Joint Workshop on Security 2008, Tokyo

Anti-Bot Countermeasures
in Japan- Introducing Cyber Clean Center 25 March 2008
Telecom-ISAC Japan
Planning and Coordination Division
K. Arimura
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

What is Telecom-ISAC Japan?
https://www.telecom-isac.jp/●Japan’s●Japan’sfirst
firstISAC
ISACestablishedestablishedininJuly
July2002.
2002.
●Members
includingtelecommunications●Members including telecommunicationscarriers
carrierscollect,collect,analyze
analyzeand
andshareshareinformation
informationand
andtaketaketimelymeasurestoensuretroublefreeandstableoperationsofservices.
timely measures to ensure trouble free and stable operations of services.
Memberszz

Cooperative
activities andinformation
sharing are
centered on
workinggroups.
The color of TISAC-J
activities arereflected in the
WGs.

Main
activities of
WGs

Pres.
VP’s
Members: KDDI Corp.
The companies in green are ISPs and carriers.
: NTT Communications Corp., NIFTY Corp.
: NEC Corp., SOFTBANK TELECOM Corp., Internet Initiative Japan Inc., Hitachi, Ltd.,
Matsushita Electric Industrial Co., Ltd., Oki Electric Industry Co., Ltd.,SOFTBANK BB Corp., Yokogawa Electric Corp., Matsushita Electric Works, Ltd.,NIPPON TELEGRAPH AND TELEPHONE EAST Corp.,
NIPPON TELEGRAPH AND TELEPHONE WEST Corp., NTT VISUALCOMMUNICATIONS Corp., KDDI R&D Laboratories, NEC BIGLOBE, Ltd.
NIPPON TELEGRAPH AND TELEPHONE Corp., FUJITSU LIMITED
Alliance members: Little eArth Corporation Co., Ltd., Intec NetCore Inc., Trend Micro Inc.,IBM Japan Co., Ltd./ISS
Observers : Ministry of Internal Affairs and Communications,
National Institute of Information and Communications Technology, etc.

z
z
z
z
9
9

Responses to DDoS attacks
Wide area monitoring
Monitoring of BGP routing information
Measures to counter Antinny
Research and Investigation of infection by botnets in Japan
Measures to counter bot programs / Operation of the website CCC

etc.

1

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Anti-bot Measures
The Anti-bot Measures Project was
launched in December 2006.
・Our portal site: Cyber Clean Center
https://www.ccc.go.jp/• Promotion and collaboration among 2 ministries (MIC and METI).
• Organized by Telecom-ISAC Japan, JPCERT/CC and IPA.
• Co-operation with 65 ISPs who are ISAC members (currently) andantivirus vendors in the anti-bot measures workflow.
• From FY 2006 to 2010
• Main objectives:
To reduce the number of bot-infected users
To make removal tools that specialize in bots that arewidespread in JapanTo provide specimens to security vendors participating in the
project.

2

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Bots in Japan: Survey Results
About 80% of malware programs
observed on Japanese telecom
networks are classified as bot
programs【Estimate from the results of studies by T-ISAC-J and
JPCERT/CC in 2005】

It takes about 4 minutes on
average for an unprotected
PC to be infected whenconnected to the Internet.
【From experiments conducted by T-ISAC-J and
JPCERT/CC in 2005】

The estimated infection rate is2%-2.5%Equivalent to 400k - 500k
people (computers)【Estimate from the results of studies by T-ISAC-J
and JPCERT/CC in 2005】

About 100 types of bots arecaptured in our honey-pot as
unknown types per day.
【Number of bot programs with unique hashcapturing by CCC】

And
z It was revealed that traffic caused by botnets or viruses tops 300Mbps
per IP.
z A total of around 10Gbps of traffic from Japanese IP addresses arewasted by botnets. (SPAM mail traffic via botnets are not included.)3

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Why Countermeasures against Bot-infected Users?
Herder (originator)

×

C&C server (IRC server)

Bot (Bot-infected PC)

What should countermeasures target?

●Herders are difficult tolocate.
●Dealing with herders is thework of law enforcement
agencies.
●It is believed to fall outside
the scope of ISP operations.

Yes, It is
LEA’s
Job!

×

○

● Servers are located mainly
outside Japan.
● In some countries, C&C
servers are subject tomonitoring in order tocapture criminals.
● The situation is like a catand-mouse game, since new
C&C servers will appear after
being upgraded from bots
every time current servers
are eliminated.
● Nevertheless, we want toeliminate C&C servers inJapan.

● Detect bot-infected PCs inorder to contact and alert
the PC users about bot
infection, and urge them totake steps for bot-removal.
● Users must know how toprevent re-infection andincrease their knowledge
level regarding bots.
● Make it harder to be
infected by bots in Japan sothat users can connect theirPCs to the Internet at ease.
● It is absolutely necessary to use
HoneyPots to collect bots andlocate infected PCs!

The reason
we arehere!

Yes, WE
can takecare ofthis!

4

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Workflow for Countermeasures against
Bot-infected Users
ISP[Reference 2]･･ ･･④Requesting
identification of
infected PCs⑥Sending e-mail for alerting
about infection andurging removal of bots
⑤Identifying infected PCs

Cyber Clean Center

Bot-infected PCs(Users ofparticipating ISPs)!!

･ ･ Analysis

Internet
Internet
Honeypots①Infection activities②Detection of infection
activities Capture of bot
analytes⑦Accessing thecountermeasures
website⑧Downloading the botremoval tools
Bot-infected PCs(General users)
Accessing the disclosure website

Countermeasures
website[Reference 3]

Disclosure
website[Reference 1]･･

Analytes andrelated information③Preparation of bot
removal tools

5

Downloading the bot-removal tools
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Roles of Three Organizations
Cyber Clean Center Steering Committee (CCC-SC)

Bot countermeasure system
operation group Organized by

Bot countermeasure program
analysis group Organized by

Bot infection prevention
promotion group Organized by

Bot specimens captured

Super
Super
honeypots
honeypots

Bot specimens sharedInternet
Internet

Bot specimens collected
Analysis of bot
specimens

Removal tool
provided

Bot-removal
Bot
Bot-removal
tool
tool distribution
distribution
site
site

Operation test of removal tool

Removal tool
creation(CCC Cleaner)

Security
Security Vendors
Vendors
Anti-virus products updated to provide
protection

Pattern files
provided to antivirus customers

Infected
Infected users
users

Notification of bot infection

ISP
ISP

6

GeneralGeneral users
users
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

CCC Public Site (Image) [Reference 1]
Japanese Version
http://www.ccc.go.jp/

Website for the public
English Version

7

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Security Alert E-mail Text (Image) [Reference 2]
Subject: 【重要】悪性プログラム(BOT)駆除のお願い
あんしん太郎様
平素はAnshin-Netをご利用いただき誠にありがとうございます。
セキュリティ担当 ○○と申します。
総務省・経済産業省の連携プロジェクトである「サイバークリーンセンター(以下、CCC)」より、ボット（BOT）※1感染者からの感染活動に伴う通信が検出されたため、感染者に対しBOTの駆除を案内して欲しいとの連絡が弊社に寄せられました。
そのため、弊社においてCCCからの情報をもとに感染活動を実施しているOCN回線を確認したところ、ご契約の回線（お客さま番号「${ISP_CUSTOMER_ID}」）であることが判明いたしました。
ボットは他のお客様に感染を広げるだけではなくお客様のパソコン内の情報を外部に流出させる恐れもある非常に悪質なウイルスです。

Tracking ID つきましては、下記のボット対策サイトへアクセス後、サイト内の手順に従って
given to eachボット駆除の実施や再発防止の実施をお願い申し上げます。
対応が完了しましたら、サイト内に設置された対策完了ボタンを押して頂くことで、弊社でもお客様の対策実施状況が確認できますので、ご協力お願い申し上げ
user
ます。

■ボット（BOT）対策サイト ━━━━━━━━━━━━━━━━━━━━━━
https://taisaku.ccc.go.jp/7a4ckxkk3hakf2mf77t9c9iz9━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━｜対策後は必ずサイト上で完了連絡をしていただきますようお願いいたします。
｜なお完了連絡がない場合は再度ご案内させていただくことがございます。

CLICK～以下省略～ToCountermeasuressite
8

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

CCC Countermeasures Site [Reference 3]
From the alert e-mailThe Tracking ID[Step3] Results of running cleaner are displayedand sent to CCC+
Number of files
searched【Step1】【Step2】

number of files
infected byviruses①Survey
Number of files
cleanedNumber of files
not cleaned+ ②Bot-removal status③ List of malware causing infection

9[Sending Results of Running CCC Cleaner]
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Results of CCC’s Activities①① Total
Total number
number ofof specimens
specimens
collected:
collected: 6,534,844
6,534,844②Number②Number ofof uniqueunique specimens：159,683
specimens：159,683[Since[Since aa number
number ofof thethe specimens
specimens
collected
collected are
are thethe same,same, those
those thatthat areareidentical
identical inin size
size andand external
external
characteristics
characteristics areare removed
removed toto separate
separate
uniqueunique specimens
specimens (binary(binary files).]files).][Specimens,[Specimens, such
such asas botbot
programs(binary
files)
programs (binary files) arearecollected
from
among
the
collected from among thecountlesscountless attacks
attacks onon thethe "honey"honeypot.“]
pot.“]⑥⑥ Security
Security alerts:
alerts:197,035
197,035 times
times

6 Security alert e-mail ISP
････

[This
[This isis thethe number
numberofsecurityalertsof security alerts thatthat
cooperating
ISPs
cooperating ISPs
providedprovided to
to infected
infected
users.]
users.]

NumberNumber ofof recipients:
recipients:
48,391
48,391⑦⑦ Ratio
Ratio ofof security
securityalert
alert recipientsrecipientswho
who download
download
bot-removal
bot-removal tools:
tools:
30%
30%[Unique[Unique specimens
specimens areareexaminedusing
examined using
commercial
commercial anti-virus
anti-virus
software,software, then
then those
those thatthatareare undetectable
undetectable areareseparated.]
separated.]

Analysis ofsource attacking

2 Isolation･･

1
Supper
Honey
pots

!!

④Number④Number ofofspecimens
specimens reflectedreflected
in
in removal
removal tools:
tools:
6,915
6,915[Unknown[Unknown specimens
specimens areareanalyzed
analyzed toto createcreate botbotremoval
tools
for
those
removal tools for thosethatthat areare high-riskhigh-risk andandcurrently
currently infecting
infecting many
many
PCs.]
PCs.]

3

Analysis of programs ･AccessDownload removal tool③
③ NumberNumber ofof unknown
unknown
specimens：8,377
specimens：8,377

Infected PC’s IP list

PCs infected by
Bot Programs

7

Dec. 2006 - Jan. 2008
(except for some data)

Measure
Site

8

5

4

⑤Bot-removal⑤Bot-removal tools
tools
Updated:Updated: 53
53 times
times

Making removal tool
【CCC Cleaner】[Bot-removal[Bot-removal tools
tools areare
updatedevery
week.]
updated every week.]

Cyber Clean Center

Total
Total Downloads
Downloads ofof Removal
Removal Tools：
Tools：

284,100

10

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Status of Responses by Usersz The user response rate from e-mail notification is
excellentz The ratio of site visitors is gradually rising but
seems to have peeked
z The download rate fell in November due to achange in procedures (Windows Update required
before downloading the tools)
50%
45%
40%
35%

Rate of visiting the web site

30%

Rate of downloading the tools

25%

Rate of sending reports

20%
15%
10%
5%
0%
2/12/28

3/13/31

4/14/40

5/15/31

6/16/30

7/17/31

8/18/31

9/19/30

10/110/31

11/111/30

12/112/31

2008
1/11/31

11

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Effect of CCC Activities [1]Changes in Number of New Infections by ISP
Linear approximation
ISP A

ISP B

ISP C

120

100

80

60

40

20

0
2007/02/09

2007/03/09

2007/04/09
ISP A

2007/05/09
ISP B

2007/06/09

2007/07/09

2007/08/09

2007/09/09

2007/10/09

2007/11/09

ISP C

There
There isis aa trend
trend ofof aa decline
decline inin thethe number
numberofof new
new users
users infected
infected by
by malware
malware12

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Effect of CCC Activities [2]Malware samples collected by bot honeypots worldwide (2007)（Courtesy Trend Micro Inc.）

FranceGermary
Japan
Korea
US
Malaysia

Jun

Jul

Aug

Sep

Oct

Nov

Dec

In
In Japan,Japan, vulnerability
vulnerability attacks
attacks (worm(worm type
type
infections)
infections) tend
tend toto be
be on
on thethe decline
decline13
13

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Anticipated New Threats Related to Bots
The mode of infection is shifting from vulnerability
attack type to other modes, and the threat of botsthemselves is increasing (estimate).
2007
2005
E-mail

2P-Ptype

E-mailIMbasedAll bot infections
Skypebased

Vulnerability attack type
(Worm type infection)Web-based
infection
Combined

Vulnerability
Attack type
(Worm type
infection)

14
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Detection Reports (Report of Cleaner Results)
ツール報告数State of Multiple Infections of Bot-infected PCs

20000
18000
16000
14000
12000
10000
8000
6000
4000
2000
0
0

5

10
15
20
Total Number of Attacks Detected in Honeypot (hash-based)
Honey捕獲検体種類数(ツール実行前1ヶ月)

There is one type of sample that a
PC attacks once the CCC honey-pot ,but the PCs are infected by anaverage of 200.4 malwares.

25

Used as a topic in user education

15

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

From Vulnerability Attacks to Web-based
Infection
45%

41%

40%
35%
30%

32%

31%
27%

25%
20%

21%

15%

16%

10%

11%

23%
21%

Countermeasures Site, vulnerability attack malware

25%
23%

Public Site, vulnerability attack malware

19%

Countermeasures Site, web-based malware

14%

14%

Public Site, web-based malware

11%
6%

5%
0%
2007/111.
2.
3.

2007/12

2008/01

2008/02

Data“Bot infection list” sent using the reporting function after running CCC Cleaner
Data analysis
The content of the list has been classified into web-based infections and vulnerability
attacks. The number of types are tabulated on a monthly basis.
Trend estimation
The type of bots using web-based infections are on the increase. The types of botsusing vulnerabilities are on the decline.

The number of infections based on the monthly tabulation results shows a similar trend.
However, further analysis of monthly trends is required.

16

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

The Next Step in Enhancing the CCC Projectz Change the composition of honeypots

z Consider modes of infection other thanvulnerability attacks¾ Field surveys of malware using web-based infection¾ Consider and implement countermeasures against
malware using web-based infection

z Broaden the reach of ISPs (Increase number ofpartners)z Build a closer relationship with global partnersz Inform the public about anti-malware measures

17

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.