Hide and Seek
3/24/19
https://www.malwaretech.com/2019/01/tracking-the-hide-and-seek-botnet.html
This is a blog from a malware analyst. In this post he goes through Hide and Seek. This targets primarily *nix based systems like cameras, tvs, and other IoT devices.
Unlike the majority of analysis I see, this is not a virus or trojan, but a worm. The worm runs through and creates a botnet without a main C2C. One of the cool results of this is that once an update is loaded to an infected device, the update is sent to the other infected peers.
The spread of the worm is through an infected device sending it’s peer list and it’s own IP to be added as a peer. The device will continue this until the device can no longer fill up it’s peer list. This means infecting one P2P connected device can affect that system and every system it is connected to, every device that those devices are connected to... etc. This can be done quite fast.
The counter-measure against discovering and mapping the entire botnet is done through coding that will record the requester’s IP onto the peer list, and then (basically in effect) not send new peers.
This can be resolved by using a snippet of the worm’s code to “churn” through IP’s making it possible to map the peers once every 128 seconds. With multiple IPs and fast enough throughput (to send enough requests at the correct time) the botnet can be mapped.
I would suggest checking out this guy’s review of the NSA’s new malware analysis tool as well. It is interesting for anyone looking to pursue malware/software analysis seriously.
https://www.malwaretech.com/2019/03/video-first-look-at-ghidra-nsa-reverse-engineering-tool.html