NTRG_ElasticBotnetReport_06102015

The DDoS functionality of BillGates originates within the CManager::DoAtkStartCommand
function. CManager::DoAtkStartCommand reads the CTask object from the CCmdMsg. The CTask
object is used to set the current CConfigDoing task before generating a new CThreadAtkCtrl
object. CThreadAtkCtrl contains the DDoS engine as defined by the various subtasks within
the CTask. For each CSubTask within the CTask object, CThreadAtkCtrl::ProcessMain will
determine if the class of attack is a “kernel” or “normal” attack. Kernel attacks (type 1) result in
a call to CThreadAtkCtrl::DoKernelSubTask while normal attacks (type 0) result in a call to
CThreadAtkCtrl::DoNormalSubTask.
3.2.1 BILLGATE’S “KERNEL” DOS ATTACK MODE
The CThreadAtkCtrl::DoKernelSubTask function calls CThreadAtkCtrl::StartKernalSubTask,
which in turn generates a new CThreadKernelAtkExcutor object. When activated, the
CThreadKernelAtkExcutor object calls CThreadKernelAtkExcutor::ProcessMain in order to
initiate a DDoS attack using a kernel driver. The first step in generating a DoS attack using a
kernel driver is to fork the current process by means of the fork function. Following the fork,
CThreadKernelAtkExcutor::ProcessMain begins calling CThreadKernelAtkExcutor::KCfgDev
for each CPU available on the victim’s server. The CThreadKernelAtkExcutor::KCfgDev function
configures the pktgen (packet generator) device 11 , located at /proc/net/pktgen/kpktgend_X
where X represents the enumeration of the number of CPUs in the system, by issuing the following
commands:
rem_device_all
add_device ethY
max_before_softirq
The rem_device_all command effectively removes any attached device currently using the CPU’s
packet generator. add_device attaches the specified ethY device (where Y is 0, 1, 2, and so on
depending on the desired NIC). The command max_before_softirq is a threshold change that
specifies how many packets may be generated before being interrupted by the kernel. The authors
of BillGates made a mistake in their understanding of what the meaning of the X is in the name of
the kpktgend_X devices: while X indicates the CPU associated with the particular packet generator,
the authors of BillGates are using the NIC number instead. Therefore, if the attack specifies the use of
eth1, then kpktgend_1 is configured and attached to eth1. The result of this mistake is that instead of
utilizing multiple CPU cores to generate packets, BillGates is limited to using a single CPU core. While
the pktgen driver is still capable of producing a significant number of packets on a single CPU core, the
performance could be significantly enhanced had the authors properly utilized the pktgen device.
After performing the initial configuration of the pktgen device,
CThreadKernelAtkExcutor::ProcessMain calls CThreadKernelAtkExcutor::KCfgCfg
to configure each packet generator through the /proc/net/pktgen/ethY interface.
CThreadKernelAtkExcutor::KCfgCfg issues the following commands in the order presented below:
11
“Linux Foundation. “pktgen” http://www.linuxfoundation.org/collaborate/workgroups/networking/pktgen 19 November 2009
THE ELASTIC BOTNET REPORT
34