Malicious CDNs
Discovering botnet and bulletproof hosting infrastructure through anomalous SSL certificate patterns.
Summary
SSL Analysis
Prior research examined relationships between malware, bulletproof hosting, and SSL using seed domains. Novel statistical techniques discover botnet and bulletproof hosting IP space by examining SSL distribution patterns.
Open Source Data
Using only open source datasets and tools, infrastructure discovery becomes possible with limited seed information. IPv4 namespace scanning produces 4 million node bipartite graphs connecting common names to IP/CIDR/ASN.
Relative Entropy Metric
Relative entropy creates pairwise distance metrics between common names and ASNs. The metric generalizes regular and anomalous SSL distribution patterns, identifying domains with anomalous structures.
Zbot Proxy Discovery
Zbot proxy network structure parallels popular CDNs like Akamai and Google but uses compromised devices. Layering SSL signals with passive DNS data extracts Zbot domains with high accuracy, enabling infrastructure discovery.
Related talks
Main Stage·34 min
Michael Torres · Zane Hoffman
Provides an inside look at a massive operational relay network (ORB) of compromised IoT devices and routers used by Chinese APT actors to obfuscate cyber attacks.
Main Stage·33 min
Ben Folland
Demonstrates methodologies for intercepting and decrypting command-and-control traffic between active malware implants and adversary servers.
HackInBo® Security Conference & Training·50 min
Alchimia delle Cyberwarfare
Alchimia delle Cyberwarfare: (D)DoS e Botnet nei conflitti digitali Emanuele De Lucia HackInBo® W23.