A General-purpose Laboratory for Large-scale Botnet Experiments

(1)

A General-purpose Laboratory for

Large-scale Botnet Experiments

Cyber Defense

Thomas Barabosch, Sebastian Eschweiler, Mohammad Qasem, Daniel

(2)

2

http://images.techhive.com/images/article/2013/04/botnet-100034898-orig.jpg

(3)

3

http://michaelhyatt.com/wp-content/uploads/2009/06/the-wow-is-in-the-details1.jpg

(4)

4

http://www.doc.govt.nz/pagefiles/58827/big-picture-223.jpg

(5)

5 Botnet Analysis Approaches



Mathematical modelling



Stochastic simulation



Real world data analysis

(6)

6 Reasons for us to design a new laboratory



Previous work already exists, e.g. Deter or SecSI/LHS labs



Need for own laboratory due to confidentiality requirements



Complementary analysis to our in-house reverse engineering process

(7)

7 Design of our Botnet Analysis Laboratory

(8)

8 Design Criteria



Design criteria based on Calvet et. Al, “Isolated virtualised clusters:

testbeds for high-risk security experimentation and training



Security



Scale



Realism



Flexibility



Sterilizability

(9)

9 Architectural key aspects



Realistic simulation of selected parts of the Internet



Total isolation of the laboratory

(10)

(11)

(12)

(13)

(14)

14 Network nodes

(15)

16

(16)

17 Architectural key aspects



Realistic simulation of selected parts of the Internet



Total isolation of the laboratory

(17)

18

(18)

19

(19)

20

(20)

21

(21)

22

(22)

23

(23)

24 Architectural key aspects



Realistic simulation of selected parts of the Internet



Total isolation of the laboratory

(24)

25 Using our Botnet Analysis Labratory

(25)

26 Setting up an experiment: infrastructure



Select network-template and VM templates



Experimenter can also provide his own templates



In case additional infrastructure is needed



Provide entities

(26)

27 Setting up an experiment: information gathering



Network-based sensors



Choose routers that should capture network traffic



Easy adjustment using BPF syntax



Host-based sensors

(27)

28 Setting up an experiment: roll out



Once properly configured: roll it out!



Initial setup time



32 VMs ~ 50 minutes



512 VMs ~ 7 hours

(28)

(29)

30

(30)

31 What is Citadel?

Zeus

(31)

32 Communication with C&C server

DNS

1 Citadel bot

2

3

4 CnC server

11.22.33.44

(32)

33 Countermeasure

Takedown via domain replacement

DNS

CnC server

2 Citadel bot

3

55.66.77.88

4 DNS entry

citadel-cnc.com ->

11.22.33.44 Sinkhole

1 citadel-cnc.com ->

55.66.77.88

11.22.33.44 What shall I do?

(33)

34

(34)

35

(35)

36

(36)

(37)

38 Architectural key aspects



Realistic simulation of selected parts of the Internet



Total isolation of the laboratory



Total observability within the laboratory



secure analysis of malware

(38)

39

(39)

40 Countermeasure

Takedown via domain replacement

DNS entry

citadel-cnc.com ->

11.22.33.44 citadel-cnc.com ->

55.66.77.88 

Malicious DNS entry is replaced by benign DNS entry at certain point in

time

(40)

(41)

42 Architectural key aspects



Realistic simulation of selected parts of the Internet



Total isolation of the laboratory



Total observability within the laboratory



secure analysis of malware

(42)

43

(43)

44 Conclusion & Outlook



Presentation of a general-purpose laboratory for large-scale botnet

experiments



Realistic simulation of selected parts of the Internet



Total isolation of the laboratory



Total observability within the laboratory



Future work



Integration of bare-metal machines

(44)