Welcome to part four of this module.
It's finally time to talk about botanists before we get started.
I do have to say that the amount of practical demonstration in this video is going to be somewhat light
and that is because the legalities surrounding botanists is very tricky.
From region to region.
So you're not going to see me infect one of my own machines and then try to connect to it or anything
like that.
But we are going to go over what botanists can do and we're going to be taking a look at a botnet that
actually more or less comes built in to Cali with just a few downloads being necessary.
So first off what is a botnet in this very simplistic terms a botnet is a network of computers that
have been infected with malware and can be given orders to perform certain tasks remotely.
The most common architecture is to have a command and control server usually a virtual private server
with bullet proof hosting somewhere out on the Internet.
The CNN SI as it is called is where the bots connect to and receive their orders from the bot malware
is then disseminated to victim computers through some other means.
We've seen examples of how this is done in prior videos already.
The victim becomes infected with the bot and their computer is effectively owned by the person controlling
the botnet.
Nets are most commonly used for distributed denial of service attacks which are universally illegal
and will land you in very hot water distributed denial of service or D.D. OS basically involves having
a lot of machines flood a particular target with traffic and requests to overload its capability and
cause it to either crash or become completely jammed.
This is why services like CloudFlare exist to create a buffer and defend against such direct attacks
which have become all too common.
But DNS attacks are for people with no imagination bought nets are capable of far more subtle insidious
things.
One very low level example is click fraud.
Having many infected computers visit a particular site usually without the users being aware of it.
And it isn't for the purpose of crashing the site but to increase the view counter.
Giving the illusion of increased traffic which in turn generates money usually through advertising revenue.
Another use that has become popular only in the last few years is to use a botnet to simulate real people
on the Internet to manipulate opinion on certain topics.
For instance having a network of bots using dummy accounts all post the same general comments on Reddit
for Chan YouTube etc. creating the illusion that a great many people seem to think a certain way or
to bury contrary opinions under a block of spam posts in some cases this has even been used to influence
things like stock prices by creating a false impression that a stock is worth more than it is or less
than it is perhaps the most famous type of bot net involves banking trojans.
These sorts of bots are based on the original zoo's botnet code and are benign to most users machines.
They seek only to spread themselves from computer to computer automatically until they find machines
used in online banking either as a customer or heaven forfend as a server.
Their only function is to steal large amounts of money and many millions of dollars have been stolen
in this way.
These are just a few uses for a botnet.
I'm sure you can probably think of more right.
So with this in mind how do people create or obtain such a network.
Surely you need super mega hacking coding skills to achieve it.
Right well not anymore.
Now it is absolutely the case that the most dangerous hackers write their own bought code.
Having the skill to do this allows for the greatest flexibility and new code is much less likely to
be detected as malicious even if it is not put out through some sort of crypto or or some other method
of obfuscation.
For more information on how that happens please see the prior videos on Metis Floyd.
But you don't need any skills to start aborting that really.
The basic code for the famous zoo's botnet banking Trojan is available right here on github.
In fact all of the most famous bot nets are available free to download.
They can be reverse engineered with a minimum of coding skill a person could just use them as they are
install the CMC and then distribute the client component.
Although any antivirus worthy of the name will absolutely detect these older and more out of date bought
nets as they have been around forever even using a crypto is not likely to be enough to hide them simply
slipping past antivirus for the initial infection.
Doesn't mean the board won't still be detected during subsequent scans.
This code and other code like it is mainly useful for people who want to see how it all works and then
develop their own.
But what if someone isn't a coder but still wants their network to function newer sleeker more dangerous
botnet software particularly banking trojans.
That seems to be one of the main interests are being manufactured and sold illicitly.
Of course most of these are coming out of the Russian Federation.
The purchase of such software by itself is almost certainly illegal.
Depending on your regional world though the use of it most definitely is.
So hopefully this explanation is clear so far as I said at the beginning I will not be creating a bot
bottom hand in this video.
That would be illegal and would violate the terms of use of this platform.
However there is a question that usually comes up and it is this how do all these kids deeds OS people.
How do teenagers with no appreciable coding skills seem to have access to bought nets.
Surely they did not purchase one for hundreds or thousands of dollars from some Russian coder set up
a VPN as a command and control server then somehow infect thousands of people with malware successfully.
So what gives.
Well we live in the future and that's what gives.
Ten years ago maybe even five years ago if someone wanted to access a powerful botnet the only answer
was to create one from scratch who now live in an age of public resources and access UFO net is a tool
for Cally Linux.
This is something you will see me demonstrate in a very limited way.
I want to stress that it is absolutely illegal to use this software to perform distributed denial of
service attacks.
This information is being presented so that students of this class know how such a thing can be done
without any actual skills so that they can then defend against it in their roles as system administrators
and lawful penetration testers.
I must say again obey the laws at all times with that very important disclaimer out of the way.
All we actually need to do to install UFO net and by the way I will be using virtual box for this not
the virtual private server.
You've seen me use up until now.
Although a black hat would want to use a G.P.S. or some other remote machine not connected to their
personal identity you have phone it can be installed on most distributions of Linux.
So this sort of attack can be performed from anywhere really.
At any rate the first thing we need to do is clone the link like so popular clipboard and now we're
going to minimize the browser and we're gonna open up our terminal.
Go ahead and maximize it so all we're going to do is type get clone and then we're gonna go ahead and
paste in that link that we just copied.
This will take just a moment and it should download everything we need.
Downloading now.
It's pretty small.
It shouldn't take more than a few more seconds and there we go.
So we're going to go ahead and minimize the terminal window where it come over to our final manager.
And here we can see in our home directory UFO net has been downloaded to make this a little easier and
more straightforward.
Let's go ahead and move it to the desktop and we'll come back to our terminal and now we're going to
see into our desktop and we'll see into U.S. phone at K.
Now we need to modify certain permissions so we're gonna type C H mod plus x u Setup Dot P Y
AND WE'RE GOING TO TYPE C H mod plus x U.S. phone at set up may or may not be needed.
I've installed it already and I think newer versions don't require you to run it that way.
But what's one extra command right.
So if we need to run setup and I don't think we do it's just period forward slash Setup Dot p y.
Okay.
Well that wasn't really necessary.
So to load it we're just going to do period forward slash UFO net.
And as you can tell this is running the UFO net script and should give us the title page right.
And here we have the title page.
This gives us information on how to use the tool via the command line.
If we scroll up a little bit.
We can see all of the various arguments that we can supply.
So now we're going to type period forward slash you a phone at Tak tak or dash dash help.
And that gives us even more information in this case the specific arguments we need such as target to
target list places rounds.
What type of bots to use et cetera.
Now I want to stress that we don't actually have a working botnet yet.
This is a script that is going to effectively connect to a kind of open source botnet so to speak.
Now this is where things get tricky and by tricky I don't mean they get hard.
I mean that they get tricky a black hat wishing to abuse this software would type period forward slash
UFO net tack tack or dash dash download TAC zombies were one to do this it would result in downloading
a list of infected computers for UFO net to use several thousand at the time this video is being recorded
and the number is ever growing you will not see me press the Enter key nor should you attempt to do
this yourself downloading this list is sort of the equivalent of loading a gun and it can get you into
a lot of trouble just by itself.
The term zombies by the way is just the colorful language that the creators used to describe infected
computers that have been infected with the bought client software.
I want to stress again our purpose here is not to test this piece of software but to be aware of what
it is and how it works and other tools like it and there are a great many so that we can defend against
it.
So do not download this bought list.
We also see commands that would allow someone to upload zombies which is a way of sharing computers
that have been infected to the public list so that all the other users of UFO net can make use of them.
The configuration attack options have to do with what you're trying to do some abuse for DNS attacks
redirect was for click fraud and that sort of thing.
Obviously the software is not sophisticated enough to allow for some of the attacks that I mentioned
such as influencing public opinion through bots and dummy accounts UFO net and other tools like it or
a blunt instrument for those lacking the skill to create a network of their own or those without the
resources to purchase professionally made software again illegally.
In other words kids with Cowley use this and other tools like it to DS OS each other and feel like big
scary hackers.
It's so easy.
They often do not realize that launching an attack of this kind is against the law but because these
resources are so widely used it makes attribution for an attack exceedingly difficult.
And in the case of more the more skilled hacker who actually knows what they're doing.
This is why as a system administrator we need to assume that such tools are being used in a purposeful
way.
Even if 80 percent of the time it's just a bunch of script kiddies.
In any case let's pretend that I downloaded the bot net list or zombies as this tool calls them and
proceed as if I had so to begin with we're going to type period forward slash UFO net.
And this time we're going to supply the argument Tak tak gooey for graphic user interface.
This may take a moment or two to load particularly in a virtual box as we can see we have another title
page and in just a moment we should be presented with what appears to be a web based interface though
it is local.
So to examine this we're going to click the Start mothership button and from here we click or rather
hover over this worm hole icon and then click bot net.
It says that I have one of each type of bot but that is because this software counts itself.
If I had downloaded that public bought list there would be several thousand listed.
So now we're going to come down here and win we're going to click on attack.
Now this is all pretty self-explanatory.
Here you would set the target.
So for example w w w dot this is not a real web page.
One two three.
Bubble bubble blah bunch of gibberish dot com.
And just in case you can't tell that is not a real you U.R.L. at least I hope not.
But we won't be clicking attack anyway.
You could also enter in a specific IP address rather than a target U.R.L. if you had one and then you
can specify the exact place to attack
put desktop and then the number of rounds that the attack will consist of 500 would seem to be a good
number.
Now if we go to configure requests this sub window will pop up as you can see a proxy server can even
be used.
So doing this from a VPN is paid for anonymously using a VPN or and or Tor with proxy chains to connect
and then a proxy server on top of it.
Then factor in that with this network getting used by so many kids.
I mean notice that this whole thing looks like a video game it's pretty much meant to attract kids.
Well the bottom line is tracing the source of a real serious attack becomes virtually impossible anyway.
The number of threads we would set to something like 50 and of course this information can be changed
a proxy server can be used perhaps tor cetera you would click the set button.
I will not be clicking attack.
You get the idea that you are all the you are L that I entered is not real.
Obviously most people who use the software don't even bother taking any kind of a precaution.
They use it from their home computers in the clear UFO and that is just one example of a public botnet.
And these things exist not because anyone cares about giving you know kids the ability to knock each
other off x box live but because it makes real use of them that much more difficult to trace.
And because it allows other people to contribute bots to the network creating a shared resource that
perpetually grows a little research is all it takes to find other tools like this.
Some of them may even be more sophisticated.
There is one more thing about bought nets that bears mentioning serious botnet software often has a
failsafe built in that can be rather easily set up.
At the time the client bought is generated.
What I mean by this is it might be perfectly reasonable to conclude after what you've just heard that
the best way to eliminate a botnet would be to track down the command and control server.
After all the bots have to connect to it.
So taking it out should logically collapse the entire network.
Sometimes this is even an option when so-called bullet proof hosting is not used or some dumb black
hat runs the CMC on their home computer.
The computer gets seized by authorities and presto and a botnet.
That is why most modern botnet software includes these so-called fail safes.
It goes like this.
If a bot cannot connect to the command and control server after a certain number of unsuccessful attempts
it will attempt to connect to another command and control server or even another after that.
In short a hacker or a group of hackers might have a dozen virtual private servers or servers all bullet
proof hosting.
If the current CSC get shut down the bots will automatically migrate over to the next CNBC in the list.
After so many failed attempts to connect to the first one then the next and provided the botnet owner
still controls one of the established senses sees the bots can be updated even after infection with
new failsafe instructions thus taking out the command and control server is not a sure way to eliminate
a particular botnet.
Thus large powerful networks are able to fester and grow.
Let sleeping giants awaiting orders.
It isn't that figuring out where the CMC is is impossible just that doing so isn't always enough.
Now I know you're tired of hearing this but please be lawful at all times.
Please do not use anything presented here in a way that breaks the law.
And remember that actually using these bots during a pen test is almost certainly illegal because even
if you have permission from the target to test their server in that way you may not have permission
from all of the machines that have become infected.
So just don't do it.
If you are interested in learning more about botnet code github is a supremely useful resource to examine
what other people have done and then you can tailor tailor your defenses accordingly for the servers
that you administrate.
Thank you.