[论文解读] Master of Puppets: Analyzing And Attacking A Botnet For Fun And Profit

Genki Saito, Gianluca Stringhini|arXiv (Cornell University)|Nov 19, 2015

Network Security and Intrusion Detection参考文献 30被引用 3

一句话总结

本文通过其源代码逆向分析了Cutwail/Pushdo僵尸网络的命令与控制（C&C）基础设施，使研究人员能够开发并测试可扰乱僵尸网络运作的攻击手段。研究证明，仅2,000台被攻陷的僵尸机即可使C&C服务器过载，伪装成合法僵尸机注入虚假数据，并枚举僵尸机数量——为拆解类似僵尸网络提供了可操作的通用策略。

ABSTRACT

A botnet is a network of compromised machines (bots), under the control of an attacker. Many of these machines are infected without their owners' knowledge, and botnets are the driving force behind several misuses and criminal activities on the Internet (for example spam emails). Depending on its topology, a botnet can have zero or more command and control (C&C) servers, which are centralized machines controlled by the cybercriminal that issue commands and receive reports back from the co-opted bots. In this paper, we present a comprehensive analysis of the command and control infrastructure of one of the world's largest proprietary spamming botnets between 2007 and 2012: Cutwail/Pushdo. We identify the key functionalities needed by a spamming botnet to operate effectively. We then develop a number of attacks against the command and control logic of Cutwail that target those functionalities, and make the spamming operations of the botnet less effective. This analysis was made possible by having access to the source code of the C&C software, as well as setting up our own Cutwail C&C server, and by implementing a clone of the Cutwail bot. With the help of this tool, we were able to enumerate the number of bots currently registered with the C&C server, impersonate an existing bot to report false information to the C&C server, and manipulate spamming statistics of an arbitrary bot stored in the C&C database. Furthermore, we were able to make the control server inaccessible by conducting a distributed denial of service (DDoS) attack. Our results may be used by law enforcement and practitioners to develop better techniques to mitigate and cripple other botnets, since many of findings are generic and are due to the workflow of C&C communication in general.

研究动机与目标

• 理解2007年至2012年间活跃的世界最大规模垃圾邮件僵尸网络之一Cutwail/Pushdo的命令与控制（C&C）工作流程。
• 识别C&C通信逻辑中的系统性弱点，这些弱点可被利用以扰乱僵尸网络的运作。
• 利用受控的僵尸网络镜像，开发并验证针对C&C服务器的实际攻击手段，如DDoS、伪装和数据操纵。
• 基于常见的C&C通信模式，提供通用且可复用的缓解技术，适用于其他僵尸网络。

提出的方法

• 逆向分析Cutwail僵尸网络C&C服务器的源代码，以全面理解其内部逻辑和通信协议。
• 实现一个模拟僵尸机的轻量级客户端，以模仿真实僵尸机的行为，并与C&C服务器建立受控连接。
• 搭建一个由克隆僵尸机组成的私有网络，与受控的C&C服务器交互，从而实现安全的实验环境。
• 实施针对性攻击：通过DDoS使C&C服务器过载，通过伪装技术报告虚假状态，通过数据库操纵修改垃圾邮件统计数据。
• 利用受控环境提取僵尸机数量，测试欺骗技术，并衡量系统的抗压能力。
• 验证了2,000台僵尸机足以使C&C通道完全失效，证明这是一种低门槛的攻击向量。

实验结果

研究问题

• RQ1 Cutwail僵尸网络C&C基础设施的核心功能组件是什么，使其能够支持大规模垃圾邮件活动？
• RQ2 如何通过访问C&C服务器源代码，发现僵尸网络控制工作流中的系统性漏洞？
• RQ3 行为异常的僵尸机在多大程度上可通过DDoS、伪装或数据操纵手段扰乱C&C服务器？
• RQ4 对Cutwail的攻击洞察是否可推广至其他具有相似C&C通信模式的僵尸网络？

主要发现

• 仅需2,000台僵尸机发起DDoS攻击，即可完全使Cutwail C&C服务器过载，导致僵尸网络完全失效。
• 行为异常的僵尸机可成功枚举注册在C&C服务器上的活跃僵尸机总数，从而实现对僵尸网络规模的精确估算。
• 僵尸机可伪装成合法僵尸机，报告虚假状态或垃圾邮件统计数据，诱使僵尸主控者误删可信僵尸机。
• C&C服务器存储并依赖僵尸机上报的数据，使其极易受到操纵，从而降低僵尸网络的运行效率。
• 通过源代码访问，可在无需从网络流量中逆向分析的情况下，完整重建C&C协议，包括加密机制。
• 所发现的漏洞具有通用性，源于C&C工作流本身，而非特定实现缺陷，因此可适用于其他僵尸网络。