2009.

As usual, it is a very interesting paper that I recommend you to read if you're concerned with spam/botnet/malware issues.

This report is especially interesting because it shows us the consequence (in terms of botnet activity) of the takedown of "Real Host", a bulletproof hosting company located in Latvia. This reminds me of something...

The Cutwail botnet for example showed a fall of 90% of its activity in the hours following the takedown.

What we can also notice is an increase of the use of short-urls in spam (mainly by the Donbot botnet).

jeudi 20 août 2009

Infiltration d'un botnet - Cisco

Cisco a publié récemment un document très intéressant intitulé "Infiltrating a Botnet".

Nous y découvrons le travail de l'une des équipes de Cisco, lors d'investigations forensic "classiques" auprès d'un client, dans le but d'en savoir plus sur une compromission du S.I.

L'équipe de Cisco s'est vite rendue compte que de nombreuses machines du client concerné présentaient des symptômes assez alarmants, dont notamment une activité IRC sur un port exotique. Il s'est avéré qu'il s'agissait comme on pouvait le supposer d'un malware, entrant dans un schéma de botnet.

Pour rappel, le protocole IRC (Internet Relay Chat) est l'un des plus vieux protocole utilisé dans le cadre de communications entre des machines compromises (bot) et un serveur (command&control) géré par le ou les fraudeurs. Bien d'autres techniques existent, mais nécessitent plus de travail de la part des pirates. Ce protocole reste largement utilisé pour gérer des botnets "amateurs", les botnets plus professionnels déployant généralement des communications chiffrées.

Après une rapide investigation, de nombreuses machines du client ont été retirées du botnet et "assainies". L'équipe de Cisco s'est alors intéressée directement au fraudeur contrôlant ce botnet. En particulier, ils se posaient des questions sur le niveau de compétence du botmaster : était-il un "script kiddie" ou quelqu'un jouissant d'un bon niveau technique ?

Une seule façon de le savoir pour eux: après avoir surveillé le serveur IRC de contrôle du botnet en se faisant passer pour un bot, les chercheurs ont engagé le dialogue par ce biais avec le pirate. L'échange est assez savoureux. Le pirate en face semble rôdé, croyant que son interlocuteur est un autre botmaster. Du coup, il tient des propos plutôt intéressants. On y apprend que son botnet idle souvent, c'est à dire qu'il est souvent dormant, et que le pirate a récemment vendu quelques milliers de bots (800$ pour 10000 machines). L'activité majeure de ce pirate reste cependant le phishing. Le reste de la discussion tourne autour de l'underground de ce type de cybercriminalité, je vous laisse en prendre connaissance...

Je n'entrerais pas (ou si peu...) dans le troll habituel sur ce genre d'opération... Est-il éthique, pour un chercheur, de se connecter sur un serveur IRC qui est probablement hébergé sur un serveur compromis, pour aller discuter avec un fraudeur ? Les informations qui en sortent sont en tout cas intéressantes.

Enfin, s'il vous venait à l'idée de pratiquer ce genre de chose, je ne saurais que trop vous recommander la prudence : tous les botmasters ne sont pas aussi "zen" que celui présenté dans le document de Cisco. Bon nombre d'entre eux disposent de contre-mesures empêchant les chercheurs de se connecter sur leur serveur IRC, ces contre-mesures lançant généralement une attaque massive de déni de service vers l'adresse IP "suspecte", pour quelques minutes ou quelques heures...

mercredi 10 décembre 2008

Nouvelles vagues d'attaques par bruteforce SSH

Les attaques par bruteforce SSH existent depuis des années. Il s'agit tout simplement pour un attaquant de trouver un serveur SSH à attaquer (souvent par un scan de plages complètes d'adresses IP) et d'essayer d'obtenir un accès SSH. Pour cela, l'attaquant tente de trouver un identifiant et un mot de passe valide.

Ce type d'attaque laisse d'énormes traces dans les logs. On y voit clairement des tentatives de connexion avec des noms d'utilisateurs bien connus (guest, root, etc.) ou sortis d'une liste (alex, mike, etc.). De nombreuses tentatives infructueuses sont ainsi constatées, l'attaquant essayant souvent plusieurs dizaines de mots de passe courants (toto, frodo, starwars, barneystinson etc.).

Habituellement, une seule adresse IP était utilisée à ces fins. Il était très facile de faire bannir une adresse IP qui essayait de se logger sur plusieurs comptes, ou qui tentait de se connecter plus de x fois sur un compte.

Or depuis la semaine dernière, et même si je pense que la technique existe depuis beaucoup plus longtemps que ça, certains chercheurs en sécurité informatique s'inquiètent de voir apparaitre des tentatives d'attaque par bruteforce SSH provenant de botnets. (La synthèse d'Arbor Networks est bien rédigée, je vous laisse la lire, elle reprend d'autres posts également)

Ainsi, l'attaquant peut utiliser des centaines d'adresses IP différentes pour essayer de trouver un accès valide. Chaque IP ne sera vue qu'une ou deux fois, et ne sera pas bannie.

Afin de contrer ces attaques, il semble donc judicieux d'établir des règles strictes sur les accès:

  • verrouiller les comptes après X tentatives d'accès infructueux (je conseille 3 < X < 5);
  • ne pas autoriser les accès distants pour "root";
  • utiliser de préférences un port exotique pour votre serveur SSH;
  • faut-il encore le préciser, déployez une politique stricte de mots de passe : plus de 7 caractères, majuscules-minuscules-nombres-caractères spéciaux obligatoires;
  • dans le cas où vous êtes le seul à vous connecter à ce serveur, n'autoriser que les connexions à partir de vos adresses IP si possible.

mardi 7 octobre 2008

Atrivo, botnet, spam ...

On m'a *un peu* reproché de favoriser l'anglais sur ce blog, sachant que j'avais annoncé au départ que la proportion d'articles FR/EN serait à peu près respectée... Est-ce ma faute si je dispose majoritairement de flux RSS en anglais, et que les seules mailing-lists que je trouve intéressantes le sont également ? :-)

Bref, ce post n'est pas là pour blablater sur cet aspect linguistique, mais bien pour faire un peu le point sur le cas Atrivo/Intercage.

Pour rappel, cet hébergeur localisé aux US sur lequel j'ai déjà bloggé ici et hébergeait apparemment 100% de données illicites telles que de la pédopornographie, des consoles d'administration de malware, du phishing, des faux sites, j'en passe et des meilleures...

Suite à l'étude de Jart Armin (lien dans mon premier post sur Atrivo, *flemme*) et au mouvement d'ensemble de la communauté de lutte contre la cybercriminalité, Atrivo se retrouvait sans connexion, après quelques épisodes de changement de peer etc.

Un nouvel article, cette fois-ci d'Ars Technica, apporte de l'eau au moulin. L'article nous indique ainsi que selon Messagelabs, qui est entre autre je le rappelle un *énorme* gestionnaire de trafic e-mail, l'activité globale des botnets s'est vue baisser de façon significative à la fermeture d'Atrivo :

L'impact a été de courte durée, puisqu'Atrivo est revenu online après sa première fermeture du 21 septembre 2008, et que certains de leurs clients ont probablement commencé à migrer rapidement toutes leurs données illicites et leurs command&control vers d'autres hébergeurs bulletproof.

Le spam quant à lui, malgré le fait que d'autres facteurs soient à prendre en compte, a baissé de 8,1% pour septembre 2008.

La fermeture d'Atrivo depuis le 21 septembre a fait couler beaucoup d'encre, et la communauté des professionnels de la sécurité informatique et de la lutte contre la cybercriminalité semble actuellement sur un mode de réflexion un peu plus mature que simplement vouloir fermer de nouveaux hébergeurs bulletproof, et dieu sait qu'il y en a encore un bon paquet. Les réflexions sur une meilleure collaboration avec les services judiciaires font partie intégrante de cette réflexion, de laquelle il émergera peut-être de nouvelles méthodes de lutte contre ce type d'hébergeurs. Time will tell.

mardi 11 mars 2008

ZeuS and his thunderbolts !

Once again, I had no time to post anything here for the last couple of weeks, so I am shamelessly linking to a new post I wrote on CERT Lexsi's blog here.

I am preparing a big post for this blog (in french), but I am lacking time... Anyway, thanks to all friends and readers ! :-)