殭屍網絡

kickassoff · 發表於 2013-6-9 16:46:30

殭屍網絡
殭屍網絡（Botnet，亦譯為喪屍網絡、機械人網絡）是指駭客利用自己編寫的分散式阻斷服務攻擊程式將數萬個淪陷的機器，即黑客常說的僵屍電腦或肉雞，組織成一個個控制節點，用來發送偽造包或者是垃圾封包，使預定攻擊標的癱瘓並「拒絕服務」。通常蠕蟲病毒也可以被利用組成殭屍網絡。

最早的殭屍網絡出現在1993年，在IRC聊天網絡中出現。1999年後IRC協議的殭屍程式大規模出現。曾有一個紐西蘭19歲的黑客控制了全球150萬台電腦，中國唐山的黑客也控制了6萬台中國的電腦對某音樂網站進行分佈式拒絕服務（DDoS）攻擊，造成該網站不論將伺服器轉移到台灣還是美國都無法正常提供服務，損失上百萬元人民幣，河北唐山黑客的殭屍網絡規模也是中國目前為止最大的，目前這兩位黑客均已被逮捕。[1]

2011年4月13日美國聯邦司法部和聯邦調查局（FBI）宣布破獲大批中毒電腦所組成的「殭屍網絡」(botnet)，已全面關閉名為Coreflood伺服器和網絡域名，並對13名嫌疑人起訴。該網絡運作將近10年，全球有超過200萬台個人電腦被Coreflood惡意程式感染。[2]
用途

黑客發送命令開「喪屍」的SOCKS代理用來發送垃圾郵件
分散式阻斷服務攻擊商業競爭對手的網站

等共10種左右的用途
危害程度
有害軟件傳播性可控性竊密性危害級別
殭屍網絡具備高度可控有全部控制：高
木馬不具備可控有全部控制：高
間諜軟件一般沒有一般沒有有訊息泄露：中
蠕蟲主動傳播一般沒有一般沒有網絡流量：高
病毒使用者干預一般沒有一般沒有感染檔案：中

參考文獻

^ CNCERT/CC配合公安部門搗毀一大規模殭屍網絡：2004年河北唐山黑客許某控制近十萬台「殭屍」，其中六萬多台在中國境內，包括部分政府和其他部門的電腦
^ 網路執法關國際殭屍網路. 世界日報. 2011-4-14 [2011-4-18查閱] （中文（台灣）‎）.
^ CNCERT／CC的文獻《殭屍網絡的威脅和應對》

kickassoff · 發表於 2013-6-9 16:46:31

英文版的

Botnet
A botnet is a collection of internet-connected programs communicating with other similar programs in order to perform tasks. This can be as mundane as keeping control of an IRC channel, or it could be used to send spam email or participate in DDoS attacks. The word botnet stems from the two words robot and network.

Legal botnets

The term botnet is widely used when several IRC bots have been linked and may possibly set channel modes on other bots and users while keeping IRC channels free from unwanted users. This is where the term is originally from, since the first illegal botnets were similar to legal botnets. A common bot used to set up botnets on IRC is eggdrop.
Illegal botnets

Botnets sometimes comprise computers whose security defenses have been breached and control ceded to a 3rd party. Each such compromised device, known as a "bot", is created when a computer is penetrated by software from a malware (malicious software) distribution. The controller of a botnet is able to direct the activities of these compromised computers through communication channels formed by standards-based network protocols such as IRC (Internet Relay Chat) and HTTP (Hypertext Transfer Protocol).[1]
Recruitment

Computers can be co-opted into a botnet when they execute malicious software. This can be accomplished by luring users into making a drive-by download, exploiting web browser vulnerabilities, or by tricking the user into running a Trojan horse program, which may come from an email attachment. This malware will typically install modules that allow the computer to be commanded and controlled by the botnet's operator. Depending on how it is written, a Trojan may then delete itself, or may remain present to update and maintain the modules.[citation needed]

The first BotNet was first acknowledged and exposed by Earthlink during a lawsuit with notorious spammer Khan C. Smith[2] in 2001 for the purpose of bulk spam accounting for nearly 25% of all spam at the time.
Organization

While botnets are often named after the malware that created them, multiple botnets typically use the same malware, but are operated by different entities.[3]

The term "botnet" can be used to refer to any group of computers, such as IRC bots, but the term is generally used to refer to a collection of computers (called zombie computers) that have been recruited by running malicious software.[citation needed]

A botnet's originator (known as a "bot herder" or "bot master") can control the group remotely, usually through an IRC, and often for criminal purposes. This server is known as the command-and-control (C&C) server. Though rare, more experienced botnet operators program command protocols from scratch. These protocols include a server program, a client program for operation, and the program that embeds the client on the victim's machine. These communicate over a network, using a unique encryption scheme for stealth and protection against detection or intrusion into the botnet.[citation needed]

A bot typically runs hidden and uses a covert channel (e.g. the RFC 1459 (IRC) standard, Twitter, or IM) to communicate with its C&C server. Generally, the perpetrator has compromised multiple systems using various tools (exploits, buffer overflows, as well as others; see also RPC). Newer bots can automatically scan their environment and propagate themselves using vulnerabilities and weak passwords. Generally, the more vulnerabilities a bot can scan and propagate through, the more valuable it becomes to a botnet controller community. The process of stealing computing resources as a result of a system being joined to a "botnet" is sometimes referred to as "scrumping."

Botnet servers are typically redundant, linked for greater redundancy so as to reduce the threat of a takedown. Actual botnet communities usually consist of one or several controllers that rarely have highly developed command hierarchies; they rely on individual peer-to-peer relationships.[4]

Botnet architecture evolved over time, and not all botnets exhibit the same topology for command and control. Advanced topology is more resilient to shutdown, enumeration or discovery. However, some topologies limit the marketability of the botnet to third-parties.[5] Typical botnet topologies are Star, Multi-server, Hierarchical and Random.

To thwart detection, some botnets are scaling back in size. As of 2006, the average size of a network was estimated at 20,000 computers, although larger networks continued to operate.

Formation and exploitation

This example illustrates how a botnet is created and used to send email spam.
How a botnet works

A botnet operator sends out viruses or worms, infecting ordinary users' computers, whose payload is a malicious application—the bot.
The bot on the infected PC logs into a particular C&C server.
A spammer purchases the services of the botnet from the operator.
The spammer provides the spam messages to the operator, who instructs the compromised machines via the control panel on the web server, causing them to send out spam messages.

Botnets are exploited for various purposes, including denial-of-service attacks, creation or misuse of SMTP mail relays for spam (see Spambot), click fraud, mining bitcoins, spamdexing, and the theft of application serial numbers, login IDs, and financial information such as credit card numbers.

The botnet controller community features a constant and continuous struggle over who has the most bots, the highest overall bandwidth, and the most "high-quality" infected machines, like university, corporate, and even government machines.[7]

kickassoff · 發表於 2013-6-9 16:46:32

Types of attacks

In distributed denial-of-service attacks, multiple systems submit as many requests as possible to a single Internet computer or service, overloading it and preventing it from servicing legitimate requests. An example is an attack on a victim's phone number. The victim is bombarded with phone calls by the bots, attempting to connect to the Internet.
Adware advertises a commercial offering actively and without the user's permission or awareness, for example by replacing banner ads on web pages with those of another advertiser.
Spyware is software which sends information to its creators about a user's activities – typically passwords, credit card numbers and other information that can be sold on the black market. Compromised machines that are located within a corporate network can be worth more to the bot herder, as they can often gain access to confidential corporate information. Several targeted attacks on large corporations aimed to steal sensitive information, such as the Aurora botnet.[8]
E-mail spam are e-mail messages disguised as messages from people, but are either advertising, annoying, or malicious.
Click fraud occurs when the user's computer visits websites without the user's awareness to create false web traffic for personal or commercial gain.
Fast flux is a DNS technique used by botnets to hide phishing and malware delivery sites behind an ever-changing network of compromised hosts acting as proxies.
Brute-forcing remote machines services such as FTP, SMTP and SSH.
Worms. The botnet focuses on recruiting other hosts.
Scareware is software that is marketed by creating fear in users. Once installed, it can install malware and recruit the host into a botnet. For example users can be induced to buy a rogue anti-virus to regain access to their computer.[9]
Exploiting systems by observing users playing online games such as poker and see the players' cards.[10]

Countermeasures

The geographic dispersal of botnets means that each recruit must be individually identified/corralled/repaired and limits the benefits of filtering. Some botnets use free DNS hosting services such as DynDns.org, No-IP.com, and Afraid.org to point a subdomain towards an IRC server that harbors the bots. While these free DNS services do not themselves host attacks, they provide reference points (often hard-coded into the botnet executable). Removing such services can cripple an entire botnet. Some botnets implement custom versions of well-known protocols. The implementation differences can be used for detection of botnets. For example, Mega-D features a slightly modified SMTP protocol implementation for testing spam capability. Bringing down the Mega-D's SMTP server disables the entire pool of bots that rely upon the same SMTP server.[11]

The botnet server structure mentioned above has inherent vulnerabilities and problems. For example, finding one server with one botnet channel can often reveal the other servers, as well as their bots. A botnet server structure that lacks redundancy is vulnerable to at least the temporary disconnection of that server. However, recent IRC server software includes features to mask other connected servers and bots, eliminating that approach.

Security companies such as Afferent Security Labs, Symantec, Trend Micro, FireEye, Umbra Data and Damballa have announced offerings to counter botnets. Norton AntiBot was aimed at consumers, but most target enterprises and/or ISPs. Host-based techniques use heuristics to identify bot behavior that has bypassed conventional anti-virus software. Network-based approaches tend to use the techniques described above; shutting down C&C servers, nullrouting DNS entries, or completely shutting down IRC servers.

Some newer botnets are almost entirely P2P, with command-and-control embedded into the botnet rather than relying on C&C servers, thus avoiding any single point of failure. Commanders can be identified just through secure keys and all data except the binary itself can be encrypted. For example, a spyware program may encrypt all suspected passwords with a public key hard coded or distributed with the bot software. Only with the private key (which is known only by the commander) can the data captured by the bot be read.

Some botnets are capable of detecting and reacting to attempts to figure out how they work. A large botnet that learns it is being studied can even attack those studying it.

Researchers at Sandia National Laboratories are analyzing botnets behavior by simultaneously running one million Linux kernels as virtual machines on a 4,480-node high-performance computer cluster.[12]
Historical list of botnets
Date created Date dismantled Name Estimated no. of bots Spam capacity Aliases
2009 (May) 2010-Oct (partial) BredoLab 30,000,000[13] 3.6 billion/day Oficla
2008 (around) 2009-Dec Mariposa 12,000,000[14]    ?
2008 (November) Conficker 10,500,000+[15] 10 billion/day DownUp, DownAndUp, DownAdUp, Kido
2010 (around) TDL4 4,500,000[16]    ? TDSS, Alureon
? Zeus 3,600,000 (US only)[17] n/a Zbot, PRG, Wsnpoem, Gorhax, Kneber
2007 (Around) Cutwail 1,500,000[18] 74 billion/day Pandex, Mutant (related to: Wigon, Pushdo)
2008 (Around) Sality 1,000,000[19]    ? Sector, Kuku
2009 (Around) 2012-07-19 Grum 560,000[20] 39.9 billion/day Tedroo
? Mega-D 509,000[21] 10 billion/day Ozdok
? Kraken 495,000[22] 9 billion/day Kracken
2007 (March) 2008 (November) Srizbi 450,000[23] 60 billion/day Cbeplay, Exchanger
? Lethic 260,000[24] 2 billion/day none
2004 (Early) Bagle 230,000[24] 5.7 billion/day Beagle, Mitglieder, Lodeight
? Bobax 185,000[24] 9 billion/day Bobic, Oderoor, Cotmonger, Hacktool.Spammer, Kraken
? Torpig 180,000[25] n/a Sinowal, Anserin
? Storm 160,000[26] 3 billion/day Nuwar, Peacomm, Zhelatin
2006 (Around) 2011 (March) Rustock 150,000[27] 30 billion/day RKRustok, Costrat
? Donbot 125,000[28] 0.8 billion/day Buzus, Bachsoy
2012 (Around) Chameleon 120,000 [29] n/a None
2008 (November) 2010 (March) Waledac 80,000[30] 1.5 billion/day Waled, Waledpak
? Maazben 50,000[24] 0.5 billion/day None
? Onewordsub 40,000[31] 1.8 billion/day ?
? Gheg 30,000[24] 0.24 billion/day Tofsee, Mondera
?    ?? 20,000[31] 5 billion/day Loosky, Locksky
? Wopla 20,000[31] 0.6 billion/day Pokier, Slogger, Cryptic
2008 (Around) Asprox 15,000[32]    ? Danmec, Hydraflux
Spamthru 12,000[31] 0.35 billion/day Spam-DComServ, Covesmer, Xmiler
2010 (January) LowSec 11,000+[24] 0.5 billion/day LowSecurity, FreeMoney, Ring0.Tools
? Xarvester 10,000[24] 0.15 billion/day Rlsloup, Pixoliz
2009 (August) Festi    ? 2.25 billion/day Spamnost
2008 (Around) Gumblar    ?    ? None
2007 Akbot 1,300,000[33]    ? None
2010 (Several: 2011, 2012) Kelihos 300,000+ 4 billion/day Hlux

Researchers at the University of California, Santa Barbara took control of a botnet that was six times smaller than expected. In some countries, it is common that users change their IP address a few times in one day. Estimating the size of the botnet by the number of IP addresses is often used by researchers, possibly leading to inaccurate assessments.[34]
All botnets listed here affect only Microsoft Windows systems.