Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Networking Technology

What a Botnet Looks Like 122

Posted by timothy from the when-jerks-are-smart dept.
Esther Schindler writes "CSO has an annotated, zoomable map of real botnet topologies showing the interconnections between the compromised computers and the command-and-control systems that direct them. The map is based on work by security researcher David Voreland; it has interactive controls so you can zoom in and explore botnets' inner workings. Hackers use botnets for spamming, DDoS attacks and identity theft. One recent example is the Storm botnet, which may have comprised 1 million or more zombie systems at its peak. As with any networking challenge, there are good (resilient) designs and some not-so-good ones. In some cases the topology may be indicative of a particular botnet's purpose, or of a herder on the run."
This discussion has been archived. No new comments can be posted.

What a Botnet Looks Like More

What a Botnet Looks Like

Comments Filter:

  • Flash site, very funny. (Score:5, Funny)

    by inTheLoo ( 1255256 ) * on Thursday May 08, 2008 @01:53PM (#23340444) Journal

    To get a good look at a botnet they say, "You need to upgrade your Flash Player". How true!

    • Re: (Score:1, Informative)

      by gnutoo ( 1154137 ) *

      It is true [slashdot.org].

      • Oh come on. (Score:2, Interesting)

        by willeyhill ( 1277478 )

        Who modded this "offtopic"? The site requires the latest and greatest flash player to look at a freaking image when everyone knows that Flash has big fat holes in it. They might as well made it IE only.

    • Re:Flash site, very funny. (Score:5, Funny)

      by Bryansix ( 761547 ) on Thursday May 08, 2008 @02:45PM (#23341206) Homepage
      They say you can get a good look at a botnet by upgrading your flash player but I'd rather take your word for it.

  • What a Botnet Looks Like (Score:5, Funny)

    by sm62704 ( 957197 ) on Thursday May 08, 2008 @01:59PM (#23340530) Journal
    here's [interconnection.org] a photo of a botnet. Ok, it's a small botnet but if the botnet was a semi you wouldn't see the computers, now would you?

  • Thanks for posting... (Score:4, Funny)

    by Thelasko ( 1196535 ) on Thursday May 08, 2008 @02:00PM (#23340550) Journal
    all of the IP addresses. Can I get that in a text format? I want to add them to my hosts file.
    • all of the domains and IP addresses. Can I get them in text format please? I want to add the domains to my hosts file and the IP addresses to my firewall's blacklist.

      Had a brain cramp a moment ago.

      • Re:Thanks for posting... (Score:5, Insightful)

        by multipartmixed ( 163409 ) on Thursday May 08, 2008 @02:37PM (#23341102) Homepage
        I don't think you'd want to do that.

        My current RBL has about 6.5 million entries, and is extremely permissive. It is also updated bi-hourly.

        I sure wouldn't want my machine to traverse a hosts table of 7 million hosts every time I tried to look up a name in the DNS.

        Same for your firewall, 7 million entries will cripple iptables. Hell, 30,000 entries causes visible slowness on a dual-core opteron system.

        Of course, you might get better performance out of iptables with the ipsets kernel patch. But that's still a damned big list.

        • Not to mention... why blacklist them? It sounds reasonable at first, but blacklisting an IP cause it has a botnet is a poor idea of security, because all it takes is a new IP/new machine. If you are that afraid of getting hit by one, just try to keep up to date on your security information(at least patch monthly).

          Like parent stated, it will only slow down your packets. No real benefits will be gained.
        • Strange...

          Apart from memory constraints, why should there be a slowdown?

          Aren't IP addresses a numeric type that can easily be looked up in a hash table or a balanced binary tree?

          If the lookup algorithm is O(N) then I'm going to kill someone.
          • At first I thought he same thing. If we were only talking about IPs, there's only ~4 million possible in IPv4 and it would be cake to traverse that. However, he corrected and asked for the host names as well.

            I'm not quite sure why you'd block on host names instead of IPs for this purpose, but whatever.
            • First of all, the lookup in iptables appears to be O(N), when you use a single rule to block a single IP.

              Second, when you have many rules in iptables, it becomes extremely expensive to insert another one. It will take a long time, and no other iptables administrative operation can happen at the same time.

              Third, inserting rules with iptables-restore helps but not enough. I also mentioned ipsets as a solution, but that requires patching your kernel. I also don't know if it's good enough or not.

              Fourth, 2^32 is

        • Re: (Score:2)

          by Matey-O ( 518004 )
          What ELSE are you gonna do with three of four cores idle?

        • Re: (Score:1, Informative)

          by Anonymous Coward
          You don't want to use iptables for that kinda thing, you use ipset, arange all those IP addresses in a giant hash map and match against that :)
    • Um, I think you meant hosts.deny

      • Re: (Score:2)

        by Anpheus ( 908711 )
        On Windows machines the hosts file can be used to deny certain domains or IP addresses by defining them to 127.0.0.1
        • Ah. I had not thought of that. That's what I get for being a smart ass, I guess. : -)

    • Re: (Score:2, Funny)

      by apt-get moo ( 988257 )
      I heard 192.168.1.1 is among...

    • Re: (Score:2)

      by antdude ( 79039 )
      Isn't that pointless? Do we even know how old these datas are (didn't see any dates with a quick glance)? I am sure they change. It would be nice if we could get up to date ones often.

    • Re: (Score:2)

      by szap ( 201293 )
      Interactive Flash controls my foot. It looks like a raster image output of the Graphviz's dot command. Which takes a text file as an input, meaning we could have the source to generate the dang map in the first place.
  • because I don't work in this area, but I think a simpler explanation for the crazy hodge-podge of IP's on the map is dynamic IP's being given to a few infected PC's.

    How can one say with confidence that the design is purposeful?

  • reminds of the sexual partners mapping... (Score:5, Interesting)

    by Anonymous Coward on Thursday May 08, 2008 @02:02PM (#23340598)
    http://www.artsci.washington.edu/news/Autumn05/largermap_sexualnetworks.htm

    • Re: (Score:2)

      by erlenic ( 95003 )

      I looked through this pretty closely (it's amazing what boredom will do :). I could only find one same-sex encounter, and it wasn't in the largest group. It's in the second to the right structure along the top. Right in the middle of that group there's a triangle with a female-female encounter. I wonder if that triangle was three separate incidents, or one very lucky guy :D

      Anyone see anything else interesting? What's the highest number of partners for one individual?

      Extra note: I just went and looked agai

      • I found one male-male in the big blob, but I've not spotted the other one yet.

        As for the actual groupings, did anyone else notice that in all except the big huge "we sleep around a lot" map then the girls were more likely to have multiple partners? Both the two in the top-right and the star pattern that's not quite in the bottom-left have clusters around a pink blob and then mainly single partner chains from there.

        Yes, there's more lone guys with two female partners, but other than that then the girls seem

        • Re: (Score:2)

          by erlenic ( 95003 )

          As far as the big loop, I think it's less promiscuous than it seems as first. If you look closely, there are a lot of two partner people, and most of the branches are formed by someone with three. Considering this is an 18 month study in a high school, it's not unheard of for them to have two or three somewhat long term relationships, especially if one ended right at the beginning of the study.

          I see what you mean about the ratio of males to females among multiple partners. The most I could find was a male

        • Re: (Score:2)

          by jotok ( 728554 )
          IIRC there is something about this in Mathematics and Sex but
          1. It is easier for women to get laid,
          2. 10% of men sleep with 90% of women, and
          3. It is easier for women to get laid.

          Say you're an attractive woman. You walk into a party. Instantly the vast majority of guys and an appreciable minority of women want to take you home.

          Say you're an attractive guy. You walk into a party. Instantly the vast majority of women consider that they might signal to you in some subtle fashion that they are interested in

      • Re: (Score:1)

        by Zebedeu ( 739988 )
        And there is this one blue dot with 9 female connections on the largest group (on the top-right).

        The lucky bastard!

    • Re: (Score:2)

      by antdude ( 79039 )
      Obviously for a typical /.er like me, it is just one dot. :(

  • Wow - I can see my house from here! (Score:3, Interesting)

    by jmichaelg ( 148257 ) on Thursday May 08, 2008 @02:07PM (#23340676) Journal
    It would be nice to be able to search my static IP or a range of IPs to see if they are on the map.

  • Check out the losers (Score:5, Funny)

    by Hoplite3 ( 671379 ) on Thursday May 08, 2008 @02:08PM (#23340686)
    There are lots of well constructed stars, where a handful of master nodes control several slaves. Each slave knows two or three masters for redundancy. That's good design, and I expected it.

    But what's hilarious is that there are some ip addresses that are slaves to four or five different botnets. I wonder what the owners of those machines think?

    "Man, the internet sure is slow today!"

    "I need a new computer, this one's all slow."

    "Sweet! Five botnets and counting! I'm part of something! I belong!"

    • Re:Check out the losers (Score:5, Insightful)

      by Esther Schindler ( 16185 ) <esther@bitranch.com> on Thursday May 08, 2008 @02:18PM (#23340850) Homepage

      I do know what those users think, and it's very much like you posited: "My computer has become unusably slow, and I don't know why or how to fix it!" Unfortunately that was followed by, "Aunt Esther, can you tell me what's wrong?"—and thus I spent half a day killing enough of the junk that I could install a firewall, antivirus, etc.

      People like my nephew aren't unwilling to learn. They're just lost when it comes to their computers. And they don't particularly mind being ignorant as long as the equipment works right (or appears to). Just as most of us don't feel the need to understand how a car works in order to drive one.

      Some of us remember the days when we wistfully wanted computers to become easy enough for ordinary people to use them. Alas, we got our wish.

      • Re:Check out the losers (Score:4, Interesting)

        by Volante3192 ( 953645 ) on Thursday May 08, 2008 @02:28PM (#23340984)
        And they don't particularly mind being ignorant as long as the equipment works right (or appears to). Just as most of us don't feel the need to understand how a car works in order to drive one.

        Yes, but people are often more familiar with what a car needs. Regular oil changes, maintenance, gas; they might not know (or care) why the car needs these, but they know that if they don't, the car will fail to work.

        People don't even know that much about computers, about what they shouldn't do, even if they don't know why.

        • Re:Check out the losers (Score:4, Insightful)

          by Esther Schindler ( 16185 ) <esther@bitranch.com> on Thursday May 08, 2008 @03:00PM (#23341446) Homepage

          Not everyone does understand basic maintenance. You'd be amazed. Plenty of people wait until the car breaks down before they think to get it serviced.

          And they don't like to gain even basic knowledge. In the gas crisis of the late 1970s, my (then-)mother-in-law waited 40 minutes at a gas station before she got to the pump. When she discovered it was self-serve, she drove away, because she didn't know how to use the pump herself. (Yes, obviously all she had to do was ask the person behind her—who'd be motivated to help—but she didn't.)

          Also, even when people take the car in for maintenance, it's something they do out of distrust for the practitioners. That's better than not taking it in, of course, but it's inherently a combative relationship: what's the mechanic gonna tell me I need this time?

          The thing is, few of us want to be experts in every technology we use. We just want it to work.

          None of which excuses ignorance, mind you, but it does explain it.

      • And this, dear parents, is why you make an image of your kids computer and just put it back when the computer gets "slow".

        It will save you that day of irritation and removing all the junk.

        I guess that's worth a few bucks, isn't it?
      • It's scary. You get a friend, sibling, nephew, whatnot coming to you asking for you to fix their computer. And you just sit there and think "HOW IS THIS POSSIBLE!?"

        Pre-SP2, I only ever ran Spyware searches when I installed software I *knew* came with spyware, with no way to install it otherwise. I've since found better alternatives...but apart from tracking cookies, I get nothing now. Anyways, so even after doing a new installation of XP, along with 5-10 or so spyware filled programs, I'd get about 50 or so
    • Wow thats a pretty detailed map, in fact I think I see one of my IP address.

      Wait what?
    • from tfa:

      One thing to remember when looking at the map is that the information takes place over time. In that sense it's like time-lapse photography, a composite of 24 snapshots a day for 60 days. That means the more lines and points you see, the more activity you're looking at. The two connected stars to the left spent more time moving around than the single star below during the two months Vorel collected data.
      Maybe that's what you are seeing?

  • I, for one.. (Score:5, Insightful)

    by oodaloop ( 1229816 ) on Thursday May 08, 2008 @02:12PM (#23340770)
    ...would like to see more. Was there actually an article there, or was that just a picture? How about something about the methodologies used, a description of the organization of the network, maybe even some metrics like centrality. Something other than a picture, ferchrissakes.

  • How it looks like? (Score:3, Funny)

    by gmuslera ( 3436 ) on Thursday May 08, 2008 @02:15PM (#23340808) Homepage Journal
    There are fields, Neo. Endless fields where bot beings are no longer born. Are grown. For the longest time I wouldn't believe it and then I saw the fields with my own eyes...

  • Ha Ha! (Score:3, Funny)

    by Thelasko ( 1196535 ) on Thursday May 08, 2008 @02:22PM (#23340898) Journal
    One of the nodes backendportal.info [networksolutions.com] is registered to Horatio Nelson! [wikipedia.org]

  • Honeynets seem to be doing their thing (Score:4, Interesting)

    by Lucas123 ( 935744 ) on Thursday May 08, 2008 @02:26PM (#23340938) Homepage
    If you zoom in, you'll see a lot of the concentration of spiderwebs are around sites like honeynet.cz.
  • I can see my house from...oh wait..oh :/

  • 127.0.0.1 (Score:4, Funny)

    by Anonymous Coward on Thursday May 08, 2008 @02:32PM (#23341030)
    Wait, 127.0.0.1 is in there. That is my IP address!

  • How does eNom... (Score:3, Funny)

    by Thelasko ( 1196535 ) on Thursday May 08, 2008 @02:45PM (#23341210) Journal
    allow people to register with information like:
    Registrant Contact:
    elnopic
    elnopic elnopic (elnopic@elnopic.com)
    +1.2435543
    Fax: +1.5555555555
    123 sdhdsa g
    asdf, AD 34215
    US
    Do they not even try to verify this information?

    • Re: (Score:3, Interesting)

      by Thelasko ( 1196535 )
      after further investigation, it appears the above domain was registered by a company called namecheap also known as HostingAnime [wikipedia.org] a company known for hosting al-Qaeda websites.

      Coincidence? I think not!

  • Too many bots! (Score:3, Funny)

    by IBBoard ( 1128019 ) on Thursday May 08, 2008 @03:00PM (#23341456) Homepage
    There must be too many bots - I can't even get it to render! All I get is a white page with no nodes and no links :\

    Either that or they've rendered the botnet on a white background in apple white with light grey lines.

    (i.e. it seems to be Slashdotted ;) )

  • yeah... and (Score:3, Interesting)

    by spikedvodka ( 188722 ) on Thursday May 08, 2008 @03:05PM (#23341548)
    And why's this so much news?
    Any self-respecting revolutionary knows that you have a distributed network, so that even if a cell goes down, you can still pass messages.

    Hell... I wish IRC could learn from this, I've had enough of netsplits. By rights only the server that goes offline should be affected if it goes down, it shouldn't split the network into 2 massive sections.

    Yeah the image looks nice, and is all "ooohhhh ahhhh" and lends itself to "Hey... that's me", but really "News"? I think not

    Call me when they have an article as to how they got this information

    -1 "Cynical Bastard"

    • Re: (Score:2)

      by drew ( 2081 )
      I certainly hope there aren't too people here saying "Hey... that's me!"
  • ...And people say nobody uses IRC anymore.
  • Anyone knows if there's a tool to check an IP and see if it's part of a botnet?

  • Hey.... (Score:2, Funny)

    by losethisurl ( 980326 )
    That looks alot like the map of our network where I am emplo... oh crap...
  • I zoomed in and saw "pimpin.opendns.be" attatched to 1.3.3.7 Has someone been messing with them or something? Anyone else seen any weird ones?
  • Wow, I can see my house's IP address from the zoom-out. It looks like a little ant from up here.
  • hacker != blackhat
    ... come on, this is /. we're smarter then this, we not supposed MSM misinformed terminology
  • Is that too much to ask?

    David is lead on the Czech Honeynet Project - http://www.honeynet.cz/?mmenu=home&smenu_int=0&lang=en&vmetr=1 [honeynet.cz]

  • A little off topic, but my use of non-text tools is a bit limited. :) How would one go about mimicing the ability to make that Botnet map?

Slashdot Top Deals

"What man has done, man can aspire to do." -- Jerry Pournelle, about space flight

Close