45
3

3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

  • Upload
    others

  • View
    1

  • Download
    0

Embed Size (px)

Citation preview

Page 1: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

����

����� ��������3�� ��

Page 2: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

CONTENTSn ���� ����

n �����

q ��������

q IDS

Page 3: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

1. ��������

Page 4: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

'#%("��&!��

n TROJ_SKAq��+Happy99q�����������)��� ����*

q$(&������)HAPPY99.exe���

http://www.vcon.dekyo.or.jp/virus/outline

Page 5: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

MS Blastern W32.Blaster.worm

q 2003/7/17 MS, Windows 2000/XP (95/98/Me ��: RPC�����

q 8/12 19����q TCP 135 �!$1.068)�"���9Worm:

q ��+(45/&2.-

q 8/29 �;��918�:�

����9*3.0,'7%�#��:

Page 6: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

GM>?<

n � q�6�!:(�3��)�3��:�3 (Malicious) FN@KH(software)

1. �� P" ���!QFN@KH8COB6�(:�/�.9

""'6%$:�9(��Q���:�2S�7ADO29

2. ����14-905:*2SN@:�2

3. ��» +--05,:29» 1. #�R2. IJL�&R3. ����R4. E;=M)

Page 7: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

FHA [����]

n �q �*, �)��.64C9 I����J

q &@@:.-/!K��!'

q $Internet Worm% I1988�J» sendmail/buffer overflow» ��6,000�I��/10%)» CERT/CC (8G>BH<����;G<HJ)"�

q W32.Nimda.A@mm I2001�J» Windows IIS/���» EH7C?25C/html(1��*+3=D90#�» ?25C��(1��

http://www.classicgaming.com/splatterhouse/worm.jpg

Page 8: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

P\IA�7 ["�]

n �)q�� *F�;?8JH[O _"� *`

q�%?T\LYVA�E+8F&�E

qKZNW(/P\I2>A�8

q login» X^MID, PasswdAT\]TPa!-A�$ C�9a» ,�=PasswdF3�a

q AIDS���5 (1988)» AIDS@6:E0�>.�» 90�1�@�<ASGI[F��a��A#@BRQUA��D34F�'

q Back Olifice

http://www.intellectualconservative.com/article2506.html

Page 9: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

"%���� []

n�����&+!)(

q��*".,-(.#+����

q+�- (logger)» -'-$��������+!

»����� �������

Page 10: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

SpyEyen ��� &�!"�����

n ��$!#�!#%!�&���

qMan-in-the-browser

��������'�� �UFJ��������(http://itpro.nikkeibp.co.jp/article/NEWS/20121030/433523

Page 11: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

What is “Mirai”n Mirai botnet

q composed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile targets with massive distributed denial-of-service (DDoS) attacks

q an unprecedented 623 Gbps DDoS attack on Sep. 21, 2016.

Page 12: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

SHODAN (�����������

Page 13: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

� 459?,�'>A01.

n Stuxnet (2010)q/@B*������=@B:PLC

n Havex (2014)n BlackEnergy (2015)

q�%���SCADA7<:*���»�",��D<-/A��D3CA6B8C)��%

q201512�D02@/; #,6�$)�+!��%D40��(�&

Page 14: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

Stuxnetn 2010�0�*.��������� ���&,���q��%/ �)+"�

q Closed �$!#-/���0USB'(+/�����

�*.�����http://topics.nytimes.com/top/news/inter

national/countriesandterritories/iran/nuclear_program/index.html

Page 15: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

BadUSBn USB� ������(?)

qBlack Hat USA 2014q���"#$��' ����������&!&�� ��

q2GB, $55.99

https://www.keelog.com/wifi_hardware_keylogger.html

�&�����&%�&KeyGrabber Wi-Fi Premium

Page 16: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

���(� (IPA #2013�10��$)+��6

2001� 2004� 2009�

�� ��,021���(2001)

�������(2005)

� ���"

45./,

Nimda (2001), Code Red (2001)

P2P (2005)713-./, (2005)

��DDos(2009), Stuxnet (2010)

�� %'&* !�� � ��

Page 17: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

-1%&$ ����

n������

qNimda

qSirCum

qKlez

qcodeRed

qsoBig

qWorm_MSBlaster.D

http://hotwired.goo.ne.jp/news/news/culture/story/20030910206.html

Administrator �

,3'0.�

��� ��

���-%4)4*/5�

��$+2( [email protected]

= Nachi = Welchia

"���������#��!

Page 18: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

��������������

n 2000/5/12q �I LOVE YOU�q"�$��& #'�'��� ���(23)

q!�% &���(*())����

http://www.sankei.co.jp/databox/nw/

Page 19: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

���(� (IPA #2013�10��$)+��6

2001� 2004� 2009��� ��,021�

��(2001)������� (2005)

� ���"

45./,

Nimda (2001), Code Red (2001)

P2P (2005)713-./,(2005)

��DDos(2009), Stuxnet (2010)

�� %'&* !�� � ��

Page 20: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

2. ��������

Page 21: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

"�(�!� �*�J

n��$��%�� �<C3A?+��

[email protected], USBH�)���*q@FB��:,/B+��G>2C0.B5,

MelissaHq01;=F4+��GNimda)q�'�#�?! (DF?I968DF2�)��HqWinny (��+�&�I �/E58FBH

Page 22: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

!�"��,!,"+,

n !���#+�(&

buf.c1 main(){2 char a[10] = "", b[10] = "";3 gets(b);4 printf("a = %s¥n", a);5 printf("b = %s¥n", b); 6 }

�gets(char *b) : �,%, �����b�������')��$,*

n � ��

n �����

./bufHELLOa = b = HELLO

./bufHELLO123456789A = 89 ������!!

B = HELLO123456789

Page 23: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

��'8D5

45721D:D;BD

n C��'���8D5(�NULL#�-,���'@D@�%��$.�� ":7;/�.�

��

void sub(){char buf[10];…strcpy(buf,p);…return;

}

4572

buf[10]'�

Sub�*' +09A4

��'8D5

��

�' +09A4

6=D8D5

���<B3?>

*p&10�����!�)$CCC

Page 24: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

�������

n ����(CASL) n ���(COMET)

PGM START BEGINBEGIN LD GR0,A

LAD GR1,ALD GR2,0,GR1LAD GR3,0,GR1RET

A DC #27B DC #1DC DS 1

END

��� ���

0000 1000 00090002 1210 00090004 1021 00000006 1231 00000008 81000009 0027000A 001D000B 0000

����

�����

���� ��! �����

�����

"����"

������

Page 25: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

�) ������0000 PGM START BEGIN0000 BEGIN LAD GR0,00002 LAD GR1,00004 LOOP ADDA GR0,A,GR10006 ADDA GR1,ONE0008 CPA GR1,COUNT000A JMI LOOP000C ST GR0,B000E RET

(Java)GR0=0;for(GR1=0;

GR1 – Count <0; ++GR1){GR0 = GR0 +A[GR1];

}B[0] = GR0;

Page 26: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

������

n Stirling ( ��������

<table border="0" cellpadding="0" width="800"><tr><td><div id="table-

left"><h2><a href="#"><img src="img/klab.png" width="320" alt="�����" border="0" /></a></h2></div></td>

Page 27: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

���� �� OllyDbg

����

���

���

�������

���

Page 28: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

���

n ��������

q COM, EXE��

n ��

����

�����

����

�����

����

q������� ���

Page 29: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

3. �������

Page 30: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

1. ����������n ������

q���

q������

q����

q���

Norton AntiVirus 7.51

Page 31: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

%#-*38

n .(87,8(18&= %#-*38q$!'���

q�����

q�����

q (2-3MB�$!'�3-5���" 5&�9

q� ������

0+)8

/6#42

" 5&

0+)8

/6#42

" 5&

" 5&

0+)8

/6#42

" 5&

0+)8

/6#42

" 5&

0+)8

/6#42

" 5&

0+)8

/6#42

" 5&

" 5&

%#-*38

�������

Page 32: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

����

����

����

2

3

4

Page 33: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

����

������� A

��������� B

� ������ C

��False Negative

��False Positive

����� U

Page 34: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

����

sip dip sp dp

NetA NetA any 80 passNetA NetA any 53 passNetA NetB any 80 passNetA NetB any 53 dropNetB NetA any 80 passNetB NetA any 53 passNetB NetB any 80 passNetB NetB any 53 drop

n � �.q deny allq allow sip=NetAq allow dip=NetA

���

�� ��

�� 5 1(FN)

��1(FP) 1

Page 35: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

5$-�B$-�

5$-� $-�

�� WKV`I0JRcXa>@��YbO_\E��I-�?G

�/YbO_\I �C#�A�*>@e�)7I, ?G

2� �'DYbO_\E�!I?G<B:�Gf

61D�)7I�%A;Gf��$D(��"f

&� -�D�3%.:�+A�4:99Gf

[aLMJ:, =H@7G<BI�%>@e��E�!I��>@>F8f

� 0JRcX_―e]^`dScY

��#�ePcUZTNQ

Page 36: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

DEP (Data Execution Prevention)������

IPA � ����������� C��� �10-7

Page 37: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

2. ��BEHG ��n ��BEHG; �(3�)

q'!�(ID8OGUWM)A��3@087�7/@?.:956-@FVPRWI:YNJLUWEA*26BEHG1Y�7/@��:161>.(HDRSKCQWTA�3@08X&�Z

q 1���;��>4<50����;#+n ��BEHGA�,3@&�(4�)

q��;OGUWM)�, ��q 30����;#+

n "�%;$ (5�), (�=;��(6�)

Page 38: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

���6<?>�-)3�T

1. +�03& ,ID'JQN�"2. sendmail ,?;KMC7IQN4%%�"R��-�*�$"S

3. 8PDLFBD'G>OQE4��&��+*2 0�"

4. /13"��!+��,ID(G>OQE49:H���+"#'��"

5. ��?PA+�.�5'=P@QN�1��4��5�"

Page 39: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

3. >=CH$,n *�(8�3'>=CH6�$,(CYDER)9q 2013�;<3�q 2015��I�8�I0

101)+(�345)I275 I

q 12:E=F?BHG» �2&/I4�I�7I1���

» ����» ���I� I�&6!

n @DAH

q��� 25, q��-"� 32, q5. 27q%# 6

http://biz.nikkan.co.jp/news/nkx0220151027abau.html

Page 40: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

������

n ���� (GSX)q ������

q�������������

http://www.gsx.co.jp/informationsecurity/attackmailtraining.html

Page 41: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

4. CSIRTn computer security

incident response team (CSIRT)q 1988 CERT1. SOC(Security

Operations Center) ��

2. Incident Response Team ��

3. Forensic investigators ��

4. Engineering team

Page 42: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

EJ

n () / /( / ) q EJqPa aRq EJ Tq () C

IA aR

q

http://www.jpcert.or.jp/

Page 43: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

���������� NCAn 2007��

q JPCERT/CC��

q������

q��������

q���

n 106�� waiting 90��!

http://www.nca.gr.jp/

Page 44: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

5. ����

n � �������

CAPTCHA (��� !

C&C��� ����!

���������

�������

bot�����

Page 45: 3kikn/CDN/NSEC3-MWb.pdfWhat is “Mirai” nMiraibotnet qcomposed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile

607

n GJ?@=5M N0#$��4malicious 2software&9�/#:P?>JA4�0);:M NOM NOM N43.41;&<�+:P

n ����4��5O��4#-,9&9OM N8���3��*/(/#:P

n ��2FLE<IKCH3��+:M NO��2DLB< �*/��!�<�(�%:M N214�� �'":P