Tag
Botnet
all chapters
- Chapter 11 The bot that bragged - and couldn't be bothered A 1,177-byte loader landed: nine lines of wget, one per architecture, in the style I have already opened three times on this blog. I was going to file it as a repeat offender and get on with my day. I opened it anyway, out of habit - and the first thing I saw was that it had a few characters too many.
- Chapter 16 The tenant who'd been there eleven years A bot walked into my honeypot, stayed 62 seconds and left. I filed it as Gafgyt and I was wrong. A week later I followed its command servers and ended up inside an operation that has been running since 2015 - one I'd had in my hands from day one.
- Chapter 17 Fresh out of the oven A quiet Sunday, my new-binary alarm went off after days of silence. The first thought was the best one there is: something fresh. What followed was a rollercoaster - an old acquaintance, a false positive that nearly fooled me, and finally a critter that wasn't in any public repository, caught less than thirty hours after it was born.
- Chapter 18 Nothing to file An already-infected IP connected to the honeypot's telnet and pasted a recipe all at once: eleven binaries, one per architecture, each with a made-up name that will never come round again. Two weighed exactly the same and looked like variants - they turned out to be the i586 and i686 builds of the same program. And behind them wasn't a stray bug: fifty-odd distinct binaries in two weeks. The whole delivery is built so that no blocklist, by name or by signature, catches anything.
- Chapter 21 Introduced by its enemy An automated scanner found the honeypot's telnet and, eighteen seconds later, there was a binary inside. The password was «telnet». The loader it dropped comes with two operator typos, one of which breaks an entire infection. And when I finally put a name to the family (IranBot, a Mirai fork with a public dossier) it turned out that name had been written on this blog since August: a rival bot had put it there, in the list of competitors it uninstalls on arrival.
- Chapter 22 The twin I was missing A bot of the Mirai school carries the address of whoever gives it orders. I looked for this one's by four different routes and found it by none - and along the way I published a theory of my own that turned out to be false. What finally worked wasn't a better tool: it was realising that somewhere out there sat another binary, compiled from the same code, whose command centre somebody had already published. With both in front of me, the difference between them is one thousand one hundred and thirty bytes.
- Chapter 26 Sixty-six seconds The family from the previous chapter didn't stand still: there's a newer build going around, and I caught it from the first second. It brute-forces its way in over SSH, sizes the machine up, evicts the competition (its own older version included), uploads sixteen megabytes in a single file and fires. All in a little over a minute. And then it walks straight into one line of fstab.
- Chapter 27 Only the leader talks The kit sat still on the disk, so I switched it on myself in a cage with no way out. Inside there's a bot that insists on knowing its own address before anything else, joins a mesh of up to two thousand nodes, holds an election and crowns itself leader - and only then opens a Telegram chat. The operator never logs into any machine: he sends a message to the head of the pack. And when you burn the chat, the botnet heals itself.
- Chapter 29 It told me its name three times Another IoT ELF with the look of a run-of-the-mill Mirai landed in the decoy. I christened it “zbot” after its cron files, and it turned out that wasn’t even its name: by three separate routes (the paths it left on disk, the banners it speaks SSH and HTTP with, and the first bytes of every message to its C2) the thing kept telling me its real name. Behind it was something more interesting than a server-flooding bot: a machine for renting out its victim’s home line as a proxy. And an operator who, with the whole thing built, kept breaking his own download URLs. XLab had already named it “Shemzbot” in a tweet; this is the teardown that tweet didn’t carry.
- Chapter 30 The C2's Landlord Last chapter I opened shem up from the inside, but one thing nagged at me: its command centre is a bare IP, no domain, so I couldn't follow the operator. I pulled on that IP anyway. And what turns up at the other end isn't the operator - it's his landlord: a bulletproof hosting block that swaps its name and its plates to stay out of reach, rents to half a dozen botnets at once, and throws the server away after ten days.
- Chapter 31 One door, three visitors Forty megabytes of binary that won't open: the decompiler takes one look and refuses. Before forcing that door, the boring part that has to come first - who brought them here.
- Chapter 32 It encrypted a broken message too Three lying bytes keep the decompiler out, and behind them there's a second wall: the author's strings aren't in the file at all. By the time I finally got it talking, it had spent a while saying yes to seven orders that don't exist.
- Chapter 33 DIICOT: Ciocolata flavour Almost three megabytes that do one single thing: call home, say two words and wait ten seconds for someone to answer. If nobody does, it leaves without a trace. But inside, encrypted a different way, it carries a second address: a domain nobody has registered. And the rest of the program fits in one line of shell.
- Chapter 34 DIICOT: One syllable apart The executor from the last chapter calls a machine I already knew and keeps as a fallback a domain that looks far too much like one that did exist. Pulling on that one-syllable difference brings out its big brother, the previous C2 and the slot it uses to get into its victims. In the end, I asked the other side what it sends.