振ac陈book, Twi波ter and Botnets.ppt

Tesekkurler Ibrahim Halil Saruhan Facebook : halilsaru@ E-Mail : ibrahimsaruhan@ Sorular ? Facebook, Twitter and Botnets OWASP Turkey Chapter September 26 2009 Istanbul Botnet Collection of software robots, or bots, that run autonomously and automatically Botnet in its simplest form is an army of compromised computers that take orders from a botherder Botnets are arguably the biggest threat that the Internet community has faced Most popular Botnet Type: “IRC Channels based Botnets” Lately Social Networking Sites based Botnets Puppetnet Puppetnets rely on websites that coerce web browsers to participate in Malicious activities Such activities include distributed denial-of-service worm propagation reconnaissance probing Puppetnets exploit the high degree of flexibility granted to the mechanisms comprising the web architecture A website under the control of an attacker can thereby transform a collection of web browsers into a distributed system that is effectively controlled by the attacker Puppetnets can instruct any web browser to engage in malicious activities Puppetnet Participation in puppetnets is dynamic Users join and participate unknowingly while surfing the net Easy to maintain a reasonable population, without the burden of having to look for new victims Harder for the defenders to track and filter out attacks, as puppets are likely to be relatively short-lived Only indirectly misuse browsers to attack third parties http://www.ics.forth.gr/dcs/Activities/papers/TISSEC.puppetnets.2007.pdf Puppetnet Diagram Kurban Site Atak komutlarini da iceren HTTP istek ve cevaplari Zararli Web Sunucusu Web Istemcileri Atak Trafigi What can be done via Puppetnets Image Reference Loading image objects through Javascript Open up pop-up Windows Creation of Frames to load remote objects * No browser that imposes restrictions on the location or type of the target referenced through these mechanisms Puppetnet DDoS What is more important? Size of Puppetnet