Manufacturing Compromise: The Emergence of Exploit-as-a-Service

12 Pages·2012·1.11 MB·English

Manufacturing Compromise: The Emergence of
Exploit-as-a-Service
Chris Grier†(cid:5) Lucas Ballard(cid:50) Juan Caballero§ Neha Chachra∗ Christian J. Dietrich(cid:113)
Kirill Levchenko∗ Panayiotis Mavrommatis(cid:50) Damon McCoy‡ Antonio Nappa§
Andreas Pitsillidis∗ Niels Provos(cid:50) M. Zubair Rafique§ Moheeb Abu Rajab(cid:50)
Christian Rossow(cid:113) Kurt Thomas† Vern Paxson†(cid:5) Stefan Savage∗ Geoffrey M. Voelker∗
†UniversityofCalifornia,Berkeley ∗UniversityofCalifornia,SanDiego (cid:50)Google
(cid:5)InternationalComputerScienceInstitute §IMDEASoftwareInstitute
(cid:113)UniversityofAppliedSciencesGelsenkirchen ‡GeorgeMasonUniversity
ABSTRACT promisehosts,theexploit-as-a-servicemodelspecificallyrelieson
drivebydownloads.
Weinvestigatetheemergenceoftheexploit-as-a-servicemodelfor
Our prior work suggests that driveby downloads that target
drivebybrowsercompromise.Inthisregime,attackerspayforan
browser and plugin vulnerabilities (e.g., PDF viewers, Flash, and
exploit kit or service to do the “dirty work” of exploiting a vic-
Java) to install malware now represent the largest threat to end
tim’sbrowser,decouplingthecomplexitiesofbrowserandplugin
users[30].Thevanguardofthisassaultisleadbythedevelopment
vulnerabilitiesfromthechallengesofgeneratingtraffictoaweb-
of exploit kits: packages of browser exploits that simplify the act
site under the attacker’s control. Upon a successful exploit, these
ofcompromisingvictimsthatvisitmaliciouswebsites.Whileweb
kitsloadandexecuteabinaryprovidedbytheattacker,effectively
exploitkitsthemselvesarenotnew,datingbacktoatleastMPack
transferringcontrolofavictim’smachinetotheattacker.
in 2006 [34], there is little doubt that exploit kits have come of
In order to understand the impact of the exploit-as-a-service
age. The recent compromise of mysql.com—a site in the Alexa
paradigmonthemalwareecosystem,weperformadetailedanal-
1000—wasusedtoinfectvisitorsusingtheBlackholeexploitser-
ysis of theprevalence of exploit kits, thefamilies of malware in-
vice [14], which wehave found anecdotally (via Blackhole man-
stalleduponasuccessfulexploit,andthevolumeoftrafficthatma-
agement screenshots) to achieve a successful compromise rate of
liciouswebsitesreceive.Tocarryoutthisstudy,weanalyze77,000
9–14%[17,43,46]
maliciousURLsreceivedfromGoogleSafeBrowsing,alongwith
Inordertounderstandtheimpactoftheexploit-as-a-servicemar-
acrowd-sourcedfeedofblacklistedURLsknowntodirecttoex-
ketplaceonthemalwareecosystem,weperformadetailedanalysis
ploitkits.TheseURLsledtoover10,000distinctbinaries,which
oftheprevalenceofexploitkits,thefamiliesofmalwareinstalled
weraninacontainedenvironment.
uponasuccessfulexploit,andthevolumeoftrafficmaliciousweb-
Our results show that many of the most prominent families of
sites receive. To carry out this study, we aggregate and analyze
malwarenowpropagatethroughdrivebydownloads—32families
77,000maliciousURLsreceivedfromGoogleSafeBrowsing,and
in all. Their activities are supported by a handful of exploit kits,
from a crowd-sourced feed of blacklisted URLs known to direct
withBlackholeaccountingfor29%ofallmaliciousURLsinour
toexploitkits.ForeachoftheseURLs,wealsoobtainatregular
data,followedinpopularitybyIncognito.WeuseDNStrafficfrom
intervalsacopyofthemaliciousbinariestheyattempttoinstall,to-
realnetworkstoprovideauniqueperspectiveonthepopularityof
talingover10,000variantsfromthecourseofMarch1,2012until
malwarefamiliesbasedonthefrequencythattheirbinariesarein-
April20,2012.
stalled by drivebys, as well as the lifetime and popularity of do-
Weruneachofthesebinariesinacontainedexecutionenviron-
mainsfunnelinguserstoexploits.
mentanddetermineasample’sfamilyaswellasitsmonetization
approach,suchasspam,fakeanti-virus,andamultitudeofother
strategiesforprofitingoffofaninfection.Toofferacomparisonto
1. INTRODUCTION othercompetingmalwaredistributiontechniques,wedevelopand
acquire malware feeds that include malicious email attachments,
Inthisworkweinvestigatetheemergenceofanewparadigm:the
torrentsforpiratedsoftware,maliciousbinariesinstalledbydrop-
exploit-as-a-serviceeconomythatsurroundsbrowsercompromise.
perstiedtothepay-per-installmarketplace,andbinariesextracted
Thismodelfollowsinthefootstepsofadramaticevolutioninthe
fromlivenetworktraffic.Wefindthatdrivebysanddroppersarethe
worldoffor-profitmalwareoverthelastfiveyears,wherehostcom-
primarysourceofthemostprominentmalwarefamilies,indicating
promiseisnowdecoupledfromhostmonetization.Specifically,the
a continuing shift in the malware ecosystem towards miscreants
meansbywhichahostinitiallyfallsunderanattacker’scontrolare
thatspecializesolelyincompromisinghosts.
nowindependentofthemeansbywhichan(other)attackerabuses
Inadditiontothemalwareinstalledbybrowserexploits,weex-
thehostinordertorealizeaprofit.Thisshiftinbehaviorisexem-
aminetheexploitkitsthatarebehindthescene.Wedeterminethat
plifiedbythepay-per-installmodelofmalwaredistribution,where
Blackhole accounts for 29% of all malicious URLs, followed in
miscreantspayforcompromisedhostsviatheundergroundecon-
popularitybyIncognitoandasmallhandfulofotherexploitkits.
omy[4,41].Wherethepay-per-installmarketreliesonamixture
Combined,thesekitsareusedtodistributeatleast32differentfam-
of social engineering, spam, and other infection vectors to com-
ThispaperappearsintheProceedingsofthe2012ACMConferenceonComputerCommunicationsSecurity 1
iliesofmalware.Furthermore,wemapoutthecomplexinfection sponsibleforluringtheirownvictimsanddeterminingwhichmal-
chain tied to driveby exploits, including the use of compromised waretodistribute.
pagesandtheredirectionofvictimstomultipleexploitkitssimul- Traffic-PPIservicetaketheexploitpackmodelonestepfurther
taneously. and can be considered an evolution of the pay-per-install service
Finally,using3.5TBofpassiveDNSdatacollectedfromseveral model[4].Inthismodel,clientssimplypurchaseinstallsandpro-
largeISPsandenterprises,weprovideauniqueperspectiveonthe videtheirbinaries((cid:185)),whiletheTraffic-PPIservicetakescareof
rankingofmalwarefamiliesbasedonthefrequencythatdrivebys theentireprocessofgeneratingtraffic,redirecting,andexploiting
installtheirbinariesaswellasthelifetimeofexploitdomains.We a victim’s browsers ((cid:182), (cid:183), (cid:184)) until finally installing the client’s
find that droppers, information stealers, and fake anti-virus soft- software((cid:186)).
ware dominate the monetization of drivebys. Despite finding that
2.1 ExploitKitsandServers
exploitdomainssurviveforamedianofonly2.5hours,weshow
that thousands of visitors suffer exposure to drivebys due to the Forourpurposeswewillusethetermexploitkits(orpacks)to
compromiseofpopularwebpages.Lastly,weexaminetheimpact refertosoftwarepackagesthatbundlemultipleexploitstargetedat
ofGoogleSafeBrowsingondrivebydomains.Whileouranalysis vulnerabilitiesinwebbrowsersandtheirplugins(e.g.,Flash,PDF
clearlyhighlightsthatwebsiteshostingdrivebyexploitsencounter and Java). Popular exploit kits include Blackhole, Eleonore, and
immensepressure,thisdoesnotsufficetodisruptoperationscom- Phoenix[9].Attackersinstallexploitkitsonwebservers,andwe
pletely. termthecombinationofserverplusexploitkitasanexploitserver.
Insummary,weframeourcontributionsasfollows: Upon a visit to a domain hosted in an exploit server, the exploit
kitautomaticallyprofilesthebrowseranddeliversanexploitbased
(cid:118) Foreachdrivebysite,weidentifythemostpopular ontheoperatingsystem,browser,andpluginconfiguration.Ifthe
exploitkitusedandthemalwarefamilyservedby exploit succeeds, it downloads a binary that then executes on the
thesite,includingitsmonetizationscheme. user’scomputer.
(cid:118) Using passive DNS data we estimate the rela- ExploitkitsdatebackatleasttoMPackfrom2006[34].Thetra-
tivepopularityofmalwarefamiliesdistributedvia ditionalbusinessmodelforcommercializingexploitkitshasbeen
drivebyexploits. one-timefees[27].Liketraditionalsoftware,oncepurchased,such
(cid:118) Wereportonoperationalaspectsofdrivebycom- licensesgenerallyallowunlimiteduse,althoughsomekitsattempt
promises; specifically, the lifetime of domains toenforcelimitsbasedontimeordomainsandIPaddressesused
usedtodistributemalware(hoursonaverage),and bytheexploitserver.Forexample,thePhoenixexploitkitcharges
theeffectivenessofinterventionslikeGoogleSafe a flat fee for a single domain license. This license cost $400 in
Browsing. November2009andcurrentversionsstartat$2,200[23].
Recently,theBlackholeexploitkitintroducedtheexploitserver
Weorganizetherestofthispaperasfollows.Section2provides model,whichcanbeviewedasanapplicationofthesoftware-as-a-
abackgroundonexploitservicesandhostcompromise.Section3 serviceparadigmforbrowsercompromise.Withanexploitserver,
describes our measurement and malware classification methodol- anexploitkitauthorprovidesclientswithaccesstoapre-imaged
ogy.InSection4wepresentourresults.Weframerelatedworkin hostrunningtheirexploitsoftware,whichclientscanconfigureto
Section5andsummarizethepaperinSection6. dropvariousmalwarevariants;allotheraspectsofhosting,includ-
ingdomainregistrationandperiodicexploitupdates, arehandled
bytheexploitauthor.RentingaBlackholeserverrangesfrom$50
2. BACKGROUND foranhourupto$500foramonth(asurprisinglynarrowrangein
priceforwhichwedonothaveanexplanation),whichincludesfull
From the time a victim accesses a malicious website up to the
supportforthedurationoftherental[13].
installationofmalwareontheirsystem,thereisacomplexchainof
eventsthatunderpinsasuccessfuldrivebydownload.Wepresenta 2.2 Traffic-PPIServices
sample infection chain for a real driveby exploit in Figure 1, ob-
fuscatingonlythecompromisedwebsitethatlaunchedtheattack. Traffic-PPIservicesareanaturalevolutionoftheclassicpay-per-
Theprocessbeginswithavictimvisitingacompromisedwebsite install(PPI)service[4]adaptedtothedrive-by-downloadecosys-
orotherwisemaliciouspage((cid:182)).Thevictim’sbrowserreceivesa tem.Thekeydifferencebetweenthemodelsisthatintheclassic
seriesofredirectionsthroughachainofintermediatepages((cid:183))that PPI model, the PPI service outsources the task of exploiting the
obscuresthefinallandingpage,whichhostsanexploitkit((cid:184)).This target hosts to affiliates. Affiliates rely on their own distribution
final page attempts to exploit a victim’s browser, targeting either methods,whichincludetorrents,drivebys,spam,or,surprisingly,
vulnerabilities in the browser, or browser plugins such as Adobe simplyusingotherPPIservices.Incontrast,theservicethatruns
FlashandJava.Ifanunpatchedversionofthevulnerablesoftware a Traffic-PPI marketplace is in charge of exploitation exclusively
exists,thevictim’smachineiscompromisedandanyvarietyofmal- through drivebys. Often, these Traffic-PPI services rely on affili-
warecanbeinstalled((cid:185),(cid:186)). ates to provide traffic. Similar to web advertising, these services
The challenge of identifying new browser exploits, funneling chargeclientsacost-per-impression(CPI)forinstallingaclient’s
traffictomaliciouswebpages,andmonetizingcompromisedhosts programandpayaffiliatesfortrafficthatleadstoasuccessfulinfec-
hasledtoadiversificationofroleswithinthemalwareecosystem, tion.Traffic-PPIservicescanabsolvethemselvesoffurtherworkby
and in particular, the emergence of a new marketplace surround- outsourcingthecreationofbrowserexploitstoanexploitpackau-
ing exploit-as-a-service. This marketplace currently includes two thor,wheretheTraffic-PPIsimplybecomesamiddlemanbetween
businessmodels:exploitkitsandTraffic-PPIservices. traffic generators, exploit kit writers, and clients. We present two
Intheexploitkitmodel,miscreantseitherpurchaseexploitkits examplesofTraffic-PPIservicestoillustratetheirbusinessmodels.
(software only) or rent access to pre-configured exploit servers SellMeYourTraffic: The Traffic-PPI program SellMeYourTraffic
(hardwareandexploitsoftware).Thisbusinessmodelfulfillsallthe states that they buy any type of traffic from affiliates, regard-
requirementsofstep(cid:184)and(cid:186)inthedrivebychain.Clientsarere- less of quality, paying affiliates between $0.80–$3.00 USD per
ThispaperappearsintheProceedingsofthe2012ACMConferenceonComputerCommunicationsSecurity 2
Figure1:Thedrive-by-downloadinfectionchain.Withintheexploit-as-a-serviceecosystem,tworoleshaveappeared:exploitkitsthataid
miscreantsincompromisingbrowsers((cid:184)),andTraffic-PPImarketsthatsellinstallstoclients((cid:185))whilemanagingallaspectsofasuccessful
exploit((cid:182),(cid:183),(cid:184)).
thousand visits [37]. In their own words: “Send it all... Pop-ups, ilyavailableforpurchasehasledtoaproliferationofcustomized
pop-unders,blindclicks,re-directs,arbitrage,remnanttraffic,and botnets,incontrasttothemonolithicbotnetsassociatedwithspam.
whatever else you have [...]” Similar to other Traffic-PPI affili- Clickfraud:Clickfraudgeneratesrevenuebyusingautomatedbots
ate programs, they do not specify how they will use the traffic, to simulate legitimate traffic to pay-per-click advertisements [25,
but behind the scenes they redirect incoming traffic to instances 42].Theseadstypicallyappearonpagescontrolledbymiscreants,
of the Blackhole exploit kit [38]. For instance, when a user vis- while the ads are syndicated from advertising networks such as
its feekiller.com, a website belonging to a SellMeYourTraffic GoogleAdSense.
affiliate,theuserendsupbeingredirectedtotheSellMeYourTraf-
BrowserHijacking:Browserhijackingincludesanymalwarethat
ficserviceatclick.icetraffic.comandeventuallytoaBlack-
overwritesthedefaultbrowsersearchengineorre-routeswebtraf-
holeexploitserver.ThisexchangewascapturedbyURLQuery.net,
ficonamachineinordertogarnertraffictoaparticularwebsite.
a service that visits websites and provides detailed logs for each
Thirdpartiescanpurchasethistrafficeitherseekingtobootstrapin-
visit[38].
fections(e.g.,bydirectingtraffictodrivebydownloads)orforother
Traffbiz:TraffbizisaRussianTraffic-PPIservice.Theyalsorun revenuestreams,suchasadvertisingorproductscams.Weexclude
anaffiliateserviceandpayaffiliatewebmasters$1.6USDperthou- malwarethathijacksbrowsingsessionstostealcredentialsordis-
sandvisitsfromusersinRussia[45].Toperformthehand-offof playphishingpagesfromthiscategory,asthegoalofsuchvariants
traffic, the affiliate receives a small snippet of JavaScript code to istosiphondataforinformationtheft,nottogeneratetraffic.
add to their websites. The JavaScript snippet contains a link to a
FakeSoftware:Fakesoftwareincludesanymalwarethatprompts
bannerpicture,whichinturnincludesafivedigituniqueaffiliate
ausertoinstallorupgradeineffectualsoftware.Themostpromi-
identifier. In reality, the banner is the start of a redirect sequence
nent approach here is selling rogue antivirus [31,39]. These pro-
that eventually leads the user’s browser to an exploit server run-
gramspromptuserstopayaone-timefeeinordertoremovenon-
ningtheBlackholeexploitkit.UsersoutsideofRussiaaresimply
existentmalwareinfections,providingnoprotectioninreturn.
presentedwithanormalbanner.
Proxies & Hosting: For externally facing hosts, miscreants can
2.3 MonetizationApproaches convert compromised machines into bulletproof hosting services
Profitliesattheheartofthemodernmalwareecosystem.Once and proxy networks that are re-sold as tools for other miscre-
amachinehasbeensuccessfullyinfected,miscreantshaveanum- ants [12]. These machines can in turn host vital C&C infrastruc-
berofmonetizationvectorsattheirdisposal,manyofwhichinfact ture, act as anonymizers, or simply provide a diverse pool of IP
reflectservicesthatfurtherfueltheundergroundeconomy.Wepro- addressestocircumventIP-basedrestrictionsforsendingspamor
videabriefoverviewofthesetechniques,payingparticularatten- registeringaccounts.
tiontothemostnotoriousfamiliesofmalware. Droppers:Ratherthanemployingoneoftheaforementionedtech-
Spamming:Spampertainstoanyformofbulkunsolicitedmessag- niques,miscreantscansellsuccessfulinfectionstootherpartieson
ing,includingmessagessentviaemailandsocialnetworks.Exam- theundergroundmarket[4].Insomecases,thisinvolvesmiscreants
plesofwell-understoodemailspambotnetsincludeRustock[16], installingadropperonacompromisedhost.Thistoolautomatically
Storm [19], and MegaD [6], while a number of unidentified pro- contactsapay-per-installproviderfornewbinariestoinstallinex-
gramstargetFacebookandTwitter[11,44].Monetizationcomesin changeforafee.Wedifferentiatebetweenstagedinstallerswhere
manyforms,includingthesaleofpharmaceuticals,replicagoods, aninitialinfectionisusedtobootstrapupdatesornewfeatures,and
andfakesoftware[21].Whileadiversityofrolesexistswithinthe droppers,wherecontrolofamachineisre-soldtoasecondoreven
spammarketplace,inthecontextofmonetizationapproacheswhen multipleparties.
werefertospamwespecificallymeanthebulkdistributionofmes-
sages. 3. METHODOLOGY
InformationTheft:InformationstealerssuchasTorpig[40],Zeus, Our study of driveby downloads centers around the malware
and SpyEye harvest sensitive user data from compromised ma- installed upon a successful browser exploit. Figure 2 shows our
chines,includingdocuments,passwords,andbankingcredentials. pipelineforexecutingmalwaretodetermineitsfamilyandmoneti-
Theseinturncanbecashedoutorsoldtotheundergroundecon- zation.Wereceivemaliciousbinariesfromavarietyoffeeds.While
omyofcarders[10].Theexistenceofcrimewaretoolkits[18]read- in this paper we focus on malware distributed through driveby
ThispaperappearsintheProceedingsofthe2012ACMConferenceonComputerCommunicationsSecurity 3
Figure2: Architectureofourmalwareexecutionenvironment.Wereceiveafeedofmalwareexecutablesfromavarietyofsources((cid:182)),
whichweexecuteinacontained,controlledenvironmentthatcapturesnetworktraffic,systemmodifications,andscreenshotsbeforetermi-
nating((cid:183)).Weclusterthebehavioralreportsusingavarietyoftechniques((cid:184))beforefinallysupplyingtheclusterstoanalystsformanual
classification((cid:185)).
Feed Vector Start End Num.Run Droppers:WereceiveafeedofbinariesfromSandnet[36],which
Google Driveby 4/2012 5/2012 4,967 automaticallycontactsdropperservices[35]andrequeststhelatest
BH/Phoenix Driveby 3/2012 5/2012 5,341 binariesthatthird-partymiscreantspaidtohaveinstalled.Intotal,
Sandnet Dropper 9/2011 5/2012 2,619 wereceived2,619binaries,whichweuseasasampleoftheactivity
SpamTraps Attachment 2/2012 5/2012 2,817 occurringinthepay-per-installmarket.
Torrents Warez 9/2011 5/2012 17,182
ArborASERT LiveTraffic 8/2011 5/2012 28,300 Email Attachments: Email attachments have a long history as a
vectorofmalicioussoftware.Wereceiveafeedofemails,sentto
spamtrapshostedonavarietyofdomains,fromwhichweextracted
Table1:Malwarefeedsusedinthestudy.
2,817attachmentscorrespondingtoeitherarchivefiles(ZIP,RAR)
thatcontainaWindowsexecutableorplainWindowsexecutables.
Torrents:Torrentsusedtodistributepiratedsoftware,cracks,and
downloads,wealsoanalyzecompetinginfectionvectorstoexplore
patchesrepresentanothercommonmethodforinfectingendusers.
theprominenceofdrivebydownloads.
Toanalyzethisvector,wescanThePirateBay,isohunt,h33t,anda
We execute a sample of these binaries in a contained environ-
numberofothertrackerseveryfourhours,downloadinganynew
ment,trackingeachsample’sbehavior.Wethenautomaticallyclus-
software torrents. (When we download content, we prohibit up-
terthebehavioralreportsofvariantsandprovidethemtoanalysts
loadingtoavoidenablingfurtherinfringement.)Intotal,wedown-
formanualclassification.
loaded 17,182 torrents that constitute either archive files or Win-
3.1 MalwareFeeds dowsexecutables.Asnotallofthesearenecessarilymalicious,we
relyonclusteringandmanualclassification,asdiscussedbelow,to
Our malware collection infrastructure consists of six distinct
identifyharmfulsamples.
feeds.Fiveofthemcapturetrafficfromspecificinfectionvectors.
Thesefeedsincludemaliciousexecutablesinstalledafterasuccess- LiveNetworkTraffic:Ourfinalfeedconsistsof28,300executa-
ful driveby download exploit (two distinct sources); executables bles identified by the Arbor Security Engineering and Response
obtainedbyinfiltratingthepay-per-installmarketplace;malicious Team and provided via their ATLAS system.1 The feed does not
emailattachments;andinfectedexecutablesembeddedincracked targetanyonespecificinfectionvector,butratherencompassesex-
orpiratedsoftwaredownloadedfromtorrents.Thefinalfeedcon- ecutablesfoundthroughoutthewild,includingURLs,honeypots,
stitutesacollectionofbinariesfoundinthewildbyhoneypotsand andinnetworktraffic.Executablesinthefeedarenotguaranteed
networktrafficmonitors,asexplainedbelow. tobemalicious,againrequiringamanualefforttofilteroutbenign
Obtainingarepresentativesampleofmalwarepresentsanardu- samples.Wecompareagainstthisfeedtodetermineattacksbroadly
ous,ifnotinsurmountable,task[5].Instead,weaimtocapturebi- seeninthewildversusthosefoundspecificallyindrivebys.
nariesthatspanthebreadthofpopularinfectionvectors,allowing FeedOverlap:AcomparisonoftheMD5sofsamplesineachfeed
us to characterize differences in monetization approaches across reveals that 0.4% of the binaries appear in more than one of the
eachvector.Table1summarizesofoursixfeedsandthevolumeof feeds.Themostfrequentlyoccurringoverlap(0.3%)aresamplesin
binariesweacquirefromeach.Wenowdiscusseachinturn. theSandnetandtheArborASERTfeeds.ComparingfeedsbyMD5
DrivebyDownloads:Ourfirstfeedofdrivebydownloadsconsists sumisproblematic,asfrequent(andevenon-demand)repackingof
of executables and their corresponding URLs found by Google’s malwarecausesnumerousdistinctsamplesofthesamemalwareto
SafeBrowsinginfrastructure[29].Googleusesawebbrowserto occurinthewild[4].InSection4weprovideanothercomparison
visit suspicious web sites, flagging URLs that attack the browser offeedsbasedontheclassificationofthesamples.
andresultinmalicioussideeffects.Wereceiveacopyofthemal-
3.2 ContainedExecution
warethattheattackinstalls,alongwiththeURLresponsibleforthe
exploitandURLforthedownloadedmalware.Intotal,wereceived Weexecuteeachbinaryinavirtualizedenvironmentprovidedby
4,967binariesthisway,allofwhichwepresumeasmaliciousdue theGQhoneyfarm[20],whichsupportsmonitoringmalwareexe-
tothenatureoftheirinstallation. cutionwhileprovidingaflexiblenetworkpolicy.WeuseWindows
Our second driveby download feed focuses on payloads deliv- XPServicePack3forallexecutions,andthesystemcanprocess
eredbyinstancesoftheBlackholeandPhoenixexploitpacks.We thousandsofbinariesperday.
relyoncrowd-sourcedidentificationofdrivebyURLs[24],which Inourexperimentstheexecutionenvironmentpreventsalltraffic
wethenvisitatregularintervalstodownloadthebinarythatitcur- from directly contacting outside hosts, and instead redirects traf-
rentlyservestoinfectionvictims.Usingthisapproach,weacquired
5,341additionaldriveby-relatedbinaries. 1http://atlas.arbor.net
ThispaperappearsintheProceedingsofthe2012ACMConferenceonComputerCommunicationsSecurity 4
Feed DNS HTTP System Windows ticatedapproachesforclusteringdomains[48],ourapproachworks
Driveby 40.1% 44.7% 60.0% 45.1% wellinpractice,andanalystsfinditeasytointerpret.However,due
Dropper 28.6% 22.2% 56.8% 20.5% totheephemeralnatureofmaliciousdomains,newclustersappear
Attachment 51.3% 5.1% 100.0% 31.6% overtime,whichrequiresre-labeling.Toavoidthislimitation,we
Torrent 4.1% 3.7% 64.5% 66.3% consideranumberofotherclusteringapproaches.
Live 13.1% 9.9% 42.1% 39.1%
HTTP Arguments: For binaries that produce an HTTP request,
we examine the User-Agent string tied to the request as well as
Table2:Typesofoutputproducedbyeachfeed.Weuseeachout-
GET and POST arguments. We produce tokens by splitting a re-
putasabehavioralsummaryforclustering,ifpresent.
quest’s parameters on any non-alphanumeric character. For in-
stance, /forum/showthread.php?page=5fa58 is tokenized as
{forum,showthread,php,page,5fa58}.Wethentaketheresult-
fictointernalservices.Toproviderealisticservicesthatmimicthe
ing set of tokens and generate all possible combinations, treating
destinationsthatmalwaresamplescontact,wehavebuiltseveralin-
eachuniquecombinationasanindependentfeaturevector.Aclus-
ternalservicesthatrespondtoDNS,HTTP,andSMTPrequestson
terconsistsofallbinarieswithidenticalfeaturevectors(e.g.,allbi-
demand.OurHTTPserveroperatesasatransparentHTTPproxy
narieswithHTTPrequestscontainingjustthetokensshowthread
forhostsonawhitelist,andreplieswithHTTP200OKmessages
and 5fa58, with separate clusters for binaries containing all the
and empty bodies for all non-whitelisted destinations. We hand-
aforementionedtokens).Ouraimwiththisapproachistocapture
craftthewhitelisttoincludewebsitescommonlyusedbymalware
increasinglyspecificHTTPparameters,whileatthesametimeac-
asconnectiontests,wherefailedconnectionswouldotherwisere-
counting for natural variations to HTTP requests such as times-
sultinthemalwareterminatingprematurely.
tamps that would otherwise prohibit direct matching. The advan-
For DNS, our service answers all queries, even requests with-
tageofclusteringonHTTPargumentsisthatwhiledomainschange
outavalidanswer,toensurethatdomaintakedownshavelimited
due to takedown, the protocols for communicating with a C&C
impactonmalwareexecution.Finally,forSMTPtrafficourserver
serveraremorestableandthuseasiertoclusteron.
contactstheoriginaldestinationandrelaystheserverbannerstothe
SystemModifications:Wecanalsoassessvariationamongstmal-
malware,butdoesnotrelaySMTPcommandstotherealserver.For
warefamiliesbythechangesmadetoasystemuponinstallation,
allotherprotocoltypesweprovideasinkthatwillacceptpackets
including the names of spawned processes, the paths and values
butdoesnotrespond.
of new, deleted, or modified registry keys, and the paths of new,
Inadditiontonetworkmonitoring,oursystemcollectsoperating
deleted,ormodifiedfiles.Duetotheadversarialnatureofanti-virus
system events, including process creation, file modifications, and
signatures,manyofthesemodificationswillincorporatepurposeful
registrychanges.Priortoshutdown,wetakeascreencaptureofthe
randomizationtothwartmatching.Nevertheless,wetokenizeeach
runningsystemforuseduringtheautomatedclusteringstepwhich
oftheaforementionedvaluesbasedonnon-alphanumericcharac-
leveragesvisiblecontent.
ters and compute all possible combinations using the same ap-
3.3 AutomatedClustering proachasHTTParguments.Inordertoavoidclusteringonchanges
totheWindowssystemthatresultfrombenignWindowscodethat
Inordertominimizepolymorphismandguideanalyststowards
runssimultaneouslyalongsidemalware,wegenerateawhitelistof
themostprominentfamiliesofmalware,weclusterexecutionswith
actionsthatoccuracrossallbinaries,includingamanuallylabeled
similarbehavioralsignatures,asinourpreviousPPIwork[4].Our
set of benign samples. We take care to not simply whitelist pro-
approachtargetsfourcharacteristics:thedomainsamalwaresam-
cesses in the event that malware injects into a previously benign
ple contacts, the HTTP requests it makes, any system modifica-
process.
tions,andfinallythelayoutofthewindowsitspawns,capturedbya
Screenshots:Ourfinalapproachtoclusteringgroupsbinariesbya
screenshot.Table2summarizeswhichclassesofbinariesperform
screencaptureoftheWindowsmachineafterabinarysamplehas
each of the aforementioned actions and highlights why no single
runitscourse,justpriortotearingdownthevirtualenvironment.
approachissufficient.
Screencapturesaidimmenselywithidentifyingfakeanti-virusand
Our clustering draws from a long lineage of behavioral-based
othersoftwarethatsolicitsauserresponsebutdoesnotproduceany
malwareclassification[2,3,33].Buildingonthiswork,wemake
networkactivityorsystemchangesintheabsenceofuserinterac-
a number of improvements to clustering network traffic, as well
tion.Andersonetal.usedimageshinglingcombinedwithclustering
asoffernewtechniquesforclusteringbinarieswithnosystemor
toidentifysimilarspamwebpages[1];similarly,weseektoclus-
networkside-effects.
ter malware with similar UI components. For two screenshots m
Domains: Domain-based clustering identifies binaries that con-
andn,webeginbycomputingeachimage’shistogram,H(m)and
tact the same hosts, whether they are C&C servers or test
H(n).Ahistogram,H(m),containsthenumberofpixels,x ,
m,i
connections (such as a request to google.com). We tokenize
in each bin, i, corresponding to an 8-bit bin for each of the red,
domains by extracting increasingly specific subdomains. For
green,andbluecolorbands(eachbandisanalyzedseparately,to-
instance, we tokenize mail.lebanon-online.com as {com,
taling768bins).Tocomparethetwoimages,wecalculatetheroot
lebanon-online.com,mail.lebanon-online.com}.Onceto-
meansquareddeviationbetweenthetwohistograms:
kenized, we consider each token as an independent feature vec-
tor. We produce clusters by grouping binaries with identical fea- (cid:114)(cid:80)n (x −x )2)
turevectors(e.g.,allbinariesthatcontactacomtop-leveldomain, RMSD(H(m),H(n))= i=1 m,i n,i (1)
n
or that contact the lebanon-online.com domain). As a result,
wecanplaceasinglebinaryintomultipleclusters.Toavoidsome Ifthisdifferenceissmallerthanamanuallydeterminedthreshold
overlybroadclusters,weomitclustersthatmatchamanuallygen- τ,weconsiderthetwoimagesasidentical,andclusterthem.We
eratedwhitelistofdomainsandtokensthataretoogeneric,suchas donotrequireexactduplicationtoallowsubtlewindowvariations
domainscontactedbyWindowsduringinitialization,independent suchasdifferentbannersandtext.Viafeedbackfromanalysts,we
ofthepresenceofmalware.Whilewecouldconsidermoresophis- adopt a τ value of 100 for screenshots with a size of 1024x768.
ThispaperappearsintheProceedingsofthe2012ACMConferenceonComputerCommunicationsSecurity 5
clusterlabel.Notethateveninthesecases,wecanstillidentifythe
monetizationtechniqueforthecluster.
4. DRIVEBYDOWNLOADANALYSIS
Inthissectionweprovideadetailedinvestigationofthelifecy-
cleofdrivebydownloadsandthepopularityofexploitkits.Wefind
popularexploitkitsincludingBlackholeandIncognitoaccountfor
(a)FakeAnti-VirusWarning (b)BlankScreen over47%ofallpagesservingexploits.Thesekitsareusedtoin-
stall at least 32 identifiable families of malware, which cover the
spectrumofmonetizationtechniques,highlightingtheimportance
of the exploit-as-a-service market to the malware ecosystem. We
comparetheotherinfectionvectorsinourdatasettodrivebysand
findonlydroppersandlivetrafficcarrysimilarmalwarevariants.
UsingpassiveDNSdata,weexaminethevolumeoftrafficthat
domainshostingexploitsreceive,aswellastheirlifetime,finding
exploitdomainshaveamedianlifetimeofamere2.5hoursbefore
disappearing.WealsoassesstheimpactofGoogleSafeBrowsing
onthelifetimeofdrivebys,andconcludewithtrendsweidentifyin
(c)FakeAnti-VirusHistogram themalwaremonetizationtechniques.
4.1 ComparisonofInfectionVectors
Webeginwithacomparisonofthebinariesinstalledbydriveby
exploitsandthosefoundinotherinfectionvectors.Table3shows
arankingofmalwarefamiliesbasedonthepercentofbinariesin
eachfeedthatbelongedtoaparticularfamily. Forinstance,12%
ofbinariesinstalledbydrivebyswereEmit,adropperthatinstalls
othermalwarefamilies.Wenotethattorrentsandlivetrafficcontain
agreatdealofgoodware,resultinginlowpercentagesofmalware.
(d)BlankScreenHistogram
Intermsofvariants,drivebydownloadsaredominatedbydrop-
pers, information stealers, and fake antivirus. Some of the same
Figure3:Sampleoutputofimageclustering.Weidentifyanum-
families such as Emit and ZeroAccess (otherwise called Sirefef)
beroffakesoftwarecampaignsthatotherwiseproducenonetwork
are also distributed by droppers, indicating that malware authors
activityorsystemmodificationsbasedondifferencesinscreenshot
oftenchoosemultiplevectorstoobtaininfections.Bycontrast,our
histograms.
attachmentfeedisdominatedbywormsthatarerelicsfromnearly
9yearsago.Whilethesefamiliesrepresentasizeablenumberofbi-
Figure3showstwoclustersidentifiedbythisapproach:afakeanti- naries,theircommandandcontrolinfrastructurehaslongbeendis-
viruswarning,andanexecutablewithnowindows,alongwiththeir mantled,relegatingthewormstomerelypropagating.Surprisingly,
histograms. thevastmajorityofpiratedsoftwareisbenign.Thosetorrentsthat
docontainmalwareareprimarilyfocusedonspywareandadware,
Discussion: Each of the clustering techniques was included be-
withtheexceptionofZeroAccess.
causeoftheabilitytodiscernspecificfeaturesinmalware.Forex-
WefindthatlivetrafficfromArborrepresentsacross-sectionof
ample,theFakeWinZipfamilyofmalware(seeTable3)doesnot
allourfeeds,thoughitonlycapturesasubsetoftheprominentfam-
producenetworktrafficorsystemmodifications;however,screen-
ilies. In summary, the most notorious malware variants currently
shotclusteringquicklyandaccuratelyidentifiesthisfamilyofmal-
active are found only in drivebys and droppers. Furthermore, no
ware.SystemmodificationswerecriticaltoidentifyBitcoinmining
single feed is a panacea for obtaining a representative sample of
bots,whichhavenoUIcomponentsandproduceonlytestnetwork
allmalwarevariants.Thisleavesasignificanthurdleformalware
connections.Wecaneasilyidentifytheminingbotsbythecreation
research,requiringmalwarestudiestoinfiltratepay-per-installser-
ofanewfilenamed“nvcuda.dll”(theNVIDIACUDAlibrary).For
vices, develop tools to identify driveby downloads, and simulta-
themajorityofthefamiliesofmalwarewefind,networkfeatures
neouslycapturetheplethoraofotherinfectionvectorsusedinthe
providethemostutilityforclusteringbinaries.
wild.
3.4 ManualClassification
4.2 ComponentsofaDrivebyDownload
For the final step in our analysis pipeline, we perform manual
analysis of cluster reports. Here, analysts (e.g., conscripted secu- Delving into our driveby malware, we examine how victims
rityresearchers)reviewlargeclustersofbinarieswithsimilarbe- reach driveby downloads. For each binary that a driveby installs,
haviorandcomparethemagainstpublicreports.Manualanalysis we know the initial URL that directed a visitor to an exploit, the
isrequiredtowadethroughthemultitudeoffamilynamesandthe finalURLthathostedthemalware,andthefamilyandmonetiza-
inaccuracyinherentinfamilylabels.Wealsoexamineasample’s tionofthemalwareinstalled.Table4providesasummaryofour
screenshot,filemodifications,andnetworkbehaviortodetermine dataset. In total, we receive 4,967 distinct binaries from Google
how a sample monetizes an infected host. In the event we could SafeBrowsing(asdeterminedbyMD5sum)thataredirectedtoby
notlocateacorrespondingpublicfamilyname,weapplyageneric 77,353initialURLs.Inaddition,wehave5,341binariesinstalled
ThispaperappearsintheProceedingsofthe2012ACMConferenceonComputerCommunicationsSecurity 6
Rank Driveby Dropper Attachment Torrent Live
1 Emit(12%) Clickpotato(6%) Lovegate(44%) UnknownAdware.A(0.1%) TDSS(2%)
2 FakeWinZip(8%) Palevo(3%) Mydoom(6%) Sefnit(0.07%) Clickpotato(1%)
3 ZeroAccess(5%) NGRBot(2%) Bagle(1%) OpenCandy(0.07%) NGRBot(1%)
4 SpyEye(4%) Gigabid(2%) Sality(.5%) UnknownAdware.B(0.06%) ToggleAdware(0.5%)
5 WindowsCustodian(4%) ZeroAccess(2%) TDSS(.1%) ZeroAccess(0.01%) ZeroAccess(0.3%)
6 Karagany(4%) Emit(1%) Emit(.03%) Whitesmoke(0.01%) Gigabid(0.2%)
Total 32families 19families 6families 6families 40families
Table3:Mostprominentfamiliesperinfectionvectorbynumberofdistinctbinariesineachfamily,alongwithtotalfamiliespervector.
Statistic Count Ranking Pack Initial Final
InitialDrivebyURLs 77,353 1 Blackhole 4,828 28% 1,075 29%
InitialDrivebyDomains 16,302 2 Incognito 1,779 10% 504 13%
FinalDrivebyURLs 13,998 3 Unknown.1 699 4% 74 2%
FinalDrivebyDomains 6,309 4 Sakura 393 2% 122 3%
5 Crimepack 219 1% 17 <1%
DistinctBinariesfromDrivebys 10,308
6 Unknown.2 200 1% 48 1%
7 BleedingLife 188 1% 20 <1%
Table4:Breakdownofdrivebydownloaddatasets. 8 Phoenix 164 <1% 73 2%
9 Eleonore 34 <1% 14 <1%
– Executable 8,186 49% 1,656 45%
byBlackholeandPhoenixthatweusetounderstandmalwarefam-
iliesinstalled.2 Table5:Popularexploitpacksandthenumberofinitialandfinal
WemanuallyanalyzedasampleofinitialURLsanddetermined domainsthatleadtoeach.ExecutableindicatesthatthefinalURL
thattheyrepresentcompromisedlegitimatesites,whilewefindthat endedwith“.exe”.Todatewehavebeenunabletoattribute#3and
finalURLsreflectdedicatedinfectionsiteshostingmalware.(We #6onthelisttoaknownexploitpack.
providefurtherevidenceoftheseobservationsinSection4.4.)Ex-
aminingthecomplexityoftheinfectionchain,wefindthat99.8%
of initial pages lead to an exploit hosted on a different domain. kits; a single miscreant authors a kit and then sells it to multiple
Wefindover46%offinaldomainsarelinkedtobymorethanone parties whom each run it on their own domains. As a result, ma-
initialURL,indicatingdrivebycontrollersinfectmultiplesitesin jorvariationsbetweenURLsonlyappearinthedomains,notthe
ordertomaximizetrafficwhileanexploitdomainisalive.(Clearly, formatoftheURLs.Forrareinstanceswhenwecannotidentifya
thisfan-incouldbemuchhigher,sincewemaynothaveallinitial cluster,weprovideanarbitrarylabel.Intotal,weidentify10dis-
URLsinourdata-gathering.)Duetotakedownandblacklistingof tinctclustersofexploitpackscontaining92%ofallURLsfromthe
finaldrivebydomains,43%ofinitialdomainsredirecttomorethan GoogleSafeBrowsinglist.Wecouldnotclustertheremaining8%
oneexploitdomain.Thismayalsobetheresultofdemultiplexing ofURLs.
trafficfromasingleinitialURLtomultiplemiscreantswillingto
payfortraffictotheirexploitpage.Finally,23%offinaldomains 4.3.2 ExploitKitPopularity
installedmorethanonefamilyofmalware. Table5showsabreakdownofthemostpopularexploitkits.Over
47% of initial domains terminate at an exploit kit, indicating the
4.3 TheRoleofExploitPacks
driveby ecosystem is permeated by exploit packs. Blackhole has
thehighestpopularity,accountingfor28%ofinitialdomainsthat
4.3.1 IdentifyingExploitPacks
ledtoanexploit.Incognitofollowsinpopularity,alongwithashort
Wedeterminetheexploitpackassociatedwithadrivebydown- listofotherkits.Ofthetop9,wecouldnotidentifytwoclusters.
load from Google’s Safe Browsing list using similar techniques Theremaining49%ofinitialdomainsarefoundinURLsthatlink
tothosedescribedinSection3.3;inparticular,automatedcluster- directlytomalwareexecutables.Whiletheserequestscertainlyre-
ing and manual analysis. We use a combination of three sources flect a successful exploit, we are unable to identify if an exploit
of ground truth to identify kits: access to exploit pack code for packwasresponsible.
Blackhole, Eleonore, Phoenix, and Crimepack (typically obfus-
4.3.3 MalwareFamiliesbyExploitPack
cated PHP); traces of traffic from live instances of other exploit
kits;andcommunityknowledge. Exploit kits drive the exploit-as-a-service ecosystem, allowing
ForallfinalURLs,weautomaticallygenerateclustersbasedon any miscreant to infect victims with their flavor of malware. We
thequeryparametersembeddedineachURL.Ananalystthenap- findthat77%offinaldomainsthatrelyonexploitkitsserveonlya
pliestheappropriatelabeltoeachcluster.Forinstance,weknow singlefamilyofmalware.Ifweaggregatethesefamiliesacrossex-
thataURLwithparametersmatchingw.php?f=(.*?)&e=(.*?) ploitkits,themultipleactorswithinthedrivebyecosystemallusing
belongstoBlackhole.Wefindthesepatternsareconsistentacross thesamekitbecomeapparent.Table6showsamappingbetween
distinctdomainsduetothesoftware-as-a-servicenatureofexploit exploitkitsandthemostpopularmalwarefamiliesinourdataset.
Acheckmarkindicatesthatafamilywasseenbeingdistributedvia
2ItisimportanttonotethatwhenweanalyzeURLbreakdownsand
aparticularkit.
exploitkitpopularity,weonlyusetheSafeBrowsingbinaries,to
avoid biasing our data towards specific exploit kits. In particular, WefindthatBlackholeisfarandawayusedtoinstallthemost
wedonotusetheBlackhole/Phoenixfeed,whichwouldofcourse variants of malware, indicating a wide range of malware authors
provideabiastowardsthoseexploitkits. rely on Blackhole’s services. After Blackhole comes the as-yet-
ThispaperappearsintheProceedingsofthe2012ACMConferenceonComputerCommunicationsSecurity 7
e Statistic Value
Family Executable Blackhole Incognito Unknown.1 Sakura Crimepack Unknown.2 BleedingLif Phoenix Eleonore AAATovvvteeearrrlaaaCgggeeeomDDDpaaaiiirllleyyyssDUReedNngiSSqisuiLtzeeeorLeo(3dok/ouD1kp/ou1smp2s–a4in/2s0/12) 727659,,,3696.31951518,,,102T591B292
ZeroAccess (cid:51) (cid:51) – (cid:51) (cid:51) – – – – –
WindowsCustodian (cid:51) – – – – – – – – – Table7:DailystatisticsforDNSdatasetspanningMarch1,2012
Karagany (cid:51) (cid:51) – – – – – – – – toApril20,2012.
Spyeye (cid:51) (cid:51) (cid:51) – – – – – – –
TDSS (cid:51) – – (cid:51) – – – – – –
ClusterA (cid:51) (cid:51) – (cid:51) – – – – (cid:51) –
Zbot (cid:51) (cid:51) – – – – – – (cid:51) –
MultiInstaller – – – – – – – – – –
Medfos – (cid:51) (cid:51) (cid:51) (cid:51) – – – – –
ClusterB – (cid:51) – (cid:51) – – – – – –
clickpotato (cid:51) – – – – – – – – –
PerfectKeylogger (cid:51) – – – – – – – – –
Emit (cid:51) – – – – – – – – –
Sality – – – – – – – – – –
Votwup – – – – – – – (cid:51) – –
FakeRena – (cid:51) – – (cid:51) – – – (cid:51) –
ClusterC (cid:51) (cid:51) – – – – – – – –
Table6:Malwarefamiliesinstalledbydifferentexploitpacks,or-
Figure4:TheSIEpassiveDNSdatasetcontainsDNSresponses
deredbypopularity(Section4.4).SalityandMultiInstallerwere
returned to recursive resolvers and authoritative servers. When a
installedbyauniquesetofURLsthatwecouldnotattributetoan
client attempts to resolve a domain, it contacts the recursive re-
exploitpack.
solver configured by the ISP ((cid:182)); if the resolver does not have a
cachedentryforthedomain,itcontactstherelevantauthoritative
servers to resolve the domain for the client ((cid:183)); the resulting re-
unidentified kit Unknown.1, along with Phoenix. Given that any- sponsesappearintheSIEpassiveDNSfeed((cid:184)).
onecanpurchaseakit,wefinditsurprisingtoseeIncognitoand
Bleeding Life used predominantly to distribute a single malware
family.Inparticular,92%ofthedomainsleadingtoIncognitode-
livered Spyeye, an information stealer, while 59% of the installs 2012toApril20,2012.Whilethevantagepointsspannumerous
performed by Bleeding Life were Votwup, a DoS bot. For three geographic locations and include a diversity of network environ-
exploitpacks,Crimepack,Unknown.2,andEleonore,despitetheir ments,oneUSresidentialISPheavilydominatesthedata,account-
relative popularity in Table 5, we do not observe them dropping ingfor75.6%ofalllookups.Assuch,ouranalysismainlycharac-
popularfamiliesofmalware,andingeneralweonlyfindafewdis- terizesusersofthisISP,butthedatasetalsoincludestrafficfrom
tinctMD5sdistributedbyallthreepacks. atleast9otherdistinctnetworksprovidersspanning18citiesand
Insummary,ourfindingsillustratethecomplexrelationshipsin 3 countries. Table 7 summarizes the dataset; an average day in-
the exploit-as-a-service market where single exploit kits are used cludes75millionuniqueDNSlookupstonearly10millionregis-
by multiple miscreants, each chasing their own profits. Even if a tered domains. Identifying the 22,071 domains we know are tied
singleexploitkitdisappears,amultitudeofkitscantakeitsplace. to driveby downloads requires scanning through 3.58TB of com-
presseddatainaMapReduceenvironment.
4.4 DrivebyPopularity&Duration Figure 4 shows the process of how a DNS lookup appears in
our dataset. When a client makes a DNS request, it first contacts
Forthelastcomponentofouranalysis,weexaminethevolume
its local resolver ((cid:182)). If the resolver has the answer in its cache,
oftrafficthatinitialandfinaldomainsinthedrivebyinfectionchain
it replies immediately and does not generate a log entry in the
receive.Wefindthatdomainsthathostexploitkitsremainactive
SIEdataset.Conversely,uponacachemisstheresolverfetchesthe
for a median of only 2.5 hours. These domains receive a limited
recordfromanotherresolverfurtherupintheDNShierarchy((cid:183)).
volumeoftrafficfromseveralcompromisedwebsites.Fromthese
The SIE dataset contains all DNS responses returned to queries
trafficestimates,weprovideauniqueperspectiveonthemostpop-
performedbyparticipatingresolvers;wedonotseedirectlookups
ularmalwarefamiliesinstalledbytheexploit-as-a-servicemarket,
fromclients,nordoesthedatasetrevealtheclientIPaddresses((cid:184)).
aswellastheimpactofGoogleSafeBrowsingonthelifetimeof
EachlookupcontainstheIPaddressoftheDNSresolver,theoutgo-
drivebydomains.
ingqueryparameters,andthesubsequentresponse,includingdo-
mains,thereply’sTTL,andassociatedAandNSrecords.
We must address a number of challenges to take the DNS
4.4.1 EstimatingDNSTraffic lookupsinthisdatasetandgeneratefromitestimatesofthetotal
volumeofrequeststodrivebydownloads(and,similarly,estimates
Toestimatethevolumeoftraffictodrivebyrelateddomains,we
ofthenumberofclientsaffected).Wedefinethreesourcesofim-
obtainedadatasetofpassiveDNSlookupsrecordedbytheSecu-
precisionwiththedataset:
rityInformationExchange(SIE).3 Oursubsetofthedataconsists
of an average of 726 million daily DNS requests recorded from Caching errors result from DNS caching at a resolver. When a
135 distinct network vantage points over the course of March 1, client makes a lookup, we only see that lookup if it does not hit
theresolver’scache.Furthermore,asTTLsdifferacrossdomains,
3https://sie.isc.org/ adirectcomparisonbetweentwodomainswithoutaccountingfor
ThispaperappearsintheProceedingsofthe2012ACMConferenceonComputerCommunicationsSecurity 8
cachingwouldleadtoinaccuracy.Withoutaccountingforcaching Family Monetization Volume Feeds
errors,wewouldunderestimatethevolumeoftraffictoadomain. ZeroAccess Dropper 35.0% D,T,L
Revisit errors occur for domains that the same client repeatedly WindowsCustodian FakeAV 10.3% -
Karagany Dropper 9.5% D
queriesovertime.Revisiterrorsonlyaffectestimatesofthenumber
SpyEye InfoStealer 8.0% D
of clients that request a domain. If we naively assume all clients
TDSS InfoStealer 5.6% A,L
only request a domain once, we will overestimate the number of ClusterA BrowserHijacking 5.1% -
clientsaccessingadrivebydomain. Zbot InfoStealer 5.0% D
MultiInstaller Dropper 3.0% -
Unrelated query errors occur for compromised domains where
Medfos BrowserHijacking 2.6% -
onlysomeofthedomain’spagesservedrivebydownloads.Forin-
ClusterB FakeAV 2.2% -
stance,ifanattackercanonlygaincontrolofaspecificsubdirec- Clickpotato Adware 2.1% D,L
toryonawebserver,countingthenumberofDNSlookupstothe PerfectKeylogger InfoStealer 1.9% L
domainwilloverestimatethevolumeoftrafficflowingtoadriveby Emit Dropper 1.8% D,A,L
exploitduetootherlegitimatetraffic. Sality Dropper 1.7% A
Votwup DenialofService 1.6% -
Inordertoaccountforcachingerrors,weadoptanapproachde- FakeRena FakeAV 1.5% -
scribedbyRajabetal.[32]toestimatethenumberofDNSlookups ClusterC InfoStealer 0.7% -
masked by caching. Specifically, DNS lookups are modeled as a
Poissonprocesswithqueryrateλ(ifthequeryratesarenotPois- Table8:Malwarefamiliesrankedbytraffictotheexploitdomains
son, this model introduces error, thus we emphasize our results hostingthefamily,alongwithwhetherthesamefamilyappearedin
shouldbeusedtoranktherelativepopularityofdomainsandnot otherfeeds:(D)roppers,(A)ttachments,(T)orrents,and(L)ive.
asexactestimates).Wecanestimatethisratefromtheinterarrival
timesofvalidDNSlookups.Forasingleresolverr,wecalculate
theinterarrivaltimebetweentwopacketsattimeT andT asthe
i i+1 for domains hosting exploits. Servers that use “cloaking” to pre-
differencebetweentheendoftheTTLwindowforthefirstrequest
ventclientsfromreceivinganexploitmorethanoncecanleadus
untilthesecondrequest:
to overestimate the number of infected clients. As such, we only
speakaboutexploitdomainsintermsofpopularityandvisits,not
∆T =T −T −TTL (2)
ri ri+1 ri thenumberofsuccessfulinfections.
GivenaseriesofDNSlookupsD,thequeryrateλcanbeapprox-
imatedas: 4.4.2 PopularityofMalwareFamiliesInstalled
D Ratherthanrankingmalwarefamiliesbythenumberofvariants
λ ≈ (3)
r D (uniqueMD5s)aswedidinTable3,weuseourestimatesforthe
(cid:80)
∆Tri numberofvisitstodrivebydomainstodeterminethepopularityof
i=1 familiesinstalled.Tostart,forallofthefinaldomainsthatlaunch
DuetotheadditivenatureofPoissonprocesses,estimatingλacross anexploit,weestimatethetotalnumberofvisitsV eachdomain
allresolversissimplythesummationofindividualλrestimates: received during its lifetime, where V is the expected number of
visits within a time period T given an estimated interarrival rate
R
(cid:88) ofDNSlookupsindependentofcachingλ(explainedindetailin
λ= λ (4)
r Equation 5). We also know the set of exploit domains E that in-
i=1
stalled a particular malware family when the exploit domain was
Weestimatethequeryrateλforallofthedomainsinourdataset visited.Combined,wecanthencalculatethepopularityofafamily
on a daily basis and project them to daily traffic estimates V by as:
calculating the time between the first and last lookup for the day (cid:88)
Popularity(family)= V
andtheexpectedlookupsperunittime: i
i∈E
V =(T −T )·λ (5)
daily max min daily Table8showsourresults,withvolumeindicatingthefractionofall
For initial domains, many of which are compromised, this es- DNStraffictodrivebysthatbelongstoaparticularfamily.Intotal,
timation approach is a requirement due to the frequency of DNS weestimatethatdrivebyexploitpageswerequeried47,250times
requeststhatcanoccurduringaTTLcachewindow.Themedian overthecourseof60days.Wefindthat35%oftheselookupsare
interarrival time for requests for initial domains in our dataset is todomainshostingZeroAccess,adropperthatcaninstallavariety
4.5 minutes, 30% of which happen within one TTL window. For of other malware variants. This same family is also found in our
thefinaldomainsthathostdrivebyexploits,theseestimatesprove dropper feed, torrents, and live traffic, indicating that miscreants
unnecessarysincetheinterarrivaltimeofDNSlookupsfarexceeds relyonamultitudeofinfectionvectorstopropagate.Theremainder
theTTLs,leavingasmalllikelihoodofacachehitwhiletheTTL of the list is dominated by fake anti-virus software, information
is alive. The median TTL for final domains is only 30 seconds, stealersincludingSpyEye,andotherdroppers.Spamisnoticeably
whilethemedianinterarrivaltimeofvisitsis16minutes.Coupling absentfromthetopranking,somethingmirroredinourotherfeeds.
domainTTLswiththeirassociatedinterarrivaltimes,wefindthat
fewerthan10%ofquerieshappenwithinoneTTLwindow.
Apartfromcachingerrors,revisiterrorsandunrelatedqueryer-
4.4.3 DomainDuration
rorshavenosimplesolution.However,wefindthatmostdomains
that host exploits are short-lived and not compromised, eliminat- Weestimatetheuptimedurationofadomainasthetimebetween
ing unrelated query errors that result from extraneous traffic (see thefirstlookupthatreturnsavalidArecorduntilthetimeofthelast
Section4.4.3).Thisleavesrevisiterrors,wherethesameclientvis- valid lookup. Given the large size of the ISP predominant in our
itingapopularcompromisedsitemaymakemultipleDNSrequests DNS data, such an estimate might not prove too far off from the
ThispaperappearsintheProceedingsofthe2012ACMConferenceonComputerCommunicationsSecurity 9
trueglobaldurationofadomain,forinstancesofbroadlytargeted
domainsthatwillappearindiscriminatelyintheISP’sDNStraffic. 1.0
Figure5showsourresults.Finaldomainsareshortlived,witha source
mediandurationof2.5hours.Assuch,partiessearchingfordrive- 0.8 execution
bysrequireconstantvigilanceinordertodetectthefastchurnof s
maliciousdomains.Incontrast,theinitialdomainsthatdirecttraf- main0.6 final
fictoexploitshaveexistedforamedianof44days,withourdata o initial
d
spanningamaximumof60days.Thisreiteratesthatmanyofthe n of 0.4
pages that funnel traffic to exploits are legitimate, compromised o
websites. Fracti0.2
Weperformthesamedurationanalysisfordomainscontactedby
binariesinstalledbydrivebyinfections(denotedexecutions).Sur-
0.0
prisingly, we find a similar behavior to initial domains. We man-
uallyanalyzeasampleoftheconnectionsthatbinariesmakeand 100 101 102 103 104 105 106
findmanydomainsbelongtotestconnectionsorC&Cinfrastruc-
Domain duration (seconds)
tureoncompromisedhosts.Assuch,estimatingthepopulationof
clients infected with a family (not just visitors to those domains)
basedonDNStraffic(usingthetechniqueofRajabetal.[32])is Figure 5: Length of time we see valid DNS requests and re-
wroughtwithrevisiterrorsandunrelatedqueryerrors. sponses.Thisincludesinitialdomainsthatfunneltraffic,finaldo-
mains which host exploits, and lastly domains contacted by mal-
4.4.4 PopularityofInitialDomains wareonceinstalled.
Apartfromthefinaldomainsthathostexploits,wealsoexamine
the relative popularity of websites that funnel traffic to drivebys.
For ethical reasons, we do not reveal the names of popular com-
promised domains. Instead, we offer the volume of visitors they 1.0 type
receive as a metric of their importance. We use our estimates of Time available after listing
0.8
DNSlookupsV,averaginglookupsperdomain.Wefindthatame- Time available before listing
s
diansiteexhibitsonly30DNSlookupsperdayinourDNSdataset. n
However,1%ofinitialdomainsreceiveover22,548estimatedDNS mai0.6
o
rloecoekiuvpesspaenredsatiym.Tatoedof8fe7r,4a4c2odmapilayrilsooonk,uipnst.hTehdeasteasreetsuglotsoghligeh.lcigohmt n of d0.4
o
that browser exploits are not relegated solely to obscure portions cti
oftheweb,butincludepopularcontentthatvictimsmayregularly Fra0.2
browse.
0.0
4.4.5 SafeBrowsingPerformance&Impact
102 103 104 105 106
ThefinalmetricwederivefromDNSlookupsconcernstheim-
Time (seconds)
pact of Google Safe Browsing on the lifetime of final domains
hosting exploits. To perform the analysis, we draw upon a list of
fine-grainedtimestampscorrespondingtowhenGoogleidentified Figure6:Timebetweenmiscreantscreatingadomain(firstDNS
eachofthefinaldomainsinourdataset.Wenotethatonly22%of lookup)untilthedomainisflaggedbyGoogleSafeBrowsing,and
final domains appear in the list, and these exhibit a bias towards subsequently, the time until the domain no longer receives traffic
longerlivingdomains,withamediandurationof2dayscompared (e.g.unregistered,abandoned).
to2.5hours.
From the passive DNS logs, we determine the first appearance
ofavalidDNSlookuptoadomaint andthelastvalidlookup
min We briefly discuss some of the important lessons we learned
t .Wecanthenestimatethetimebeforeamaliciousdomainis
max throughouranalysisandhowwebelieveourfindingsshouldim-
identifiedbyGoogleast −t .Similarly,wecanestimate
listed min pactthedevelopmentofnewdrivebydetectiontechnologies.
thetimeadomaincontinuestoreceivetrafficafterithasbeenlisted
ast −t .Figure6showsaCDFofthiscalculationforall Malwarediversity:Ourmalwarefeedsdemonstratethatnosingle
max listed
of the final domains in our dataset. A median malicious domain sourceofbinariesisexhaustive;droppers,drivebys,email,warez,
receivestrafficfor17hoursbeforeGoogleflagsit,andcontinuesto andlivetrafficalldistributebinarieswithvariousdegreesofover-
receivetrafficfor11hoursafteritislisted.Thesemetricsreiterate lap. Furthermore, not all working malware samples produce net-
thefastchurnrateofdrivebydomainsandtheinherentchallenge work traffic, and those that do often contact compromised web-
oftrackingdownnewlycreatedmalicioussites. sites that simultaneously receive legitimate traffic, complicating
Theremaining78%offinaldomainsnotflaggedbySafeBrows- network-basedestimatesofinfectionsandclustering.
ing directly were identified only because of previously identified Crawler-based detection: The use of crawlers to identify mali-
initial and intermediate URLs that lead to new final domains. As ciousURLsoftensuffersfromafewshortcomings,includingthe
finaldomainstendtohaveshortlifetimes,focusingonidentifying challengeofidentifyingthecontinuouschurnofshortlivedexploit
initialURLsismorelikelytohelppreventusersfromvisitingex- domainsandcloaking[30]employedbyexploitkits.Futuredetec-
ploitsites. tionstrategieswouldbenefitfromtargetingthehandfulofexploit
packs that exist, and in-browser defenses (deployed where detec-
4.5 Discussion
tion must occur before a vulnerability is exploited) [22] remove
ThispaperappearsintheProceedingsofthe2012ACMConferenceonComputerCommunicationsSecurity 10