LAN of the Dead:
Putting computer zombies back in their grave, Ash style.
By Adrian Duane Crenshaw

        I'm writing this article about computer zombies in honor of George A. Romero, everyone's favorite zombie film director. A zombie computer is a box that has been backdoored or compromised in such a way that the would-be cyber necromancer can send it instructions to do his unholy bidding. Much like Romero's zombies, one on one they aren't much of a problem, but when you get a few hundred of them clawing at you in a distributed denial of service attack they can become a serious issue.

        Zombie networks (a collection of zombie boxes, also know as bot-nets) have many common uses. One of the most common uses is distributed denial of service attacks against servers on the Internet. One computer may not be able to suck up much of a servers bandwidth or processor cycles, but a few hundred can make the server so bogged down that it can't service legitimate users. Zombies can be used to obscure the attackers location. By using a zombie the attacker can send spam or pull off network attacks without it being easily tracked back to an IP associated with the attacker. A Bot-net can also be used to run a process that can benefit from distributed computing. Don't have your own password cracking cluster? Use other folk's computers for the task.

        In this article I hope to give the reader details that will help them shoot the network zombies in the head, and keep them down for good.

Listening for Moans

        Before a zombie hunter can kill some zombies he has to find them. In the movies the hero can listen for low sorrowful moans or slow shuffling feet to track them down, or just look for the carnage of half eaten people. On your network you can look for similar signs of the undead so you can blast them to oblivion.

        Computers that are running way too slowly may have a bot on them. Despite what some newer movies portray, zombies should be slow. Of course this is a purely subjective criteria and is not always a reliable sign. Too many people think that their computer is infected with something just because it behaves a little flakey. Other causes of slowness could be spyware, too many apps set to start up automatically or a very fragmented hard drive. Regardless, if the computer is running very slowly for no obvious reason (like you installed Windows XP on a Pentium 200 with 128 megs of memory) then you should check it out for a possible revenant.

        Look for bandwidth spikes that are way beyond normal. If your sniffers/packet shapers/border routers are seeing way more traffic then they should you will want to track down which IPs are hogging most of the bandwidth and check them out. If the zombie is being used as part of a distributed denial of service attack or to host pirated movies its network utilization will likely skyrocket.

        Scan for odd open ports. Do regular port scans of your network with tools like Nmap to see if any hosts are running abnormal services. Many zombie software packages listen on standard ports that script kiddies are too lazy or too unknowledgeable to change. If you see those ports open take a look at those boxes for possible malware. Even if it's not a common zombie control port beware of services like FTP or IRC that are running on workstations. For a list of common Bot/Trojan ports see:

http://www.simovits.com/nyheter9902.html

        and

http://www.glocksoft.com/trojan_port.htm 


        Since many modern bots use IRC as the command infrastructure look out for IRC traffic or servers on your network. A few examples of IRC bots would be Agobot, Phatbot, SDBot and GT bots. Most IRC bot-nets run their own IRC servers. Sometimes a host that was originally just a member of a bot-net may be promoted to being a server. This is especially true if the compromised box has a fast connection to the Internet. Most IRC servers operate on TCP port 6667, but an attacker could change the IRC server to listen on some other port. You may want to use Nmap with the "-sV" flag to see if it recognizes an IRC daemon on a non-standard port.

        Most anti-virus programs for Windows will also detect other malware that's associated with zombified computers. If your AV package is throwing up warnings about detected malware that's an obvious sign, but if you notice that the AV package's real time protection features have been disabled you will also want to check the box out for potential problems. For those of you running *nix boxes look into using Chkrootkit to find trojaned binaries and backdoors on your box.

        If your host based firewall (The one built in to XP or ZoneAlarm for example) warns you of odd applications trying to open up ports, those applications should be checked out.

        Odd traffic leaving your network could be a sign of a compromise. I once found out a box of mine was rooted because I sniffed leet speak leaving it. Turns out that someone had installed Stacheldraht on that server. Also, if your sniffer or IDS detects unusual IRC traffic you will want to check into it and make sure the box sending or receiving the traffic is not part of a bot-net.

        Look for strange things set to startup automatically on the box. Use a program like HiJackThis to look for suspicious programs set to startup automatically, then check to see if these items are common or not. Be careful with tools like HiJackThis, as disabling the wrong service/startup items could render your system inoperable. When in doubt ask around on forums to see which items should be disabled.

        Check for traffic that's resolving to dynamic DNS systems. If your sniffers see a lot of name resolution requests to Afraid.org, DynDNS.org or No-IP.com the requester may be part of a bot-net (See the footnotes for a longer list of dynamic DNS providers). By no means is this necessarily the case; a user on your network may just be trying to access their home computer, but you may still want to look into it.

A Bullet to the Brain

        Once you have found a zombie, how do you make it rest in peace? If you wish to do any live forensics on the box while it's up now is the time, but there are a few things you should keep in mind. If the attacker obtained complete admin privileges on the box they may have installed a keyboard catcher. Don't login to the compromised box with a high level account or the credentials may be sent to the attacker, making things far worse.

        For some older DDoS zombies, such as Trinoo, TFN, Stacheldraht, and Shaft, you can use Bindview's Zombie Zapper. Zombie Zapper allows you to send a signal to these DDoS zombies to stop flooding. Unfortunately, it only works if the attacker used all of the defaults when they set up the zombie, and not all zombies are designed like the four above. Zombie Zapper has not been updated in awhile so it will be of little use in stopping more modern zombies, but I though it was worth mentioning.

        Once you are ready to clean up a zombie box there are two approaches you can take, the "Night of the Living Dead" approach and the "Return of the Living Dead" approach.

        The "Night of the Living Dead" approach is much easier and less painstaking, the digital equivalent of shooting the zombie in the head. All that is necessary is to patch the security hole that let the attacker in, shutdown the backdoor apps, uninstall or delete the files and remove them from startup. The problem with this simple approach is that you don't know what all the attacker did while they controlled your box. Depending on the level of the compromise, the attacker may have copied off sensitive password files (SAM and SYSTEM in Windows, passwd and shadow on many *nix systems), installed key stroke catchers, trojaned other system files or done a host of other things that makes the zombie box a security risk.

        Most of the time I take the "Return of the Living Dead" approach to killing a zombie computer: nuke and rebuild it from scratch. Since it's hard to be sure what system files the attacker may have changed or trojaned the best course of action is usually to backup all data files on the system and reinstall the OS from known good media. Before you put it back online make sure you have installed all the newest patches; otherwise the box may very well be compromised again, and in short order. Since the attacker may have cracked the local admin password on the box you will want to change that password on every box that shares the same local admin/root login credentials as the compromised machine.

That's another one for the fire

        I hope you have enjoyed this article and that your zombie hunting goes well. If you have any suggestions for additional material that should be added to this article please email me. Oh, and: "Good bye aunt Alisha!"

Wikipedia Article on Computer Zombies
http://en.wikipedia.org/wiki/Zombie_computer 

Honeynet Project Tracking Botnets Paper
For more detail on IRC zombies that this article
http://www.honeynet.org/papers/bots/ 

John Kristoff's NANOG32 Botnets presentation
John's presentation kicks much ass, even if you have to use RealMedia to watch it
http://www.nanog.org/mtg-0410/kristoff.html 

Killing a Zombie
http://tweezersedge.com/archives/2005/02/000534.html 

Zombie Zapper
http://www.bindview.com/Services/RAZOR/Utilities/Windows/ZombieZapper_form.cfm 

Common Trojan/Bot Ports:
http://www.simovits.com/nyheter9902.html
http://www.glocksoft.com/trojan_port.htm
 
Chkrootkit Website:
http://www.chkrootkit.org/
 
Dynamic DNS Providers:
http://dmoz.org/Computers/Software/Internet/Servers/Address_Management/Dynamic_DNS_Services/