syssec_red_book

11. The Botnet that Would not DieNugacheStormSality v3Sality v4WaledacZeroAccess v1ZeroAccess v2Kelihos v1Kelihos v2Kelihos v3MinerZeusabandonedactivedisabledJan 2006 Jan 2007 Jan 2008 Jan 2009 Jan 2010 Jan 2011 Jan 2012Figure 11.1: Lifetimes of botnet variants. Note that Sality has been up since2007.have received much attention from security researchers and law enforcementin takedown attempts [157,363]. In response, botnet controllers (botmasters)have designed and implemented new architectures to make their botnets moreresilient. Some botnets use fast-flux DNS, which relies on a large pool ofIPs belonging to compromised systems to mask out the actual address of anattacker-controlled mothership that delivers malicious content or runs scamcampaigns [296, 309].In addition, attackers have implemented domain generation algorithms(DGAs) to generate pseudo-random domain names used for C&C dynamically(e.g., depending on seed values such as the current date/time and Twittertrends) [85]. For instance, the Zeus DGA currently generates a thousanddomains a day.However resilient such botnets have become, they have not stopped securityresearchers and law enforcement from taking them down. This is not the casefor a new breed of botnets, based on peer-to-peer (P2P) technology, that appearto have been designed with resilience in mind.In a P2P botnet, bots connect to other bots to exchange C&C traffic, eliminatingthe need for centralized servers. As a result, P2P botnets cannot bedisrupted using the traditional approach of attacking critical centralized infrastructure.Figure 11.1 shows the lifespans of twelve different botnets based onP2P technology. Observe that ZeroAccess has been up since 2009. Incredibly,the Sality botnet which counts about a million nodes has been operationalsince 2007. In 2007, George W. Bush was still in the White House, nobody hadheard about Stuxnet, and Nokia still reigned supreme in the mobile phonemarket!To be sure, researchers did manage to take down several P2P botnets inthe past. The Storm and Waledac botnets were probably the most famous ofthese [211, 362]. Thus, P2P by itself does not provide resilience. The point isthat modern botnets explicitly incorporate resilience in their design, with fallbackC&C channels (often based on DGA recovery), heavy encryption, signed82