基于僵尸网络的新型网格计算分布式暴力攻击方案(GCDBF)(IJCNIS-V9-N6-3)

I.J.ComputerNetworkandInformationSecurity,2017,6,21-29PublishedOnlineJune2017inMECS()DOI:10.5815/ijcnis.2017.06.03Copyright©2017MECSI.J.ComputerNetworkandInformationSecurity,2017,6,21-29OnaNovelGridComputing-BasedDistributedBrute-forceAttackScheme(GCDBF)ByExploitingBotnetsMohammadReza.HasaniAhangarImamHosseinUniversity/DepartmentofComputerEngineering,Tehran,IranE-mail:[e-mail]ityofTechnology(TehranPolytechnic)/DepartmentofComputerEngineering,Tehran,Iran,ImamHosseinUniversity/DepartmentofComputerEngineeringE-mail:[e-mail],[e-mail]—Brute-forceattacksareknowntobethepromisingwaytobreakintoevenmostcomplicatedsystemsbytryingeverypossiblepermutationofthekeys.Butsincecryptosystemsbegantouselongerandmorecomplexkeys,brute-forceattackshaslosttheirusability,becauseofrelativelyhighcomplexityoftryingeverypossiblepermutationwithrespecttocomputationalpowerandcomputationtimethatwasavailabletocryptobreakers.Althoughcomputationalpowerisincreasingcontinuously,itsincreasingrateislessthanthatofkeylengthandcomplexity.Havingtheseassumptionsinmind,itisinfeasibleforcentralizedtraditionalcomputingarchitectureswithlimitedcomputationpowertobreakintomoderncryptosystembycompromisingthekeywithimplementingschemeslikeconventionalbrute-force.Inthispaperauthorsaimfordevisinganovelbrute-forceschemewhichintegratesamoderncomputingarchitecture(gridcomputing)withbotnetsinordertoperformbrute-forceattackswithlowercomputationtimeandlowerequipmentcostforindividualcryptobreakerswhohavenoaccesstosupercomputers.Insummary,GCDBFusesaportionofcomputationpowerofeachoftheinfectednodesbelongingtoabotnetinagrid-basedenvironmentinordertoprocessaportionoftotalworkloadofabrute-forceattackwhichisneededforbreakingaspecifickey.Thisapproachneutralizestheneedofacquiringsupercomputersforindividualhackerswhilereducingtherequiredtimeforbreakingthekeybecauseofusinggridcomputingarchitecture.Forthepurposeofevaluation,GCDBFisimplementedindifferentscenariostoproveitsperformanceincomparisontocentralizedbrute-forcescheme.IndexTerms—Brute-force,gridcomputing,distributedcomputing,botnets.I.INTRODUCTIONBrute-forceattackshavebeenrecognizedasonethemostbasicandpromisingwaysforbreakingciphersforalongperiodoftime.Inordertoneutralizethiskindofattack,cryptosystemsdesignersbegantofurthercomplicatetheirsystemswhichresultsinmorecomplexityforbreakingthem.Ontheotherhand,computingpowerhasalsoincreased.Thesetwoapproachescreateaclosecompetitionbetweencryptosystemsdesignersandcryptobreakers.Sincethen,cryptosystemsdesignersfoundawaytoovercomethisissuewhichwas:increasingthekeyspace.Forakeywithlengthofnbinarybits,wehavetheprobabilityspace(orkeyspace)of.Inaverageaneffortoforderisrequiredtofindtheactualkey.Therefore,akeywithlong-enoughlength(i.e.,128bits)requiresaverylongtimetobreakanditisalsocomputationallyexpensivetoperform.Thisamountofcomputationaleffortandtimemakescentralizedbrute-forceattacksinfeasibleintermsofcomputationtimeandequipmentcost.Therefore,nowadaysbrute-forceattacksarenotaseffectiveastheywereatthebeginning.Inthispaper,wedeviseanovelscheme(GCDBF)whichitselfbasicallyconsistsofacombinationofthreemainconcepts:1.Brute-forceattacks2.Botnets3.GridComputingEachofwhichwillbebrieflydescribedrespectively.A.Brute-forceAttackBrute-forceattacksaredesignedtofindkeys(suchaspasswords)withguessingortryingeverypossiblekey.Forexample,cryptobreakersassumethatuserschoosetheirpasswordsfromasmallsubsetofthefullpasswordspace,e.g.,shortpasswords,dictionarywords,propernames,andlowercasestrings[1,2].Inthiscase,theattackersattempttologintouseraccountsbytryingalmostallofthepossiblepasswordsuntiltheactualoneisfound.Ifthecryptobreakersexploitapredeterminedlistofcommonorusualpasswords,theywillbeabletoperformadictionaryattack,otherwisetheyspaceof22OnaNovelGridComputing-BasedDistributedBrute-forceAttackScheme(GCDBF)ByExploitingBotnetsCopyright©2017MECSI.J.ComputerNetworkandInformationSecurity,2017,6,21-29passwordswillbesearchedbyusingbrute-forceattack.Brute-forceattacksdivideintosimpleordistributedattacks.Insimpleattacksorcentralizedattacks,thecryptobreakerusesonlyonehostthatsearchesfortheactualpassword.Indistributedattacks,manycryptobreakerssendrelativelysmallnumbersofrequestsatonce[2].ItisnoteworthythatGCDBFdistributionisdifferentthan[2]orothersimilarworks,sinceitconductsbrute-forcebyimplementingitbythemeansofgridcomputingconceptsandbotnets’components.Brute-forceattacksrequiresignificantamountoftimeandprocessingpowerwhenthekeyspaceislong.Acomputerprogramisusuallyusedtoconductabrute-forceattack.Theeffortofbrute-forceshouldstartwithonedigitpasswordnumberandcoverallpossibilitiesinaworstcase[3,4].B.BotnetsAbotnetisanetworkofthousandsofcomputers(knownasbots,zombiesorinfectednodes)thatareinfectedbyaparticularmalwareandarecontrolledbyabotmaster(orbotherder)[5].Botherder(personwhocreatesthebotandisabletocontrolitremotely)sendcommandstoaserver,whichrelaysthosecommandstoinfectednodes.Uponexecutingthecomm