Botnet hoat dong nhu the nao

Mot trong nhung phuong thuc tan cong DDoS hieu qua va pho bien nhat hien nay la hoat dong dua tren hang tram may tinh bi chiem quyen dieu khien (tuc cac zombie). Nhung zombie nay thuong bi kiem soat va quan ly qua cac mang IRC, su dung duoc goi la cac botnet. O bai nay chung ta se xem xet mot so cach thuc tin tac co the dung de tan cong va chiem quyen dieu khien may tinh dich, cung mot so bien phap doi pho hieu qua nham bao ve may tinh truoc nhung moi de doa nguy hiem luon rinh rap xung quanh.

Chung ta se tim hieu ve:

• Nhu the nao la bot, botnet; cach thuc hoat dong cua chung.
• Nhung thanh phan pho bien nhat trong bot.
• Mot host co the bi tan cong va chiem quyen dieu khien nhu the nao.
• Bien phap ngan chan hieu qua va cach doi pho truoc hoat dong pha hoai cua chung.

Dieu gi ban nen biet?

• Cach thuc hoat dong cua phan mem doc hai (malware) nhu trojan, worm, ….
• Co che duoc dung trong kieu tan cong DDoS.
• Hieu cac khai niem co ban cua TCP/IP, DNS va IRC.

Cuoi the ky 19 cung nhu dau thien nien ky moi danh dau buoc phat trien nhanh, manh cua mot so chien luoc tan cong khac biet nham vao he thong mang. DDoS, tuc Distributed Denial of Services, hinh thuc tan cong tu choi dich vu phan tan khet tieng ra doi. Tuong tu voi nguoi anh em DoS (tan cong tu choi dich vu), DDoS duoc phat tan rat rong, chu yeu nho tinh don gian nhung rat kho bi do tim cua chung. Da co nhieu kinh nghiem doi pho duoc chia se, voi khoi luong kien thuc khong nho ve no, nhung ngay nay DDoS van dang la mot moi de doa nghiem trong, mot cong cu nguy hiem cua hacker. Chung ta hay cung tim hieu ve DDoS va san pham ke thua tu no: cac cuoc tan cong botnet.

Gioi thieu ve Bot va Botnet

Bot la viet tat cua robot, tuc cac chuong trinh tu dong hoa (chu khong phai la nguoi may nhu nghia chung ta van goi) thuong xuyen duoc su dung trong the gioi Internet. Nguoi ta dinh nghia spider duoc dung boi cac cong cu tim kiem truc tuyen, anh xa website va phan mem dap ung theo yeu cau tren IRC (nhu eggdrop) la robot. Cac chuong trinh tu dong phan ung khi gap su kien ngoai mang noi bo cung duoc goi la robot. Trong bai nay, chung ta se quan tam toi mot kieu robot cu the (hay bot nhu ten tat van thuong duoc goi) la IRC bot. IRC bot su dung cac mang IRC nhu mot kenh lien lac de nhan lenh tu nguoi dung tu xa. Vi du cu the nhu, nguoi dung la mot ke tan cong, con bot la mot Trojan horse. Mot lap trinh vien gioi co the de dang tao ra mot so bot rieng cua minh, hoac xay dung lai tu cac bot co san. Chung co the de dang an nap truoc nhung he thong bao mat co ban, sau do la phat tan di nhanh chong trong thoi gian ngan.

IRC

IRC la ten viet tat cua Internet Relay Chat. Do la mot giao thuc duoc thiet ke cho hoat dong lien lac theo kieu hinh thuc tan gau thoi gian thuc (vi du RFC 1459, cac ban update RFC 2810, 2811, 2812, 2813) dua tren kien truc client-server. Hau het moi server IRC deu cho phep truy cap mien phi, khong ke doi tuong su dung. IRC la mot giao thuc mang mo dua tren nen tang TCP (Transmission Control Protocol - Giao thuc dieu khien truyen van), doi khi duoc nang cao voi SSL (Secure Sockets Layer - Tang socket bao mat).

Mot server IRC ket noi voi server IRC khac trong cung mot mang. Nguoi dung IRC co the lien lac voi ca hai theo hinh thuc cong cong (tren cac kenh) hoac rieng tu (mot doi mot). Co hai muc truy cap co ban vao kenh IRC: muc nguoi dung (user) va muc dieu hanh (operator). Nguoi dung nao tao mot kenh lien lac rieng se tro thanh nguoi dieu hanh. Mot dieu hanh vien co nhieu dac quyen hon (tuy thuoc vao tung kieu che do do nguoi dieu hanh ban dau thiet lap ) so voi nguoi dung thong thuong.

Cac bot IRC duoc coi nhu mot nguoi dung (hoac dieu hanh vien) thong thuong. Chung la cac quy trinh daemon, co the chay tu dong mot so thao tac. Qua trinh dieu khien cac bot nay thong thuong dua tren viec gui lenh de thiet lap kenh lien lac do hacker thuc hien, voi muc dich chinh la pha hoai. Tat nhien, viec quan tri bot cung doi hoi co che tham dinh va cap phep. Vi the, chi co chu so huu chung moi co the su dung.

Mot thanh phan quan trong cua cac bot nay la nhung su kien ma chung co the dung de phat tan nhanh chong toi may tinh khac. Xay dung ke hoach can than cho chuong trinh tan cong se giup thu duoc ket qua tot hon voi thoi gian ngan hon (nhu xam pham duoc nhieu may tinh hon chang han). Mot so n bot ket noi vao mot kenh don de cho lenh tu ke tan cong thi duoc goi la mot botnet.

Cach day chua lau, cac mang zombie (mot ten khac cua may tinh bi tan cong theo kieu bot) thuong duoc dieu khien qua cong cu doc quyen, do chinh nhung ke chuyen be khoa co tinh phat trien. Trai qua thoi gian, chung huong toi phuong thuc dieu khien tu xa. IRC duoc xem la cong cu phat dong cac cuoc tan cong tot nhat nho tinh linh hoat, de su dung va dac biet la cac server chung co the duoc dung nhu mot phuong tien lien lac. IRC cung cap cach thuc dieu khien don gian hang tram, tham chi hang nghin bot cung luc mot cach linh hoat. No cung cho phep ke tan cong che day nhan dang that cua minh voi mot so thu thuat don gian nhu su dung proxy nac danh hay gia mao dia chi IP. Song cung chinh boi vay ma chung de lai dau vet cho nguoi quan tri server lan theo.

Trong hau het cac truong hop tan cong boi bot, nan nhan chu yeu la nguoi dung may tinh don le, server o cac truong dai hoc hoac mang doanh nghiep nho. Ly do la boi may tinh o nhung noi nay khong duoc giam sat chat che va thuong de ho hoan toan lop bao ve mang. Nhung doi tuong nguoi dung nay thuong khong xay dung cho minh chinh sach bao mat, hoac neu co thi khong hoan chinh, chi cuc bo o mot so phan. Hau het nguoi dung may tinh ca nhan ket noi duong truyen ADSL deu khong nhan thuc duoc cac moi nguy hiem xung quanh va khong su dung phan mem bao ve nhu cac cong cu diet virus hay tuong lua ca nhan.

Bot va cac ung dung cua chung

Kha nang su dung bot va cac ung dung cua chung cho may tinh bi chiem quyen dieu khien hoan toan phu thuoc vao suc sang tao va ky nang cua ke tan cong. Chung ta hay xem mot so ung dung pho bien nhat.

DDoS

Cac botnet duoc su dung thuong xuyen trong cac cuoc tan cong Distributed Denial of Service (DDoS). Mot ke tan cong co the dieu khien so luong lon may tinh bi chiem quyen dieu khien tai mot tram tu xa, khai thac bang thong cua chung va gui yeu cau ket noi toi may dich. Nhieu mang tro nen het suc toi te sau khi hung chiu cac cuoc tan cong kieu nay. Va trong mot so truong hop, thu pham duoc tim thay ngay khi dang tien hanh cuoc pha hoai (nhu o cac cuoc chien dotcom).

Tan cong tu choi dich vu phan tan (DDoS)

Tan cong DDoS la mot bien the cua Foolding DoS (Tan cong tu choi dich vu tran). Muc dich cua hinh thuc nay la gay tran mang dich, su dung tat ca bang thong co the. Ke tan cong sau do se co toan bo luong bang thong khong lo tren mang de lam tran website dich. Do la cach phat dong tan cong tot nhat de dat duoc nhieu may tinh duoi quyen kiem soat. Moi may tinh se dua ra bang thong rieng (vi du voi nguoi dung PC ca nhan noi ADSL). Tat ca se duoc dung mot lan, va nho do, phan tan duoc cuoc tan cong vao website dich. Mot trong cac kieu tan cong pho bien nhat duoc thuc hien thong qua su dung giao thuc TCP (mot giao thuc huong ket noi), goi la TCP syn flooding (tran dong bo TCP). Cach thuc hoat dong cua chung la gui dong thoi cung luc mot so luong khong lo yeu cau ket noi TCP toi mot Web Server (hoac bat ky dich vu nao khac), gay tran tai nguyen server, dan den tran bang thong va ngan khong cho nguoi dung khac mo ket noi rieng cua ho. Qua la don gian nhung thuc su nguy hiem! Ket qua thu duoc cung tuong tu khi dung giao thuc UDP (mot giao thuc khong ket noi).

Gioi tin tac cung bo ra kha nhieu thoi gian va cong suc dau tu nham nang cao cach thuc tan cong cua chung. Hien nay, nguoi dung mang may tinh nhu chung ta dang phai doi mat voi nhieu ky thuat tinh vi hon xa so kieu tan cong DDoS truyen thong. Nhung ky thuat nay cho phep ke tan cong dieu khien mot so luong cuc ky lon may tinh bi chiem quyen dieu khien (zombie) tai mot tram tu xa ma don gian chi can dung giao thuc IRC.

Spamming (phat tan thu rac)

Botnet la mot cong cu ly tuong cho cac spammer (ke phat tan thu rac). Chung da, dang va se duoc dung vua de trao doi dia chi e-mail thu thap duoc, vua de dieu khien co che phat tan thu rac theo cung mot cach voi kieu tan cong DDoS. Thu rac duoc gui toi botnet, sau do phan phoi qua cac bot va tu do phat tan toi may tinh dang bi chiem quyen dieu khien. Tat ca spammer deu lay ten nac danh va moi hau qua thi may tinh bi pha hoai ganh chiu.

Sniffing va Keylogging

Cac bot cung co the duoc su dung mot cach hieu qua de nang cao nghe thuat co dien cua hoat dong sniffing. Neu theo doi luu luong du lieu truyen di, ban co the xac dinh duoc con so kho tin luong thong tin duoc truyen tai. Do co the la thoi quen cua nguoi dung, trong tai goi TCP va mot so thong tin thu vi khac (nhu mat khau, ten nguoi dung). Cung tuong tu nhu vay voi keylogging, mot hinh thuc thu thap tat ca thong tin tren ban phim khi nguoi dung go vao may tinh (nhu e-mail, password, du lieu ngan hang, tai khoan PayPal,…).

An cap nhan dang

Cac phuong thuc duoc de cap o tren cho phep ke tan cong dieu khien botnet de thu thap mot luong thong tin ca nhan khong lo. Nhung du lieu co the duoc dung de xay dung nhan dang gia mao, sau do loi dung de co the truy cap tai khoan ca nhan hoac thuc hien nhieu hoat dong khac (co the la chuan bi cho nhieu cuoc tan cong khac) ma nguoi ganh chiu hau qua khong ai khac chinh la chu nhan cua cac thong tin do.

So huu phan mem bat hop phap

Day la hinh thuc cuoi cung, nhung chua phai la ket thuc. Cac may tinh bi tan cong theo kieu bot co the duoc dung nhu mot kho luu tru dong tai lieu bat hop phap (phan mem an cap ban quyen, tranh anh khieu dam,…). Du lieu duoc luu tru tren o cung trong khi nguoi dung ADSL khong he hay biet.

Con rat nhieu, rat nhieu kieu ung dung khac nua duoc phat trien dua tren botnet (nhu tra tien cho moi lan kich chuot de su dung mot chuong trinh, phishing, hijacking ket noi HTTP/HTTPS…), nhung liet ke ra duoc het co le se phai mat hang gio. Ban than bot chi la mot cong cu voi kha nang lap ghep va thich ung de dang cho moi hoat dong doi hoi dat quyen kiem soat don len mot so luong lon may tinh.

Cac kieu bot khac nhau

Nhieu kieu bot da duoc xay dung va cho phep download duoc cung cap nhan nhan khap Internet. Moi kieu co nhung thanh phan dac biet rieng. Chung ta se xem xet mot so bot pho bien nhat va thao nhung thanh phan chinh va cac yeu to phan biet cua chung.

GT-Bot

Tat ca cac bot GT (Global Threat) deu dua tren kieu client IRC pho bien danh cho Windows goi la mIRC. Cot loi cua cac bot nay la xay dung tap hop script (kich ban) mIRC, duoc dung de dieu khien hoat dong cua he thong tu xa. Kieu bot nay khoi chay mot phien client nang cao voi cac script dieu khien va dung mot ung dung thu hai, thong thuong la HideWindows de an mIRC truoc nguoi dung may tinh dich. Mot file DLL bo sung se them mot so thanh phan moi vao mIRC de cac script co the chi phoi nhieu khia canh khac nhau tren may tinh bi chiem quyen dieu khien.

Agobot

Agobot la mot trong nhung kieu bot pho bien nhat thuong duoc cac tay be khoa (craker) chuyen nghiep su dung. Chung duoc viet tren nen ngon ngu C++ va phat hanh duoi dang ban quyen GPL. Diem thu vi o Agobot la ma nguon. Duoc modul hoa o muc cao, Agobot cho phep them chuc nang moi vao de dang. No cung cung cap nhieu co che an minh tren may tinh nguoi dung. Thanh phan chinh cua Agobot gom: NTFS Alternate Data Stream (Xep luan phien dong du lieu NTFS), Antivirus Killer (bo diet chuong trinh chong virus) va Polymorphic Encryptor Engine (co che ma hoa hinh dang). Agobot cung cap tinh nang sap xep va sniff luu luong. Cac giao thuc khac ngoai IRC cung co the duoc dung de dieu khien kieu bot nay.

DSNX

Dataspy Network X (DSNX) cung duoc viet tren nen ngon ngu C++ va ma nguon dua tren ban quyen GPL. O kieu bot nay co them mot tinh nang moi la kien truc plug-in don gian.

SDBot

SDBot duoc viet tren nen ngon ngu C va cung su dung ban quyen GPL. Khong giong nhu Agobot, ma nguon cua kieu bot nay rat ro rang va ban than phan mem co mot luong gioi han chuc nang. Nhung SDBot rat pho bien va da duoc phat trien ra nhieu dang bien the khac nhau.

Cac yeu to cua mot cuoc tan cong

Hinh 1 the hien cau truc cua mot botnet dien hinh:

Hinh 1: Cau truc cua mot botnet dien hinh

• Dau tien ke tan cong se phat tan trojan horse vao nhieu may tinh khac nhau. Cac may tinh nay tro thanh zombie (may tinh bi chiem quyen dieu khien) va ket noi toi IRC server de nghe them nhieu lenh sap toi.

• Server IRC co the la mot may cong cong o mot trong cac mang IRC, nhung cung co the la may chuyen dung do ke tan cong cai dat len mot trong cac may bi chiem quyen dieu khien.

• Cac bot chay tren may tinh bi chiem quyen dieu khien, hinh thanh mot botnet.

Mot vi du cu the

Hoat dong cua ke tan cong co the chia thanh bon giai doan khac nhau:

• Tao
• Cau hinh
• Tan cong
• Dieu khien

Giai doan Tao phu thuoc lon vao ky nang va doi hoi cua ke tan cong. Neu la nguoi be khoa chuyen nghiep, ho co the can nhac giua viec viet ma bot rieng hoac don gian chi la mo rong, tuy bien cai da co. Luong bot co san la rat lon va kha nang cau hinh cao. Mot so con cho phep thao tac de dang hon qua mot giao dien do hoa. Giai doan nay khong co gi kho khan, thuong danh cho nhung ke moi vao nghe.

Giai doan Cau hinh la cung cap server IRC va kenh thong tin. Sau khi cai dat len mot may tinh da duoc kiem soat, bot se ket noi toi host duoc chon. Dau tien ke tan cong nhap du lieu can thiet vao de gioi han quyen truy cap bot, bao ve an toan cho kenh va cuoi cung cung cap mot danh sach nguoi dung duoc cap phep (nhung nguoi co the dieu khien bot). O giai doan nay, bot co the duoc dieu chinh sau hon, nhu dinh nghia phuong thuc tan cong va dich den.

Giai doan Tan cong la su dung nhieu ky thuat khac nhau de phat tan bot, ca truc tiep va gian tiep. Hinh thuc truc tiep co the la khai thac lo hong cua he dieu hanh hoac dich vu. Con gian tiep thuong la trien khai mot so phan mem khac phuc vu cho cong viec den toi, nhu su dung file HTML di dang de khai thac lo hong Internet Explorer, su dung mot so phan mem doc hai khac phan phoi qua cac mang ngang hang hoac qua trao doi file DCC (Direct Client–to–Client) tren IRC. Tan cong truc tiep thuong duoc thuc hien tu dong thong qua cac sau (worm). Tat ca cong viec nhung sau nay phai lam la tim kiem mang con trong he thong co lo hong va chen ma bot vao. Moi he thong bi xam pham sau do se tiep tuc thuc hien chuong trinh tan cong, cho phep ke tan cong ghi lai tai nguyen da dung truoc do va co duoc nhieu thoi gian de tim kiem nan nhan khac.

Co che duoc dung de phan phoi bot la mot trong nhung ly do chinh gay nen cai goi la tap nhieu nen Internet. Mot so cong chinh duoc dung cho Windows, cu the la Windows 2000, XP SP1 (xem Bang 1). Chung duong nhu la dich ngam yeu thich cua hacker, vi rat de tim ra mot may tinh Windows chua duoc cap nhat ban va day du hoac khong cai dat phan mem tuong lua. Truong hop nay cung rat pho bien voi nguoi dung may tinh gia dinh va cac doanh nghiep nho, nhung doi tuong thuong bo qua van de bao mat va luon ket noi Internet bang thong rong.

Bang 1: Danh sach cac cong gan voi lo hong dich vu
 

Giai doan Dieu khien gom mot so hoat dong thuc hien sau khi bot da duoc cai dat len may dich trong mot thu muc chon. De khoi dong voi Windows, bot update cac khoa dang ky, thong thuong la HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\. Viec dau tien bot thuc hien sau khi duoc cai dat thanh cong la ket noi toi mot server IRC va lien ket voi kenh dieu khien thong qua su dung mot mat khau. Nickname tren IRC duoc tao ngau nhien. Sau do, bot o trang thai san sang cho lenh tu ung dung chu. Ke tan cong cung phai su dung mot mat khau de ket noi toi botnet. Dieu nay la can thiet de khong ai khac co the su dung mang botnet da duoc cung cap.

Hinh 2: Ky thuat botnet hardening

IRC khong chi cung cap phuong tien dieu khien hang tram bot ma con cho phep ke tan cong su dung nhieu ky thuat khac nhau de an nhan dang thuc cua chung. Dieu do khien viec doi pho truoc cac cuoc tan cong tro nen kho khan. Nhung may man la, do dac diem tu nhien cua chung, cac botnet luon tao ra luu luong dang ngo, tao dieu kien de dang de co the do tim nho mot so kieu mau hay mo hinh da biet. Dieu do giup cac quan tri vien IRC phat hien va can thiep kip thoi, cho phep ho go bo cac mang botnet va nhung su lam dung khong dang co tren he thong cua ho.

Truoc tinh hinh nay, nhung ke tan cong buoc phai nghi ra cach thuc khac, cai tien ky thuat C&C (Control and Command - Dieu khien qua lenh) thanh botnet hardening. O ky thuat moi nay, cac bot thuong duoc cau hinh de ket noi voi nhieu server khac nhau, su dung mot hostname anh xa dong. Nho do, ke tan cong co the chuyen bot sang server moi de dang, van hoan toan nam quyen kiem soat ngay ca khi bot da bi phat hien. Cac dich vu DNS dong nhu dyndns.com hay no-IP.com thuong duoc dung trong kieu tan cong nay.

DNS dong

Mot DNS dong (nhu RFC 2136) la mot he thong lien ket ten mien voi dia chi IP dong. Nguoi dung ket noi Internet qua modem, ADSL hoac cap thuong khong co dia chi IP co dinh. Khi mot doi tuong nguoi dung ket noi toi Internet, nha cung cap dich vu mang (ISP) se gan mot dia chi IP chua duoc su dung lay ra tu vung duoc chon. Dia chi nay thuong duoc giu nguyen cho toi khi nguoi dung ngung su dung ket noi do.

Co che nay giup cac hang cung cap dich vu mang (ISP) tan dung duoc toi da kha nang khai thac dia chi IP, nhung can tro doi tuong nguoi dung can thuc hien mot so dich vu nao do qua mang Internet trong thoi gian dai, song khong phai su dung dia chi IP tinh. De giai quyet van de nay, DNS dong duoc cho ra doi. Hang cung cap se tao cho dich vu mot chuong trinh chuyen dung, gui tin hieu toi co so du lieu DNS moi khi dia chi IP cua nguoi dung thay doi.

De an hoat dong, kenh IRC duoc cau hinh gioi han quyen truy cap va an thao tac. Cac mo hinh IRC dien hinh cho kenh botnet la: +k (doi hoi phai nhap mat khau khi dung kenh); +s (khong duoc hien thi tren danh sach cac kenh cong cong); +u (chi co nguoi dieu hanh (operator) la duoc hien thi tren danh sach nguoi dung); +m (chi co nguoi dung o trang thai su dung am thanh +v moi co the gui tin den kenh). Hau het moi chuyen gia tan cong deu dung server IRC ca nhan, ma hoa tat ca lien lac tren kenh dan. Chung cung co khuynh huong su dung nhieu bien the ca nhan hoa cua phan mem IRC server, duoc cau hinh de nghe tren cac cong ngoai tieu chuan va su dung phien ban da duoc chinh sua cua giao thuc, de mot IRC client thong thuong khong the ket noi vao mang.

Bai sau chung toi se cung cap noi dung cu the mot cuoc tan cong mau, moi ban doc don xem.

 Theo Security