Virus Blog

I finally managed to finish my technical report on the Amun honeypot. I have tried to document all aspects of the software, so others can understand it. Maybe now it is more easy for others to contribute new modules. The PDF document is available here.

Abstract:
In this report we describe a low-interaction honeypot, which is capable of capturing autonomous spreading malware from the internet, named Amun. For this purpose, the software emulates a wide range of different vulnerabilities. As soon as an attacker exploits one of the emulated vulnerabilities the payload transmitted by the attacker is analyzed and any download URL found is extracted. Next, the honeypot tries to download the malicious software and store it on the local harddisc, for further analyses. As a result, we are able to collect at best unknown binaries of malware that automatically spreads across the network. The collected samples can for example be used to help anti-virus vendors improve their signatures.

We have just presented our work about monitoring the Waledac botnet at the European Conference on Computer Network Defense (EC2ND). The main focus of the paper is to get a more insight look at the botnet, that is supposed to be the successor of the Storm Worm botnet. By analyzing the communication infrastructure we managed to construct a fake Waledac instance, called Walowdac, to infiltrate the botnet and collect interesting information. The following image shows the number of bots counted during a single day in august 2009. More information about the approach is presented in the paper.

Abstract:
A botnet is a network of compromised machines under the control of an attacker. Botnets are the driving force behind several misuses on the Internet, for example spam mails or automated identity theft. In this paper, we study the most prevalent peer-to-peer botnet in 2009: Waledac. We present our infiltration of the Waledac botnet, which can be seen as the successor of the Storm Worm botnet. To achieve this we implemented a clone of the Waledac bot named Walowdac. It implements the communication features of Waledac but does not cause any harm, i.e., no spam emails are sent and no other commands are executed. With the help of this tool we observed a minimum daily population of 55,000 Waledac bots and a total of roughly 390,000 infected machines throughout the world. Furthermore, we gathered internal information about the success rates of spam campaigns and newly introduced features like the theft of credentials from victim machines.

This work is a collaboration with Ben Stock, Markus Engelberth, Felix Freiling, and Thorsten Holz.

I came across a posting on the blog of the Internet Storm Center about a little forensics contest. Although the puzzle is not very hard it is fun to investigate. If you are willing to send in your solution, there is also a prize to win. Winners are to be announced at Sec558 Network Forensics in San Diego, 9/16-9/18.

All you have to do is analyse a pcap file containing valuable information and answer the following questions:

1. What is the name of Ann's IM buddy?
2. What was the first comment in the captured IM conversation?
3. What is the name of the file Ann transferred?
4. What is the magic number of the file you want to extract (first four bytes)?
5. What was the MD5sum of the file?
6. What is the secret recipe?

I won't tell you any solutions here, but i tell you what tools i used to analyse the pcap file. So the number one tool when it comes to pcap is in my opinion still tcpdump. It gives you a quick overview about what happened. Use the appropriate filter options to dump the complete packet content.
This will help you to answer the first few questions. You can also use Wireshark. Another nice tool i came across while investigating the file is tcpxtract. This tool extracts files out of a pcap file. With the help of this tool you are able to extract the file that was transferred, and a bunch of other files =)

To further investigate the instant messenger session i used AimSniff. This tool extracts all kinds of instant messenger information from a given pcap. However, in this case it did not reveal anything that was not already discovered using tcpdump, but it substantiates the earlier foundings.

Another nice tool i used was Chaosreader. This tool generates a nice overview about who is communicating with who and what protocols are used. It extracts sessions and creates some small statistics.

Have fun with the challenge.

Although i was not able to finish everything i had planned for the new version, due to lack of time, i decided to release it anyway. So Amun v0.1.8 has a lot of fixes, modifications, and additional stuff. Feedback is always welcome. Documented changes are the following:

 Changes in v0.1.8:
        - added ulm shellcode handler
        - added bergheim shellcode handler
        - added langenfeld connectback2
        - added leimbach encoded tftp command detection
        - added pexalphanumeric b64encoded plain url detection
        - added new amun smb handler
        - fixed netdde vulnerability
        - fixed missing socket import for log-blastomat module
        - fixed reply function to send all bytes
        - fixed amun crash on already used port/address
        - fixed anubis submission module
        - fixed amun ftp NAT download
        - modified ftp_download_core to handle broken pipe on push command
        - modified vuln-http to serve images from folder
        - modified log-surfnet configuration to accept database port
        - modified vuln-arc to no reply
        - modified md5 to hashlib (deprecated warning)
        - modified popen2 to subprocess (deprecated warning)
        - removed conn= parameter prefix for asynchat.async_chat.__init__

For those of you struggling with the Atheros WLAN card and Archlinux distribution, i have a few hints.

The card i use shows up like this:
lspci | grep Atheros
01:0b.0 Network controller: Atheros Communications Inc. AR5008 Wireless Network Adapter (rev 01)

My current kernel version is 2.6.30. The software needed is wpa_supplicant. The most important thing is, make sure the athXk kernel module does not load (X is a number, currently its 9, and was 5 previously). To assure this modify your rc.conf and add MODULES=( ... !ath9k). The only modules that are loaded (lsmod | grep ath) are ath_pci, wlan, ath_rate_sample, and ath_hal. To check your setup use ifconfig -a, you should find a device called ath0. Bring it up using ifconfig ath0 up and do a iwlist ath0 scan to scan for accesspoints nearby. To connect to an accesspoint use iwconfig ath0 essid YourSSID and start your wpa_supplicant by issueing wpa_supplicant -B -iath0 -c/etc/wpa_supplicant.conf. If your accesspoint hands out IPs using dhcp use the command dhcpcd ath0 to get one.

An example of a wpa_supplicant.conf for a WPA secured network looks like follows:

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
eapol_version=1
ap_scan=1
fast_reauth=1
network={
ssid="YourSSID"
scan_ssid=1
proto=WPA
key_mgmt=WPA-PSK
psk="YourPassphrase(plain ASCII)"
auth_alg=OPEN
}

That is basically all you need to do. To automate the process at boot up, edit your rc.local and add the lines:

ifconfig ath0 up
iwconfig ath0 essid YourSSID
wpa_supplicant -B -iath0 -c/etc/wpa_supplicant.conf
dhcpcd ath0


That´s it.

As my colleague philipp already mentioned in his blog, our short paper about the visualization of malware behaviour is accepted at this years VizSec Workshop (11 Oktober, Atlantic City, NJ, USA).

We use transformed sandbox reports as a visualization basis. The recorded malware behaviour is displayed in different ways to aid malware researchers. I will blog more on this topic as soon as the workshop is over. 

Lukas from Glasblog released a new version of his webhoneypot called Glastopf yesterday. Several new modules have been implemented including a Twitter and an IRC module to log current statistics and attack information. A complete changeset can be found here.

A webhoneypot can be used to detect remote/local file inclusion attacks against current webapplications, such as phpmyadmin or roundcube webmailer. The honeypot simulates several vulnerable webapplications and extracts injected commands from the incoming requests. A request can either try to load another file from a remote server, that is already under the control of the attacker and execute it in the context of the webserver. In some cases these remotely loaded files contain IRC bots, that allow the attacker to take control over the attacked system. Other methods to compromise the system include the gathering of information about the running operating system and then include some local root exploit to take complete control over the server.