Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
399
A. Custom network or transport layer implementations
Bot herders may and have in fact already written their own implementations
for network or transport layer protocols (cf. e.g. [12]) to avoid detection.
Since packets sent by these implementations have to traverse networks consisting
mostly or only of non-infected systems, the design space for these implementations
is however strongly limited. With IPv4 and IPv6 dominating wide area networking,
a layer 3 implementation has to be compatible with these protocols, where IPv4
is predominant in most regions and end-user systems are often not configured to
permit using IPv6 in a second stack.
This comes with a second side-effect, a non-representative study [13] revealed
that 90% of a large European carrier’s DSL users were connected to the Internet via
a NAT gateway. NAT rewrites transport layer headers to provide Internet access
for several hosts which have to share a single public IPv4 address. Thus, unless
a bot herder considers the inability of a significant portion of potential clients
to access the C 2 channel acceptable, a custom transport layer protocol has to
survive forward and backward translation by a NAT gateway. Effectively, this
leaves little options other than tweaking the TCP or UDP protocols at this time.
In fact, the malware described in [12] used a standard-conform implementation
of the TCP protocol only to bypass firewalls and intrusion detection mechanisms
installed on the infected host.
A manipulation not yet addressed above is the spoofing of layer 3 addresses.
Spoofing destination addresses makes little sense unless the sender does not care
whether the recipient will actually receive a packet or can ensure that the intended
destination can be reached through a given address – which would however no
longer meet our understanding of the term “spoofed”. Spoofed source addresses
have on the other hand been observed in the wild and may actually hinder attribution
efforts. However, the analysis presented in [14], the only wide-scale effort to
detect filtering of spoofed addresses we are aware of, concluded that only about one
quarter of the autonomous systems observed in 2005 were vulnerable to spoofing.
Thus, relying solely on a communication mechanism that uses spoofed addresses
may again deny a bot herder access to a significant fraction of its infected systems.
In addition to that, when an infected system is behind a NAT gateway, the gateway
will simply follow its mode of operation and translate the packet, writing the legitimate
address to the packet sent through the wide area network.
B. Steganography
Steganography is the art of hiding communication channels. Since the observation
of C 2 channels is a prominent part of detection and takedown efforts,
a bot herder may be tempted to use techniques developed in this field to hide
its botnet’s C 2 channel. Approaches such as the one described in [15] use fields