[radikal]

I am not very skilled in malware analysis and forensics but i read all over to news that security researchers can't shutdown P2P botnets like ZeroAccess or Zeus P2P, i wonder why ? When we have samples of given malware, can't we analyse it and write exploit that could be sent over the network as command or some request and to misconfig or just crash the entire network ?

Its just theory, so give me your suggestions and ideas.

[EP_X0FF]

Due to decentralized feature of P2P network shutting it down is not trivial task. You can't like in case of Rustock just go and simultaneously turn off all known C&C with DDoS on their infrastructure to break their communication/possible migration, because there is no C&C.

There are still few possibilities to shutdown it, all require deep reversing of network protocol used by specific malware and cracking crypto algorithms used by it.

1. Poison p2p network by inserting sinkholes. This is generic method as bots in p2p network connects each other and share their list of nodes. Once bot connects to sinkholed node it gets fake list of nodes (can be all sinkholed) and every bot that connects to this bot will receive poisoned list of nodes. Machine will still be infected by malware. Malware operators may (and likely does) monitor state and can take countermeasures against this method as poisoning works not immediatelly. This method was used by Crowdstrike and Kaspersky to shutdown Kelihos. Results? You already know - malware authors quickly pushed new version with updated protocol and renewed their botnet. They did this already few times.

2. Botnet relying on bootstrapping is vulnerable during its early stage. Physically isolating or shutting down bootstrap servers or the bots in the initial list that is hardcoded in bot code can prevent a new botnet from life. Sound almost fantastic. ZeroAccess for example already established botnet and every new bot pushed from drop zones has it predefined list of frequently updated peers.

There are of course exists other ways, above are just most generic. However effectivity of them doubful.

You can't send command to self-destruction simple because there is no such command (exists only in lame malware and holywood hackers movies). You can't use botnet command to forcebly upload any remover to affected computer - because this is users privacy violation, intrusion attempt and victims may sue the company who tried to do this (not the malware authors but you). Especially imagine what will be if your removal tool will fuckup anything on that computer. Welcome to the court and media scandal.

If we are talk about ZeroAccess/Sirefef as the most sophisticated and interesting malware currently available, its P2P functionality implemented inside module usually seen on infected machines as "n". Internally this is dll named p2p.32.dll (or p2p.64.dll for x64). It is very simplified P2P client, it only supports three commands:

• getL - get list of nodes
• retL - send list of nodes
• newL - publish node

when "n" takes control it start to listen UDP port. Malware reads bootstrap peers lists from s32, _32 (s64, _64) files (format described in http://www.kernelmode.info/forum/viewto ... 582#p18582). Then it starts to send packets using UDP protocol. Each ZeroAccess has packet header described by the following structure

Code: Select all

typedef struct _zpackethead {
	DWORD dwCheckSum; //CRC32
	DWORD dwCommand; //getL, retL or newL
	DWORD dwHop; //used in nodes publication
	DWORD dwData; //used to store IP address or session ID
} zpackethead, *pzpackethead;

Actual data encrypted and starts after this header (including some other structures used by bot).

While work bot continiously exchange nodes list by sending getL commands.

If dwHop in incomming packet of retL command is equal to 1 then bot thinks it is supernode (has external IP) and transmites newL command to 16 nodes from it current nodes list (nodes are taken depending on the last active time - starting from most newer). It sets dwData to IP address, dwHop to 8. When other bot receives newL command, it gets node IP address from dwData and does ListOfNodes.IndexOfNode(dwData). If there is no such IP, bot extends list. After this bot sends retL to his 16 nodes to continue new node publication with dwHop decreased by one. Publication continues until dwHop != 0 or new node IP is not known by all other nodes.

retL command packet looks like this

packet start

zpackethead Head;
DWORD dwNodeCount;
znode zNodes[dwNodeCount];
DWORD dwDataBlocksCount;
zdata zData[dwDataBlocksCount];

packet end

You maybe all wondered why ZeroAccess filenames are has a hexademical numeric looking (e.g. 000000c0, 000000cf), the explanation of this inside implementation of P2P protocol used by ZeroAccess. Bot works as downloader using retL command and TCP connection for actual payload download.

zdata structure

Code: Select all

typedef struct _zdata {
	DWORD dwFileId; //filename as dword
	DWORD dwFileTime;
	DWORD dwFileSize;
	UCHAR uHash[128]; //used to check
} zdata, *pzdata;

If there is no such file on target machine, or it outdated compared to received data, bot downloads update/new file by sending new specific packet containing 3 first fields from zdata structure. Files are transmitted as RC4 encrypted with a key of MD5 of the structure describing download.

Take a note - even if the commands stay the same - ZeroAccess protocol updates. For example previously it used different set of commands - getL, getF, srv? - maybe some old bots still use this set.
Now looking on this architecture think how it can be shutted down.

[radikal]

Thanks for the information, the sink holes method can work for malwares like Zeus P2P, because its sold to people without much technical knowledge, till they understand(if they even ever understand) whats going on it will be too late.
None of current P2P malwares use public-private key for commands exchange i think, which makes them vulnerable but as you told it gonna turn into media scandal :D

[radikal]

What about the botnets using DGA algorithms, i know domains can easily be predicted, but is it easy to shutdown ?
I think its not easy to shutdown either... ?

[EP_X0FF]

What about the botnets using DGA algorithms, i know domains can easily be predicted, but is it easy to shutdown ?
I think its not easy to shutdown either... ?

You have to identify all of them by reverse-engineering domain generation algorithms, sinkhole botnet to study and observe it traffic. And finally do a coordinated shutdown, including all backup system botnet may have, interfering botnet communications to not let them save their infrastructure like Rustock was able in 2008. All this requires hell amount of preparations & resources. Shutting down one-two domains from DGA list obviously make no sense. I think most of botnets including future botnets will move to p2p model + maybe having something to backup in case of emergency (like Kelihos already).

[Squirl]

@Radikal,

I'd suggest reading the Sophos ZeroAccess whitepaper: http://www.sophos.com/en-us/medialibrar ... df?dl=true

The reason this botnet is so hard to sinkhole, is because of it's peer-list updating mechanism; each bot will only update it's list with 16 'superNodes' at a time, so it's impossible to poison the entire list (256 IPs) at once. The paper shows how difficult it was to inject just one oftheir own rogue superNodes into the network, let alone enough to actively sinkhole every bot.

[r3shl4k1sh]

You have to identify all of them by reverse-engineering domain generation algorithms, sinkhole botnet to study and observe it traffic. .

by "sinkhole" here you mean just register on domain from the DGA list ?

[EP_X0FF]

You have to identify all of them by reverse-engineering domain generation algorithms, sinkhole botnet to study and observe it traffic. .

by "sinkhole" here you mean just register on domain from the DGA list ?

Yes, so the bots can connect to your server. Sometimes improper handling of sinkhole causes funny problems like in case of Flashback botnet :)

[r3shl4k1sh]

Is it depends on which one of the domain from the DGA list i will register?
IOW once connected to the C&C the bot stops connecting to the other domains?

[radikal]

Is it depends on which one of the domain from the DGA list i will register?
IOW once connected to the C&C the bot stops connecting to the other domains?

I dont think its so simple, it could use authentication with public-private key, making registration of the domains useless.