Re: attacking Storm Worm

[coderman <coderman () gmail com>]

> On Wed, Mar 19, 2008 at 5:49 AM, mcwidget <mcwidget () gmail com> wrote:
>  >...
>  > Aint that the whole problem with Storm tho?  The lack of CC boxes?  Without
>  > that target, how do you effectively shutdown something like this?

On Wed, Mar 19, 2008 at 12:37 PM, coderman <coderman () gmail com> wrote:
>  the target is the distributed hash table routing metric used for
>  decentralized C&C.  kademlia, chord, and DHT's in general are fragile;
>  they trade efficiency for resilience against a coordinated attacker,
>  presuming the redundancy adequate for random (read: not intentional)
>  failure is sufficient.

http://www.usenix.org/event/leet08/tech/full_papers/holz/holz_html/
"Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case
Study on Storm Worm"

section 4.2 describes the implementation of a sybil attack which is
the most effective way to observe and manipulate DHT's without
endpoint based partitioning of the DHT address space.  (for example,
achord, would make a sybil attack more difficult, but this too can be
mitigated with enough address space on hand...)

the polluting attack appears most effective for the overnet/stormnet
routing described; for other DHT's the index poisoning (Eclipsing
Content in paper) would be even more effective (CAN,KAD,etc).

additional variations on these attacks are described in: "Security
Considerations for Peer-to-Peer Distributed Hash Tables" and
elsewhere.
http://www.cs.rice.edu/Conferences/IPTPS02/173.pdf

if persistent tampering of decentralized botnet C&C is pursued by
researchers and/or industry actors, it will be interesting to watch
the defenses evolve.  defeating sybil attacks and robust resource
discovery have been persistent problems for peer networks of any type.
 (my money is on achord style endpoint id space partitioning and
iterative unicast discovery that would adapt to malicious pollution
effectively and efficiently.)

best regards,


( see also "curious yellow", an oldie but goodie:
http://blanu.net/curious_yellow.html )

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/