Presentation given in collaboration with Laurent Schmid (electric-haze.org) at the Espace Jules Verne of the Maison D\'ailleurs, Yverdon, Switzerland.

2. FUD
FEAR, UNCERTAINTY AND DOUBT
Dark Designs Symposium
Yverdon - October 14 2008

3. BOT
• derived from the word "robot"
• program that performs repetitive
functions
• infected computer controlled by
another computer

4. BOTNET
• a network of bots
• commonly used to control or
attack computer systems
• controlled through an IRC
channel.
• also referred to as “zombies” or
“drones”

5. USE OF BOTNETS
• distributing spam
• mounting DDoS attacks
• sniffing network traffic
• key logging
• click fraud (Google AdWords)

6. IRC
• Internet Relay Chat
• created in 1988
• first bots : 1993
• client / server

7. HISTORY
• 1999: SETI@home
• screensaver program
• prove the viability and
practicality of the 'distributed grid
computing' concept

8. SETI@home

9. February 2000
• first widely publicized botnet
incident
• floods CNN.com, Amazon.com,
eBay...
• 75 computers in 52 different
networks

10. SubSeven
Discovered: June 6, 1999
also known as: Backdoor.SubSeven
(Kaspersky Lab), Backdoor.SubSeven22
(Symantec), BackDoor.SubSeven
(Doctor Web), Troj/Sub7-1.7 (Sophos),
Backdoor:Win32/SubSeven.A (RAV)...

11. SubSeven

12. SubSeven
• server / client
• control over IRC
• monitor keystrokes
• remote desktop application

13. SubSeven

14. SubSeven

15. SubSeven
• october 2000
• 800 infected computers found
• SexxxyMovie.mpeg.exe

16. GTbot
• modified IRC client
• coupled with the hackers own scripts
• port scanning
• DDoS attacks

17. DDoS
• Distributed Denial of Service Attack
• attacker causes a network of
computers to “flood” a victim
computer with large amounts of data
or specific commands

18. GTbot

19. GTbot

20. DDoS

21. Agobot
• most widely circulated virus in
history
• best-written source code
• C++ base plugin framework
• GPL license

22. Op.Cyberslam
• October 2003
• Agobot used in DDoS attack
• Botnet: 5000 to 15000 computers
• FBI investigation

23. Op.Cyberslam

24. Op.Cyberslam

25. October 2005
• Discovery of a botnet counting
1.5 million compromised computers

26. January 2007
• The Storm Botnet is identified.
• Estimate: from 600 million computers
on the Internet, 150 million belong
to a botnet (Vint Cerf).

27. STORM BOTNET
• 1 million to 50 million computer
systems
• encrypted P2P control
• more computing power than the
world’s 500 top supercomputers

28. Russian Business
Network

29. RBN
• cybercrime organization
• personal identity theft
• bulletproof hosting
• child pornography, phishing, spam,
and malware distribution
• physically based in St. Petersburg

30. Companies
RBNet, TcS Network,
RBNetwork, Nevcon Ltd.
RBusinessNetwork, (Panama),
iFrame Cash, Too coin Software
Aki Mon Telecom, (UK),
4Stat, 76service,
Eexhost, MalwareAlarm...
Rusouvenirs Ltd.,

31. Malware
Gozi, Grab, Haxdoor, Metaphisher,
Mpack, Ordergun, Pinch, Rustock,
Snatch, Torpig, URsnif...
• viruses or worms
• send data back to RBN servers

32. October 2007
• Storm Botnet reduces size
• fallen to 160,000 systems
• partitioning / smaller networks
• 40-byte key encryption

33. November 2007
• RBN vanishes from the web
• unusual bulk registries of
thousands of Web addresses in
China
• servers move to Shangai/Taiwan

34. KRAKEN BOTNET
• largest botnet as of april 08
• over 400’000 bots
• also known as:
Bobax, Oderoor, Cotmonger