Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

USING LEGITIMATE WEB SITES FOR DATA EXFILTRATION: THE SHADOW NETWORK143Shadow Network malware that used Baidu Blogs, Twitter, Google Groups, and other similarsites to control the compromised computers. These channels of communication were oftenused in conjunction with traditional HTTP-based C&C—similar to what was observed inGh0stNet. However, unlike Gh0stNet, the hackers made better efforts to obfuscate theHTTP-based command-and-control servers as well. They relied on legitimate free Webhostingservices such as justfree.com and yourfreehosting.net and free domains providedby co.tv and net.ru. The IP addresses associated with C&C servers on the free domains wereall traced back to locations in the U.S. and Germany. But when these free hosting accounts forwhatever reason failed to function, the researchers observed that the hackers would send amessage to the compromised systems via a blog post redirecting their HTTP traffic to whatappeared to be the “core” C&C servers. This handful of servers, as it turned out, resided in thePeoples’ Republic of China (Figure 7.6).Targets of the Shadow NetworkThe researchers at Information Warfare Monitor and the Shadowserver Foundation used anovel technique known as DNS Sinkholing to investigate the Shadow Network. Often thecommand-and-control (C&C) server of a botnet or other network of compromised computersis either shutdown or becomes abandoned. In the aftermath of such abandonment, thecompromised systems may still attempt to communicate with the server. With DNSSinkholing, a security professional registers a machine using the name of the C&C server.1Compromised workstation2 345HackerYahoo! MailPublically hosted C&C serverTorWeb site(sites.google.com)1 The target established a connection with a Yahoo! Mail account and receives anemail with executable code that directs the target to download malware from apublically hosted web site.2 The target downloads the malware from the publically hosted web site.3 Directed by the new malware, the compromised system downloads files disguisedas digital images from another C&C server.4 The new files direct the target to upload unencrypted data files to Tor.5 While uploading the files to Tor, the hacker monitors the unencrypted traffic,hence obtaining the desired data from the compromised system.FIGURE 7.6 Use of Yahoo! Mail for command and control of a compromised workstation. The relationship to theTor network is hypothesized based on a different investigation.