William Adama writes "In the past week, I've observed a spike in brute-force attacks on ssh on one of our servers. Closer inspection leads me to the conclusion that this is (once again) an instance of a distributed attack conducted over a botnet. Now, I could just lean back and relax, since logging into ssh with a password has been disabled for several years on all our servers — the attacker will never succeed. But it rankles with me that there are all these compromised machines out there, and there is nothing I can do. So I've cobbled together a script that extracts relevant email-addresses from the attacking nodes' whois-entries and sends a notification to the relevant network admins and abuse-handling queues, and repeats the notification if nothing has changed after 24 hours.
As it turns out (and as you've probably guessed), that is an imprecise, incomplete and tedious approach. Imprecise because the email addresses gleaned from the whois entry don't always lead to the right network admin. Incomplete because notifications fail to arrive for a variety of reasons, be it that the whois-data is out of date or doesn't contain any contact information at all, or that the abuse-account has exceeded the allotted quota. Tedious because every single sent notification that does arrive somewhere in an abuse queue results in an automated response, filling my inbox with yet more messages that need to be carefully looked at before being moved to /dev/null — and because in some cases discussion ensues, and/or log entries have to be added to the supplied information. There must be a way to automate this battle against the bots, to leverage the fact that we all take similar steps to protect our machines.
So I would like to tap into the repository of wisdom that is slashdot, and ask: what can be done to combat Botnets?
Here's my vision: since we can't simply take compromised nodes off the net (for both technical and legal reasons), we should try to take the net off those machines. We need a directory of known compromised nodes, with a simple interface to submit current botnet activity, and one to update our hosts.deny file or our firewall rules, perhaps using a probability gradient. Is it possible to set up such a system so that it can't be subverted to be used as a DOS-vector? What are the legal and or ethical implications? How do we deal with dynamic IPs? What information can we make available to concerned network-admins? Whose reports do we trust?
Discuss"
