CS 259D 僵尸网络 介绍

作者:Leo

  • 简介
  • 起源
  • 僵尸网络的组件
  • 僵尸网络生命周期
  • 僵尸网络C&C拓扑结构
    • 星型结构
    • 多服务器结构
    • 分层结构
    • 随机结构
  • 召集机制
    • IP 地址硬编码
    • 动态DNS
    • 分布式的DNS
    • Fluxing
    • IP Flux (Fast-Flux)
    • 域名 Flux
  • 盲代理重定向
  • 通信协议
    • IRC 协议
    • HTTP 协议
  • 可观测到的行为
    • 基于网络的的行为
    • 基于主机的行为
    • 全局相关的特征
  • 逃避检测与僵尸网络检测的挑战
  • 参考资料

简介

  • 由被操控的机器组成的网络
  • 据估计,互联网上有 16-25% 的机器是肉鸡
    • 僵尸网络 Rustock 拥有超过一百万的肉鸡
    • 僵尸网络风暴是世界上最大的超算之一
  • 应用于
    • 信息和身份盗窃
    • 分布式拒绝服务(DDoS)
    • 软件盗版
    • 垃圾邮件/网络钓鱼
      • 几乎 80% 的邮件是垃圾邮件
      • 例如: Grum, Cutwail, Rustock
    • 地下经济
      • 10,000 个肉鸡售价 15 美元
  • 危害影响 (参照国际电信联盟)
    • 2006年,全球经济直接损失132亿美元
    • 2005年,美国企业直接和间接损失共计622亿美元
    • 2007年全球垃圾邮件成本:全球为100亿美元,美国为350亿美元

起源

  • 互联网中继聊天(Internet Relay Chat, IRC)
    • 基于文本的聊天系统
    • 在频道中组织通讯
    • 僵尸网络被用于控制IRC聊天室中的交互
      • 理解执行简单的命令
      • 提供管理支持
      • 提供简单的游戏/服务
      • 检索信息:操作系统,登录信息,电子邮件等
    • 第一个IRC bot:Eggdrop,1993

僵尸网络的组件

  • 僵尸
    • 高传输率
    • 安全级别低
    • 远程
    • 大多数是 Windows

僵尸网络生命周期

  • 首次感染
    • 受感染的网站,电子邮件附件,可移动媒体等
  • 二次注射
    • 宿主下载并运行二进制文件,成为一个僵尸
    • FTP, HTTP, 或者 P2P
  • 召集连接
    • 与 C&C (Command and Control) 建立连接
    • 每次宿主重新启动时都会发生
  • 恶意行为
    • 宿主与 C&C 之间通信更紧密
  • 维护和升级

僵尸网络C&C拓扑结构

星型结构

  • 集中式, C&C 与所有机器人通信
  • 使用的协议:
    • IRC
      • SDBot,GTBot,Agobot 的 C&C 功能仍在使用中
      • 原作者自行发布
    • HTTP
      • 混入正常的用户流量
      • DIY 工具包
    • 即时消息(IM)协议
      • ICQ,AIM,MSN Messenger
      • 需要为每个机器人创建一个帐户
  • 优点:
    • 控制速度
  • 缺点:
    • 单点故障

多服务器结构

  • 扩展星型拓扑结构
  • C&C 服务器之间也进行通信
  • 优点:
    • 没有单点故障
    • 根据地域优化
  • 缺点:
    • 维护运营需要更多的成本

分层结构

  • 一组机器人作为 servant
    • 静态可路由的IP地址
    • 通过代理C&C个僵尸机器人下达指令
  • 变体:分层 Kademlia
    • 集群僵尸网络和孤立僵尸网络的合集
    • 集群内通信:P2P
    • 集群间通信:超级机器人
  • 优点:
    • 僵尸网络的“自我认知”: 僵尸网络无法监听所有成员,不大可能透露 C&C
    • 易于二次销售
      • 向其他运营商租借/转售部分僵尸网络
  • 缺点:
    • 命令有延迟:不适合实时行动

随机结构

  • 没有集中的 C&C
    • 僵尸网络控制者发布命令,通过任意的僵尸机器人发布、分享指令文件
    • 为避免被接管,命令由控制者签名
  • 未来:基于Skype的僵尸网络
    • 更好地混入其他 P2P 流量
  • 优点:
    • 弹性高
  • 缺点:
    • 命令有延迟
    • 僵尸网络难以枚举

召集机制

  • C&C 位置解析

IP 地址硬编码

  • 硬编码 IP 地址列表
  • 可以通过僵尸网络IP地址进行检测

动态DNS

  • 由动态 DNS 提供商分配的硬编码的 C&C 域名
  • 当旧的 C&C 服务器发生故障或被关闭时, 易于创建新的 C&C 服务器
  • Botmaster 可以随机更改位置,更加难以检测

分布式的DNS

  • 僵尸网络运行自己的DNS服务执法或其他当局的范围
  • 机器人使用 DNS 地址来解析 C&C 服务器
  • 使用高端口号以避免安全设备和网关的检测

Fluxing

  • 提高适应性能

IP Flux (Fast-Flux)

  • 持续变化的 IP 地址信息
  • Single Flux
    • 单一域名关联多个(100s-1000s) IP 地址
    • 快速注册/取消注册的IP地址
      • 循环分配
      • 短时间(TTL) DNS A 记录
  • Double Flux
    • 变换完整域名(Fully-Qualified Domain Name, FQDN)的 IP 地址
    • 用于查询 IP 地址的 DNS 服务器的 IP 地址也进行变换(NS records)

域名 Flux

  • 域通配符
    • 在DNS记录中使用通配符
      • 例如: *.domain.com
    • 用于垃圾邮件/网络钓鱼
    • 通配符信息被用于
      • 识别受害者
        • 一个独一的随机域名
        • 例如: rjhgbrwh.domain.com
      • 跟踪
      • 绕过反垃圾邮件检测
  • 域名生成算法
    • 每天创建 FQDN 动态列表
      • 加密域名
    • 生成的 FQD 由宿主进行轮询,以此查找 C&C
    • 例如:蠕虫 Conficker.C
      • 每天生成50,000个域名
      • 尝试联系500个
      • 如果操纵者每天只注册1个域名,则每天有1%的机会更新
      • 为了防止更新请求,需要每天注册50,000个新域名
    • 好处
      • 批量生成域名, 生存时间短(通常为1天)
      • 难以调查/阻止所有潜在的域名

盲代理重定向

  • 添加一个额外的弹性层
  • 代理 IP /域名查找和 C​​&C 流量

通信协议

IRC 协议

  • IRC主要用于为一对多通信,但也可以用于一对一
  • 大多数企业网络不允许IRC流量, 因此任何IRC请求都可以确定存在外部或内部僵尸机器人
    • 出站IRC请求意味着网络上已经被感染的计算机
    • 入站IRC请求意味着控制者 botmaster 招募僵尸大军

HTTP 协议

  • 由于 HTTP 普遍使用,很难跟踪使用 HTTP 协议的僵尸网络
  • 使用 HTTP 可以使得僵尸网络避开防火墙对 IRC 僵尸网络的限制
  • 检测 HTTP 僵尸网络比较困难,但并非不可能,因为头部字段和有效载荷不符合正常的 HTTP 流量特点

可观测到的行为

基于网络的的行为

  • 网络模式可以用来检测僵尸网络
    • IRC 和 HTT P是最常见的僵尸网络通信形式
    • 通过识别异常流量的特征来检测
  • DNS 域名
    • DNS 查询来定位 C&C 服务器
    • 宿主查询不适宜的域名
    • 与域名关联的 IP 地址持续变化
  • 流量
    • 时而突然忙碌,余下的时间比较空闲
    • 异于常人的快速反馈
    • 攻击行为

基于主机的行为

  • 宿主计算设备可以观测到僵尸网络行为
    • 呈现出类似病毒的活动
    • 运行时,出现多个程序
      • 修改注册表
      • 修改系统文件
      • 创建未知的网络连接
      • 禁用防病毒程序

全局相关的特征

  • 全局特征与基本僵尸网络相关联
    • 除非僵尸网络完全重新设计和重新实施,否则不会改变
    • 最有价值的僵尸网络检测方法
  • 无论僵尸网络是通过 IRC 还是 HTTP 通信,行为都是相同的
    • 由于分配了新的 C&C 服务器,全球 DNS 查询增加
    • 网络流量中断

逃避检测与僵尸网络检测的挑战

  • 僵尸网络流量与正常流量类似
    • 可能加密
  • 僵尸网络发展迅速
    • 新的机器人不断增加
    • 改变协议
      • 不使用 IRC
      • 用一下方法进行控制
        • HTTP
        • VoIP
        • IPV6
        • ICMP
        • Skype 协议
    • 改变体系结构
    • 改变感染模型
    • Fast flux 托管

参考资料

“CS 259D 僵尸网络 介绍”的107个回复

  1. I just want to mention I am new to weblog and certainly enjoyed you’re page. Very likely I’m likely to bookmark your site . You actually come with good article content. Kudos for sharing your web site.

  2. When I originally commented I clicked the -Notify me when new comments are added- checkbox and after this each time a comment is added I get four emails with the same comment. Perhaps there is by any means you are able to remove me from that service? Thanks!

  3. I loved as much as you’ll receive carried out right here. The sketch is tasteful, your authored material stylish. nonetheless, you command get got an shakiness over that you wish be delivering the following. unwell unquestionably come more formerly again as exactly the same nearly very often inside case you shield this hike.

  4. Thanks for one’sfor onesfor yourfor your personalfor afor theon your marvelous posting! I actuallyseriouslyquitedefinitelyreallygenuinelytrulycertainly enjoyed reading it, you could beyou areyou can beyou might beyou’reyou will beyou may beyou happen to be a great author.I will make sure toensure that Ibe sure toalwaysmake certain tobe sure toremember to bookmark your blog and willand definitely willand will eventuallyand will oftenand may come back from now ondown the roadin the futurevery soonsomedaylater in lifeat some pointin the foreseeable futuresometime soonlater on. I want to encourage you to ultimatelythat youyourself toyou to definitelyyou toone toyou continue your great jobpostswritingwork, have a nice daymorningweekendholiday weekendafternoonevening!

  5. I am going to devices this critique in direction of Two styles of men and women: existing Zune property owners who are taking into consideration an upgrade, and men and women trying to make a decision amongst a Zune and an iPod. (There are other gamers importance thinking of out there, together with the Sony Walkman X, nevertheless I anticipate this delivers on your own sufficient information in the direction of crank out an informed option of the Zune vs players other than the iPod line as effectively.)

  6. Hi my family member! I want to say that this article is amazing, nice written and come with almost all important infos. I would like to peer more posts like this.

  7. Excellent beat ! I would like to apprentice while you amend your web site, how can i subscribe for a blog site? The account helped me a acceptable deal. I had been tiny bit acquainted of this your broadcast provided bright clear concept

  8. Hey There. I found your blog using msn. This is a really well written article. I’ll make sure to bookmark it and come back to read more of your useful information. Thanks for the post. I’ll definitely return.

  9. My brother suggested I might like this blog. He was totally right. This post truly made my day. You can not imagine just how much time I had spent for this info! Thanks!

  10. Fantastic goods from you, man. I’ve understand your stuff previous to and you are just extremely great. I really like what you have acquired here, really like what you’re saying and the way in which you say it. You make it entertaining and you still care for to keep it smart. I can not wait to read much more from you. This is really a tremendous site.

  11. I precisely needed to thank you so much again. I do not know the things that I would’ve tried without those methods provided by you about such a theme. It had become a real distressing scenario in my opinion, but taking a look at a well-written technique you handled the issue forced me to weep with delight. I will be thankful for this guidance and then wish you really know what an amazing job you’re undertaking instructing other individuals through the use of your webpage. I’m certain you haven’t come across all of us.

  12. you are in point of fact a good webmaster. The web site loading velocity is amazing. It seems that you’re doing any distinctive trick. In addition, The contents are masterpiece. you have performed a great job in this subject!

  13. RETSPRO scams can be obtainable on the net, so please beware of trying to buy versions of our software at reduced prices. There is only one legitimate place to buy our software and that is on our own RETSPRO website.

  14. Hiya very nice blog!! Man .. Excellent .. Wonderful .. I’ll bookmark your website and take the feeds also…I’m happy to search out so many useful information right here within the publish, we want work out more strategies in this regard, thank you for sharing.

  15. My wife and i felt very fortunate when Jordan could conclude his research by way of the ideas he acquired through the blog. It is now and again perplexing to simply be giving freely guides which other people could have been making money from. We really figure out we now have you to give thanks to because of that. The entire illustrations you made, the simple site navigation, the friendships your site help to create – it’s got most unbelievable, and it is letting our son and the family feel that the topic is awesome, which is exceedingly important. Thank you for the whole lot!

  16. I’ve recently started a web site, the information you offer on this site has helped me tremendously. Thanks for all of your time & work. “Men must be taught as if you taught them not, And things unknown proposed as things forgot.” by Alexander Pope.

  17. Hello very cool website!! Guy .. Excellent .. Amazing .. I’ll bookmark your website and take the feeds additionally…I’m glad to seek out numerous useful information here within the post, we need work out extra strategies on this regard, thanks for sharing.

  18. I loved as much as you will receive carried out right here. The sketch is tasteful, your authored subject matter stylish. nonetheless, you command get bought an shakiness over that you wish be delivering the following. unwell unquestionably come more formerly again as exactly the same nearly a lot often inside case you shield this increase.

  19. You could definitely see your expertise within the paintings you write. The sector hopes for even more passionate writers such as you who are not afraid to mention how they believe. Always follow your heart. “If the grass is greener in the other fellow’s yard – let him worry about cutting it.” by Fred Allen.

  20. I want to express my admiration for your generosity in support of those individuals that really need help with this important subject matter. Your real commitment to passing the message along has been unbelievably advantageous and has consistently allowed others much like me to reach their goals. Your entire invaluable facts entails much to me and still more to my fellow workers. Thanks a lot; from each one of us.

  21. you’re truly a just right webmaster. The site loading velocity is amazing. It seems that you’re doing any unique trick. Moreover, The contents are masterpiece. you have done a magnificent process in this subject!

  22. I want to show my thanks to the writer just for rescuing me from this situation. After scouting throughout the online world and coming across concepts which were not powerful, I figured my entire life was gone. Existing without the presence of strategies to the difficulties you have fixed by means of your review is a critical case, as well as the ones that would have in a negative way damaged my entire career if I had not come across the website. Your personal competence and kindness in dealing with all the stuff was important. I am not sure what I would have done if I hadn’t come upon such a solution like this. I can at this moment look forward to my future. Thank you so much for your impressive and results-oriented help. I will not be reluctant to propose your blog to any individual who would like guide on this topic.

  23. Simply want to say your article is as amazing. The clearness in your post is simply nice and i could assume you are an expert on this subject. Well with your permission let me to grab your feed to keep updated with forthcoming post. Thanks a million and please keep up the rewarding work.

  24. you’re actually a good webmaster. The web site loading pace is amazing. It sort of feels that you are doing any unique trick. Also, The contents are masterpiece. you have performed a excellent process in this subject!

  25. Simply wish to say your article is as astonishing. The clearness in your post is simply great and i could assume you are an expert on this subject. Well with your permission allow me to grab your RSS feed to keep updated with forthcoming post. Thanks a million and please carry on the rewarding work.

  26. Pretty section of content. I just stumbled upon your blog and in accession capital to assert that I acquire actually enjoyed account your blog posts. Anyway I’ll be subscribing to your augment and even I achievement you access consistently rapidly.

  27. I have been browsing online more than 3 hours today, yet I never found any interesting article like yours. It’s pretty worth enough for me. Personally, if all site owners and bloggers made good content as you did, the net will be a lot more useful than ever before.

  28. You actually make it seem so easy with your presentation but I find this topic to be actually something that I think I would never understand. It seems too complex and extremely broad for me. I am looking forward for your next post, I will try to get the hang of it!

  29. Thank you for sharing superb informations. Your site is very cool. I am impressed by the details that you have on this web site. It reveals how nicely you understand this subject. Bookmarked this website page, will come back for extra articles. You, my friend, ROCK! I found just the information I already searched all over the place and simply could not come across. What a perfect website.

  30. I as well as my buddies happened to be going through the good solutions located on your web page then the sudden came up with a horrible suspicion I never expressed respect to the blog owner for those strategies. My boys had been as a result thrilled to read through all of them and have in effect clearly been taking advantage of those things. Many thanks for really being so kind and also for opting for this kind of decent ideas millions of individuals are really desirous to be informed on. My personal honest regret for not saying thanks to you sooner.

  31. Hi, Neat post. There is a problem along with your website in internet explorer, could check this… IE still is the marketplace chief and a large section of other folks will omit your excellent writing because of this problem.

  32. My wife and i got thrilled when Jordan could carry out his studies via the precious recommendations he made through your web site. It is now and again perplexing to simply choose to be releasing tricks which usually the others may have been selling. And now we keep in mind we have the writer to appreciate for this. Those explanations you made, the straightforward site menu, the friendships you will make it easier to promote – it is many extraordinary, and it is leading our son and our family know that this situation is pleasurable, and that is incredibly fundamental. Thanks for the whole lot!

  33. I must show thanks to this writer just for bailing me out of this particular scenario. After scouting throughout the search engines and meeting ideas that were not productive, I thought my entire life was well over. Living without the answers to the problems you’ve fixed as a result of the short post is a serious case, and the ones that would have badly damaged my career if I hadn’t encountered your site. Your main know-how and kindness in maneuvering every item was very useful. I’m not sure what I would have done if I had not encountered such a point like this. I can also at this moment look ahead to my future. Thanks a lot very much for your specialized and effective help. I won’t think twice to refer your blog to any individual who wants and needs tips about this subject.

  34. I really like your writing style, fantastic info, thanks for putting up :D. “Much unhappiness has come into the world because of bewilderment and things left unsaid.” by Feodor Mikhailovich Dostoyevsky.

  35. Great ¡V I should certainly pronounce, impressed with your web site. I had no trouble navigating through all the tabs as well as related information ended up being truly easy to do to access. I recently found what I hoped for before you know it in the least. Reasonably unusual. Is likely to appreciate it for those who add forums or something, website theme . a tones way for your client to communicate. Excellent task..

  36. It’s really a nice and helpful piece of info. I’m happy that you just shared this useful information with us. Please stay us informed like this. Thanks for sharing.

  37. of course like your website however you have to check the spelling on several of your posts. A number of them are rife with spelling problems and I in finding it very troublesome to tell the truth nevertheless I will definitely come again again.

  38. Magnificent goods from you, man. I’ve understand your stuff previous to and you are just extremely fantastic. I really like what you have acquired here, certainly like what you are saying and the way in which you say it. You make it enjoyable and you still take care of to keep it sensible. I cant wait to read far more from you. This is really a tremendous website.

  39. Someone necessarily assist to make severely posts I’d state. This is the first time I frequented your web page and thus far? I surprised with the analysis you made to create this particular publish incredible. Wonderful activity!

  40. Its like yousuch as you readlearn my mindthoughts! You seemappear to understandto knowto grasp so mucha lot approximatelyabout this, like yousuch as you wrote the booke-bookguideebooke book in it or something. I thinkI feelI believe that youthat you simplythat you just couldcan do with somea few p.c.percent to forcepressuredrivepower the message househome a bita little bit, howeverbut other thaninstead of that, this isthat is greatwonderfulfantasticmagnificentexcellent blog. A greatAn excellentA fantastic read. I’llI will definitelycertainly be back.

  41. I am extremely impressed with your writing skills as well as with the layout on your blog. Is this a paid theme or did you customize it yourself? Either way keep up the nice quality writing, it’s rare to see a nice blog like this one these days..

  42. I definitely wanted to compose a small remark so as to thank you for these stunning ways you are placing at this website. My time intensive internet research has at the end of the day been paid with beneficial know-how to talk about with my great friends. I ‘d admit that many of us site visitors are undeniably fortunate to exist in a fantastic site with so many wonderful people with helpful tips. I feel very happy to have come across your webpages and look forward to really more fabulous times reading here. Thanks once again for a lot of things.

  43. Simply wish to say your article is as surprising. The clarity in your post is simply spectacular and i could assume you’re an expert on this subject. Fine with your permission let me to grab your feed to keep up to date with forthcoming post. Thanks a million and please continue the gratifying work.

  44. Thank you for sharing superb informations. Your web-site is very cool. I am impressed by the details that you have on this site. It reveals how nicely you understand this subject. Bookmarked this web page, will come back for extra articles. You, my pal, ROCK! I found simply the information I already searched everywhere and just couldn’t come across. What a great web-site.

  45. Hi, i think that i saw you visited my web site so i came to “return the favor”.I’m trying to find things to enhance my website!I suppose its ok to use a few of your ideas!!

  46. This is really interesting, You are a very skilled blogger. I have joined your feed and look forward to seeking more of your excellent post. Also, I have shared your website in my social networks!

  47. hello there and thank you for your info – I’ve certainly picked up anything new from right here. I did however expertise a few technical points using this site, as I experienced to reload the website many times previous to I could get it to load correctly. I had been wondering if your web hosting is OK? Not that I am complaining, but slow loading instances times will often affect your placement in google and could damage your high-quality score if ads and marketing with Adwords. Well I am adding this RSS to my email and can look out for a lot more of your respective exciting content. Make sure you update this again very soon..

  48. I would like to thnkx for the efforts you have put in writing this website. I’m hoping the same high-grade website post from you in the upcoming also. In fact your creative writing skills has encouraged me to get my own website now. Actually the blogging is spreading its wings rapidly. Your write up is a great example of it.

  49. Thanks for your entire work on this website. Betty loves working on internet research and it’s really easy to understand why. We all know all about the dynamic ways you produce functional thoughts by means of your web blog and as well as recommend participation from others about this topic while my girl is without a doubt understanding a whole lot. Take advantage of the remaining portion of the new year. You have been carrying out a really good job.

  50. Good website! I really love how it is simple on my eyes and the data are well written. I’m wondering how I might be notified whenever a new post has been made. I have subscribed to your RSS feed which must do the trick! Have a nice day!

  51. I think this is one of the most important info for me. And i’m glad reading your article. But should remark on few general things, The web site style is wonderful, the articles is really nice : D. Good job, cheers

  52. Unquestionably believe that which you stated. Your favorite reason appeared to be on the internet the simplest thing to be aware of. I say to you, I certainly get annoyed while people consider worries that they just don’t know about. You managed to hit the nail upon the top and defined out the whole thing without having side-effects , people could take a signal. Will probably be back to get more. Thanks

  53. Its like you read my mind! You seem to know so much about this, like you wrote the book in it or something. I think that you could do with a few pics to drive the message home a bit, but other than that, this is magnificent blog. A fantastic read. I will certainly be back.

  54. Thanks for sharing excellent informations. Your website is very cool. I am impressed by the details that you’ve on this website. It reveals how nicely you perceive this subject. Bookmarked this website page, will come back for more articles. You, my friend, ROCK! I found simply the information I already searched all over the place and just could not come across. What a great web site.

  55. I’ve been browsing online greater than three hours as of late, yet I never discovered any attention-grabbing article like yours. It¡¦s beautiful price sufficient for me. Personally, if all web owners and bloggers made excellent content material as you probably did, the web will be much more helpful than ever before.

发表评论

电子邮件地址不会被公开。 必填项已用*标注