Recruiting Friendly Botnets To Counter Bad Botnets

holy_calamity writes "New Scientist reports on a University of Washington project aiming to marshal swarms of 'good' computers to take on botnets. Their approach — called Phalanx — uses its distributed network to shield a server from DDoS attacks. Instead of that server being accessed directly, all information must pass through the swarm of 'mailbox' computers, which are swapped around randomly and only pass on information to the shielded server when it requests it. Initially the researchers propose using the servers in networks such as Akamai as mailboxes; ultimately they would like to piggyback the good-botnet functionality onto BitTorrent."

Throttled

ultimately they would like to piggyback the good-botnet functionality onto BitTorrent.

Yeah, just let the ISP's bring your site to its knees instead of the botnets.

GTFO my torrents.

Ah yes. So now not only do Comcast and company want to throttle my torrents, but now these yahoos want to press my computer into their vigilante posse?

Do these guys, possibly actually WORK for Comcast and are out looking for ways to make every ISP in the world, and possibly governments as well, ban torrents?

Re:

Ha vigilante was the first thing that popped in my head. What happens when these vigilantes feel the power in their hands and they themselves turn evil? A legitimate question would be: couldn't a black hat reverse engineer this and use it against the whi

I've always wondered...

I've always wondered why botnets always seemed to be created by black hats. I think it'd be cool to have a competition where some whitehats try to exploit a vulnerability in some software in order to patch it FROM that vulnerability.
Even if it just forced a windows update, it'd still be quite useful, but it seems nobody with the skills to pull off such a feat can be bothered to do it.
Surely there's some benign genius out there who could exploit an existing botnet to send it a shutdown command, rather akin to how captain Picard defeated the Borg after he was captured by them, once again proving that Star Trek has given us great insight into the future and, of course, that Picard is better than Kirk will ever be?

Re:I've always wondered...

Because, a white hat could do it for free, and it'd be cool, but they'd risk being sued into a smoking crater if they told anyone.

By contrast, a black hat, stands to make thousands and thousands of dollars by just exploiting that vulnerability.

Which would you choose? Honestly?

Re:I've always wondered...

Not to mention that using someone's computer without their permission is unethical. Black hats don't have to bother with ethics or morals.

GP: Even if it just forced a windows update

The first Windows update after I installed XP hosed my network drivers. If I hadn't given permission for that update I'd have seen a lawyer about the matter.

If you don't have permission to be in a computer STAY THE HELL OUT OF IT. It's unethical, it's illegal, and it's BAD MANNERS.

Re:

What if my computer was a honeypot as part of a honeynet?

Re:I've always wondered...

It's been done http://en.wikipedia.org/wiki/Welchia [wikipedia.org] with mixed results.

Re:I've always wondered...

I seem to remember that back when the Blaster worm was a big deal, someone did just this. Thing is, everyone complained and said it was terrible and irresponsible to patch peoples' computers without their permission, potentially causing instability, especially in the enterprise where patches have to be thoroughly vetted before being applied, even if they are for critical vulnerabilities. Someone else pointed this out, too, with an appropriate link to http://en.wikipedia.org/wiki/Welchia [wikipedia.org]

Re:I've always wondered...

I remember one of my boxes was compromised in the 90s through a POP3 exploit. The kid patched the hole after he gave himself an ssh account. He poked around the pr0n site hosted on it, then sent me a talk request to tell me what he did. I miss the old days of polite crackers.

Re:

White hats just use the basic social engineering technics of hacking. See Seti, RSA, etc...

This will never work

The researchers are so ignorant of history. All the malware writers have to do is to create a Legion botnet. The Legion defeats a Phalanx every time.

At least watching this in action would be cooler than playing Rome: Total War.

Future of Botnets

First person to make a "good" BotNet where you can join and get protection for a low, low monthly subscription, makes a killing.

BotNets are obviously the only way to fight BotNets.

Re:

I doubt you would actually get protection by joining a good botnet. The bad botnet will likely attack the good botnet and take out at least a few of the machines (temporarily). A machine in a good botnet is about as secure as any given fish in a school o

awwww

aww reminds me of the days that if you tried to probe a bot server it tried to launch a DOS attack on you. had many hours of fun spoofing a nmap of a bot server's ip and watch the servers take each other out.. man i laughed for days watching bots attack each other.. aw the good-ol days.

stupid idea is stupid.

well, sure, every single other time someone made a "good" virus to patch holes that "bad" viruses exploited, it didn't work out and in fact became a bigger problem than the original virus, but since this is about *distributed* botnets -- waaaaaayyyy more than just one or two infected machines -- *THIS* time it'll work perfectly.

Further reading: http://www.people.frisk-software.com/~bontchev/papers/goodvir.html [frisk-software.com]

Re:What kind of mental cripple thinks this shit up

From TFA:

Their system, called Phalanx, uses its own large network of computers

Chill the flip out, man. They're not taking over your computer.

Could we have something like Phalanx@Home?

Like Seti@Home or Folding@home? We could have people sign up and join the Phalanx network. Or create a similar "open" network? People could then sign up for the service. I guess you could make it to where when you sign up, your computer becomes part of the network, and is also protected by the network. I don't know how feasible this is... just throwing out ideas.

Re:Could we have something like Phalanx@Home?

Calling it Phalanx is lame. It should be called Legion.

Re:

Good idea, but you'd want to make sure that Phalanx@Home is a securely-written (e.g., privilege-separated, full-paranoia input validation, all passed communication is unreadable by the node, etc...) application so that it cannot be taken over by a 'bad' bo

Re:What kind of mental cripple thinks this shit up

Uhm hyperventilating much? This is /. after all and we don't need to RTFA, but please at least cut down the unwarranted profanity. FTA:

"Rather than using an ill-gotten botnet, Phalanx would use the large networks of computers which companies currently use to serve massive amounts of content," says team member Colin Dixon."

Flame where warranted, but please, please, don't rely on /. summaries to form your opinion. *sigh*.

Re:What kind of mental cripple thinks this shit up

Did you even read the summary?

It's not an offense, it's a defense. A protected server has all traffic routed to members of large cluster of helper machines (the "good botnet"). The protected server then contacts and collects the content as it is able. Instead of a DDOS attack being able to shovel data down on the target, the data is distributed to the cluster of helper machines. The recipient server then deals with the traffic at a pace it is able.

The article is short, but it kind of sounds like each node in the "good botnet" is serving as a sort of per-connection proxy to the destination server.

Maybe that clarifies things a bit?

The same kind of mental cripple who doesn't RTFA?

They are NOT talking about "accessing and carrying out tasks on my machine without my express permission."

"Rather than using an ill-gotten botnet, Phalanx would use the large networks of computers which companies currently use to serve massive amounts of content," says team member Colin Dixon.

Re:

Heck, I do it for free [stanford.edu].

Re:Question

1) How do you detect a DDoS attack?

There are various ways. Activity profiling, sequential change point detection, wavelet analysis, etc. Here's a good page on different techniques: http://dsonline.computer.org/portal/site/dsonline/menuitem.6dd2a408dbe4a94be487e0606bcd45f3/index.jsp?&pName=dso_level1_article&TheCat=1001&path=dsonline/2006/01&file=w1spot.xml& [computer.org]