Analysis of 24 Hours Internet Attacks

A Brief Overview of Malicious Traffic Targeting Featureless Servers on the Web

Tim Britton 1 , Ian Liu-Johnston 1 , Ian Cugnière 1 , Swati Gupta 1 , Danton Rodriguez 1 ,
Julien Barbier 1 , Sebastien Tricaud 2

1
Holberton School
2
Honeynet Project

Abstract: We first set up a bare Amazon AWS

For the past decades, bots and botnets instance whose data center resides in
have been on the front page of newspapers and Ashburn, Virginia. To get a general overview
are one of the main topics of discussion in the of the traffic that would come to the server,
news media. The range of the attacks and their we did not run any services that would be
targets have been increasing.1​ A recent useful to anybody else, and did not connect
example, the Mirai network - a botnet built the Internet Protocol (IP) address to any
through insecure Internet of Things (IoT) domain name. Very shortly after renting the
devices -, has been at the center of attention server, we set up a packet capture for a
after it provoked an internet outage primarily 24-hour period with tshark/wireshark. We
on the East Coast.2​ A study also found that “80 did this to identify the most promising
percent of spam was sent by botnets by 2009”.3​ traffic/protocols to observe and concentrate
Despite this, most of our everyday life relies our efforts on. We then analyzed the packet
heavily on the internet and is still vulnerable to capture file with tools such as
malicious attacks. This paper aims to explore tshark/wireshark, Computer Incident
where such attacks originate and how the Response Center’s (CIRCL) Border Gateway
attacks occur. We set up and decided to Protocol (BGP) ranking API, and p0f.
observe what happens to an internet-facing
server that should not encounter anything but 1.1 BGP Rankings
local network activity. To investigate further, CIRCL’s BGP Ranking provides data to
we set up honeypots on that server to see how calculate the security ranking of Internet
the flow of traffic changed, and what bots and Service Providers (ISPs).​4 We compared the
other clients would do. We wish to share our list of IP addresses that accessed our server
findings and thus humbly contribute to more during the initial 24-hour period to calculate
awareness about the risks faced by anyone the risk assessment for these IP addresses.​5
using the internet. The closer the BGP ranking is to zero, the
more malicious the IP address is. At the time,
1. Introduction & Methodology the most malicious IP in our logs scored 0 out
In order to observe malicious activity of ​13,043. This IP address accessed the TCP
on the internet we set clear steps to decide port 3380, which is used by the SNS Channels.
which methodology to adopt based on the Other notable ports and protocols that were
traffic we would receive. accessed by high risk IP addresses were
various ephemeral ports such as the Intel
Remote Desktop Management Interface ● The SIP protocol is often used for
(IRDMI) protocol, the port 8089, and the port enterprise-level telecommunication
81 (TorPark Onion routing). See Table 1.0 for systems;
the list of the most malicious IP addresses we ● The SSH protocol represents many
captured (as of February 13rd, 2017): bruteforce attempts and accounts for
more than half of the total traffic from
our initial packet capture;
● The Telnet protocol: The Mirai botnet
and its successor Hajime exploit this
protocol, as IoT devices - which often
use Telnet - comprise the majority of
targeted systems.
We thus used honeypots to attract the traffic
that targets the protocols above and analyzed
the data they produced.​6 Honeypots are
pieces of software designed to reproduce the
same functionality as vulnerable servers, and
can act as decoys to attract intruders.
In this paper, we will first detail the
traffic observed per protocol. Then, we will
We realized that some protocols were
expand on the botnets’ patterns that we were
attracting remarkably more traffic than
able to notice. It will allow us to better grasp
others. For example, for application layer
how these botnets infect and interact with a
protocols, we recorded 255,796 ​connection
targeted system.
attempts through Secure Shell (SSH), while
we received only 1 connection to the
2. Protocols of interest
Connection-less Lightweight Directory Access
Protocol (CLDAP), cf. table 1.1 in Annex.
2.1 HTTP
“The Hypertext Transfer Protocol (HTTP)
1.2 Protocol Selection is an application-level protocol for distributed,
While the scope of this paper might collaborative, hypermedia information systems. It is
seem enormous, if not quixotic, after parsing a generic, stateless, protocol which can be used for
the data, we decided to focus our efforts on many tasks beyond its use for hypertext, such as
the following protocols: the Hypertext name servers and distributed object management
Transfer Protocol (HTTP), the Session systems, through extension of its request methods,
Initiation Protocol (SIP), SSH, and the error codes and headers.” 7​
Telecommunications Network (Telnet) Because HTTP is one of the most
protocol. These protocols were selected for widely used protocols on the internet, it is
the following reasons: also one of the main vectors for exploitation.
● The HTTP protocol is the most widely We recorded 245 HTTP packets during our
used protocol on the internet, and initial 24-hour packet capture.
thus provides the biggest resource for To investigate this protocol further,
exploits; we setup a web-application honeypot,
Glastopf, running in a Docker container. This
honeypot provided basic functionality to To give us a broader picture of
record GET or PUT requests, IP addresses, possible connections, we decided to run
Uniform Resource Identifiers (URIs), and Glastopf for a much longer period of time. In
timestamps. It was also designed to simulate addition, we wrote a basic honeypot in
SQL vulnerabilities and record injection NodeJS to run simultaneously and compare
attempts. We launched this honeypot the traffic from both servers.​8 The custom
alongside another packet capture for a second honeypot served a static authentication page
24-hour period on March 7th, 2017. and had logging capabilities. We ran both web
servers on port 80 for a 12-day period.
By doing so, we were able to
cross-reference the data obtained from those
sources, which gave us a more refined
understanding of the kind of attacks currently

The resulting logs from Glastopf did

not yield much data, possibly because of
specialized functionality, and possibly
because Glastopf is an older honeypot. In total
only 14 connections were made, two of which
were requests for meta-release-lts​, and targeting the HTTP protocol (cf. Table 2.0
/phpmyadmin/scripts/setup.php​, while and Table 2.1).
the rest were for the website root.
 In our observations of the Glastopf leveraged the Shellshock vulnerability in
logs, the majority of client requests were for other logs.
PHPMyadmin and vulnerable Wordpress Another series of notable exploit
plugins. There were various other requests to attempts leveraged a recent vulnerability in
interesting URIs such as / ​ system.ini​, the Apache Struts web framework.​10
/struts2-showcase/​, and This exploit was revealed March 7th,
/current-config/passwd​. ​Regardless of 2017. The initial log entries were dated
where the requests originated from, be it shortly after the exploit was publicly
Bangalore, Austria or the United States, the released. There were multiple exploit
attacks were fairly homogenous between our attempts that used the same methodology as
honeypots and relied on well-known attack in the exploit-db python script.​11 The exploit
vectors. works by leveraging a vulnerability in parsing
The most interesting log entries for the Content Type header field, which allows
the NodeJS honeypot provided links to remote code execution.​12
trojans and other binaries. They were sent to Subsequent attempts were
our servers in various HTTP headers, with the enumeration techniques from Metasploit
ability to install and execute malware through modules,​13​ that followed this convention:
known exploits. %{#context['com.opensymphony.xwork2.
One type of malicious request dispatcher.HttpServletResponse'].add
Header('tkplpyg','tkplpyg')}.multipa
attempted to leverage an exploit known as
rt/form-data
“Shell Shock” or “Bashdoor”,​9 which was
The first few malicious clients
made public in 2014. It exploited a
downloaded a malicious script for Linux and
vulnerability in web servers that uses Bash to
a binary named “UnInstall.exe” for Windows.
process the User-Agent header for certain
This binary was also found during the same
requests. The User-Agent string would be
time period in a pirated torrent of Skyrim.
sent as a malformed function definition with
The Linux script stopped all firewalls,
bash commands immediately following the
set the DNS server to 8.8.8.8, removed any
function definition. Such a string could adopt
instances of Apache from /etc/init.d/ and
the following format:
instances of the malicious binary. Then it
( ) { :;}; /bin/bash -c ‘echo
vulnerable’
downloaded a series of dynamic libraries as
The Shellshock exploit in our logs well as the malicious binary masquerading as
attempted to download a shell script, a Perl an Apache process.
script, and a tar archive renamed to have a The binary itself was a bitcoin miner
.jpg extension. The tar archive compressed all based off of cpuminer2.3.3, that mined into
other files. The shell script created a crontab the Stratum mining pool.​14 It used the hash
that would re-download the trojan and verify algorithm cryptonight, with the username
that the service was running. All Bash scripts “sqwukiomcage.” This illustrates the recent
ensured persistence for the Perl script trend of increasing attacks aimed at
named “DDoS Perl IrcBot v1.0 / 2012 by cryptocurrencies.
DDoS Security Team”. We also encountered a Next, it set a crontab to download and
modified version of the Perlbot that also execute the script again, and checked through
“known_hosts” in all “.ssh” directories, and in
all “.bash_history” files to find any servers 31st, we saw 1,075 connections, with a total
that were connected through ssh. Finally it of 306 unique IP addresses, connect to the
downloaded the trojan onto those new Telnet honeypot server. 835 of those 1,075
servers. connections resulted in the connecting party
successfully logging in (providing any two
2.2 Telnet - esp. IoT Honeypot lines of input for a username and password),
“The purpose of the TELNET Protocol is to with 267 unique IPs logging in. Of the 835
provide a fairly general, bi-directional, eight-bit logins, 750 were generated by bots that
byte oriented communications facility. Its primary successfully connected and created enough
goal is to allow a standard method of interfacing
traffic to fit into an identifiable pattern. We
terminal devices and terminal-oriented processes to
observed patterns left by the following
each other. It is envisioned that the protocol may
also be used for terminal-terminal communication
variants of Mirai: Mirai scanner, Mirai/Ecchi
("linking") and process-process communication downloader, OBJPRN Mirai variant, Hajime
(distributed computation).” ​15 downloader, and the Mirai 'xkajdnabw'
Telnet is an unsafe protocol as all variant. Around November 2016, the Mirai
information (including authentication) is source code was released to the general
exchanged over plain text. Nonetheless, it is public. Mirai’s original source code continues
still used for IP cameras, routers and other to be modified and new variants spread and
IoT devices to allow remote system keep infecting vulnerable devices. The
administration, such as firmware upgrades. It variants mentioned previously echo concerns
is used instead of SSH on these devices about Mirai being an easily replicable and
because it is easy to implement and highly adaptable botnet.​18
lightweight, making it acceptable for devices The countries of origin from our
without a lot of resources. analysis directly correlated to some of those
Telnet was the second port to attract that were observed by experts in the field of
the most traffic, with 606 interactions cybersecurity: Taiwan, Russia, South Korea,
detected during the 24-hour capture. We Turkey, China, the United States, Brazil, and
decided to study Telnet because of the Iran (see Map 2.0).​19
aforementioned trend regarding botnets,
such as Mirai, targeting IoT devices. Our
intention was to study how those trends -
noted by many experts - translate in near
real-time observation. We thus decided to
investigate further.
In order to do so, we installed H-M-S
Telnet honeypot​16 in order to become the
target of a more consequent flux of
attacks/interactions. This honeypot has no
specific content but does mimic a GoAhead
wifi camera based on an exploit uncovered by
Pierre Kim.​17
Focusing on IoT devices paid off as
the traffic captured demonstrates. On March
2.3 SIP 2.4 SSH
SIP is based on an HTTP-like “The Secure Shell (SSH) is a protocol for secure
request/response transaction model and is used to remote login and other secure network services
establish, modify, and terminate multimedia over an insecure network.” ​23
sessions such as audio or video calls, Internet Although statistically we got an
​
telephony call.20 enormous volume of SSH connection
The SIP protocol caught our attention attempts, we decided not to investigate the
for several reasons. Not only did it account for protocol as thoroughly as HTTP or Telnet
a significant portion of the traffic we received, because the traffic is mostly comprised of
but most of its applications are in enterprise brute force attempts.
telecommunication systems. While the number of connection
However, SIP ended up being a attempts was significant, the vast majority of
disappointing lead as the only packets we the attempts came from three IP addresses
observed were generated by SIPVicious. whose geolocation data corresponded to the
As noted by Cisco: Guangdong and Jiangsu areas in China. To be
​“The tool could also be used to scan the IP or VoIP precise, 130,598 of the 140,606 SSH
telephony network. Due to a flaw in the processing connection attempts we analyzed, came from
of SIP messages by the telephony device firmware, just three IP addresses. In fact, over 99.8% or
an attacker could use any number or any SIP
140,417 of the SSH connection attempts
address in the INVITE message to scan random
appeared to have originated from China. The
networks to determine availability of live hosts. The
attacker could initiate an INVITE session and
highest number of connection attempts from
determine a successful detection by receiving a an IP address whose geolocation data was
phone ring as a response. This detection could allow outside of China was 49.
the attacker to conduct further attacks such as host A general trend we noticed by
spoofing to make phone calls using the detected IP analyzing the auth logs from the 24-hour
​
phone identity.”21 capture on the AWS server was IP addresses
It can also be used in a non-malicious trying to connect via SSH as root on all ports
way to audit a network.​22 from 1-​65535, which may explain the high
All the packets were transferred over volume of traffic from individual IP
UDP, using the second version of the SIP addresses. When we analyzed the auth logs
protocol. The headers of the SIP packets show from the DigitalOcean server, we noticed that
connection attempts. The To and From t​here were a number of bruteforce attempts
Header fields indicate that after the initial against a range of user names, but not against
INVITE request, attackers tried random a range of ports, contrary to the AWS
strings in the Contact header field to directly instance.
connect with a user at another end.
Let us note that the results of this 3. Botnets detected
traffic may be attributed to a recent release of ​After having briefly mentioned the Botnets
SIPVicious. The latest release of SIP vicious encountered, we will expand on that subject
occurred on February 4th. We ran our initial as it is one of the most notable and worrying
packet capture concurrently on February 4th trends in today’s security landscape.
- 5th.
3.1 Hajime control (C&C) servers, displaying the
According to Rapidity Network, following message on infected systems:
Hajime was first spotted around October 5th,
2016.​24 The traffic generated is similar to Just a white hat, securing some
Mirai’s; after sequentially using a list of systems.
randomly generated passwords, Hajime Important messages will be signed
like this!
attempts to open a new shell, and uses the
Hajime Author.
/bin/busybox trick seen with Mirai (with
Contact CLOSED
ECCHI normally) to verify whether it is inside Stay sharp!
​ proc/mounts​,
an actual shell. Then, it checks /
and attempts to go to a seemingly random Like the other botnets found, Hajime's effects
directory and to run a set of commands to are only stored in memory, and resetting the
ensure that it can actually write to the device will clear it back to the same insecure
directories listed. Hajime also checks to see if settings Hajime found the device with.
it has access to netcat or wget, and finally,
runs the Data Duplicator (DD) command 3.2 Mirai
against /bin/echo to grab the first 52 bytes Mirai is likely the most famous botnet,
and analyze the Executable and Linkable found to be responsible for a record-breaking
Format (ELF) header, to get architecture 620 Gbps DDoS attack.​25 On October 21st,
information for the current machine. 2016, Dyn’s DNS infrastructure was hit with
Finally, Hajime will download a script an attack of a similar Gbps output, drawing
for the appropriate architecture with w ​ get (if Mirai into the public spotlight.​26 On Twitter,
accessible and if the control server has that Octave Klaba, the founder and owner of OVH,
resource). reported attacks thought to stem from Mirai,
reaching over 1Tbps.​27 Many researchers
2017-03-31 05:22:16,698 - RECEIVED
have done their own study of Mirai whose
INPUT 202.174.185.162 : ['rm .s;
source code was released around October 1st,
wget http://73.9.22.205:49511/.i;
chmod +x .i; ./.i; exit']
2016, on Hackforums, by a user called
2017-03-31 05:22:17,498 - RECEIVED Anna-Senpa.​38 This latter source includes
INPUT 202.174.185.162 : ['q'] everything from the scanner, the loader, even
2017-03-31 05:22:17,504 - Lost an API where customers can be allowed
connection to 202.174.185.162:39189 access to the C&C server to direct attacks.
As a result of the source being leaked,
Other researchers have noted that it countless modified strains have been found in
will attempt to echo-assemble a binary if the wild and continue to be found.
wget and nc are unavailable. In this case, the Mirai first scans the environment it
downloaded malware has an MD5 sum of has penetrated. It logs on by randomly
91a02956678c4ff6aa9075cfe99db24d​. selecting username/logins from a
The purpose of Hajime is unknown predetermined list. Once it is in the system, it
and open to speculation. The Hajime binary attempts to determine whether it is in a shell
actually attempts to block the ports that Mirai or not using shell and, checking access to the
uses to communicate with its command and /bin/busybox MIRAI path to ensure it is
receiving the proper response (​MIRAI: torture', Synchronization Acknowledgment
applet not found​). (SYN/ACK) floods, Generic Routing
If it receives the expected response, Encapsulation (GRE) IP, Ethernet flooding,
the Mirai downloader, ECCHI, shows up next. and HTTP flooding.
It starts out with similar commands to the
scanner, running shell and sh, and then 3.3 Bashlite
/bin/busybox ECCHI​. Next, it checks the The Bashlite malware, like Qbot and
output of ps so as to discover other running its derivatives, has been around since at least
processes. The Mirai source carries a list of early 2015 and the source is easy to find.​29
processes to destroy, namely other botnets. If HackForums and LeakedFiles list several, and
any are found, it will run k ​ ill -9 against even GitHub has several repos with the
them. This is a territorial act, as it wants to source. The HackForums user Anna-Senpai
ensure it is the only botnet in control of the even references it in the original forum post
device. where the Mirai source code was posted:
Like Hajime, it checks ​/proc/mounts “However, I know every skid and their mama,
for mounted filesystems and cycles through it's their wet dream to have something
them to determine access. besides Qbot.” and then references the speed
To prep for the impending download, of Mirai versus Qbot: “Bots brute Telnet using
Mirai copies / ​ bin/echo​, empties it, and then an advanced SYN scanner that is around 80x
chmod​’s it to ensure it can execute the file. The faster than the one in Qbot, and uses almost
last step before it can download is to cat 20x less resources.”
/bin/echo​. The bot ignores everything but A quick Google search results in
the ELF header, and simply checks it for the numerous YouTube videos and forum posts
architecture information. with tutorials on how to set up Qbot. Most
Then, it checks for wget and tftp, and uses versions of Qbot lack any kind of honeypot
whichever is available. Mirai downloads the detection, and simply log in and try to dump
architecture specific file. Mirai supports x86, their malware. Each client malware is
MIPS, MPSL, ARM, ARM5, ARM7, PPC, SPC, cross-compiled for different architectures, as
M68K, and SH4 architectures, and the source we can see at one of the GitHub links.​30 NTPD
actually includes a cross compiler for this is MIPS, bash is x86, tftp is ARMv6, etc.
reason. Then it downloads it to the prepared Basically, it attempts to download every
dvrHelper file and runs it. That done, it runs possible file and run every possible one,
the script and exits out, its mission hoping one will be the right architecture to
accomplished. infect the client.
The malicious binary causes a Qbot/bashlite generally contains
connection between the device and the Mirai capabilities for HTTP, UDP and TCP flooding
C&C server. The device will begin the same attacks, but with so many sources available
scanning routine seen previously, alerting the the attack vectors can differ from bot to bot.
C&C server of insecure bots so it can be hit by
a loader and added to the botnet. The 3.4 Bricker Bot
connection can also be used to broadcast a Bricker Bot made the headlines May
multitude of DDoS attacks to the clients: UDP 4th, 2017, after a RadWare article revealed
flood, Valve query flooding, 'DNS water details about the bot.​31 It returned to the
spotlight on April 21st, 2017, with a generated string, which was different each
BleepingComputer article that claimed to time it connected.
have found the author of Bricker Bot.​32 The honeypot was modified for the
Bricker Bot is a grey-hat bot. It passwd command to 'work'; running passwd
attempts to log in to insecure Telnet devices would lock the honeypot out to anyone but
and disable them, either temporarily or those using the provided password, and in 48
permanently. Bricker Bot uses Tor exit nodes hours of uptime, we did not witness any login
to conceal the actual IP of the attacking attempt using the generated password.
device. On April 4th, 2017, the honeypot went
Its self-proclaimed creator, under the down for approximately 6 hours and
nickname janit0r, claims to have bricked thereafter stopped receiving traffic. It is
around 2 million devices. According to worth noting that we had set up two other
Radware Bricker Bot would have honeypots - one of them in the same
permanently disabled some IoT devices, but DigitalOcean region - that never received any
its actual impact remains unknown. traffic from that bot. The only difference
On April 2nd, 2017, the honeypot being that the honeypot attracting Bricker
server saw several different attack patterns Bot traffic was spun up in early March,
matching either Bricker Bot or that of a whereas the other two honeypots were not
similar botnet. Variations of the Bricker Bot started until the end of March.
attack pattern were seen 21 times, originating The last time the honeypot monitored
from 6 different IPs. The bot collected the OS any Bricker Bot-like activity was April 24th,
information from / ​ proc/version and u ​ name 2017, with some slight differences compared
-a​, checks shadow/passwd, and checked the to the previous patterns observed. This time,
contents of /​ etc/​. Then, after running su root it left a message in the ‘message of the day’
to ensure that the user was root, it attempted (motd) file warning that the system had been
to run a forkbomb by creating a function that hacked, and then immediately returned to
repeatedly forked itself: forkbomb it. The traffic resulted in 180 logins
d(){ d|d & };d 2>/dev/null in one day, from two IPs.
Traffic received in the same
timeframe and for several days caused the Conclusion
honeypot to hang on the passwd command, More than twenty years ago, John
which the bot seemed to follow minutes later Perry Barlow in his ​Declaration of the
by trying to kill every running process and Independence of Cyberspace called for a
reboot. civilization “more humane and fair” than that
Another type of traffic encountered, of governments. However, and as mentioned
more malicious, redirected /dev/urandom to above, the number of malware attacks keeps
random device descriptors, attempting to increasing at an incredible pace. When we
clear the IP route and setting max threads to started our research for this paper, Mirai was
one. the most malicious botnet in terms of scope.
After fixing the bug that caused the As of this writing WannaCry/WannaCrypt
honeypot to hang on the 'passwd' command, seems poised to take its place in the
we could see that the bot was attempting to headlines.
change the password to a randomly
 The source of attempted exploits
observed spans across the whole globe.
Featureless servers encounter a consequent Acknowledgments
amount of traffic, but that volume is even This work would not have been possible
greater when the server has a purpose, such without Sebastien Tricaud, the founder of the
as an IP camera, or a Wordpress website with French Honeynet chapter, ​to whom we are
a domain name. especially indebted. He provided us guidance
Interestingly, we discovered that most and leadership every step of the way,
of the attacks rely on old malware, which allowing us to succeed as a team.
tends to indicate that those attacks are still A co-founder of Holberton School, Julien
successful and thus that steps to prevent Barbier’s help was invaluable. Not only did he
them are largely ignored. Indeed, these introduce us to Sebastien, but he also gave us
exploits mostly rely on improperly configured the opportunity, as students, to discover more
or outdated software, and generic about the field of information security.
username/password combinations. We are grateful to Richard Sim and Philip
The attack patterns we recorded for Yoo, both students at Holberton School, for
HTTP, SSH, and SIP relied on generic exploit proofreading this paper and contributing to
attempts that seemed to scan a range of IP making it better.
addresses for well-known vulnerabilities.
Telnet, on the other hand, relied on even
simpler intrusion methods, by bruteforcing
with default username and password Annex
combinations. Sometimes, these
spray-and-pray attacks immediately
attempted to download antiquated scripts, or
more contemporary trojans, but none of the
recorded attempts were covert enough to
evade detection or overcome simple
protective measures.
On the other hand, we came across
more recent attacks among which several
variants of the Mirai botnet. Albeit more
recent, those botnets also rely on weak or
nonexistent security measures on the part of
their targets.
While this paper reaches its
conclusion, our work is not done and we will
keep developing our honeypots so as to
respond more dynamically to malicious
connection attempts.
 [Accessed 2 May 2017].
References 7. IETF. 1999. ​RFC 2616 - Hypertext
1. Lillian Ablon, Martin C. Libicki, Transfer Protocol​. [ONLINE] Available
Andrea A. Golay. 2017. ​Golay Markets at:
for Cybercrime Tools and Stolen Data​. https://tools.ietf.org/html/rfc2616.
RAND. pp. 21-23. [ONLINE] Available [Accessed 13 May 2017].
at: 8. Ian Liu-Johnston. 2017.
https://www.rand.org/content/dam/ nodeJS_honeypot​. [ONLINE] Available
rand/pubs/research_reports/RR600/ at:
RR610/RAND_RR610.pdf. [Accessed 2 https://github.com/ianliu-johnston/n
May 2017]. odeJS_honeypot. [Accessed 13 May
2. Lily Hay Newman. 2017. ​What We 2017].
Know About Friday’s Massive East 9. CVE. 2014. ​CVE-2014-6271​. [ONLINE]
Coast Internet Outage​. Wired. Available at:
[ONLINE] Available at: https://cve.mitre.org/cgi-bin/cvenam
https://www.wired.com/2016/10/in e.cgi?name=CVE-2014-6271.
ternet-outage-ddos-dns-dyn/. [Accessed 2 May 2017].
[Accessed 2 May 2017]. 10. CVE. 2017. ​CVE-2014-6271​. [ONLINE]
3. Lillian Ablon, Martin C. Libicki, Available at:
Andrea A. Golay. 2017. ​Golay Markets https://cve.mitre.org/cgi-bin/cvenam
for Cybercrime Tools and Stolen Data​. e.cgi?name=CVE-2017-5638.
RAND. pp. 21-23. [ONLINE] Available [Accessed 2 May 2017].
at: 11. Exploit Database. 2017. ​Apache Struts
https://www.rand.org/content/dam/ 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote
rand/pubs/research_reports/RR600/ Code Execution​. [ONLINE] Available
RR610/RAND_RR610.pdf. [Accessed 2 at:
May 2017]. https://www.exploit-db.com/exploits
4. CIRCL. 2017. ​BGP Ranking​. [ONLINE] /41570/. [Accessed 13 May 2017].
Available at: 12. Terrence DeJesus. 2017. ​Apache
https://www.circl.lu/projects/bgpran Struts 2 Exploit Analysis. ​NTT Security.
king. [Accessed 13 May 2017]. [ONLINE] Available at:
5. CIRCL. 2016. ​Bgpranking-redis-api​. https://www.solutionary.com/resour
[ONLINE] Available at: ce-center/blog/2017/03/apache-stru
https://github.com/CIRCL/bgprankin ts-2-exploit-analysis/​. [Accessed 18
g-redis-api. [Accessed 13 May 2017]. May 2017].
6. William W. Martin. 2001. ​Honey Pots 13. CXSecurity.com. 2017. ​Apache Struts
and Honey Nets - Security through Jakarta Multipart Parser OGNL
Deception​. SANS Institute. [ONLINE] Injection - CXSecurity.com​. [ONLINE]
Available at: Available at:
https://www.sans.org/reading-room https://cxsecurity.com/issue/WLB-2
/whitepapers/attacking/honey-pots- 017030143​. [Accessed 18 May 2017].
honey-nets-security-deception-41. 14. Pooler. 2017. ​cpuminer: CPU miner for
Litecoin and Bitcoin​. [ONLINE]
 Available at: [Accessed 13 May 2017].
https://github.com/pooler/cpuminer​. 21. Cisco. 2014. ​SIPVicious SIP Auditing
[Accessed 18 May 2017]. Tool Activity​. [ONLINE] Available at:
15. IETF. 1983. ​RFC 854 - Telnet Protocol https://tools.cisco.com/security/cent
Specification​. [ONLINE] Available at: er/viewAlert.x?alertId=33141.
https://tools.ietf.org/html/rfc854. [Accessed 2 May 2017].
[Accessed 13 May 2017]. 22. Kali Linux. 2014. ​SIPVicious Package
16. Tim Britton and Holden Grissett. Description​. [ONLINE] Available at:
2017. ​telnet-honeypot​. [ONLINE] http://tools.kali.org/sniffingspoofing
Available at: /sipvicious. [Accessed 2 May 2017].
https://github.com/h-m-s/telnet-hon 23. IETF. 2006. ​RFC 4253 - The Secure
eypot. [Accessed 13 May 2017]. Shell (SSH) Transport Layer Protocol​.
17. Pierre Kim. 2017. ​Multiple [ONLINE] Available at:
vulnerabilities found in Wireless IP https://tools.ietf.org/html/rfc4253.
Camera (P2P) WIFICAM cameras and [Accessed 13 May 2017].
vulnerabilities in custom http server​. 24. Sam Edwards, Ioannis Profetis. 2016.
[ONLINE] Available at: Hajime: Analysis of a decentralized
https://pierrekim.github.io/blog/201 internet worm for IoT devices​.
7-03-08-camera-goahead-0day.html. [ONLINE] Available at:
[Accessed 2 May 2017]. https://security.rapiditynetworks.co
18. John Costello , Allison Nixon , Brian m/publications/2016-10-16/hajime.p
Hein , Ronnie Tokazowski , Zach df. [Accessed 13 May 2017].
Wikholm . 2016. ​New Mirai Variant 25. KrebsOnSecurity. 2016.
Leaves 5 Million Devices Worldwide KrebsOnSecurity Hit With Record
Vulnerable — High Concentration in DDoS​. [ONLINE] Available at:
Germany, UK and Brazil​. Flashpoint. https://krebsonsecurity.com/2016/0
[ONLINE] Available at: 9/krebsonsecurity-hit-witth-record-d
https://www.flashpoint-intel.com/bl dos/. [Accessed 13 May 2017].
og/cybercrime/new-mirai-variant-inv 26. Dyn. 2016. ​Dyn Statement on
olved-latest-deutsche-telekom-outage 10/21/2016 DDoS Attack​. [ONLINE]
/. [Accessed 2 May 2017]. Available at:
19. Roland Dobbins. 2016. ​Mirai IoT https://dyn.com/blog/dyn-statement
Botnet Description and DDoS Attack -on-10212016-ddos-attack/.
Mitigation. ARBOR Networks​. [Accessed 13 May 2017].
[ONLINE] Available at: 27. Octave Klaba. 2016. ​we got 2 huge
https://www.arbornetworks.com/blo multi DDoS: 1156Gbps then 901Gbps​.
g/asert/mirai-iot-botnet-description- [ONLINE] Available at:
ddos-attack-mitigation/. [Accessed 2 https://twitter.com/olesovhcom/stat
May 2017]. us/778019962036314112. [Accessed
20. IETF. 2002. ​RFC 3261 - Session 13 May 2017].
Initiation Protocol​. [ONLINE] 28. KrebsOnSecurity. 2017. ​Who is
Available at: Anna-Senpai, the Mirai Worm Author?​.
https://tools.ietf.org/html/rfc3261. [ONLINE] Available at:
 https://krebsonsecurity.com/2017/0
1/who-is-anna-senpai-the-mirai-wor
m-author/. [Accessed 13 May 2017].

29. India Ashok. 2016. ​One million IoT

devices infected by Bashlite
malware-driven DDoS botnet​.
International Business Times.
[ONLINE] Available at:
https://www.ibtimes.co.uk/one-milli
on-iot-devices-infected-by-bashlite-m
alware-driven-ddos-botnet-1578870.
[Accessed 13 May 2017].
30. geniosa. 2016. ​qbot​. [ONLINE]
Available at:
https://github.com/geniosa/qbot/blo
b/master/cc7.py.txt. [Accessed 13
May 2017].
31. Radware. 2017. ​”BrickerBot” Results
In PDoS Attack​. [ONLINE] Available at:
https://github.com/geniosa/qbot/blo
b/master/cc7.py.txt. [Accessed 13
May 2017].
32. Catalin Cimpanu. 2017. ​BrickerBot
Author Claims He Bricked Two Million
Devices. BleepingComputer​. [ONLINE]
Available at:
https://www.bleepingcomputer.com/
news/security/brickerbot-author-clai
ms-he-bricked-two-million-devices/.
[Accessed 13 May 2017].