Hackers use blockchain to create bulletproof botnets

[ad_1]

A man stands in front of a photo showing the activities of a so-called ‘botnet’ during a workshop on computing and cybercrime.Photo: BORIS ROESSLER / DPA / AFP (Getty Images)

Last week, Google announced that it had partially halted the operations of a massive botnet, a gargantuan network of more than a million Windows computers infected with malware. In the world of cybersecurity, that would be news in itself, but this particular network used an alarming blockchain integration that makes it hard to beat.

Botnets are essentially armies of “zombie” devices, servers infected with malware and linked to a malicious network, the type of which can then be used to commit large-scale criminal activity. Most people whose device has been compromised and are part of a botnet have no idea what happened, and their computer is essentially functioning as an unwitting accomplice in cybercrime.

In this particular case, the criminal organization behind the botnet would be a family of malware known as “Glupteba”. Last week, Google’s Threat Analysis Group (TAG) posted a background on the Glupteba botnet, showing that the network was being used to mine cryptocurrency, also known as “cryptojacking.” CPU power siphoned off from the masses and masses of infected devices essentially acted as free rocket fuel for criminals, who could use it to support their energy-hungry businesses.

So obviously the disturbance of something like that is good. But, just like the ongoing botnet problem, the real issue isn’t necessarily how to destroy parts of an infected network, but how to keep them in place. At the same time as Google claimed to have disrupted Gluteba, it also had to admit that the infected network would soon rebuild itself and regain its full strength thanks to an innovative resilience mechanism based on the Bitcoin blockchain.

This new crypto-based mechanism, which has long been theorized but has not necessarily been seen in nature before, could present unfortunate new ground for cybercriminals, which could make them increasingly resistant to disruption by cybercriminals. law enforcement.

An evolving problem

The main problem for any cybercriminal who wants to exploit a botnet is how to keep control over his zombified hordes.

Botnets are typically set up to be controlled by a centralized party, usually referred to as a “botmaster” or “hindrance”. Breeders use what’s called a command and control (C2) server, a machine that sends instructions to all infected machines, effectively acting as the primary switchboard for criminals to control their zombies. Via C2, ranchers can run large-scale malicious campaigns, such as data theft, malware attacks or, in Glupteba’s case, cryptojacking.

But, in order to manage his herds, the botmaster needs a channel through which to stay connected to them and give commands – and this is where things can get tricky. Many C2 botnet infrastructures use basic web protocols like HTTP, which means they must be logged into a specific web domain to stay in touch with their herd. The domain acts as C2’s portal to the Internet and, therefore, the wide area network of infected devices.

However, since it’s not that hard to take down a website, it means C2s – and therefore botnets themselves – can be disrupted quite easily. Law enforcement can take them down by simply neutralizing domains associated with C2, either by forcing its DNS provider, like Cloudflare, to shut down access, or by finding and entering a domain itself.

To get around this problem, criminals have increasingly looked for innovative ways to stay connected to their herds of robots. In particular, criminals have sought to use alternative platforms, such as social media or, in some cases, Tor, to act as C2 hubs. A 2019 study from the MIT Internet Policy Research Initiative points out that some of these methods have had average success but generally do not exhibit long longevity:

More recently, botnets have experimented with esoteric C&C mechanisms, including social media and cloud services. The Flashback Trojan retrieved instructions from a Twitter account. Whitewell Trojan used Facebook as a meeting point to redirect bots to the C&C server … The results were mixed. Network administrators rarely block these services because they are ubiquitous and C&C traffic is therefore more difficult to distinguish. On the other hand, C&C channels are centralized again and companies like Twitter and Google are rushing to crack down on them.

What frequently happens is a mole game between cops and criminals, in which the police repeatedly remove domains or any other web infrastructure in use, only for the same criminals to reconstitute themselves and get the botnet back on stream via different medium. .

However, Glupteba appears to have been a game-changer: According to Google and other security analysts who have looked at the gang’s activities, the criminal enterprise appears to have found the perfect way to protect themselves from disruption. How? ‘Or’ What? By leveraging the tamper-proof infrastructure of the Bitcoin blockchain.

Bulletproof via Blockchain

For cybercriminals, the question of how to stay connected to their robot herds can be resolved through the creation of a back-up mechanism. If the primary C2 server and its associated domain are taken down by the cops, malware in infected devices can be designed to search the web for another backup C2 domain, which then resuscitates the entire infected network.

Typically, criminals hard-code these backup web domains into the malware itself. (Hard coding is the practice of embedding data directly into the source code of a particular program.) This way the botmaster can save a large number of backups. But, ultimately, there is a limit to the effectiveness of this strategy. At some point, the botnet will run out of new addresses because only a limited amount can be encoded into the malware.

In Glupteba’s case, however, the gang avoided this problem altogether: instead of hard-coding web domains into malware, they hard-coded three Bitcoin wallet addresses into them. With these addresses, Glupteba has succeeded in setting up an infallible interface between its herds of robots and its C2 infrastructure via an unrecognized function known as “OP_Return”.

The OP_Return is a controversial feature of Bitcoin wallets that allows the entry of arbitrary text in transactions. It basically functions as the crypto equivalent of Venmo’s “memo” field. Glupteba has taken advantage of this functionality by using it as a communication channel. The malware in infected devices is designed so that if any of the botnet’s C2 servers goes offline, the devices scan the public Bitcoin blockchain for transactions associated with Glupteba’s wallets. In these wallets, through the OP_Return field, cybercriminals can constantly enter new domain addresses, which their botnet is designed to recognize and redirect to.

Chainalysis, a blockchain analytics company, played a key role in helping Google’s security team investigate all of this. In an interview with Gizmodo, Erin Plante, the company’s senior director of investigations and special programs, said that criminals’ use of blockchain presents unique and potentially overwhelming challenges for law enforcement.

“When the botnet loses communication with a C2 domain, usually because there is some kind of law enforcement action, the botnet knows it needs to scan the entire public Bitcoin blockchain and look for transactions between these three Bitcoin addresses, ”said Plante. In other words, whenever a C2 domain is deleted, Glupteba can automatically replenish itself through a new domain address sent through the gang’s crypto wallets.

The decentralized nature of the blockchain means there is really no way to prevent these messages from passing through or disabling the associated crypto addresses, said Plante. Indeed, as crypto enthusiasts have often pointed out, blockchain is considered “uncensored” and “tamper-proof” because it has no overall authority or management entity. As such, no one can turn off the lights on Glupteba’s malicious activity.

Can Glupteba be stopped?

So, uh, what to do? Currently, the options aren’t great, says Shane Huntley, director of Google’s TAG team.

“This back-up mechanism is very resilient,” Huntley said in an email to Gizmodo. “As long as the attackers have the keys to the wallets, they can direct the botnet to find new servers.”

Plante seems equally pessimistic. “It is certainly a model that, if it is replicated on ransomware or other cybercrime activity, it is a frightening possibility,” she said. “At this point, besides deleting a single C2 domain and restarting it a few days later, no one has been able to find a way to stop this.”

Huntley said there were likely other examples of criminals using blockchain in this way, but the practice is certainly not considered “common” at this time.

“However, the mitigating factor is that whenever they do, it will be public and other action may be taken,” Huntley said, referring to the implicitly public nature of the blockchain. Due to its open format, Huntley said the Google Threat Team is able to continue to trace the transactions of criminals. “We’ve seen them direct the botnet to new servers before and those servers have been taken down as well. “

In other words, the botnet will live as long as the hackers make sure to update it. And security professionals will have to keep monitoring its updates until hackers give up or are apprehended in real life.

[ad_2]