Overbot: a botnet protocol based on Kademlia

ABSTRACT

One crucial point in the implementation of botnets is the command and control channel, which is used by botmasters to distribute commands to compromised machines and to obtain results from previous commands. While the first botnets were mainly controlled by central IRC servers, recent developments have shown the advantages of a more decentralized approach using peer-to-peer (P2P) networks. Interestingly, even though some botnets already use P2P networks, they do so in a naive fashion. As a result, most existing botnet implementations allow attackers to disrupt messages from the botmaster and to learn IP addresses of other nodes within the botnet.

This paper introduces Overbot, a botnet communication protocol based on a peer-to-peer architecture. More precisely, Overbot leverages Kademlia, an existing P2P protocol, to implement a stealth command and control channel. An attacker can neither learn the IP addresses of other nodes in the botnet nor disrupt the message exchange between the botmaster and the bots, even when the attacker is able to capture some of the nodes within the network. Overbot demonstrates the threats that may result when future botnet generations utilize more advanced communication structures. We believe that it is important to outline these threats to allow the research community to develop solutions before such botnets appear in the wild. To help the search for effective countermeasures, we also discuss possible directions where future research seems promising.

REFERENCES

• 1: Certicom. Press Release: Certicom Announces Elliptic Curve Cryptosystem (ECC) Challenge Winner. http://www.certicom.com/2002-press-releases/38-2002-press-releases/340, Nov. 2002.
• 2: Certicom Research. SEC 2: Recommended Elliptic Curve Domain Parameters. http://www.secg.org/download/aid-386/sec2_final.pdf, Sept. 2000.
• 3: D. Dagon, G. Gu, C. Lee, and W. Lee. A Taxonomy of Botnet Structures. In Annual Computer Security Applications Conference (ACSAC), 2007.
• 4: John R. Douceur, The Sybil Attack, Revised Papers from the First International Workshop on Peer-to-Peer Systems, p.251-260, March 07-08, 2002
• 5: Julian B. Grizzard , Vikram Sharma , Chris Nunnery , Brent ByungHoon Kang , David Dagon, Peer-to-peer botnets: overview and case study, Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets, p.1-1, April 10, 2007, Cambridge, MA
• 6: A. Loewenstern. Bittorrent DHT Protocol. http://www.bittorrent.org/beps/bep_0005.html, Jan. 2008.
• 7: Petar Maymounkov , David Mazières, Kademlia: A Peer-to-Peer Information System Based on the XOR Metric, Revised Papers from the First International Workshop on Peer-to-Peer Systems, p.53-65, March 07-08, 2002
• 8: E. Michelangeli. KadC (P2P library) Documentation. http://kadc.sourceforge.net/, Oct. 2006.
• 9: National Security Agency (NSA). The Case for Elliptic Curve Cryptography. http://www.nsa.gov/ia/industry/crypto_elliptic_curve.cfm, Mar. 2008.
• 10: RSA Laboratories. Announcement: RSA-155 is factored! http://www.rsa.com/rsalabs/node.asp?id=2098, Aug. 1999.
• 11: R. Schoof and R. Koning. Detecting peer-to-peer botnets. http://staff.science.uva.nl/~delaat/sne-2006-2007/p17/report.pdf, Feb. 2007.
• 12: J. Stewart. Phatbot Trojan Analysis. http://www.secureworks.com/research/threats/phatbot, Mar. 2004.
• 13: R. Vogt, J. Aycock, and J. M. J. Jacobson. Army of Botnets. In Network and Distributed System Security Symposium (NDSS), 2007.
• 14: Ping Wang , Sherri Sparks , Cliff C. Zou, An advanced hybrid peer-to-peer botnet, Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets, p.2-2, April 10, 2007, Cambridge, MA

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General

Keywords:
botnet protocol, malware, network security