6th European Conference - Academic Conferences

Figure 6: JavaScript obfuscation
3.5 Spreading of botnet
Ivan Burke and Renier van Heerden
Thus far we have illustrated two layers of attack. The DDoS attacks and Adsense abuse described in
previous subsections are targeted towards remote servers or Impression Based advertising
companies, these attacks are in effect performed by the gadget users on behalf of the botherder. The
second layer of attack is the data gathering performed on the actual gadget user.
Attacks on remote server, actually require few gadget users. A botherder can automate mass
amounts of requests from a single gadget user. FeedFetcher was designed distributed on several
machines to improve performance and to cut down on bandwidth Google attempts to make the fetch
request on a machine situated near target remote site. This would mean that the IP would constantly
change and that the physical location of fetching machines can also be varied.
The second layer of attack is more reliant on the gadget itself to spread among users. For the
purpose of this research we merely created several Google accounts and used Google Gadget
sharing capabilities to distribute the gadgets. We will now briefly discuss some of the options available
for spreading of gadgets.
Google Gadget API provides users with the capability of sharing gadgets among a user’s Google
contact list or by sending out emails containing an invite to install the gadget. Google also provide the
capability of publishing the gadget on their Application servers. Published applications can be ranked
and browsed by all iGoogle users. By manipulating the Google ranking system one can increase the
probability of your gadget being added by other users.
Google Gadget API is fully integrated with OpenSocial API. OpenSocial API is a web framework for
developing social applications which are capable of communicating across multiple social media sites.
Peterson (2009), provides some basic steps than can be taken to increase gadget spread.
In the next Section, we will discuss our final Botnet model. We discuss how we mapped all the
techniques described in this Section into our final Proof of Concept model.
4. Botnet gadget
Figure 7: Botnet Gadget illustrates the basic structure of our Botnet gadget. The Botherder acts as a
Gadget developer and uses Google’s services to update the Gadget and by extension update the
Botnet. By doing this the Botherder can have a single point of access to all Bots at the same time.
Updates might include new JavaScript attacks or even new targets for DDoS attack. The Botnet hides
in plain sight as a normal gadget. It could either use a command from the Botherder or a temporal
event to trigger a remote attack and while the Botnet is waiting to commence the next attack the
Gadgets can gather information on Gadgets users and possibly identify other means of
communications or vulnerabilities on Gadget user’s PC.
38