Download

10 Chapter 1 • Botnets: A Call to Actionlished a Web page, and provided e-mail and ICQ contact information.This made it accessibleto many hackers. It was also easy to modify and maintain. As a result, many subsequentbot clients include code or concepts from SDBot. SDBot produced a small single binary filethat contained only 40KB of code.A major characteristic of the SDBot family is the inclusion and use of remote controlbackdoors.SDBot family worms spread by a variety of methods, including:■ NetBios (port 139)■ NTPass (port 445)■ DCom (ports 135, 1025)■ DCom2 (port 135)■ MS RPC service and Windows Messenger port (TCP 1025)■ ASN.1 vulnerability, affects Kerberos (UDP 88), LSASS.exe, and Crypt32.dll (TCPports 135, 139, 445), and IIS Server using SSL■ UPNP (port 5000)The SDBot exploits two server application vulnerabilities: WebDav (port 80) andMSSQL (port 1433). It exploits two third-party application vulnerabilities: DameWareremote management software (port 6129) and Imail IMAPD Login username vulnerability(port 143). It also exploits the following Cisco router vulnerability: CISCO IOS HTTPauthorization (Port 80) vulnerability.The following backdoors are exploited by SDBot:■ Optix backdoor (port 3140)■ Bagle backdoor (port 2745)■ Kuang backdoor (port 17300)■ Mydoom backdoor (port 3127)■ NetDevil backdoor (port 903)■ SubSeven backdoor (port 27347)If an exploit is successful, the worm creates and runs a script that downloads SDBotonto the new victim and executes it. Once executed, the new victim is infected. Note thatmany of these attacks are still used today, especially brute force and password guessingattacks targeted at ports 139, 445, and 1433.Today, variants are spread by many other means including spam attacks in InstantMessaging (SPIM), CDs, infected attachments to e-mails, and hidden downloads on phishing