Recruiting Friendly Botnets To Counter Bad Botnets

holy_calamity writes "New Scientist reports on a University of Washington project aiming to marshal swarms of 'good' computers to take on botnets. Their approach — called Phalanx — uses its distributed network to shield a server from DDoS attacks. Instead of that server being accessed directly, all information must pass through the swarm of 'mailbox' computers, which are swapped around randomly and only pass on information to the shielded server when it requests it. Initially the researchers propose using the servers in networks such as Akamai as mailboxes; ultimately they would like to piggyback the good-botnet functionality onto BitTorrent."

Throttled

[zedlander (1271502)]

ultimately they would like to piggyback the good-botnet functionality onto BitTorrent.

Yeah, just let the ISP's bring your site to its knees instead of the botnets.

GTFO my torrents.

[snarfies (115214)]

Ah yes. So now not only do Comcast and company want to throttle my torrents, but now these yahoos want to press my computer into their vigilante posse?

Do these guys, possibly actually WORK for Comcast and are out looking for ways to make every ISP in the world, and possibly governments as well, ban torrents?

Re:

[boris111 (837756)]

Ha vigilante was the first thing that popped in my head. What happens when these vigilantes feel the power in their hands and they themselves turn evil? A legitimate question would be: couldn't a black hat reverse engineer this and use it against the white hats?

What kind of mental cripple thinks this shit up?

[Chas (5144)]

NO!

NO NO NO NO!

However you slice it, even if this "friendly" botnet is performing some beneficial task (such as kacking a bad botnet that's infected my machine), it's STILL bad!

It's accessing and carrying out tasks on my machine without my express permission.

HELL FUCKING NO!

This is NOT a "lesser of two evils" choice here. BOTH choices (malicious botnet or "beneficial" botnet) are evil, PERIOD!

Re:What kind of mental cripple thinks this shit up

[zedlander (1271502)]

From TFA:

Their system, called Phalanx, uses its own large network of computers

Chill the flip out, man. They're not taking over your computer.

Could we have something like Phalanx@Home?

[vivin (671928)]

Like Seti@Home or Folding@home? We could have people sign up and join the Phalanx network. Or create a similar "open" network? People could then sign up for the service. I guess you could make it to where when you sign up, your computer becomes part of the network, and is also protected by the network. I don't know how feasible this is... just throwing out ideas.

Re:

[poetmatt (793785)]

I've heard of this open network based on a whole bunch of computers interconnected....I believe it was called, last I checked, the internet?

Re:Could we have something like Phalanx@Home?

[PitaBred (632671)]

Calling it Phalanx is lame. It should be called Legion.

Re:

[raddan (519638)]

Good idea, but you'd want to make sure that Phalanx@Home is a securely-written (e.g., privilege-separated, full-paranoia input validation, all passed communication is unreadable by the node, etc...) application so that it cannot be taken over by a 'bad' botnet operator. Otherwise, thanks for the botnet, UDub!

Re:

[alphamugwump (918799)]

You wouldn't want an open network. The whole point is to keep the IP address of the server secret. If it's open, then everyone knows. Unless you do something like TOR hidden services.

Re:What kind of mental cripple thinks this shit up

[GroeFaZ (850443)]

Uhm hyperventilating much? This is /. after all and we don't need to RTFA, but please at least cut down the unwarranted profanity. FTA:

"Rather than using an ill-gotten botnet, Phalanx would use the large networks of computers which companies currently use to serve massive amounts of content," says team member Colin Dixon."

Flame where warranted, but please, please, don't rely on /. summaries to form your opinion. *sigh*.

Re:What kind of mental cripple thinks this shit up

[whm (67844)]

Did you even read the summary?

It's not an offense, it's a defense. A protected server has all traffic routed to members of large cluster of helper machines (the "good botnet"). The protected server then contacts and collects the content as it is able. Instead of a DDOS attack being able to shovel data down on the target, the data is distributed to the cluster of helper machines. The recipient server then deals with the traffic at a pace it is able.

The article is short, but it kind of sounds like each node in the "good botnet" is serving as a sort of per-connection proxy to the destination server.

Maybe that clarifies things a bit?

misused buzz word alert

[BrunoUsesBBEdit (636379)]

It's not a botnet, but if they hadn't inappropriately used that buzz word, would we be talking about it?

It's frustrating the way our terminology continues to get diluted to where everything becomes ambiguous because you must assume that the majority of the people out there don't know the meanings of the words.

A good off topic example is "stereotype, bigotry, and racism" through related, these three are distinct but everything is now just rolled up into racism. This makes it difficult to express that a pers

The same kind of mental cripple who doesn't RTFA?

[Len (89493)]

They are NOT talking about "accessing and carrying out tasks on my machine without my express permission."

"Rather than using an ill-gotten botnet, Phalanx would use the large networks of computers which companies currently use to serve massive amounts of content," says team member Colin Dixon.

who flagged this post insightful O_o

[someone1234 (830754)]

The problem with this approach is not because they 'take over' your machine (by consent).
This is just a treatment of the symptom. The cure would be to sanitize and shield luser computers from zombie recruitment.

I've always wondered...

[neokushan (932374)]

I've always wondered why botnets always seemed to be created by black hats. I think it'd be cool to have a competition where some whitehats try to exploit a vulnerability in some software in order to patch it FROM that vulnerability.
Even if it just forced a windows update, it'd still be quite useful, but it seems nobody with the skills to pull off such a feat can be bothered to do it.
Surely there's some benign genius out there who could exploit an existing botnet to send it a shutdown command, rather akin to how captain Picard defeated the Borg after he was captured by them, once again proving that Star Trek has given us great insight into the future and, of course, that Picard is better than Kirk will ever be?

Re:I've always wondered...

[CogDissident (951207)]

Because, a white hat could do it for free, and it'd be cool, but they'd risk being sued into a smoking crater if they told anyone.

By contrast, a black hat, stands to make thousands and thousands of dollars by just exploiting that vulnerability.

Which would you choose? Honestly?

Re:I've always wondered...

[sm62704 (957197)]

Not to mention that using someone's computer without their permission is unethical. Black hats don't have to bother with ethics or morals.

GP: Even if it just forced a windows update

The first Windows update after I installed XP hosed my network drivers. If I hadn't given permission for that update I'd have seen a lawyer about the matter.

If you don't have permission to be in a computer STAY THE HELL OUT OF IT. It's unethical, it's illegal, and it's BAD MANNERS.

Re:

[What Would NPH Do (1274934)]

If I hadn't given permission for that update I'd have seen a lawyer about the matter.

Yeah, and you would have been subsequently laughed out of court as your case was dismissed. You'd also would have most likely been held accountable to pay Microsoft's attorney's fees.

Re:

[What Would NPH Do (1274934)]

Then please explain to my poor fucktarded brain why they should have a legal right to hack into my computer without permission?

Who said they did? You were talking about how you would have sued Microsoft had someone forced your computer to do a Windows Update and something had broken a driver on your system. The fact of the matter is that Windows Update would have no clue one way or another whether you, a virus, or some remote entity had allowed the update to be installed and as such you'd have no basis to sue Microsoft. Hence why I said your case would have been dismissed.

Re:

[Torvaun (1040898)]

He didn't say he would have sued Microsoft, he said he would have called a lawyer. Microsoft was never specified as the target of said lawyer. Basically, he's saying that if someone breaks his computer without permission, he's holding them liable, even if they were trying to be helpful.

Re:

[sm62704 (957197)]

Agreed, since Microisoft's driver hosed the system. I didn't even know it was updating a driver; I'd left automatic update on. That was the last time I let it do an automatic update! Had a hell of a time figuring out what was wrong with the computer. First I thought I broke the modem (it fell off the table(, the ISP's tech confirmed that he could see the modem so I thought cable. Almost bought a new LAN card when I reinstalled XP because it had disabled Roxio CD software's drivers and wouldn't let me uninst

Re:

[sm62704 (957197)]

What if my computer was a honeypot as part of a honeynet?

Re:

[ma1wrbu5tr (1066262)]

Then you'd have a problem with bears in your office. ;)

Re:

[SScorpio (595836)]

The only reason it's not already down is due to legal issues. Back in 2000ish there was an exploit for I believe IIS. Someone made a Perl module people put on their Linux Apache servers in the location of the exploit on the Windows box. When the exploit was trigger, the Linux box connected to the Windows Server using the same exploit, patched the box, and removed the worm, and forced a reboot.

This never caught on though because people were too worried about getting sued for hacking a server. The best so

Re:

[ShiNoKaze (1097629)]

Psh, if they're so benign they can't be that smart... It's the Evil genius that gets all the credit.

Re:I've always wondered...

[ChenLiWay (260829)]

It's been done http://en.wikipedia.org/wiki/Welchia [wikipedia.org] with mixed results.

Re:I've always wondered...

[Orinthe (680210)]

I seem to remember that back when the Blaster worm was a big deal, someone did just this. Thing is, everyone complained and said it was terrible and irresponsible to patch peoples' computers without their permission, potentially causing instability, especially in the enterprise where patches have to be thoroughly vetted before being applied, even if they are for critical vulnerabilities. Someone else pointed this out, too, with an appropriate link to http://en.wikipedia.org/wiki/Welchia [wikipedia.org]

Re:I've always wondered...

[witherstaff (713820)]

I remember one of my boxes was compromised in the 90s through a POP3 exploit. The kid patched the hole after he gave himself an ssh account. He poked around the pr0n site hosted on it, then sent me a talk request to tell me what he did. I miss the old days of polite crackers.

Re:

[ArsonSmith (13997)]

White hats just use the basic social engineering technics of hacking. See Seti, RSA, etc...

Re:

[prennix (1069734)]

There are lots of great things we could do for humanity with your computer. Please send me your login credentials. We'll be glad to let you know what great things we've done with your computer in a few weeks. I'll leave a note on your desktop.

This will never work

[by Anonymous Coward]

The researchers are so ignorant of history. All the malware writers have to do is to create a Legion botnet. The Legion defeats a Phalanx every time.

At least watching this in action would be cooler than playing Rome: Total War.

My botnet....

[by Anonymous Coward]

can beat up your botnet

Future of Botnets

[pieterh (196118)]

First person to make a "good" BotNet where you can join and get protection for a low, low monthly subscription, makes a killing.

BotNets are obviously the only way to fight BotNets.

Re:

[H0p313ss (811249)]

First person to make a "good" BotNet where you can join and get protection for a low, low monthly subscription, makes a killing.

You mean... you won't make us an offer we... we can't refuse?

Re:

[flaming error (1041742)]

So if we pay "protection" money, our network won't be taken down.

  > You mean... you won't make us an offer we... we can't refuse?
Somebody "makes a killing". That's all he's saying.

Re:

[Thelasko (1196535)]

I doubt you would actually get protection by joining a good botnet. The bad botnet will likely attack the good botnet and take out at least a few of the machines (temporarily). A machine in a good botnet is about as secure as any given fish in a school of fish.

Re:

[m0i (192134)]

It already exists and is bigger than any other, it is called windowsupdate and it is included with your XP license (or keygen..). Why would one try to do better than Microsoft at fixing their own OS is beyond me.

Re:

[sharp-bang (311928)]

We have those already, except for the "protection" part. It's called AV.

Calling Hollywood

[amplt1337 (707922)]

You know, this could be a pretty exciting movie plot.

Or at least an episode of Battlestar: Galactica or something.

awwww

[umbl3r (1247150)]

aww reminds me of the days that if you tried to probe a bot server it tried to launch a DOS attack on you. had many hours of fun spoofing a nmap of a bot server's ip and watch the servers take each other out.. man i laughed for days watching bots attack each other.. aw the good-ol days.

Not the Solution

[Thelasko (1196535)]

Using another botnet to send puzzles to the first botnet before it is allowed to access the main server works on a small scale. But think about it this way. If you have two networks sending massive amounts of useless data across the interweb. The ordinary users (whether they are members of a botnet or not) will suffer. Network traffic will slow to a crawl globally (I suspect it already has due to botnet activity). This will result in a MAD scenario reminiscent of the Cold War. Global network traffic w

Re:

[Thelasko (1196535)]

But it is the solution! If an internet protocol is developed that requires each machine that wishes to connect to a website to use a few computing cycles to do something constructive, like BOINC, we could make massive advances in science and technology in no time! By doing so we could harness the power of the botnets to do good.

Re:

[nuzak (959558)]

You activate the system when a DDOS attack starts. The network traffic at that point already is almost nothing but noise. Defeating the attack reduces the noise.

Besides, what makes you think computational puzzles require massive amounts of data?

We already have that

[HangingChad (677530)]

If you have two networks sending massive amounts of useless data across the interweb.

They're called Facebook and MySpace.

stupid idea is stupid.

[discogravy (455376)]

well, sure, every single other time someone made a "good" virus to patch holes that "bad" viruses exploited, it didn't work out and in fact became a bigger problem than the original virus, but since this is about *distributed* botnets -- waaaaaayyyy more than just one or two infected machines -- *THIS* time it'll work perfectly.

Further reading: http://www.people.frisk-software.com/~bontchev/papers/goodvir.html [frisk-software.com]

americans and overengineering

[jollyreaper (513215)]

Americans always try to over-engineer solutions. Just look at how the Russians handle it. Have a problem with a spammer? A man, a gun, and one bullet later, problem solved. Fancy counter-botnets? Nyet, comrade. Now let me tell you how it goes for journalists in Putinist Russia...

Rise of the BotNets

[Nom du Keyboard (633989)]

Just because you're taken over by a Good BotNet instead of an Evil one, that doesn't mean that it's a good thing in the grand scheme of things.

Re:

[zedlander (1271502)]

Heck, I do it for free [stanford.edu].

Re:Question

[What Would NPH Do (1274934)]

1) How do you detect a DDoS attack?

There are various ways. Activity profiling, sequential change point detection, wavelet analysis, etc. Here's a good page on different techniques: http://dsonline.computer.org/portal/site/dsonline/menuitem.6dd2a408dbe4a94be487e0606bcd45f3/index.jsp?&pName=dso_level1_article&TheCat=1001&path=dsonline/2006/01&file=w1spot.xml& [computer.org]