mailing list archives
Re: attacking Storm Worm
From: coderman <coderman () gmail com>
Date: Fri, 18 Apr 2008 00:37:10 -0700
On Wed, Mar 19, 2008 at 5:49 AM, mcwidget <mcwidget () gmail com> wrote:
> Aint that the whole problem with Storm tho? The lack of CC boxes? Without
> that target, how do you effectively shutdown something like this?
On Wed, Mar 19, 2008 at 12:37 PM, coderman <coderman () gmail com> wrote:
the target is the distributed hash table routing metric used for
decentralized C&C. kademlia, chord, and DHT's in general are fragile;
they trade efficiency for resilience against a coordinated attacker,
presuming the redundancy adequate for random (read: not intentional)
failure is sufficient.
"Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case
Study on Storm Worm"
section 4.2 describes the implementation of a sybil attack which is
the most effective way to observe and manipulate DHT's without
endpoint based partitioning of the DHT address space. (for example,
achord, would make a sybil attack more difficult, but this too can be
mitigated with enough address space on hand...)
the polluting attack appears most effective for the overnet/stormnet
routing described; for other DHT's the index poisoning (Eclipsing
Content in paper) would be even more effective (CAN,KAD,etc).
additional variations on these attacks are described in: "Security
Considerations for Peer-to-Peer Distributed Hash Tables" and
if persistent tampering of decentralized botnet C&C is pursued by
researchers and/or industry actors, it will be interesting to watch
the defenses evolve. defeating sybil attacks and robust resource
discovery have been persistent problems for peer networks of any type.
(my money is on achord style endpoint id space partitioning and
iterative unicast discovery that would adapt to malicious pollution
effectively and efficiently.)
( see also "curious yellow", an oldie but goodie:
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Re: attacking Storm Worm coderman (Apr 18)