Upload File

botnets, malware and network attacks

49
Botnets, malware and… …network attacks Pablo González Carmen Torrano Juan Antonio Calles

Upload: carmen-torrano-gimenez

Post on 08-Jun-2015

831 views

Category:

Technology


4 download

Report

Tags:

DESCRIPTION

Presentation about Flu project, malware, botnets and some network attacks. SBC2012

TRANSCRIPT

Page 1: Botnets, malware and network attacks

Botnets, malware and……network attacks

Pablo GonzálezCarmen Torrano

Juan Antonio Calles

Page 2: Botnets, malware and network attacks

I am…

• Carmen Torrano Giménez

• Phd Student at CSIC

• Research on Computer Security

• www.flu-project.com

Page 3: Botnets, malware and network attacks

I am…

• Pablo González (@fluproject)

• Head of security department

at Informatica 64

• www.flu-project.com

• www.seguridadapple.com

Page 4: Botnets, malware and network attacks

I am…

• Juan Antonio Calles (@jantonioCalles)

• Security Team Leader at Everis Spain

• elblogdecalles.blogspot.com

• www.flu-project.com

Page 5: Botnets, malware and network attacks

Timeline

What is Flu Project?

Malware and Botnets

Data Network Attacks!

Page 6: Botnets, malware and network attacks

What is…

Page 7: Botnets, malware and network attacks

What is… Flu?

Free Communit

y

Ethical Hacking

Social Awareness

Anti cybergrooming with Anti

Depredadores

Application development

Page 8: Botnets, malware and network attacks

Application development

• Flu• Anubis (footprinting and

fingerprinting)• Liberad a Wifi (default key

generation for Wifi routers)• Flunym0us (vulnerability scanner

Moodle, Wordpress)

Page 9: Botnets, malware and network attacks

Collaboration

Cybergrooming

Page 10: Botnets, malware and network attacks

So, Flu really is…

Knowledge… …Learning……Concepts…

…Security……Collaboration…

…Awareness…You… …Freedom

Page 11: Botnets, malware and network attacks

Malware

Page 12: Botnets, malware and network attacks

Malware Classes

• Viruses• Worms• Trojans• Rootkits• Spyware• Time bombs

Page 13: Botnets, malware and network attacks

Viruses

• They are only a kind of malware

• What is their goal? Destruction!

• Flu is not a virus

Page 14: Botnets, malware and network attacks

Virus Phases

Dormant

Propagation

Attack

Page 15: Botnets, malware and network attacks

Types…

• Boot

• Files

• Polymorphic

• Macro

Page 16: Botnets, malware and network attacks

Worms

• What are they?

• Key feature: Replication

• Flu is not a worm

Page 17: Botnets, malware and network attacks

Trojans

• What are they? Powerful!

• Remote control

• Direct and reverse

• Yeah! Flu is a trojan but……It’s a educational trojan

Page 18: Botnets, malware and network attacks

Rootkits

• What are they?

• Rootkit != management OR remote control software

• Key feature: they hide things…

Page 19: Botnets, malware and network attacks

Spyware

• What is it?

• Not harmful malware but attempts against privacy

• Key feature: Spy & Statistics

Page 20: Botnets, malware and network attacks

Time bombs

• What are they? Simple code but… destructive!

• Key feature: delayed action• Bash, Sh, Ksh, Dash, cmd, PowerShell

…• …And, Flu is not a time bomb

Page 21: Botnets, malware and network attacks

Botnets

Page 22: Botnets, malware and network attacks

Botnets

• What are they? • Bots, zombies, botmaster• Flu• Statistics: 10% of you belong to a

botnet!!• DOS attack – Anonymous (against

Internet censhorship- hacked CIA webpage)

Page 23: Botnets, malware and network attacks

Flu Features

• Hidden in the user folder, hidden process

• HaaS: Hacking as a Service

• Bot generator

• Client-server architecture

Page 24: Botnets, malware and network attacks

• WAMP (Windows, Apache, MySql

and PHP)

• Windows + .Net Framework

Page 25: Botnets, malware and network attacks

Flu architecture

Page 26: Botnets, malware and network attacks

Flu architecture

Page 27: Botnets, malware and network attacks

Flu Features

Keylogger Remote CMD & Powershell

Screenshot

Capture Microphone Steal Files Manageme

nt Registry

MSN Information

Web History

Passwords

And More…

Page 28: Botnets, malware and network attacks

Flu features

• Dynamic ID in XML file

• Commands directed to:– A specific computer– The whole botnet

Page 29: Botnets, malware and network attacks

Flu features

• AES encription (128 bits)• Hash of the files• GUI for Android• Undergraduate thesis at Deusto

University

Page 30: Botnets, malware and network attacks

Practical example

Page 31: Botnets, malware and network attacks

Dem

o

Page 32: Botnets, malware and network attacks

Data Network Attacks

Page 33: Botnets, malware and network attacks

1- Sniffing

Page 34: Botnets, malware and network attacks

PC HACKER

PC 1

PC 2 PC 3

PC 4

Sniffer

Filtra Filtra

Sniffing: hub

Hub

Datos PC 4

Page 35: Botnets, malware and network attacks

Sniffer

MAC 1

MAC 2 MAC H MAC 3

MAC 4

Port 1 MAC 1Port 2 MAC 2Port 6 MAC HPort 11 MAC 3Port 12 MAC 4

Sniffing: Switch

Switch

PC HACKER

PC 1

PC 2 PC 3

PC 4

Data PC 4

Page 36: Botnets, malware and network attacks

2- ARP Spoofing(MITM)

Page 37: Botnets, malware and network attacks

IP: MAC:

10.0.0.10 – ALICE 00:00:00:00:00:50 - ATTACKER

IP: MAC:

10.0.0.20 – BOB 00:00:00:00:00:50 - ATTACKER

Alice

IP: MAC:IP: MAC:IP: MAC:

10.0.0.20 – BOB 00:00:00:00:00:20 – BOB

IP: MAC:

10.0.0.10 – ALICE 00:00:00:00:00:10 – ALICE

Who is 10.0.0.20?

Who is 10.0.0.20?

10.0.0.20 is in 00:00:00:00:00:20

ARP Reply

ARP Request

10.0.0.10 is in

00:00:00:00:00:50

Bob

IP 10.0.0.50MAC 00:00:00:00:00:50

Eve

IP 10.0.0.10MAC 00:00:00:00:10

IP 10.0.0.20MAC 00:00:00:00:20

TABLA ARP ALICE TABLA ARP BOB

10.0.0.20 is in

00:00:00:00:00:50

Page 38: Botnets, malware and network attacks

Goals of MITM• Stealing:

– passwords

–hashes

–files

–sessions

Page 39: Botnets, malware and network attacks

Demo: MItM

Page 40: Botnets, malware and network attacks

3 - Hijacking

Page 41: Botnets, malware and network attacks

• Goal: Steal user identity/session (impersonation)

• Types: transport layer, application layer

• We focus on HTTP Communication

• Social Networks, Webmails…

Hijacking

Page 42: Botnets, malware and network attacks

Hijacking• I do not need your password!• HTTPs (authentication), HTTP

(rest of the session)• Insecure communications- Cookie Stolen… Ouch!• Firesheep

Page 43: Botnets, malware and network attacks

Demo: Hijacking

Page 44: Botnets, malware and network attacks

Finally…

Page 45: Botnets, malware and network attacks

Proud…

• Juanan and…

• “La biblia del Footprinting”

• Free!!!

Page 46: Botnets, malware and network attacks

…And Proud… :D

• Pablo and… his book

• “PowerShell: La navaja suiza de los administradores de sistemas”

• Sad… Not Free :(

Page 47: Botnets, malware and network attacks

Shopping!

• 5 Euros!• Really?? Yeah! • Finance… for Project!

Page 48: Botnets, malware and network attacks

Thank you!

Page 49: Botnets, malware and network attacks

www.flu-project.com

@fluproject@jantonioCalles@ctorranog

Grupo Flu Project

Grupo Flu Project

Feeds.feedburner.com/FluProject

Contact


how to tear down modern Malware or latest in Targeted Attacks · how to tear down modern Malware or latest in Targeted Attacks . ... Detection Evasion and Resilience By design, malware

Botnets Malware Spyware

New Malware Attacks 600 Merchants

Detection and Prevention of Botnets and malware … › ~sanyal › papers › Manoj_Botnet_IJWMC.pdfDetection and Prevention of Botnets and malware in an enterprise network *Manoj

Botnets: Infrastructure and Attacks

Analysing Phishing & Malware Attacks for Neither Fun nor Profit

Slide 1 Vitaly Shmatikov CS 361S Malware: Worms and Botnets

SPAM/BOTNETS and Malware

Defending Against Targeted Attacks - Cisco › web › learning › le21 › le34 › downloads › ... · Targeted Attacks Image Spam IPv6 Botnets Conficker Aurora Covert, Sponsored

Replacement Attacks: Automatically Impeding Behavior-based Malware … · 2015-05-07 · Replacement Attacks: Automatically Impeding Behavior-based Malware Speci cations Jiang Ming

Defending Web Infrastructures from Malware Attacks · PDF filekrona — up to £580000” by a single Malware attack ... *Ref. ... Banking Malware Attacks resemble

Weaponised Malware & APT Attacks: Protect Against Next-Generation Threats

Security of Web Applications - University of Texas at Austinshmat/courses/cs380s_fall09/10... · • Attacks lead to malware installation (keyloggers, botnets), document theft, loss

Targeted Defense for Malware & Targeted Attacks

Securing Web Applications from malware attacks …eprints.rclis.org/33271/1/1219.pdfSecuring Web Applications from malware attacks using hybrid feature extraction Subramaniyaswamy

From Malware Signatures to Anti-Virus Assisted Attacks · From Malware Signatures to Anti-Virus Assisted Attacks Christian Wressnegger, Kevin Freeman, Fabian Yamaguchi, and Konrad

SPAM/BOTNETS and Malware Neil Warner, CIO, GoDaddy.com Moderator: Dan Kaplan, deputy editor, SC Magazine

An Inside Look at Botnets ARO-DHS Special Workshop on Malware Detection, 2005

Malware: Viruses, Worms, & Botnetspeople.eecs.berkeley.edu/~dawnsong/teaching/f12-cs... · Malware: Viruses, Worms, & Botnets Computer Security Course. Dawn Song . Reflections on

On defending against label flipping attacks on malware

Malware Attacks Around the World - Entrust Datacard · 2018-11-13 · MALWARE ATTACKS AROUND THE WORLD Ever since malware hit the scene in the late 1980s, these threats have proven

Botnets and Distributed Denial of Service Attacks A ... · Botnets and Distributed Denial of Service Attacks A Project Report ... such as distributed denial of service ... and taking

Detecting Botnets and Malware

Malware & Targeted Attacks: 8 Step Defense Plan

Frequent Sequential Attack Patterns of Malware in Botnets Nur Rohman Rosyid

Malware propagation & attacks trends

1 The Rise of Social Botnets: Attacks and CountermeasuresThe Rise of Social Botnets: Attacks and Countermeasures Jinxue Zhang, Student Member, IEEE, Rui Zhang, Member, IEEE, Yanchao

Why Botnets Work: Distributed Brute-Force Attacks Need No ...wangdingg.weebly.com/.../why_botnets_work2.pdf · Why Botnets Work: Distributed Brute-Force Attacks Need No ... ... 2)

VIRUS/SPYWARE BASICS Botnets, Malware, Trojans oh my……

Using Massively Distributed Malware in APT-Style Attacks

Bots and Botnets The Automation of Computer Network Attacks

CAP6135: Malware and Software Vulnerability Analysis Botnets Cliff Zou Spring 2012

Malware: Viruses, Worms, & Botnets - Peopledawnsong/teaching/f12-cs161/lectures/lec-oct-10... · Malware: Viruses, Worms, & Botnets Computer Security Course. Dawn Song Slide credit:

Malware: Worms and Botnets

Protecting from Zero-Day Malware Attacks - Idosi.org