third Cyber Security Assessment Netherlands - NCSC

Once a computer is infected the malware ensures that a back door
is opened on the computer allowing the botnet herder to give
commands to the infected computer. The computer has thus
become a bot in the botnet, also known as a ‘zombie’. The malware
aims to be as inconspicuous as possible. For example, by lowering
the priority of his own process to the operating system, all actions
that the user carries out take precedence, with virtually no notable
deterioration in the computer’s performance.
In a traditional botnet a bot receives the instructions from a C&C
server. The botnet administrator uses this server to communicate
the commands to deploy the botnet. The C&C server is therefore the
critical component focused on in the fight against botnets. Once
this machine is switched off the botnet can no longer be controlled
and the bots remain inactive. To reduce vulnerability, administrators
build an infrastructure with sometimes hundreds [13: FS 2013] of
individual C&C servers in the same botnet.
An alternative architecture that is used to make combating botnets
difficult is the ‘peer-to-peer’ (P2P) botnet. Here, a bot is instructed
and then passes the command on to the next bot so that is spreads
like a patch of oil across the botnet. Because a different machine is
used as the starting point each time, the source of the instructions
is difficult to determine.
Instructions are also spread on social media. Because of the
astronomical volume of messages on networks such as Facebook
and Twitter there is no monitoring as to whether there are accounts
between them sending coded commands that are read by bots. In
addition, there is repeated switching between accounts.
3.3 Developments
3.3.1 Current situation
The botnet landscape is currently dominated by a number of botnet
families. The most notable is the family of ZeuS botnets. Derived
from this is Citadel, which enjoyed media attention in the
Netherlands, following incidents concerning Dorifel and Pobelka
(see boxed texts). Alongside ZeuS, ZeroAccess and Carberp are also
very common.
As well as click fraud, ZeroAccess is often used to exploit the
computing power of bots for bitcoin mining. The bitcoin is a digital
currency that is not managed by a central bank, is not recognised by
international organisations but that is increasingly accepted as a
payment method. It works on the basis of cryptographic principles
123 Microsoft Threat Encyclopedia, W32/Carberp http://www.microsoft.com/security/portal/
threat/encyclopedia/entry.aspx?Name=Win32%2fCarberp
124 C. Rossow et. al.: P2PWNED - Modeling and Evaluating the Resilience of Peer-to-Peer Botnets
http://www.christian-rossow.de/publications/p2pwned-ieee2013.pdf
125 http://webwereld.nl/nieuws/112177/update-maakt-botnet-citadel-langer-onzichtbaar.html
126 NCSC Cyber Security Assessment Netherlands CSAN-2, p. 52.
127 http://www.enisa.europa.eu/activities/risk-management/evolving-threat-environment/
ENISA_Threat_Landscape/at_download/fullReport
and is ‘mined’ by performing complex calculations. Deploying an
entire botnet to mine for bitcoins is therefore a lucrative business.
Carberp is known for creating fierce competition in the underground
economy. The botnet attempts to switch off other malware [123] and
gain control over a bot for itself. The organisation is so professional
that there is presumably a marketing department behind this botnet
to attract more customers.
Mobile telephones, in particular smartphones, are increasingly the
target of malware, resulting in the emergence of mobile botnets.
Malware that tries to intercept financial transactions sometimes
appears both on computers and mobile telephones to intercept not
just the transaction in the internet browser but any authorisation
code sent by SMS.
Botnet developers are also demonstrating their innovation in
combating detection. In addition to the increasingly common P2P
architecture [124] , they are using encryption and administrators are
communicating by Tor to retain their anonymity. Large botnets are
deployed only in small sections and target very limited objectives
to remain under the radar as much as possible. [125] The conventional
way of switching off botnets through their C&C servers is therefore
virtually redundant.
Botnets often revive because of the ease and speed with which
networks can be built and because of the high percentage of
infected computers. For example in CSAN-2 there was still talk of
dismantling the Kelihos botnet [126] , however this botnet re-appeared
[21: McAfee 2013-1]
on the radar of anti-virus companies in September 2012.
3.3.2 Expectations
The success in dismantling botnets is reflected in the declining
volume of spam sent by these botnets. [127] With spammers’
attention shifting to social media, new botnets are being to set
up to provide different functions, such as DDoS attacks. As a result,
it is impossible to estimate how effective dismantling is, based
on the volume of spam.
In the short and medium term, an increase in the number and size
of botnets can be expected. Drivers behind this are:
»»
revenue from hire remains high;
»»
the increasing interest in carrying out DDoS attacks;
»»
the increasing ease of use of ‘create your own botnet packages’;
»»
the rising bitcoin exchange rate.
Currently, the PC is still the most commonly infected device. This
is expected to remain the case, certainly given its market share, but
proportionally botnets for devices with Mac OS X, iOS and Android
will increase significantly.
64