Botnet Eavesdropping: Inside the Mocbot (MS06-040) Attack (
Page 1 of 2 )
A well-known security researcher eavesdrops on a botnet linked to the recent MS06-040 Windows attack and confirms that for-profit spammers are winning the cat-and-mouse game against anti-virus scanners.When Joe Stewart spotted a variant of the Mocbot Trojan hijacking unpatched Windows machines for use in IRC-controlled botnets, he immediately went to work trying to pinpoint the motive for the attacks.
Stewart, a senior security researcher with LURHQs Threat Intelligence Group, set up a way to silently spy on the botnets command-and-control infrastructure, and his findings suggest that for-profit spammers are clearly winning the cat-and-mouse game against entrenched anti-virus providers.
"The lesson here is once you get infected, you are completely under the control of the botmaster. He can put whatever he wants on your machine, and theres no way to be 100 percent sure that the machine is clean," Stewart said in an interview with eWEEK.
Stewart, a well-respected researcher who specializes in reverse-engineering malware files, echoed a warning issued earlier this year by Microsoft.
"The only way to be [completely] sure the system is malware-free is to completely wipe the hard drive and reinstall the operating system," he said.
Stewart arrived at that conclusion after eavesdropping on Mocbot for a few hours.
"I have two machines here running in an isolated network. I infect one with the malware, and I have the other machine pretending to be the entire Internet," he explained.
The second machine, known as a sandnet, is a custom-made tool for analyzing malware in an environment that is isolated, yet provides a virtual Internet for the malware to interact with.
"I can sit back and see all the interaction up to point where it [the infected machine] joins botnets control channel. Then I can take that information, go outside and replicate it. I can see what the real server is doing to get an entire picture of the operation," Stewart said.
Read more here about the ongoing battle to shut down botnet command-and-control infrastructure.
With Mocbot, which was targeting the Windows vulnerability patched with Microsofts MS06-040 patch, Stewart was able to figure out that the infected drones were connecting to two hard-coded command and control servers at "bniu.househot.com" and "ypgw.wallloan.com."
He was able to capture the IRC (Internet Relay Chat) login sequence generated by the bot. This included a user, a nickname, the channel name and the first bit of instructions to the infected machine.
The command schemes were all encrypted, forcing Stewart to create a custom Perl script to decode the algorithms.
"Theyre using trivial encryption, so a bit of reverse-engineering had to be done. You can see some of it in the code of Mocbot, and I wrote a little script to do the decoding. When I visit the channel and he gives a command, I can easily decrypt it to see the instructions hes sending to the bot," Stewart said.
Using telnet to connect to the command-and-control server on Port 18067 (the port number for the IRC server), Stewart successfully started spying on the control channel, but there was not much to see.
"The IRC server code was stripped down to give almost no information to the client, except the channel topic line, which was encrypted," he said.
Once decoded, he found that the botmaster was telling the infected machines to join another control channel to receive another encrypted message.
When decoded, the command simply served up a URL hosted at PixPond.com, a free image hosting service.
"The command is an instruction to download and execute [a second] file in the provided URL," Stewart said, noting that the mission of the botmaster was to get the second file into the infected system.
Next Page: Spam proxy.
Network Security & Hardware 
