Fluent Essays

Write a 2 page essay (single space) based on your analysis of The Botnet Revenue Model (the file attached). References are not included as part of the page count. Use APA citation format.Consider the following in your analysis: Describe the botnet revenue model. What are the primary cyber issues? What are the factors for pricing? What are the recommended mitigation strategies (or countermeasures) the_botnet_revenue_model.pdf Unformatted Attachment Preview The Botnet Revenue Model Giovanni Bottazzi Gianluigi Me Dipartimento di Ingegneria Civile e Ingegneria Informatica Università di Roma “Tor Vergata” Via del Politecnico 1 00133 Roma CeRSI - Research Center in Information Systems LUISS Guido Carli University Via T. Salvini, 2 00197 Roma gbottazzi73@gmail.com gme@luiss.it ABSTRACT Botnets have always been an insidious threat. The development of the “Internet Of Things” and its for-profit exploitation contributed to botnets spread and sophistication, but also to the rise of maturity of both organizations and business models behind them. Cybercrime market had a recent major leap in quality, starting from payload development (malware), sophisticated enough to allow a high degree of customization and polymorphism, subsequently used by organizations more and more structured and specialized to provide real, efficient and profitable criminal cyberservices. The purpose of this paper is to describe the pillars of the supply chain of botnets, in order to highlight that the criminal market behind their spread is mature enough to prefer a revenue model based on service rentals, instead of direct monolithic implementation. We also describe a possible measure of botnets effectiveness in order to identify vulnerabilities. As we will see, an extension of the Pay-Per-Install business model (widely used) throughout the whole supply chain, is the natural evolution of what has already happened in the spread of many botnets, allowing the low-risk growth of other productive borderline sectors. This should be considered, in our opinion, as one of the major concern about the future trends of botnets diffusion and would simply confirm the maturity of this market in its recent meaning of Cybercrime-As-a-Service. Categories and Subject Descriptors C.2.0 [Computer-Communication Networks]: Security and protection. General Terms Design, Economics, Security. Keywords Botnet, economics, revenue, supply-chain, cybercrime as-aservice, time-to-market. 1. INTRODUCTION. One of the most insidious threat for IT community is currently represented by diffusion of networks of infected computers (called bots or zombies), completely managed by attackers and due to the inoculation of some malware. They are called BOTNET. The use of botnets is very common in various IT contexts, from cybercrime to cyber warfare. They are able to provide a very Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from Permissions@acm.org. SIN ’14, September 09-11 2014, Glasgow, Scotland UK Copyright 2014 ACM 978-1-4503-3033-6/14/09…$15.00. http://dx.doi.org/10.1145/265.9651.2659673 efficient and distributed IT platform that could be used for several illegal activities such as Distributed Denial of Service (DDoS), frauds (e.g. banking information gathering) or cyber extortion (starting with a “sample” attack followed up with an email or other communication threatening a larger DDoS attack, if a certain amount of money is not paid). In this scenario, the manager of a botnet, also known as botmaster, controls the activities of the entire structure giving orders to every single zombie through various communication channels. The diffusion of the botnets measures their level of dangerousness and depends on the capabilities of managers to involve the largest number of machines trying to hide the activities of the malicious architecture too – a particular kind of “hide and seek” game. A critical phase in the arrangement of botnets is represented by their distribution. Attackers can recruit bots diffusing a malware, typically via phishing or sending the malicious agent via email. Infected machines receive commands from Command & Control (C&C) servers that instruct the overall architecture how to operate to achieve the purpose for which it has been composed. The diffusion of botnets has recently increased due to various factors such as the: • increased availability of powerful Internet connectivity and hosts (to be understood not only as personal computers, but as objects of everyday life more and more interconnected and smart). 50 to 100 billion things are expected to be connected to the Internet by 2020. This paradigm is usually referred as “Internet of Things” – IoT [1]. Many of these “things” have few security arrangements (mobile devices do not have one); • possibility of malware customization (introduced by Zeus botnet and its Software Development Kit); • greater availability of ready-to-use vectors of infection (e.g. Blackhole); • presence in the underground market of cyber criminals renting services and structures that could be usefully used as parts of the supply chain of a botnet or better are the whole real botnets. It’s very easy to find terms such as DDOS-as-a-Service, SPAMas-a-Service and Fraud-as-a-Service, commonly used to describe the practice of facilitating illegal activities through the provisioning of services. Instead, what is relatively new is the radical change in the way cybercriminals target revenues of their activities; they don’t need to have great technical expertise to operate; they just have to buy or rent all they need (tools, infrastructures and services) with more and more complete and efficient approaches. The supply chain management already could be completely outsourced to partners for illegal services: e.g. hacking services, hosting services, software development, distribution of malicious agents, and, of ccourse, custom mer support (in many cases poost-sales servicees and bbug tracking haas been observedd). T They are real for-profit orgaanizations, som me of which clearly c ddevoted to crim me (black markket), while otheers have a not easily iidentifiable maarket, that may be labeled as uunethical at thee most ((gray market). T This sale/rentaal model is deefined as Cybercrime-as-a-Seervice ((CaaS) and reppresents the naatural evolutionn of the offer in i the uunderground m market. T The cost of arraangements is shhared between all a customers (w with a bbusiness modell based on a suubscription or fflat-rate fee), m making tthese services convenient and attractivee. Criminal seervice pproviders can maximize theirr earnings by virtue of increeasing ddemand (the saame service casshed several tim mes), while redducing tthe logistics, prrofessional skillls and global rrisks. Customerrs can cchoose to rent tthe overall botnnet service or beenefit from a sennsible rreduction of eexpenses and kknowledge to manage the iillegal bbusiness (fig. 1)). creeating and conntrolling a netw work of comprromised compuuter sysstems [2]. The nnext version off this software bbecame, five yeears of development laater, one of the most m popular bootnet platforms for spaammers, fraudssters, and peopple who deal iin stolen persoonal infformation. Its coonstruction kit contained a proogram for buildding thee bot software aand Web scripts for creating annd hosting a central Coommand and Coontrol server. Coonsequently, inddependent deveelopers have created compatiible exxploit packs capable of innfecting victim ms systems ussing vullnerabilities inn the operatinng system or browser. Otther devvelopers focussed on creatiing plug-in ssoftware to help h “w wannabe” cyberccriminals in maaking money frrom a Zeus bottnet (e.gg. some add-onns focus on phiishing attacks, delivering images andd Web pages nneeded to createe fraudulent baanking sites). W With thee mentioned feeatures is veryy hard for antiivirus software to ideentify a Zeus paayload [3],[4],[55]. Hoowever, Zeus is not the only tool available forr building a botnnet, butt its birth is a milestone m for thee entire cybercriiminal sector sinnce it w was designed w with the “non--expert” user inn mind, includding sim mple point-and-click interfacess for managing infected machines (foor these reasoons called ZeuS Crimewarre family). E E.g. ZerroAccess botneet – specialized in click ffraud attacks and a appparently disrupted in 2013 – was probably widest than Zeus (esstimated millionns of infectionns globally in 2012, with upp to 1400,000 unique IP Ps in the US andd Europe). Jusst as Zeus was the cornerstonne of the next generation g botnets, Blaackhole is defiinitely the cornnerstone of thee next generattion expploit kits. In facct, in late 2010, the Blackhole eexploit kit becaame onee of the most nootorious exploitt kit ever encounntered [6]. ments. Fig. 1. Botnet Arrangem S So the CaaS paaradigm shouldd be understoodd as a new techhnical w way to deploy aand cash out maalicious infrastrructures, but alsso as a ttrue industry veery profitable aand structured in i its approach. This eeconomic moddel (considered significantlyy new, applieed to ccybercrime) wiill be referred in this paper tto highlight thaat the ccriminal supplyy chain will be in the future m more stretched thhan in tthe past, with a consequent sspecialization oof activities to build, m maintain up to ddate, disseminaate and use a genneric crimewaree with a great risk redduction for manny players in thee supply chain itself. IIn the aforemenntioned outsourrced model, for example, the sale of kknowledge abbout a vulnerability explooitation, cannoot be aautomatically cconsidered as a criminal seervice and therrefore ppunishable, unless the players are insiders. Froom that point, tthe world of botnets, as mentiooned several tim mes in this paper, haas seen a consstant evolutionn towards a m more struuctured approaach; a clear syymptom of thee maturity of the undderground markket which has become a complete enterprise vvery luccrative for its members. Maany key playerrs contributing to the success of undergrouund acttivities, each of which hass different skkills, independdent ecoonomies and revvenues (outsourrcers) as well aas the capabilityy to actt simultaneouslyy on both the llicit and illicit m markets (e.g. w wire trannsfers done throough cash officees are essentiallly anonymous). Wiith these prem mises, we can bbuild a real aassembly chain as sum mmarized in figg. 2. IIn this scenarioo we are goingg to see the coonstruction of a real ccriminal supplyy chain that caan take advantaage of technoloogical rresources mucch more effi ficient (thanks to IoT) annd a ccomprehensive regulatory fraamework not aalways synchroonized w with the dynam mism and the exttraterritoriality of o the IT econom my. 22. BOTNE ET SUPPLY Y CHAIN. T The spread oof today botneets involves the t productionn and aavailability of software archittectures highly structured, aim med at ttheir efficient ddissemination annd, especially, monetization. m F From a technicaal point of view w it is possible tto identify two major m milestones in thhe development and spread of bbotnets. IIn 2005, a Russsian group of five developerss known as UppLevel sstarted developping Zeus, the ffirst “Point-andd-Click” prograam for F Fig. 2. Botnet A Assembly Chain n. F Firstly, at thee bottom of fig. 2 has been used a sscaled rrepresentation, called Market D Darkness, to shhow how the m market, m moving along tthe supply chainn of a botnet, ttakes the form oof the bblack market (iillegal). It has bbeen already saaid that some pllayers iin the supply chhain carry out activities that todday can be labeeled as uunethical at moost. These playeers, positioned in the Gray M Market, aare the ones wiith the higher ttechnical skills and, for this reeason, ffew in numbeer, while the rreal criminals are certainly more nnumerous and, in our model, tthey can afford reduced professional ccapabilities, meeaning that theey are advancedd users, not security pprofessionals, with w many softw ware infrastructuures ready-to-usse. IIn our ideal chaain, we used grreen colored briicks to indicate those oorganizations w whose activities have a low crim minal risk factoor (for tthis reason theey lie in the grray area of Maarket Darknesss) and w whose prerogaatives are to eemploy highly qualified perssonnel ((reduced) or tto live in counntries with a very condesceending llegislation (diffferent countriess different laws)). Fall between these ccategories: R Research and D Development. A Are those who iidentify new exxploits aand vulnerabilities, developp new payloaads and put their kknowledge on the market, ppossibly with a complete Sofftware D Development K Kit ready to be customized, solld or better rentt. The eemergence of the Exploit-as--a-Service moddel has been allready ddemonstrated inn previous reseaarch [7]. M Money Transfeers. Are those tthat offer paym ment services w with a hhigh degree off anonymity, soome of which aare more awaree than oothers about aany side effect (e.g. money transfers t system ms or aanonymous offfshore current aaccounts versuss VISA gift carrd). In tthis category faall also all the money m mule reccruitment camppaigns uused by botnet ccrews to cash out funds from a victim accountt [8]. T The yellow coloored bricks refeer to those orgaanizations speciaalized iin bulletproof ddomain hostingg services and m malware distribbution. T The yellow coolor has been used to outlinne the ambiguiity of sservices offeredd that, even if not always subbservient to bootnets, ccan often be traaced to no legal activities. C C&C Bulletprooof hosting. Aree those organizaations that havee been uused historically to sell variious goods on the black e-m market tthrough differennt bulletproof ddomains and now w used to rent vvirtual m machines that hhosting multiplle “drop” sites (where botnets store ppasswords or baanking accountss) and C&C serrvers. It almost seems s llike a paradox but b also these ddomains need too be protected aggainst D DDOS attacks [9],[10]. [ of ever-evolving ccountermeasurees, poses a daunnting task requirring higghly developed skills and resources. F For this reasson, enttrepreneurial-m minded gangs haave formed Payy-Per-Install (P PPI) serrvices – specialized organizatioons that focus oon the infectionn of sysstems of victim ms. A research hhas shown that 12 of the first 20 moost popular malw ware families inn the world, em mploy PPI serviices to bbuy infections [[12]. Alll the bricks aboove lead to the construction off the true crimiinal acttivity (red coloored bricks), unnderstood as thhe ownership oof a bottnet, the most ppopular, cross-pplatform and verrsatile as possibble, toggether with the sale/rent of itss capabilities too those who haave maade the appropriiate request (so called Pay-Per--Use model). 3. UNDERG GROUND E ECONOMY Y. Using the model iin fig. 2, we tryy now to providde some econom mic vallues from differrent perspectivees. That of crimiinal crews who try to quantify the cost of services needed to arrange a bottnet wners) or to uuse a botnet (uusers), as welll as the revenuues (ow obttained (those knnown) by thosee organizations that have alreaady fouund a profitable way to cash thee criminal tool. Whhat we need, before anythinng else, is the availability of a payyload (malwaree) suitable for criminal purposes (click fraaud, rannsomware, exffiltration, DOS S, etc. ..) andd that cannot be ideentified. [133] Undergroundd forums (black market) let crim minals to decidee to payy for a malwarre (with any cuustomizations) or for the souurce codde; this secondd option occurrs when there is a meaninggful exppertise in malw ware coding withhin the criminall gangs. Malwaares aree sold/rent with professional seervices includedd, in order to meet m as best as possible customer neeeds. The devellopers behind this t maarket, which iss obviously bllack (what wee know), are rreal proofessionals in thhe field of infoormation securitty that could haave maany different cooncurrent jobs (what we don’’t know). For this t reaason we put them m in fig. 2 in a ggreen colored bbrick. Thhe most popularr malware mannagement systeem (malware-ass-aserrvice) was Citaddel a web storee advertised on several membeersonlly forums, whhere authors haave proposed a common CM MS plaatform to providde, among otherrs, services for bug reporting and a sofftware enhancem ment promotionn (fig. 3). D Distribution (P Pay-Per-Install model). m The PP PI model is defiinitely tthe most advannced brick in tthe supply chaiin of botnets, partly bbecause the proocess of multipllication and disstribution of maalware iis constantly evvolving. In fact,, some years aggo, the main maalware ddistribution techhnique was the self-propagatioon, exploiting seerversside vulnerabiilities and without any useer interaction. The aadware/ad-awarre software evolution, well-knoown and out of scope oof this paper, hhas shifted the focus over the years toward cclientsside attacks, exxploiting vulnerrabilities in clieent applications,, such aas browsers andd browser plug--ins. This meanss that victims neeed to vvisit an infected Web site, cliick on a malicious link, or oppen an eemail attachmeent. So the queestion is how does one proppagate m malware on a laarge scale usingg client-side vulnnerabilities? T To solve this pproblem, malw ware authors haave come up with w a ((new) distributiion model dubbed “Pay-Per-Insstall” [11]. C Criminals have learned quicklyy that address tthe entire value chain ffrom malware creation to its income production, in the preesence F Fig. 3. Citadel CMS platform m. T The basic Citaadel package w was retailed foor $2,399 + a $125 m monthly “rent,”” but some of itss most innovativve features were sold oon demand. Bootmasters can siign up for an addditional servicce, for $$395, which auutomatically updates the bot m malware to evadde the llast antivirus siggnatures. The uupdates, howeveer, are deployedd via a sseparate Jabberr instant messagge bot and each update costs ann extra $$15. Additionnally, the “maalware-as-a-servvice” categoryy can iinclude the onne usually callled “research--as-a-service” where w ddevelopers are m more focused inn 0day vulnerabbilities research.. A As stated by M MacAfee in itss white paper [14]: “Althouggh the aacquisition of vvulnerabilities ccan be conductted via a commercial eentity, there is an a opportunity to connect withh a brokering seervice, w which can be defined as a single individdual who acts as a m middleman to ffacilitate the saale to a third paarty. A recent aarticle iin Forbes provvides details off one such indivvidual known aas the Grugq. By actting as a midddleman for thee sale of explooits to ggovernment ageencies, the brokker was able to facilitate the sale s of aan Apple iOSS exploit for $250,000 annd pocket 15\% \% in ccommission”. As shown iin fig. 4, prrices for Zerro-day vvulnerabilities vary significanntly, but the leevel of transpaarency rregarding potenntial remuneration remains ppublicly unavaiilable, w which makes siignificantly morre difficult deciisions about thee most pprofitable routee to selling any zero-day z vulnerrabilities. 0-dday Vulnerabilityy thee underground market – avoiid direct involvvement in monney lauundering [16]. Onnce the malwaree is developed, criminals need to install it on the higghest possible number of hossts (the wider is the botnet the greeater is the posssible revenue). Foccusing the econnomic aspect off those organizaations devoted ((for proofit) in malwaree distribution, itt is interesting too note that the PPI P serrvice owners acct like real outssourcers towardds their customeers. As stated by SeccureWorks in 2009 [17], thee InstallCash file dow wnload sequence seemed to cchange over tim me, based on w who theey are currentlyy doing busineess with, whichh could mean tthat I ... Purchase answer to see full attachment