As a follow-up to last week’s article on detecting the presence of a botnet on your network, I have more advice from experts in this arena. IBM’s Internet Security Systems X-Force gives specific examples of botnet activity to watch for on your network.
This week I reached out to Chris Poulin, the CSO at Q1 Labs, maker of the QRadar family of log management and security information and event management products. Poulin says that botnets are different from other security threats, but they are detectable because they exhibit “signature behavior.”
“Botnets follow a cycle of behavior,” Poulin says. “The start of the cycle is when the botnet is trying to find a weakness that will allow it to get into your network. This weakness, or exploit, is about a means to an end.”
The botnet world is booming
Poulin says the exploit could be an unpatched system, a compromised Web site visited by an unsuspecting user, an infected USB drive, or any number of situations.
The second phase in the cycle begins when the exploit proves fruitful and the botnet gains a foothold on your network. The signature activity here is that the compromised PC — the bot — will contact the command and control (C&C) server of its herder to announce that it is ready to accept directions on what to do.
Phase three is when the bot performs some unwanted activity, such as sending out spam, stealing credentials or other sensitive data, or participating in a denial-of-service (DoS) attack. This activity is controlled by the herder and can change over time.
Poulin says intrusion-prevention systems (IPS) can be effective in phase one of the cycle. “An IPS tool looks for behavior that indicates a botnet is looking to get into a network and may be able to prevent that from happening,” he says. Even with an IPS in place, networks can have vulnerabilities that allow the botnet malware to slip in. “SIEMs have an overall perspective of a network — an overarching view of what is occurring and what has occurred.” He adds that SIEMs are important tools to detect and correlate minute events that add up to something bigger, such as bot activity.
Just what kind of events might that be? IBM’s Internet Security Systems (ISS) X-Force, an R&D team that provides the foundation for a preemptive approach to Internet security, provides some examples. This team has seen their share of botnets, and they provide the following signs of a botnet infestation on your network.
The following signs are related to communication and payload:
* Look for unexpected IRC traffic from internal hosts. This is due to bots operating via IRC. The port being used for IRC traffic may even be a non-standard IRC port.
* Watch for rapid connection attempts to multiple external hosts. This is a result of bots operating with multiple C&C servers or those that operate in peer-to-peer mode. Additionally, unidentified protocols may indicate encrypted and/or custom communication protocols being used. This technique was used with Conflicker, and ISS X-Force decoded the traffic to be able to see Conflicker infections all over the world earlier this year.
* Rapid and multiple DNS queries for random-looking domain names may suggest bots that use domain name generation techniques. Such techniques are used by bots so that the host name or IP address of the C&C server is not hard-coded in the bot, thus making it difficult to blacklist or to take down the C&C server. This was another Conflicker “signature” behavior.
* You might see a spike in outgoing SMTP traffic due to bots designed for spam distribution. Or, you might see a spike in outgoing flood-type traffic due to bots designed for DoS attacks.
The following signs are related to bot propagation:
* User accounts being locked out or a high number of authentication failure events due to bots performing brute force attacks in order to spread into password-protected network shares.
* Host scanning and exploitation activity due to bots attempting to spread into other hosts in the network.
* Increase in executable file transfer activity via HTTP/TFTP/SMB, which can signify propagation or an executable payload being pushed to the botnet.
As we’ve seen over the course of these last three articles, botnets are troublesome entities and they are only going to get worse. The botmasters have huge financial incentives to make their botnets even bigger and badder. All you can do is arm yourself and get ready for battle. As Prism Microsystems CEO A. N. Ananth says, “We can’t give up the homeland.”
