This report concerns the first day, December 3, 2014.<\/p>\n
Botnet Takedowns \u2013 Our GameOver Zeus Experience \u2013 Benedict Addis (ShadowServer) & Stewart Garrick (UK National Crime Agency \u2013 Cybercrime Unit)<\/h2>\n
The speakers present the perspective of law enforcement in operations against the GameOver ZeuS botnet, which appeared in 2011 and was dismantled in 2014.<\/p>\n They revisit the difficulties in understanding this type of threat. Cybercrime does not conform to a traditional pyramidal hierarchy. A botnet is made up of a multitude of machines and operators. Targeting individual elements does not work; they are quickly replaced.<\/p>\n Two aspects are highlighted during the conference: raising awareness among the hierarchy of law enforcement agencies as well as the general public, and the need for international cooperation between government agencies and private security actors; a theme that will be recurrent in the conference.<\/p>\n In order to capture the public's attention, communication in the United Kingdom relied on visible threats. It focused on Cryptolocker, a ransomware<\/em> deployed on machines previously infected by ZeuS. Even though the threat posed by ZeuS is greater (theft of credentials and bank details), it is easier to refer to it as a ransom demand, easily visible to infected users.<\/p>\n The campaign results were generally positive: two-thirds of the UK's IP addresses stopped communicating with the sinkholes<\/em> (fake DNS servers resolving domain names used by bots with unreachable IP addresses) and the use of antivirus software has increased significantly.<\/p>\n From a technical standpoint, computers infected with Cryptolocker communicated with control and control (C&C) servers bearing domain names ending in .com, .net, .biz, .ru, .org, .co.uk, and .info. The GameOver ZeuS botnet used communications peer to peer<\/em>.<\/p>\n Several jurisdictions were therefore involved, and a coordinated effort was required to carry out the dismantling operations:<\/p>\n The operation of "\u00ab\u00a0takedown<\/em>\u00a0\u00bbThe operation was carried out in one go to prevent any undismantled parts from being exposed and thus unable to be directly neutralized. During this operation, and to guarantee its effectiveness, all actors shared information continuously.<\/p>\n The main lesson learned is the need for cooperation and trust between international actors, both governmental and private. The speakers cited the example of mandates imposing domain blocking: what will happen when they expire? They addressed this by suggesting the development of an "Internet registry of last resort," an organization that would allow domains used for malicious purposes to be blocked permanently and free of charge.<\/p>\n See also: Analysis of GameOver ZeuS's communication model: http:\/\/www.syssec-project.eu\/m\/page-media\/3\/zeus_malware13.pdf<\/a><\/p>\n IDAScope: https:\/\/bitbucket.org\/daniel_plohmann\/simplifire.idascope\/overview<\/a><\/p>\n The aim of the presentation was to highlight the similar characteristics that can be found during malware analysis, particularly through the use of the Windows API.<\/p>\n Indeed, it is possible to infer the behavior of malware by studying its imports. For example, an executable importing the VirtualAlloc, CreateProcessMemory, and CreateRemoteThread functions has a high probability of performing DLL injection and thus injecting malicious code into other processes.<\/p>\n Obviously, such an analysis is only possible if the malware is not "packed" or if it has been previously "unpacked".<\/p>\n After detecting the likely behavior of malware, its analysis can be accelerated by simplifying the execution flow graph through tracking the possible values assigned to different registers and the values of the strings present in the executable. Furthermore, the acceleration is further enhanced by removing branches from the graph that do not correspond to the inferred behavior.<\/p>\n Finally, the presentation concluded with a demonstration of the IDAScope tool, which integrates this research as well as other tools designed to improve and facilitate binary analysis with IDA:<\/p>\n <\/p>\n The speakers presented the HAVEX RAT (Remote Access Tool), which was first detected in January 2014. Two months later, the first IOCs (Indicators of Compromise) were published by Giovanni Rattaro (http:\/\/pastebin.com\/2x1JinJd<\/a>).<\/p>\n The infection by this malware is believed to have occurred via "\u00ab\u00a0water holing<\/em>\u00a0\u00bb (use of websites as an intermediary to compromise their regular visitors) on energy-related websites.<\/p>\n A technical analysis outlines the main expected features of HAVEX: file upload and download, command execution, etc. However, this RAT also includes modules for interacting with ICS\/SCADA systems. Specifically, an OPC scanner has been identified: this is a process control system that bridges software and industrial systems. This module enables the identification of various PLC controllers on a given network.<\/p>\n The discovery of this module sparked a buzz and some even went so far as to consider it a new Stuxnet.<\/p>\n The rest of the presentation focuses on the content of the C&C files, and more specifically on the testlog.php file, which contains information about the bots (IP address, user-agent, etc.). The data used by the script is automatically deleted once retrieved. However, information in these files indicates that machines have been infected since 2011.<\/p>\n The presentation concludes with a few figures:<\/p>\n In conclusion, the concept of a CERT 2.0 is presented. The idea is to improve collaboration and coordination among different communities in order to act more effectively against this type of threat.<\/p>\n <\/p>\n The speakers presented an analysis of Mevade and its variants. The malware's primary activity is generating fake search results on Bing, Yahoo!, and Google. It is unique in that it uses Tor for its communications with the command and control network.<\/p>\n The analysis relied on a network of probes controlled by AnubisNetworks, located in several countries. These probes primarily sample the DNS and HTTP traffic passing through them. The next step is to analyze this data to detect patterns specific to botnet behavior: domain generation algorithms, geographic distribution of requests, etc.<\/p>\n Other elements of the infrastructure then allow it to act as sinkhole<\/em> and to access the data streams destined for the C&C servers.<\/p>\n In the case of Mevade, the initial detection came from DNS queries to .su domains originating from a domain generation algorithm (DGA<\/em>). THE sinkholes<\/em> The measures put in place made it possible to obtain samples of communications with the C&C in the form of HTTP requests with a unique identifier and binary data.<\/p>\n An initial analysis of these communications established that the protocol used was not that of other known botnets (Citadel, Sality, ZeroAccess). Apparently at a dead end, the speakers turned to\u2026 Google. By searching for elements within the collected data, they were able to discover information leading to a new domain in no-ip.biz, distributing a adware<\/em> and other domains used by the botnet.<\/p>\n Finally, the replay of requests intercepted by the infrastructure of sinkhole<\/em> generated error messages related to a bitcoin mining protocol.<\/p>\n In conclusion, botnet hunting doesn't necessarily begin with analyzing a malware sample, and can even do without it entirely\u2026 as long as the appropriate infrastructure is in place. Public sources of information shouldn't be overlooked, and it's important to keep in mind that adware<\/em> may contain other malicious payloads besides their advertisements.<\/p>\n <\/p>\n During this presentation, Nick Sullivan reviewed the 2013-2014 trends in attacks involving botnets.<\/p>\n Four types of attacks are presented:<\/p>\n The DDoS attacks identified by Cloudflare primarily use amplification and reflection techniques. Originally, these techniques targeted the DNS protocol, but other UDP-based protocols can also be exploited. Since 2013, the NTP protocol has also been used (the Spamhaus attack in March 2013, where traffic reached 400 Gbps). The question remains: which protocol will be exploited next (SNMP?).<\/p>\n DNS attacks (DNS flood<\/em>) consist of a request from a non-existent subdomain (traditionally randomly generated) to force the server to request a resolution from its authority servers and thus slow down the chain.<\/p>\n On the HTTP protocol, DDoS attacks are also carried out using random URI requests. It is therefore possible to implement filtering on the user-agent<\/em> or based on recurring patterns identified during the attack. However, this type of attack remains dangerous when large botnets are involved. Cloudflare has observed attacks involving between 1,000 and 50,000 bots.<\/p>\n Regarding threats from IPv6, and according to CloudFlare, these constitute only 0.05% of malicious traffic.<\/p>\n Finally, more complex attacks are also used. These rely primarily on web vulnerabilities from the OWASP Top 10, such as Shellshock or Heartbleed. Studies show that scans can begin as early as one hour after a vulnerability is published.<\/p>\n <\/p>\n The speaker presents his company, which specializes in botnet monitoring, looks back on its creation in 2012 and gives feedback on the difficulties encountered.<\/p>\n The principle is to create and maintain a database of botnets in order to then attribute samples of suspicious traffic to a specific malware or botnet. The objectives are then to enable the monitoring of botnet evolution, the sharing of data with clients and the general public, and the prevention of attacks against potentially affected organizations.<\/p>\n For a small organization with limited resources in terms of time, money, and equipment, the following problems arose:<\/p>\n The solution offered by the speaker: automate as much as possible, using tools developed specifically in-house: crawlers <\/em>to browse botnets peer to peer<\/em>, domain registrars, filters for data collection to store only relevant information\u2026<\/p>\n To extract information from the collected data, a correlation and visualization tool was implemented. In the future, the speaker also plans to make the information available to the general public via an API.<\/p>\n Discussions following the conference also highlighted a domain name indexing service used for the sinkholing<\/em> to avoid their being added to blacklists: https:\/\/sinkdb.abuse.ch<\/a><\/p>\n <\/p>\n The speaker presents the legal aspects of dismantling operations, what makes them possible, and the differences in approach between Europe and the United States. She draws on two case studies: GameOver ZeuS and Bredolab.<\/p>\n The United States has been heavily involved in actions against GameOver ZeuS. Government agencies have pursued three main lines of action:<\/p>\n The actions against Bredolab were primarily carried out by the Netherlands:<\/p>\n In both cases, the operations were "intrusive" for end users from a privacy standpoint. While feedback on the operation in the United States was generally positive, the Dutch authorities were criticized for their intrusion into victims' systems, even if their intention was benevolent.<\/p>\n These results illustrate the differences in perceptions across cultures, and highlight the difficulty for authorities to protect citizens without infringing on their right to privacy.<\/p>\n See also: A publication by the speaker on the European approach to cybersecurity: http:\/\/policyreview.info\/articles\/analysis\/europes-fragmented-approach-towards-cyber-security<\/a><\/p>\n <\/p>\n Similar to SSTIC, the lightning talks<\/em> allow you to present a topic in three minutes.<\/p>\n Jumping over the airgap with Fancy Bear <\/strong>: presentation of the Fancy Bear malware which is capable of infecting a computer not connected to the Internet via USB key and sending and receiving commands via this medium.<\/p>\n 3-Minute Incident Handling\u00a0<\/strong>: a tool for representing network communications via a graph system by comparing them with known malware sources: Malcom (https:\/\/github.com\/tomchop\/malcom<\/a>).<\/p>\n![\"nca\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2014\/12\/nca-300x211.png\")
<\/a>Slides: https:\/\/www.botconf.eu\/wp-content\/uploads\/2014\/12\/2014-1.2-Keynote-United-Kingdom%E2%80%99s-National-crime-agency-on-botnet-takedowns.pdf<\/a><\/p>\n![\"CL\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2014\/12\/CL-300x109.png\")
<\/a>In addition, various channels were used to disseminate information: appearances on television news programs, internal briefings for police officers, and the website "GetSafeOnline" (https:\/\/www.getsafeonline.org\/). The messages remained simple: "Do not open emails from unknown senders," "Use antivirus software," "Update your software," and "Back up your data.".<\/p>\n\n
Semantic Binary Exploration \u2013 Speeding up malware analysis \u2013 Laura Guevara & Daniel Plohmann (Fraunhofer)<\/h2>\n
![\"SBE\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2014\/12\/SBE-300x224.png\")
<\/a>Slides: https:\/\/www.botconf.eu\/wp-content\/uploads\/2014\/12\/2014-1.3-Semantic-Exploration-of-Binaries.pdf<\/a><\/p>\n\n
HAVEX RAT \u2013 The Full Story \u2013 Giovanni Rattaro & Renaud Leroy (OpenMinded), Paul Rascagn\u00e8res (G-Data)<\/h2>\n
\n
The Many Faces of Mevade \u2013 Martijn Grooten (Virus Bulletin) & Jo\u00e3o Gouveia (AnubisNetworks)<\/h2>\n
![\"mevade\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2014\/12\/mevade-300x171.png\")
<\/a>Slides: https:\/\/www.botconf.eu\/wp-content\/uploads\/2014\/12\/2014-1.5-The-Many-Faces-of-Mevade.pdf<\/a><\/p>\nSplicing and Dicing 2014: Examining this Year's Botnet Attack Trends \u2013 Nick Sullivan (CloudFlare)<\/h2>\n
![\"CloudFlare\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2014\/12\/CloudFlare-300x225.png\")
<\/a>Slides: https:\/\/www.botconf.eu\/wp-content\/uploads\/2014\/12\/2014-1.6-Splicing-and-Dicing-2014-Examining-this-Year%E2%80%99s-Botnet-Attack-Trends1.pdf<\/a><\/p>\n\n
Virus Tracker \u2013 Peter Kleissner (Kleissner & Associates)<\/h2>\n
![\"virustracker\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2014\/12\/virustracker-300x168.png\"){kind=tracking}
<\/a>Slides: https:\/\/www.botconf.eu\/wp-content\/uploads\/2014\/12\/2014-1.7-Virus-Tracker.pdf<\/a><\/p>\n\n
\n<\/em><\/li>\nHow to dismantle a botnet: legal aspects behind the scenes \u2013 Karine e Silva (PhD student at Tilburg University (Netherlands) \u2013 @kar1nekks)<\/h2>\n
![\"dismantle_botnet_legal\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2014\/12\/dismantle_botnet_legal-300x224.png\")
<\/a>Slides: https:\/\/www.botconf.eu\/wp-content\/uploads\/2014\/12\/2014-1.8-How-to-Dismantle-a-Botnet-the-Legal-Behind-the-Scenes.pdf<\/a><\/p>\n\n
\n
Lightning talks \u2013 first session<\/h2>\n