transparent botnet control for smartphones over smscaptf.com/conferences/takedowncon...
TRANSCRIPT
![Page 1: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/1.jpg)
Transparent Botnet Control for Smartphones over SMS
Georgia Weidman
![Page 2: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/2.jpg)
Why Smartphone Botnets?Nearly 62 million smartphones sold in Q2 2010
Development is similar to standard platformsAndroid = LinuxiPhone = OSXWindows Mobile = Windows
Technical specs not as good as top of the line desktops. They are as good as the desktops you might have at work.
![Page 3: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/3.jpg)
Why SMS C&C?
Battery Management
Fault Tolerant
Always On
Difficult for security researchers to monitor
![Page 4: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/4.jpg)
How an SMS is sent and received
![Page 5: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/5.jpg)
How an SMS is sent and received
![Page 6: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/6.jpg)
How an SMS is sent and received
![Page 7: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/7.jpg)
How an SMS is sent and received
![Page 8: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/8.jpg)
Previous Work: SMS Fuzzing
At Blackhat 2009, Charlie Miller & Collin Mulliner
proxied the application layer and modem to crash
smartphones with SMS.
![Page 9: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/9.jpg)
![Page 10: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/10.jpg)
![Page 11: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/11.jpg)
![Page 12: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/12.jpg)
![Page 13: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/13.jpg)
![Page 14: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/14.jpg)
![Page 15: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/15.jpg)
![Page 16: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/16.jpg)
Master Bot
![Page 17: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/17.jpg)
Master Bot
Handled by botherders
Switched out regularly to avoid detection Prepay SIM Cards + Kleptomania
Sends instructions to Sentinel Bots
In charge of bot structure
![Page 18: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/18.jpg)
Sentinel Bots
![Page 19: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/19.jpg)
Sentinel Bots
Several “trustworthy” long infected bots
Receive instructions from master bot
Pass on instructions to a set of slave bots
![Page 20: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/20.jpg)
Slave Bots
![Page 21: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/21.jpg)
Slave Bots
Receive instructions from sentinel bots
Carry out botnet payload functionality (DDOS, SPAM, etc.)
![Page 22: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/22.jpg)
Robustness
Master Bot:May change device, platform, SIM at will Prepaid phones are difficult to trackHas knowledge of all active bots
Sentinel Bots:Reserved for long time bots The only bots that interact directly with the masterMaster may promote any slave when needed
Slave Bots: A compromise results in at most finding the identity of a single sentinel
![Page 23: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/23.jpg)
Security Concerns
Impersonation:Use cryptographic keys to authenticate master bot and sentinel bots
Replay:SMS timestamps Sequence numberOne time keys
![Page 24: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/24.jpg)
SMS-Deliver PDU
Field ValueLength of SMSC 07
Type of Address (SMSC) 91Service Center Address (SMSC) 41 40 54 05 10 F1SMS Deliver Info 04Length of Sender Number 0BType of Sender Number 91Sender Number 51 17 34 45 88 F1Protocol Identifier 00Data Coding Scheme 00Time Stamp 01 21 03 71 40 04 4AUser Data Length 0AUser Data E8 32 9B FD 46 97 D9 EC 37
07914140540510F1040B915117344588F100000121037140044A0AE8329BFD4697D9EC37
![Page 25: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/25.jpg)
SMS-Deliver PDU
Field ValueLength of SMSC 07
Type of Address (SMSC) 91Service Center Address (SMSC) 41 40 54 05 10 F1SMS Deliver Info 04Length of Sender Number 0BType of Sender Number 91Sender Number 51 17 34 45 88 F1Protocol Identifier 00Data Coding Scheme 00Time Stamp 01 21 03 71 40 04 4AUser Data Length 0AUser Data E8 32 9B FD 46 97 D9 EC 37
07914140540510F1040B915117344588F100000121037140044A0AE8329BFD4697D9EC37
![Page 26: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/26.jpg)
How It Works
1. Bot Receives Message
2. Bot Decodes User Data
3. Bot Checks for Bot Key
4. Bot Performs Payload Functionality
![Page 27: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/27.jpg)
How It Works
1. Bot Receives MessageBot receives all communication from modemIf SMS (code CMT) continue analysisIf not SMS pass up to user space
2. Bot Decodes User Data
3. Bot Checks for Bot Key
4. Bot Performs Payload Functionality
![Page 28: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/28.jpg)
How It Works
1. Bot Receives Message
2. Bot Decodes User DataMoves through PDU to User DataDecode 7 bit GSM to plaintext
3. Bot Checks for Bot Key
4. Bot Performs Payload Functionality
![Page 29: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/29.jpg)
How It Works
1. Bot Receives Message
2. Bot Decodes User Data
3. Bot Checks for Bot KeyBot checks for secret key in messageIf bot message continue analysisIf not bot message pass to user space
4. Bot Performs Payload Functionality
![Page 30: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/30.jpg)
How It Works1. Bot Receives Message
2. Bot Decodes User Data
3. Bot Checks for Bot Key
4. Bot Performs Payload Functionality Bot reads functionality request in messageIf found perform functionalityIf not found fail silently
![Page 31: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/31.jpg)
Getting The Bot InstalledRegular Users:
App + Local Root Exploit (Sendpage etc.)Example: John Oberheide's Twilight Android Botnet Defcon Skytalks 2010
Root-level/Jailbroken Users:Root level app using proxy function for AWESOME + Bot
Remote:Remote root exploit (rooted and nonrooted)Example: iKee-B “Duh” Worm for iPhone
![Page 32: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/32.jpg)
Example Payloads
SpamCreating SMS-Send PDUs and passing them to the modem Example: SMS ads
DDOSMillions of smartphones vs. a server
Loading New Functionality Send URL in payloadDownload the module into known payloads
![Page 33: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/33.jpg)
Parallel Research: iPhone Base Code
Rise of the iBots: Owning a Telco NetworkCollin Mulliner and Jean-Pierre Seifert
SMS and P2P smartphone botnets
![Page 34: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/34.jpg)
DEMO : )
Android Bot with SMS Spam Payload
Released code has the bot without payloads (have fun)
![Page 35: Transparent Botnet Control for Smartphones over SMScaptf.com/conferences/TakeDownCon Dallas/Transparent Botnet Co… · Why Smartphone Botnets? Nearly 62 million smartphones sold](https://reader033.vdocument.in/reader033/viewer/2022050400/5f7e050b33f3686d980faf53/html5/thumbnails/35.jpg)
To Mom for helping me master character arrays in c.
Thanks