SoCellBot: New Botnet Design to Infect Smartphones via Online Social Networking
"Learn about SoCellBot, a new cellular botnet designed to infect smartphones through online social networking. This research explores the propagation mechanisms, command and control channels, and botnet topology, highlighting the challenges and preventive measures against this emerging threat."
Uploaded on | 0 Views
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
SOCELLBOT: A New Botnet Design to Infect Smartphones via Online Social Networking Mahammad Reza Faghani and Uyen Trang Nguyen 2012 25thIEEE Canadian Conference on Electrical and Computer Engineering(CCECE) Speaker: 102/10/24
Outline Abstract Introduction The proposed SoCellBot Simulation Results Conclusion 1/15
Abstract Smartphone Online Social network(OSN) A new cellular botnet named SoCellBot o Harder to detect o More resilient to bot failures o More cost-effective to cellular bots Raising awareness of new mobile botnets Preventive measures to deter SoCellBot 2/15
Introduction OSNs 1. Most cellular network providers offer OSN access to their clients free of charge. 2. Messages exchanged in OSNs are usually encrypted. 3. The topology of an OSN-based botnet is more resilient to bot failures or unavailability thanks to the highly clustered structure of the social network graph. Why are OSNs? 3/15
The proposed SoCellBot SoCellBot Infects smartphones with malware The medium to recruit bots is OSN o Unlike SMS-based botnets, SoCellBot incurs small monetary costs. Architecture o Propagation mechanism o Command and Control channel o Botnet topology maintenance 4/15
The proposed SoCellBot Propagation Mechanism o Using social engineering techniques Eye-caching web link Infiltration 5/15
The proposed SoCellBot Command and Control Channel o Online social network messaging system (OSNMS) o Using an algorithm to disguise the commands to be normal o Sending message to a random user in Facebook is possible Infected users then infect their friends 6/15
The proposed SoCellBot SoCellBot Botnet Topology o Ensured to be connected o It is Resilient to bot failures and unavailability 7/15
Simulation OSN Model and Graphs Characteristics of OSN o Degree o Clustering coefficient o High clustering o Low average network distance 8/15
Simulation Parameters Original OSN o 3 OSNs of size 5000, 10000, 15000 o Using the algorithm by Holme and Beom to generate Equivalent random graphs(ERG) o Creating ERG by using an algorithm by Viger and Latapy Why ERG ? o ERG helps a malware to propagate faster than the original OSN graph o An attacker may be able to obtain the graph of OSN using a tool such as R[12] or Pajek[2] 9/ 15
Simulation Malware Propagation Model 1. Randomly choosing a node(user) for infiltration 2. If (the user executes the command) The user s smartphone sends out a message to his/her friends, directing them to the malicious content (adjacent vertices in the social network graph) Upon receiving the message, each friend will execute the malware with a probability p 10/15
Simulation Setting fields to each command o A unique sequence number (SN) SNs help to minimize the number of duplicate messages o Time-to-live (TTL) A good estimate for the TTL is the diameter of the OSN graph How to avoid detection? o After receiving a command, a node checks the SN to see if it has seen the message before. if (message is new) o TTL-1 o Forwarding the message to its one-hop neighbors (adjacent vertices) else if (message is duplicate) o The node simply discards it 11/15
Results . As p from 0.5 to 1, the malware propagate faster 12/15 The first set of experiments- Scenario 1
Results The first set of experiments- Scenario 2 and 3 13/15
Results 14/15 The second set of experiments
Conclusion OSNs are more suitable for mobile botnet communications than the traditional SMS The highly clustered structure of OSNs make the botnet immune from random node failures Disadvantage o It doesn t show us the preventive measure Cautions is the parent of safety 15/15
