1
00:00:00,000 --> 00:00:04,940
Good morning. My name is Leonard Bailey. I'm from the Department of Justice. I'm not sure I feel

2
00:00:04,940 --> 00:00:08,620
about having stormtroopers be my lead-in, but, you know, that's the way it works as government.

3
00:00:10,040 --> 00:00:17,080
So the office I come from works on, well, whenever there's information stolen, a computer

4
00:00:17,080 --> 00:00:21,780
broken into, we work with the FBI, the Secret Service, or other investigators to try to figure

5
00:00:21,780 --> 00:00:26,680
out what happened. When I was here thinking about, like, what would I come to roots and talk

6
00:00:26,680 --> 00:00:31,940
about, what I thought might be interesting was talking to you about how we work with computer

7
00:00:31,940 --> 00:00:37,180
security researchers to take down robot armies. And I'll explain to you what I mean by robot

8
00:00:37,180 --> 00:00:45,500
armies in a moment. So to start off with, this is a talk about botnets. I don't know how many of

9
00:00:45,500 --> 00:00:55,520
you have heard of botnets? Okay. Certainly the adults have, okay. So if you haven't, the term

10
00:00:55,520 --> 00:00:56,660
botnets is actually a cliche. It's a term that's been around for a long time. It's been

11
00:00:56,660 --> 00:01:04,060
a combination of the term robot network. So this is an army of computers that have been taken

12
00:01:04,060 --> 00:01:08,820
over kind of secretly and turned into what I would call a robot army. How does that happen? Let

13
00:01:08,820 --> 00:01:17,760
me show you. So there are a lot of ways of compromising a computer so that you can create a

14
00:01:17,760 --> 00:01:23,700
botnet. But I'm going to talk specifically this morning about phishing. So often this starts

15
00:01:23,700 --> 00:01:26,640
with an e-mail. You get an e-mail, and it has a botnet. And it has a botnet. And it has a

16
00:01:26,640 --> 00:01:32,300
malware in it, something you click, or it has a link that will take you to a site, and your

17
00:01:32,300 --> 00:01:40,920
computer will be compromised there. Now, once compromised, what happens? Well, the malware will

18
00:01:40,920 --> 00:01:49,920
do something interesting if it's working as a worm. It will start scanning, trying to find other

19
00:01:49,920 --> 00:01:56,080
computers that it can also compromise. Now, this is what it looks like on a graphic level. Let me

20
00:01:56,080 --> 00:01:56,620
show you what the botnet can do. It can do a bunch of things. It can do a bunch of things. It can

21
00:01:56,620 --> 00:01:57,880
scan in-game. It can scan out, something like a net. It can scan the code, what it looks like.

22
00:02:02,180 --> 00:02:08,340
So I've taken some of the code from something very old. It's the slammer worm. Those of us who

23
00:02:08,340 --> 00:02:13,400
were around in 2003 will remember slammer. Slammer was a pretty awesome worm that did a lot of

24
00:02:13,400 --> 00:02:21,000
damage very quickly. And yet it was only 376 bytes long. So the first step was really kind of

25
00:02:21,000 --> 00:02:26,600
sneaking into a system. It would basically send a command, run a command, and it would, you know,

26
00:02:26,600 --> 00:02:31,740
where the receiving computer assumed that it was receiving a certain type of data.

27
00:02:32,000 --> 00:02:36,360
It was going to get the name of a database that was supposed to be only 16 bytes long.

28
00:02:37,220 --> 00:02:41,840
Instead, what it sent was over, well, actually 376 characters,

29
00:02:42,100 --> 00:02:47,140
but over the limit that this computer could really use and was expecting.

30
00:02:47,500 --> 00:02:51,740
And so after it got past this 128-character mark,

31
00:02:51,920 --> 00:02:55,340
the rest of this data was dumped into the stack.

32
00:02:55,340 --> 00:02:58,780
That is, the place where the computer looks to figure out, what am I going to do next?

33
00:02:59,320 --> 00:03:03,260
And it is actually reprogramming the computer to do something that it was not intended to do.

34
00:03:04,280 --> 00:03:08,040
So after that, it starts targeting other computers.

35
00:03:08,300 --> 00:03:11,080
So it starts generating IP addresses.

36
00:03:11,280 --> 00:03:13,620
IP addresses are kind of identifiers for computers,

37
00:03:13,880 --> 00:03:16,620
and it's trying to identify, what am I going to compromise next?

38
00:03:17,080 --> 00:03:20,600
And it'll do this in a variety of different ways.

39
00:03:21,060 --> 00:03:25,200
Slammer actually used the number of time it took

40
00:03:25,200 --> 00:03:28,280
the amount of time it took for this process to run.

41
00:03:28,520 --> 00:03:31,400
It took that number and then it turned it into an IP address,

42
00:03:31,640 --> 00:03:33,660
and generated more and more and more of these.

43
00:03:33,900 --> 00:03:36,780
Now once it generated a list of targets,

44
00:03:38,940 --> 00:03:42,840
it then replicated itself, copied its code, and then sent itself out again.

45
00:03:46,000 --> 00:03:47,980
So this is what it looked like on the code level.

46
00:03:48,080 --> 00:03:50,480
On a more simplistic level, it looked kind of like this.

47
00:03:51,540 --> 00:03:55,060
You have a compromised computer that's just searching for others on a network,

48
00:03:55,200 --> 00:03:57,340
that it could also take control of.

49
00:03:57,620 --> 00:04:02,680
And once it does, once you have this whole network of computers, what happens next?

50
00:04:02,860 --> 00:04:09,760
Well, usually there is this other computer that's called a command and control server.

51
00:04:10,160 --> 00:04:13,660
Think of it as the brain of this entire army.

52
00:04:14,120 --> 00:04:16,940
And what will happen is this whole network of computers,

53
00:04:17,020 --> 00:04:19,520
that now has this code running secretly in it,

54
00:04:19,780 --> 00:04:24,780
will dial in to the command and control server and say, what do you want us to do?

55
00:04:25,240 --> 00:04:30,100
So the person who engineered this whole scheme will send commands.

56
00:04:30,720 --> 00:04:33,280
And there are a few things that this botnet army might do.

57
00:04:33,440 --> 00:04:38,880
Well, one, it might be told, hey, send me all of the passwords

58
00:04:38,880 --> 00:04:42,080
that come across your networks and all the credit card numbers.

59
00:04:42,280 --> 00:04:45,280
And so whoever's running this whole network will have that information

60
00:04:45,280 --> 00:04:48,920
and use it to buy things, commit fraud, other types of things like that.

61
00:04:49,000 --> 00:04:54,020
It may also tell the network to start sending out spam.

62
00:04:55,200 --> 00:04:58,100
Because the person who's running this may get paid to send out spam.

63
00:04:58,520 --> 00:05:00,500
And so this is profitable to him.

64
00:05:01,460 --> 00:05:04,040
Or, and this is probably the most destructive thing it could do,

65
00:05:07,720 --> 00:05:10,680
it could launch what we call a denial of service attack.

66
00:05:11,400 --> 00:05:14,600
So this would mean this computer network is not going to start dumping

67
00:05:14,600 --> 00:05:19,700
a whole bunch of communications out and target, let's say, a specific computer.

68
00:05:19,800 --> 00:05:22,260
And that computer won't be able to process all that information.

69
00:05:22,780 --> 00:05:24,280
And it will be knocked offline.

70
00:05:26,040 --> 00:05:30,240
Now, to understand this, building a botnet is, in fact, illegal.

71
00:05:30,440 --> 00:05:31,920
And launching these attacks is illegal.

72
00:05:32,380 --> 00:05:35,440
We've prosecuted a few people in the last couple of years for doing this.

73
00:05:38,060 --> 00:05:40,580
These botnets can range in size tremendously.

74
00:05:40,760 --> 00:05:42,160
Some of them are really, really big.

75
00:05:42,440 --> 00:05:44,500
So here's an example of a few.

76
00:05:46,460 --> 00:05:48,620
Conficker, 10.5 million computers.

77
00:05:50,600 --> 00:05:52,380
Mariposa, 12 million computers.

78
00:05:52,680 --> 00:05:54,980
Brito Labs, which is considered the largest that we know,

79
00:05:55,200 --> 00:05:57,960
of 30 million computers that were compromised.

80
00:05:58,300 --> 00:06:03,700
But the size of the computer is not itself an indicator of the harm that it could do.

81
00:06:03,800 --> 00:06:06,020
And we learned this just this last year.

82
00:06:08,000 --> 00:06:10,780
With something called the Mirai botnet.

83
00:06:11,520 --> 00:06:13,740
So Mirai was very interesting.

84
00:06:13,860 --> 00:06:16,160
It wasn't a particularly big botnet.

85
00:06:22,360 --> 00:06:24,820
It focused on IoT devices.

86
00:06:24,820 --> 00:06:25,900
Internet of Things devices.

87
00:06:26,300 --> 00:06:27,300
There's a village here.

88
00:06:27,420 --> 00:06:29,100
I imagine a lot of you have seen the IoT devices.

89
00:06:29,400 --> 00:06:31,520
Unfortunately, one thing we've learned about IoT lately

90
00:06:31,520 --> 00:06:33,980
is that a lot of them are very poorly secured.

91
00:06:34,760 --> 00:06:38,120
And for that reason, someone developed a botnet to target them.

92
00:06:38,520 --> 00:06:43,540
And it focused on things like IP cameras, DVRs.

93
00:06:44,940 --> 00:06:45,580
I'm sorry.

94
00:06:50,760 --> 00:06:51,200
Routers.

95
00:06:52,520 --> 00:06:52,960
Routers.

96
00:06:54,300 --> 00:06:54,740
Routers.

97
00:06:54,820 --> 00:06:55,340
It collected them.

98
00:06:55,420 --> 00:07:01,320
Now, it only had to take several, well, tens of thousands of compromised computers.

99
00:07:01,580 --> 00:07:02,540
Now, we're talking about millions before.

100
00:07:03,000 --> 00:07:06,360
So this is far fewer than those larger botnets we saw.

101
00:07:06,860 --> 00:07:10,160
And even so, it did something pretty amazing.

102
00:07:10,540 --> 00:07:11,500
Or pretty awful.

103
00:07:12,900 --> 00:07:16,360
It launched a denial of service attack on October 24th, 2016.

104
00:07:17,860 --> 00:07:24,340
Now, one of the things about this denial of service attack is one of the things that was in the way of this attack was a company

105
00:07:24,340 --> 00:07:25,080
called Dyn.

106
00:07:27,880 --> 00:07:30,340
Now, I'm guessing that none of you have ever heard of Dyn.

107
00:07:30,600 --> 00:07:33,900
I have to admit, I hadn't heard of Dyn before October 21st.

108
00:07:34,200 --> 00:07:36,400
It turns out Dyn has an important role.

109
00:07:37,800 --> 00:07:44,560
Dyn provides DNS service, domain name system service, for various companies.

110
00:07:44,680 --> 00:07:52,300
Now, the DNS system is sort of the lookup system, the phone book, the contact list for various spots on the Internet.

111
00:07:52,660 --> 00:07:54,260
And in this case, Dyn.

112
00:07:54,340 --> 00:07:57,980
provided services to some very, very big companies.

113
00:07:58,660 --> 00:08:10,180
So, Twitter, Spotify, Netflix, PayPal, CNN, all of these high-traffic sites, were in the way of this Dyn attack.

114
00:08:10,840 --> 00:08:14,440
So, what do you think happened when this hit Dyn?

115
00:08:15,960 --> 00:08:16,600
Any guesses?

116
00:08:18,120 --> 00:08:18,800
Yes.

117
00:08:22,220 --> 00:08:23,080
That's right.

118
00:08:23,180 --> 00:08:23,680
It actually,

119
00:08:24,360 --> 00:08:32,400
wiped DynOut for part of a day, the result of which was all of these businesses that were

120
00:08:32,400 --> 00:08:39,560
connected to it were inaccessible for that day, resulting in, according to them, tens of millions

121
00:08:39,560 --> 00:08:49,180
of dollars of damage to each company. So this was the largest DDoS attack that we think we've seen

122
00:08:49,180 --> 00:08:56,600
online in terms of the amount of packets that were being sent. So how does this tie back to what

123
00:08:56,600 --> 00:09:04,940
happens here? So, and by the way, there's no clip art for FBI, so we had to create this. So we

124
00:09:04,940 --> 00:09:09,140
actually come to this community in various capacities. People think of us perhaps coming and

125
00:09:09,140 --> 00:09:14,860
asking questions about things that have happened in the past. More recently, we actually are

126
00:09:14,860 --> 00:09:18,980
coming to the community with malware. And we're asking for help. And we're asking for help

127
00:09:18,980 --> 00:09:19,160
because we're asking for help because we're asking for help. And we're asking for help because

128
00:09:19,160 --> 00:09:24,860
people in this community have skills that we actually don't. And we are hoping that they will

129
00:09:24,860 --> 00:09:31,100
help us out with what we're doing. And generally, frequently, the answer is actually, sure, we'll

130
00:09:31,100 --> 00:09:34,620
take a look at what you've got and we'll see if we can provide you some assistance. Now, what do

131
00:09:34,620 --> 00:09:39,900
we get from this? Well, sometimes we learn the type of malware that's involved. And we may not

132
00:09:39,900 --> 00:09:43,660
know that without having experts take a look at it. Other times we may learn something like

133
00:09:44,380 --> 00:09:48,920
maybe who the author of the malware was. Giving us some hints about who may have

134
00:09:48,920 --> 00:09:55,100
caused this problem. We may also go and we may learn the location of those command and control

135
00:09:55,100 --> 00:10:00,080
servers. Remember I was talking about the brain of the botnet. If we know where that is, we can go

136
00:10:00,080 --> 00:10:06,500
there and we can take that offline and take control of the botnet. Or we may learn what we call

137
00:10:06,500 --> 00:10:12,900
countermeasures. These are things that we could do to counteract the effects of the botnet. Now,

138
00:10:13,560 --> 00:10:17,040
obviously, malware analysis doesn't really look like this. Let me give you a quick example of what

139
00:10:17,040 --> 00:10:18,900
that might look like. So, for example, if you have a botnet and you're trying to control a botnet,

140
00:10:18,900 --> 00:10:27,620
here, this is data that told us a bit about the botnet. What did it tell us? Well, you can't see it

141
00:10:27,620 --> 00:10:34,220
very well, but those two boxes are words in Russian. So, what we learned from that was there

142
00:10:34,220 --> 00:10:39,160
was some nexus to Russia. Now, this doesn't mean that Russia was responsible. It could mean

143
00:10:39,160 --> 00:10:44,820
that there are parts of malware that were taken and used here that were Russian in origin. But it

144
00:10:44,820 --> 00:10:48,880
tells us something that we might be able to use going forward. So, this is data that was

145
00:10:54,860 --> 00:10:59,020
taken from the botnet. So, what we learned from that was that the botnet was looking for the

146
00:10:59,020 --> 00:11:05,340
information. So, what we knew was we could go to whoever actually hosted this domain, we could

147
00:11:05,340 --> 00:11:11,500
take control of that, and we could do something to the botnet. And what might we do? So, if you

148
00:11:11,500 --> 00:11:17,600
wanted to stop a botnet, is there, what command might you issue to the botnet to make it stop?

149
00:11:18,400 --> 00:11:18,880
Well, the command that you would use would be to stop the botnet. So, if you wanted to stop a botnet,

150
00:11:23,520 --> 00:11:31,240
you would do this. Self-destruct? Pretty close. So, what we learned from the malware analysis was

151
00:11:31,240 --> 00:11:39,180
that in the code of this botnet, this was for core flood, if you issued a sleep command to the

152
00:11:39,180 --> 00:11:44,480
botnet, it went dormant. So, it was a little bit like Star Trek the Borg, which none of you

153
00:11:44,480 --> 00:11:48,880
actually really remember probably. But for this old folks, it's just a little bit like Star Trek

154
00:11:48,880 --> 00:11:54,080
the Borg. So, just like that, a sleep command made the whole thing go dormant, and that was

155
00:11:54,080 --> 00:12:06,120
helpful. Now, to close out, let me say this. What you're doing here is great. I think tearing down

156
00:12:06,830 --> 00:12:12,180
and putting back together, you know, code, equipment, things of that sort, it's how you

157
00:12:12,180 --> 00:12:18,280
learn. I had a father who was, I call him a destroy-it-yourselfer. He would tend to take things

158
00:12:18,280 --> 00:12:22,060
apart when they broke to see if he could fix them. Often we couldn't fix them, but we learned

159
00:12:22,060 --> 00:12:27,000
something about them, you know, in the course of doing that. It's an important thing. But I do want

160
00:12:27,000 --> 00:12:34,380
to give a shout-out specifically to root, which is you also have this honor code. And let me tell

161
00:12:34,380 --> 00:12:41,780
you, it's very well written. And if you do what you do and you, you know, follow this code, you

162
00:12:41,780 --> 00:12:45,680
you will learn a lot, you'll make the world a better place,

163
00:12:45,840 --> 00:12:49,700
and you'll do it in a way that won't injure anyone or harm any property.

164
00:12:50,440 --> 00:12:56,260
So with that, I have time for any questions anyone has.

165
00:12:57,500 --> 00:12:58,220
Yes, sir.

166
00:13:21,180 --> 00:13:25,540
So I believe the question was if the malware was so smart

167
00:13:25,540 --> 00:13:29,520
it actually took over all the computers, what would ultimately be the result?

168
00:13:29,800 --> 00:13:32,080
But fortunately, one thing that we have found,

169
00:13:32,180 --> 00:13:34,000
and this has been with the help of people in the community,

170
00:13:34,160 --> 00:13:39,900
is there has always been something that didn't quite work perfectly.

171
00:13:40,100 --> 00:13:40,560
Thank goodness.

172
00:13:41,140 --> 00:13:41,760
Because what?

173
00:13:41,780 --> 00:13:43,100
We always had a way of stopping it.

174
00:13:43,580 --> 00:13:47,860
In other instances, what we learned was we couldn't, I mean, again,

175
00:13:48,560 --> 00:13:50,720
in Star Trek, there was this thing called the Borg,

176
00:13:50,800 --> 00:13:52,860
which was a collective of robots.

177
00:13:52,960 --> 00:13:53,540
Okay, you knew this.

178
00:13:53,640 --> 00:13:58,000
So each generation of the Borg, which were kind of these automated bio-machines,

179
00:13:58,100 --> 00:14:00,380
would adapt and become better.

180
00:14:00,540 --> 00:14:02,340
And that's exactly what's happened with botnets.

181
00:14:02,500 --> 00:14:07,120
Every time we've taken one down, the next generation has adapted to prevent that.

182
00:14:07,660 --> 00:14:10,280
But fortunately, each time we found that, for example,

183
00:14:11,020 --> 00:14:11,620
you know,

184
00:14:11,780 --> 00:14:14,420
they became something that actually didn't use command and control servers.

185
00:14:14,560 --> 00:14:15,480
They didn't need a brain anymore.

186
00:14:15,700 --> 00:14:19,840
They just talked to each other without us having a central node to take out.

187
00:14:20,420 --> 00:14:24,300
What we learned was we had to find a way of injecting into the network

188
00:14:25,240 --> 00:14:29,080
some sort of command that would redirect them to a central node

189
00:14:29,080 --> 00:14:30,460
where we could take control of it.

190
00:14:30,560 --> 00:14:32,580
So this is where breaking down the code,

191
00:14:32,680 --> 00:14:35,280
understanding what it means has been very, very helpful and very important.

192
00:14:35,920 --> 00:14:36,940
Any other questions?

193
00:14:40,600 --> 00:14:41,040
Great.

194
00:14:41,040 --> 00:14:42,260
Well, thank you very much.

195
00:14:42,340 --> 00:14:43,500
Appreciate your time.

196
00:14:43,600 --> 00:14:44,400
Thank you to Roots.

197
00:14:47,240 --> 00:14:48,080
Thank you.