Full Disclosure mailing list archives
Re: attacking Storm Worm
From: coderman <coderman () gmail com>
Date: Fri, 18 Apr 2008 00:37:10 -0700
On Wed, Mar 19, 2008 at 5:49 AM, mcwidget <mcwidget () gmail com> wrote: >... > Aint that the whole problem with Storm tho? The lack of CC boxes? Without > that target, how do you effectively shutdown something like this?
On Wed, Mar 19, 2008 at 12:37 PM, coderman <coderman () gmail com> wrote:
the target is the distributed hash table routing metric used for decentralized C&C. kademlia, chord, and DHT's in general are fragile; they trade efficiency for resilience against a coordinated attacker, presuming the redundancy adequate for random (read: not intentional) failure is sufficient.
http://www.usenix.org/event/leet08/tech/full_papers/holz/holz_html/ "Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm" section 4.2 describes the implementation of a sybil attack which is the most effective way to observe and manipulate DHT's without endpoint based partitioning of the DHT address space. (for example, achord, would make a sybil attack more difficult, but this too can be mitigated with enough address space on hand...) the polluting attack appears most effective for the overnet/stormnet routing described; for other DHT's the index poisoning (Eclipsing Content in paper) would be even more effective (CAN,KAD,etc). additional variations on these attacks are described in: "Security Considerations for Peer-to-Peer Distributed Hash Tables" and elsewhere. http://www.cs.rice.edu/Conferences/IPTPS02/173.pdf if persistent tampering of decentralized botnet C&C is pursued by researchers and/or industry actors, it will be interesting to watch the defenses evolve. defeating sybil attacks and robust resource discovery have been persistent problems for peer networks of any type. (my money is on achord style endpoint id space partitioning and iterative unicast discovery that would adapt to malicious pollution effectively and efficiently.) best regards, ( see also "curious yellow", an oldie but goodie: http://blanu.net/curious_yellow.html ) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: attacking Storm Worm coderman (Apr 18)