Botnets - The Silent Threat

I had been planning for delivering a training. And I had to decide on a subject. So, here it is - Botnets.

Topics I will cover here:

+ What is a Botnet
+ Top Botnets
+ Why Botnet?
+ Elements
+ Features

+ Protocols used

+ Categories

+ Applications of an Attack
+ Elements of an Attack
+ Stages of an Attack
+ Detecting a Bot
+ Defending against Botnets

What is a Botnet
Botnet - bot-net - is a network of bots. A bot is a program which can perform autonomous actions in response to instructions. The bots reside on the systems which have certain vulnerabilities that are successfully exploited by an attacker. The objective of the bot is primarily to report to a central server controlled by the attacker & wait for further instructions.

The infected system is also known as a zombie. Why? Because these exploited systems work normally & the users / owners do not see any changes in the activity or performance of the systems. The Zombie rises only when commanded by its Control server. As soon as it receives the command(s), it springs into action & starts serving his master dutifully.

Top Botnets
With every passing year, there have been several botnets that were identified as the Top contenders of their times. The severity & efficiency of these botnets is usually measured by the bot's defending controls against reverse-engineering and/or prevention & the rate of increase of their bot network.

These are only a few botnets that have shown the power of the human mind & the efficiency of a smart botnet:

Sl. No. Name Botnet Size Spam Capacity
1. Conficker 10,000,000+ 10 billion/day
2. Kraken 495,000 9 billion/day
3. Srizbi 450,000 60 billion/day
4. Bobax 185,000 9 billion/day
5. Rustock 150,000 30 billion/day

It would be interesting to realize that these are just a very, very small tip of the iceberg. Conficker had been on hunting spree for so long even after it was identified. There are many which haven't even yet been found, and remember with each passing moment that a system is on the Internet, the possibility of it being successfully hit increases.

Why Botnet?
So why would someone use a Botnet if systems can be exploited remotely, with new & old attack vectors improving with technology - viruses, worms, trojans, client-side exploitation, web attacks and what not?

True, the attack vectors are present & they can do their job neatly. But in order to fully utilize the individual systems exploited via these vectors, these systems must be under some sort of centralized or intelligent control. The botnet is a consistenly increasing network of infected systems that is under direct control of the attacker. With one command from anywhere in the world, for example, an enterprise can be brought down to its knees.

That's the true power of botnet.

Elements of Botnet
+Bot herder
A bot herder is the creator of the botnet. The bot herder controls the bot remotely usually using IRC or HTTP. The bot herder ensures security over his bots, tracks progress & maintaines the CnC.

+Command n Control (CnC)
Command n Control usually runs on an IRC or HTTP server. This is primarily responsible for tracking & updating bots and sending attack launch instructions to bots.

+Bots
A bot or a bot code is the program / malicious payload which resides on & controls the host and performs the instructions sent by the CnC.

Features of A Bot
Just like any other executable, a bot has a source code. The source code defines the structure & the function(s) that a bot can perform.

Some of the functions integrated in a bot are:

1. Hidden presence - hidden from task manager, process explorer, anti-virus, IDS, host firewalls.
2. Killing Anti-Virus processes.
3. Killing rival bots - yes, the war is all around!!
4. Covert communications - using http or irc or IM protocols to communicate with the CnC.
5. Auto Run
6. Automatic Update

The bot usually have a modular structure. It enabled the bot writer or the bot herder to dynamically add or update or remove the functions or exploit codes to the bot source code. After this modification, the bot source code is compiled & built to generate the new version. And with a single command through CnC, all the bots can update the changes immediately.

Part II: coming up...

CISSP: My Study Plan

I sat for the CISSP exam on May 16, 2009. The exam was not easy, but I was prepared. And had the positive energy to complete it successfully. It was a long exam - 6 hours. Equally mentally exhaustive as much as physically demanding. Add to that the constant slight buzzing sound (read noise!!) of something in the hall.

All these in place, I took the whole 6 hours & completed & checked, rechecked the question paper & checked, rechecked the bubbles in the answer sheet. Someone must be wondering why would I check & recheck the question paper.

Please read on to know why.

My Study Resources:

+ Clement's CISSP introductory video (www.cccure.org/flash/intro/player.html/)
+ Shon Harris All-in-One (AIO) 4th Edition
+ ISC2 Official CBK Guide (www.amazon.com/Official-ISC-Guide-CISSP-Press/dp/0849382319)
+ Shon Harris CISSP CBT/DVD (www.cccure.com/cissp/shon-harris-cissp-dvd-tutorial/prod_2.html)
+ www.cccure.org CISSP forum
+ www.freepracticetests.org CISSP Quizzer
+ Notes/Aide Memoire available on cccure.org CISSP forum
+ CISSP Gold Edition Questions & Answers
+ Shon Harris AIO Quiz (in the CD)


Time Duration for Preparation:

January last week - March end 2009 -> 3-5 hours after work. Weekends -> 5-6 hours - slowly tasting the subject matter & letting it seep in.
April 2009 - May 15, 2009 - > 7-9 hours every day - Time to pace up & complete the preparation.
During this time, I completed 2 other certifications & 1 training that definitely helped me be comfortable with the domain content.

My Study Plan (in that order):

+ Finished Shon Harris CBT/DVD
+ Completed one 100-question quiz for each domain as I completed the domain from SH CBT
+ Read Shon Harris AIO 4th edition
+ Complete Q&A at the end of each AIO Chapter.+ Revise each domain through Notes/Aide Memoire available at www.cccure.org CISSP forum.
+ Read cccure.org forum posts, questions & responses, the reasoning behind the solution!
+ Complete Full Length quizzes for individual domain(s)
+ Read OIG
+ Complete Gold Edition Advanced Sample Q&A
+ Complete 10 Full Length quizzes (group of 3 & 4 domains)
+ Read my notes

Important points that will help you:

+++Pre-Booking+++

+ Be mentally prepared before you begin preparation.

+ Share your plan with your family or friends or both. At a point in time of preparation, you may find yourself face-to-face with high work load at office, unexpected but important official/unofficial events, & may lose focus/direction from the task. This is the time your family/friends will be of great help.

Remember, it is extremely important to keep yourself motivated to go on.

+ Book the exam after 2 weeks of preparation. This will help you understand what you have to complete & how long can it take for you to prepare.

+++Exam-Preparation+++

+ Complete all domains. No matter how many years you have been in the industry, you should always complete all the domains.

+ Think from the Management perspective. Remember this is not a 100% technical exam. You need to know technical stuff but it tests your decision-making using your knowledge of technical concepts.

+ Do quizzes from different sources. And know the reason why the correct answer is correct & the incorrect answer is incorrect.

+ Use google & wikipedia for reading on topics.

+ Use CCCure.org CISSP forum.

+++Day before the Exam+++

+ Organize all the documents required for the exam day & keep it in your bag - Admission Ticket, ID cards - Driving Licence / Passport, Company ID etc.

+ Ensure that you have 2 HB #2 pencils, 2 dust-free erasors, a sharpner, 2 pens (not required though) & a jacket / a light woolen-wear for the exam - temperature may be too cold or tool warm for you to feel comfortable.

+ Eat a healthy, heavy breakfast. Take at least 1 water bottle, some energy bars or preferably energy drinks with you. Believe me you will need these in the Exam and you will not like to move your a$ even a bit out of the hall after looking at the question paper!!

+ Do NOT Smoke before or during the exam. You must be relaxed all this while and smoking isn't going to help you.

+ The CISSP Exam is as mentally exhaustive as it is physically demanding. Therefore relax on the day before the exam.

+++Day of Exam+++

+ First Rule of tackling this Exam - Attempt All Questions.

+ Read through 25 questions first and then take the second round answering them.

+ Eliminate the choices & then apply the concepts on the final 2 choices - from the Management perspective.

+ Mark the 25 answers against the respective 25 questions - in the question sheet. Once you have completed 25 questions, start filling in the bubbles on the answer sheet.

+ Be very careful while filling in the answer sheet. You will agree it's been a long time when you last filled those bubbles with a pencil. Your fingers will start aching if you decide to fill in 50/100 questions in one go. So choose to complete 25/30 questions in one go.

+ Mark the questions you are unsure of, or finding tough to answer or taking too long to answer. Come back to them once you are done with all other questions.

+ Once you complete all questions, go to the first page & start reviewing the questions you marked above. You should be able to solve them now. If not, refer to the Ist rule of tackling this exam above.

+ After you have completed all questions including marked ones, it's time to review. Go to the first page of the question sheet & start reviewing each question one-by-one.

+ By this time, after review, you will have most certainly changed some of your answers. Do a review now of your answer sheet to make sure that you filled 'correct answers in the correct bubble.'

+ After you submit the Answer sheet, go & get fresh. Wash your face to get freshen up, & go eat something. I am sure you will be damn hungry by now.

+++Post Exam+++

+ Catch up with your family, friends.
+ Relax & enjoy coz you have done your part.
+ The most important of all: Think Positive.

Best Regards.

Congratulations!! You passed the CISSP examination.

Finally, the much-awaited mail arrived this early morning at 1:02 am. It went straight to the archive & got labeled to ISC2. I didn't noticed & had slept waiting for it yesterday. And as I opened my eyes & logged on, I hurried to check if there is any email there looking for me. Ah, there it was - 1 unread in ISC2.

Suddenly, the excitement turned to nervousness & the mouse pointer stopped before it could click on the label. It was there & I wouldn't click on it. I stopped there for a moment. Unsure if I must open it now that it's here. So I chanted on the higher energy & opened the email. Many successful candidates had shared that the Pass mail has a word 'Congratulations' in the subject line. Well, my mail didn't had one! So, a bit anguished, I decided to look for the 'Areas of Improvement' in the mail body. And what did I find:

Dear Karn Ganeshen:
Congratulations! We are pleased to inform you that you have passed the Certified Information Systems Security Professional (CISSP®) examination - the first step in becoming certified as a CISSP.

:)

So there I sat on my bed, Joyous & all smiles. This has been THE most exhaustive preparation AND the most exhaustive exam I've taken till now. The 5 months preparation had been demanding, & took consistent efforts & hard work. And today, I love every moment of all the nights spent since January 2009.

I will be sharing my study plan & resources used for preparation in my next post. I hope it will be useful for you.

Best Regards.

sslstrip: HTTP session hijack

About:

sslstrip provides a demonstration of the HTTPS stripping attacks presented at Black Hat DC 2009. It transparently hijacks HTTP traffic on a network, watch for HTTPS links and redirects, then map those links into either look-alike HTTP links or homograph-similar HTTPS links. It also supports modes for supplying a favicon which looks like a lock icon, selective logging, and session denial. 

How to Use it?

Configure the attack machine to allow traffic forwarding.

Setup iptables to redirect HTTP traffic to sslstrip.

Run sslstrip.

Run arpspoof to convince a network they should send their traffic to you.

That should do it.

How does this work?

First, arpspoof convinces a host that our MAC address is the router's MAC address, and the target begins to send us all its network traffic.  The kernel forwards everything along except for traffic destined to port 80, which it redirects to $listenPort (10000, for example).

At this point, sslstrip receives the traffic and does its magic. 

For more info & the Black Hat DC 2009 preso, click here:

http://www.thoughtcrime.org/software/sslstrip/index.html

Exploits of a Mom

A nice strip I came across on SQL Injection & input validation!

SQL Injection: A primer II

In continuation with my earlier post, SQL Injection: A primer (http://ipositivesecurity.blogspot.com/2009/05/sql-injection-primer.html), I will be covering the following in this post:

a. Blind SQL Injection

b. Remediation Measures

About:

Blind SQL Injection is used when a web application is vulnerable to the SQL Injection but the results of the malicious input strings are restricted or not visible to the attacker.

Attacking using Blind Injection involves observing the variations in the page output after the malicious query input is feeded into the application. The page with the vulnerability may be different than the page which displays data. The output display is different depending on the results of the logical statement(s) included with the legitimate SQL statement for that page.

Since the output varies with the attack strings, this attack can be time-intensive.

Types of Blind Injection Attacks:

1. Conditional Responses

This attack involves observing the output from the database by appending different evaluative strings. For example:

select uname from employees where deptID = 'a500' AND 1=1;

will result in a normal output / page display. And if:

select uname from employees where deptID ='a500' AND 1=0;

results in a different result / page display, it would be clear that the page is vulnerable to SQL Injection.

The reason behind this inference is the the behavior of database for the appended query string -> AND 1=1 / AND 1=0. The output must not have varied & the queries would have resulted in the same output regardless of any appended strings as input, had the input validation been in place.

2. Conditional Errors

This attack differs from Conditional Responses by attempting to force the database to evaluate a statement which would eventually throw an error when the query returns TRUE. For example:

select 1/0 from employees where uname='Victor';

1/0 will be evaluated only when the record 'Victor' is found & would then result in an error. This would provide a confirmation to the attack of the existence of the uname 'Victor'.

3. Time Delays

Another important type of Blind SQL attacks is the Time duration taken by the database to execute a long running query or a time delaying statement depending upon the query. The attacker would observe & measure the time taken for the page to load & attempt to determine if the query executed successfully as TRUE.

Remediation / Preventive Measures Against SQL Injection Attacks:

1. Using Parameterized Statements

In this technique, SQL BIND variables are used as the placeholders for the user input. A BIND variable is a question mark for each input parameter. 

The SQL statement is created using these BIND variables, it is compiled (prepared) into an internal ready-to-use form, only awaiting the value of the placeholder now. Once the parameter value (placeholder) is received, this prepared statement is executed & the resultset is presented to the front-end.

For example, in Java:

PreparedStatement prep = conn.prepareStatement("SELECT * FROM USERS WHERE USERNAME=? AND PASSWORD=?");

prep.setString(1, username);

prep.setString(2, password);

Here, the value of the 'username' & 'password' is passed as positional parameter - the question (?) marks, referenced by 1 & 2, respectively. The content of these variables do not have any impact on the final query because it is treated as 'plain data.' Hence, the application is now greatly immune to SQL Injection as against a normal query.

2. Using Stored Procedures

Stored Procedures provide encapsulation to rules for specific actions - Select, Insert, Update, Delete, etc. - into a single procedure. Business rules can be enforced so that if cond. A is TRUE, Allow Action A, else Deny Action A. For example, if a customer is a VIP, then allow him/her to avail a discount, else, apply full amount.

Stored procedures help prevent SQL Injection attacks by limiting the type of SQL statements that can be passed to their parameters. However, they are not the complete solution against SQL Injection.

3. Input Validation

Every input parameter & the value must be validated before the input reaches the database. The input fields could be input box, drop down box, check box, hidden fields, a Button, etc.. The important thing is to understand and chose the validation scheme.

There are 2 validation schemes-

1. Reject known blacklist

2. Accept known whitelist only

Using Blacklist as the sole criterion for filtering & validating the input is not a good idea. This is because of the availability of different schemes available, to convert the form of input, - Unicode, hex, base, etc.. A developer cannot & must not base his validation checks based on the Blacklist sets for it is bound to be incomplete, always.

Instead, Using Whitelist is an effective solution. Whitelist specifies the characters only which would be allowed to pass through. Period.

This allows a developer to exercise better control in defining the positive validation checklist for the input. And it is good for the security tester too :)

Besides these 3 mitigating techniques, there are other methods as well which are helpful in controlling the attack surface available for exploitation.

4. Code Reviews

The Code Reviews checks the source code of the application for flaws with respect to security. A Security professional or a developer with good knowledge & experience on Secure coding practices should do a code review. This is a manual process & hence it is time-consuming process. There are automated tools now available for this purposes. Few of them are: Checkstyle (http://checkstyle.sourceforge.net), JNorm (http://www.jnorm.org), Perl::Critic module, Parasoft (http://www.parasoft.com/jsp/solutions/application_security_solution.jsp?itemId=322) etc.

5. Control Database Error Leakage

As important it is to use Stored Procedures or Parameterized Queries, equally important is to configure the error messages thrown by the database on receiving an expected or invalid input. Think of it - an attacker being able to gather table, database, column name info, or related 'joined' table info through error messages. All your SPs, Parameterized queries, code reviews are no longer effective. Hence, configure the database errors to restrict the details or the debugging information meant to help the developers. Put a generic custom messages, whereever possible.

6. Securing the Web Server

All the code reviews, automated assessments, & manual security assessments CANNOT ensure a 100% security. It is, therefore, essential to balance the web application security measures with a secure network design. Employ a defense-in-depth approach while planning for securing the server:

- place the server in a tier-ed architecture, or at least in a hardened DMZ.

- use Web Application Firewalls (WAF) - though OWASP 2009 showed us bypassing WAFs, it's still good enough. (I will have a post coming on WAF soon.)

- And, Log monitoring.

This concludes the second & final post on SQL Injection: A primer. Please note that this is not complete even now. SQL Injection is a vast topic in itself. I have tried to present the concepts here as clearly as possible, the attack methods, query strings, steps taken to recon & penetrate a target; all may vary from applications & their implementations.

I hope someone finds this useful.

Please feel free to share your feedback.

Thanks for your time.

SQL Injection: A primer

About:

SQL Injection is a query / code injection technique which exploits a vulnerability in the database of an application. The database back-end can be Microsoft SQL Server, Oracle, or mysql; i.e. any database which understands the Structured Query Language (SQL: http://en.wikipedia.org/wiki/SQL).

The vulnerability is present when the user input is not filtered properly for string literal escape characters. This user input usually is acting as the variable for constructing a SQL query when it reaches the back-end.

How do I test it:

In order to test if a field may be vulnerable to SQL Injection attack, there's a Magic String. The magic string is a simple string of SQL which always results in a TRUE condition. Although several variations are used to verify the vulnerability, the simplest string is mostly used on Login pages. The string is:

' OR ''='

String variations:

' or 1=1--

" or 1=1--

or 1=1--

' or 'a'='a

" or "a"="a

') or ('a'='a

In case of a vulnerable login page, a successful attack will log you in as the first user in the table.

Keeping it Simple:

A simple example is of an input box which takes a numeric value as input. This value is passed as a parameter to the back-end & record(s) are returned from the table corresponding to the SQL query.

Let's say, if the variable recordNumber is used in a query as:

select * from secureTable where recordNumber = (userInput)

Giving a value to this variable as:

recordNumber = a' or '1'='1

will create the final query as follows:

select * from secureTable  where recordNumber = 'a' OR '1'='1';

The resultset from the WHERE clause will always be TRUE ('1'='1'), thereby resulting in all the records from the secureTable.

A serious query could be:

recordNumber = a';DROP table secureTable ; select * from data where uname like '%

This would result in the following query:

select * from secureTable where recordNumber = 'a'; DROP table secureTable ; select * from data where uname like '%';

This query results in all the records from the secureTable AND then drops the table 'secureTable ' AND fetches the recordset from the table 'data'.

Note that some sql server APIs like php's mysql_query do not allow for such multiple statements to be executed within one call.

What Next?

This post covered the basics of SQL Injection & discussed first order SQLi attacks. Another type of attacks are second order / Blind Injection attacks & I will cover them in the coming post(s) along with the remediation / preventive measures for the SQL Injection attacks.

Thanks for your time.