Opinion  ·  30. November 2020

GameOver ZeuS: Cat-and-mouse in the buccaneering cyber-century

Symbolbild - Cyber-Angriff auf den Deutschen Bundestag

The ramshackle, territorial setup of the Caribbean in the 17th century spurred buccaneers to exploit little-protected Spanish merchant cogs. The Spanish sought to counter the frequent attacks by the partially state-licensed freebooters and ended up creating a 100-year long cat-and-mouse game. Roughly 400 years later, the criminals shifted the cat-and-mouse game to cyberspace, developed new tactics and weapons (such as botnets, ransomware and distributed denial of service attacks) and now pose a serious threat to private and public actors on the Internet. Describing the problems of cyber-buccaneering, this article uses the example of the famous, Russia-backed GameOver ZeuS botnet (GOZ) to explain the concept of a botnet and the GameOver ZeuS specific attack vector before elaborating on the cat-and-mouse game of successful takedowns and ineffective cybercrime persecution.

 

GameOver ZeuS was a ZeuS-based botnet that infected more than 1 million machines between approx. 2010 and 2014, relied on substantial security features such as P2P and DGA, and caused hundreds of millions of dollars in damage (FBI, 2014). With traces to Russia and Ukraine, the GOZ botnet served mainly moneymaking purposes, including financial data harvesting, spam mailings and, most notably, the distribution of the CryptoLocker ransomware that extorted millions of dollars for decrypting previously encrypted non-public files (Krebs, 2014a; Storm, 2014). Attackers used the GOZ botnet also in more sophisticated use cases and in combination of cyber and non-cyber elements: After an online theft, for example via the false bank transfers or the “money mule” method where jewellery or watches are being picked up before the fraudulent bank transfer is being reversed (Krebs, 2010, 2011), the GOZ botnet launched DDoS attacks to take affected servers offline, disguise the just-finished attack and prevent restoration of affected data (Krebs, 2013).

 

Typical for a botnet, GOZ maintained a cluster of Internet-connected devices (slaves) that are programmed to execute operations by a command & control server (C2 server, master) (Puri, 2003). After infecting a machine with a derivative of the ZeuS Trojan by mimicking emails from renown companies, a “zombie” machine tries to connect with other bots in the peer-to-peer network (CISA, 2014; Krebs, 2014a). Reaching out via UDP to other infected machines listed as hardcoded IP addresses in the Trojan payload, the bot then establishes a TCP connection via several proxy layers with the peer node(s). Decentralized and multi-tiered, the new bot then received information on the C2 server and will contact it via a HTTP POST request, registering itself to the command server’s disposal (Andriesse, Rossow, Stone-Gross, Plohmann, & Bos, 2011). In addition to the proxy-tiered, decentralized peer-to-peer setup, the GOZ botnet benefited from two other security features: To protect the Command and Control server – the most sensitive link in the chain, the communication between slave and master was RSA encrypted and used a Domain Generation Algorithm (DGA) that randomly creates “rendezvous points” between the infected machine and its C2 server when conventional connection attempts failed (Chowdhury, 2019; Dell SecureWorks CTU, 2014). The main advantage of a DGA is that blacklist-based malware protection can hardly block randomly generated domains and is hence unable to prevent the malicious connection attempt with a C2 server (Plohmann, Yakdan, Klatt, Bader, & Gerhards-Padilla, 2016).

 

In 2014, a US-lead joint operation between law enforcement agencies, private cybersecurity firms and researchers under the title Operation Tovar successfully interrupted the global GOZ botnet (Johnson, 2014). Despite the successful destruction of P2P network – a success that is considered “the most expansive botnet takeovers and takedowns in history” (until 2014), security companies noticed the reconstruction of a GameOver ZeuS derivative only weeks after the takedown and again with connections to Ukraine and Russia (Dell SecureWorks CTU, 2014; Krebs, 2014a, p. 2, 2014b). In an equal cat-and-mouse fashion, the Russian national Evgeniy Mikhailovich Bogachev was indicted in the US for creating the GOZ botnet and associated cybercrimes (Gilbert, 2014). Despite a FBI bounty of $3 million on his head, Bogachev is suspected to live “in great wealth on the Russian Black Sea coast” (Perez, 2015; Rüesch, 2017, p. 2). A partial success in persecuting international cybercrime that reveals the lack of joint international action against malicious actors, particularly between non-extradition countries such as Russia and the US.

 

As more and more poorly secured machines are being connected to the internet (Internet of Things), a growing cyberspace offers more potential victims and botnet are being sold as “off the shelf” products, the impact factor, financial risks and incentives of botnets will continue to rise (Sabanal, 2016). GameOver ZeuS showed that a large-scale attack does not necessarily require a very sophisticated attack vector to exploit previously unknown vulnerabilities (so-called zero-days) but may be successful by the sheer size of the attacking network in combination with strong protection measures. The takedown and quick resurrection of GOZ as much as the indictment and following non-extradition of responsible attackers are prime examples of the cat-and-mouse game between law enforcement and cyber criminals: Successful operations are contrasted by structural deficiencies in the (international) cybercrime persecution.

 

Enhancing cyber defense, one must address problems “in the game” as much as “of the game”: To improve counter-measures like Operation Tovar, private and public sector must better understand and measure the factors for successful disruption in order to prioritize technological and organizational development on defensive measures. Following Healey, Jenkins and Work (2020), a focus on the defense will strengthen the “cats in the game”. With regards to “problems of the game”, it remains imperative to establish international rules in the hard-to-control jurisdiction of cyber space, as well as a better research on the contested question of whether cyber deterrence against vigilante states, such as Russia, China or North Korea, is effective (Healey & Jenkins, 2019). Analog to when formal agreements and stable structures ended most freebooting in the 18th century, the global community must address buccaneering cybercrimes with changes in and to the game.

This paper was submitted as final paper to the course "Cyber Risks and Vulnerabilities" at Columbia University's School of International and Public Administration (SIPA), lectured by Prof Natalie Vanatta and Prof Janee Potts.

LITERATURE

Tags: Research, Cybersecurity, Columbia University | SIPA, Germany, National Security, GameOverZeus, Ransomware

Write a comment

Comments: 0