full-disclosure - Re: attacking Storm Worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 18 Apr 2008 00:37:10 -0700
From: coderman <coderman@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: attacking Storm Worm

> On Wed, Mar 19, 2008 at 5:49 AM, mcwidget <mcwidget@...il.com> wrote:
>  >...
>  > Aint that the whole problem with Storm tho?  The lack of CC boxes?  Without
>  > that target, how do you effectively shutdown something like this?

On Wed, Mar 19, 2008 at 12:37 PM, coderman <coderman@...il.com> wrote:
>  the target is the distributed hash table routing metric used for
>  decentralized C&C.  kademlia, chord, and DHT's in general are fragile;
>  they trade efficiency for resilience against a coordinated attacker,
>  presuming the redundancy adequate for random (read: not intentional)
>  failure is sufficient.

http://www.usenix.org/event/leet08/tech/full_papers/holz/holz_html/
"Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case
Study on Storm Worm"

section 4.2 describes the implementation of a sybil attack which is
the most effective way to observe and manipulate DHT's without
endpoint based partitioning of the DHT address space.  (for example,
achord, would make a sybil attack more difficult, but this too can be
mitigated with enough address space on hand...)

the polluting attack appears most effective for the overnet/stormnet
routing described; for other DHT's the index poisoning (Eclipsing
Content in paper) would be even more effective (CAN,KAD,etc).

additional variations on these attacks are described in: "Security
Considerations for Peer-to-Peer Distributed Hash Tables" and
elsewhere.
http://www.cs.rice.edu/Conferences/IPTPS02/173.pdf

if persistent tampering of decentralized botnet C&C is pursued by
researchers and/or industry actors, it will be interesting to watch
the defenses evolve.  defeating sybil attacks and robust resource
discovery have been persistent problems for peer networks of any type.
 (my money is on achord style endpoint id space partitioning and
iterative unicast discovery that would adapt to malicious pollution
effectively and efficiently.)

best regards,

( see also "curious yellow", an oldie but goodie:
http://blanu.net/curious_yellow.html )

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/