Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
401
Finally, bot herders can use digital signatures on updates and C 2 messages
to ensure that only the owner of a specific private key, i.e. the bot herder itself,
can assert control or roll out applications in the botnet. Without authentication,
an attacker with an understanding of the botnet’s protocol may issue commands
or roll out updates on a bot, e.g. to install a software it would otherwise have to pay
the bot herder to run on infected machines, thwarting the bot herder’s business
model. Authenticated messages and/or updates have are used by several botnets
at this time, including Duqu, but also Sality [18] or Miner [19].
D. Conclusions
Our analysis suggests that while changes to protocols below the application
layer are labour intensive, they provide little potential for benefit to a bot herder
with regard to avoiding network intrusion detection. Steganographic approaches
that require changes in these layers suffer from the same drawback given that obfuscation
in one domain results in anomalies in a different domain and are thus
equally unlikely to prevail. We do however expect steganography in the sense that
botnet protocol messages will resemble or be encapsulated in legitimate protocol
messages. This is already the case with both Miner and Duqu, which encapsulate
their messages in an apparent HTTP-session.
Cryptography will play a major role in both rendering a botnet’s traffic invisible
and asserting the bot herder’s control over it. Most botnets we are aware
of encrypt their protocol messages, obstructing payload based network intrusion
detection, and at least some use digital signatures to prevent unauthorised access
to their command and control channels. Concepts and implementations however
display weaknesses that reduce the effectiveness of these safeguards. Symmetric
encryption often uses custom algorithms and fixed shared keys without any initialisation
vector instead of generating session keys. While the RSA algorithm
often used for generating signatures is considered secure, implementation details
such as key lengths, selected hash functions or data to authenticate limit their
effectiveness.
We can only guess why malware authors prefer custom but often imperfect
designs over standardised approaches, but botnet operators have proven that they
are capable of evolving their designs, particularly when their botnet’s vulnerabilities
have been exploited to interfere with their businesses. Thus, botnets will not only
increasingly rely on tunnelling all of their C 2 traffic through legitimate protocols such
as HTTP and HTTPS, but will also make a better use of cryptography. The payload
of packets transmitted or received by these botnet clients will therefore no longer
carry any features that could be exploited for deep packet inspection, motivating
a need for approaches that can detect botnet communication without relying on
any immediate properties of the payload.