Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×

Is the Botnet Battle Already Lost? 374

Posted by CowboyNeal from the fighting-the-good-fight dept.
An anonymous reader writes "Researchers are finding it practically futile to keep up with evolving botnet attacks. 'We've known about [the threat from] botnets for a few years, but we're only now figuring out how they really work, and I'm afraid we might be two to three years behind in terms of response mechanisms,' said Marcus Sachs, a deputy director in the Computer Science Laboratory of SRI International, in Arlington, Va. There is a general feeling of hopelessness as botnet hunters discover that, after years of mitigating command and controls, the effort has largely gone to waste. 'We've managed to hold back the tide, but, for the most part, it's been useless,' said Gadi Evron, a security evangelist at Beyond Security, in Netanya, Israel, and a leader in the botnet-hunting community. 'When we disable a command-and-control server, the botnet is immediately re-created on another host. We're not hurting them anymore.' There is an interesting image gallery of a botnet in action as discovered by security researcher Sunbelt Software."
This discussion has been archived. No new comments can be posted.

Is the Botnet Battle Already Lost? More

Is the Botnet Battle Already Lost?

Comments Filter:
  • this whole thing is just ridiculous. yes, sure if you treat existing poorly engineered systems as inviolate and try to work around them its a never ending battle. but the basic tools to provide systemic distributed security have been published for quite some time. fix the problem at its source and stop screwing around.

    yes, pkis are not flawless, but it would be a huge step above this kind of flailing
    • fix the problem at its source and stop screwing around.

      And what is the source?

      If the source is an insecure OS, how are we going to convince the botnet fodder to patch/upgrade/secure ? Even if Vista turns out to be a very secure OS, we will have to wait for a couple of generations before adoption is widespread. Do you know anybody who still uses Windows 98? I do.

      Is the battle already lost? Probably not. But for the moment they are winning, and all the actions we can take are purely reactive.
  • One can always create reverse honey-pot servers that connect to the chat channel and when given a command, reply with "I am sorry Dave, I cannot do that..." and then recite some multi-gigabyte random poem into the channel :)

    The key here is "unpatched server" and of course it happens to be a windows box... hmmm...

    • Re: (Score:2)

      by LordEd ( 840443 )
      multi-gigabyte random poem
      That would be a very long poem. By the time you finish reciting that to your young sweetheart, I think she would die of old age.

      Oh wait, this is slashdot. Nevermind.

    • Re: (Score:3, Funny)

      by Phroggy ( 441 ) *
      Oh freddled gruntbuggly,
      Thy micturations are to me
      As plurdled gabbleblotchits
      On a lurgid bee.
      Groop, I implore thee, my foonting turlingdromes
      And hooptiously drangle me
      with crinkly bindlewurdles,
      Or I will rend thee in the gobberwarts with my blurglecruncheon
      See if I don't.

  • Restrictive Firewall Infection (Score:2, Interesting)

    by Anonymous Coward
    Why hasn't anybody created a "good" trojan that uses as many common exploits as possible to infect these already infected machines with a port-80 restrictive firewall? I think for every somewhat bright for-profit trojan creator, there are thousands of brighter people that can come up with an intelligent plan to do this effectively. Use all spreading techniques that the best of the worst use, but minimize the wasted & bloated traffic, while fixing as many computers as possible. Should be simple!!

    Only
    • I think this was done already, but Google is letting me down. Can't find anything to back up this recollection.

    • Re: (Score:2, Informative)

      by Anonymous Coward
      You'd have to do this anonymously, vigilante-style. You'd be thrown in prison just as quickly as the people who create the more malicious exploits, as you would be illegally accessing people's computers, even if you're trying to help.

    • Why use a trojan? (Score:3, Informative)

      by khasim ( 1285 )

      Why hasn't anybody created a "good" trojan that uses as many common exploits as possible to infect these already infected machines with a port-80 restrictive firewall?

      There have been attempts at doing so with worms ... but these machines are already pwn3d and reporting into a known channel.

      In theory, there is nothing stopping the "researchers" from having the zombies identify their OS's, download any patches, install a personal firewall and automatically updating anti-virus program and then removing the ori

    • Re: (Score:2)

      by Firehed ( 942385 )
      Shouldn't this take place on Patch Tuesday?

    • Comment removed (Score:4, Interesting)

      by account_deleted ( 4530225 ) on Tuesday October 17, 2006 @01:03AM (#16464343)
      Comment removed based on user account deletion

  • We need a really big lawsuit against Microsoft (Score:3, Interesting)

    by Animats ( 122034 ) on Monday October 16, 2006 @11:11PM (#16463585) Homepage

    What's needed is for someone like NY Attorney General Elliot Spitzer to charge Microsoft with reckless endangerment for knowingly, willfully, and negligently distributing and continuing to distribute systems vulnerable to such attacks.

    Meanwhile, we may need some brutal firewalls:

    • All incoming e-mail is reformatted. Attachments are converted to .odf or .png, as appropriate. Stuff that can't be converted is dropped. HTML is parsed, checked for syntax, and Javascript dropped.
    • All web browsing to non-secure sites is proxied. Javascript is removed. Flash is removed. Java is removed. All binary data is removed. Images are reformatted to .png format and the HTML adjusted to match. No more "Web 2.0"; those sites just stop working.
    • Web browsing to secure sites via SSL is only permitted if the site has a SSL cert that is a high-grade "we really know who this is" cert.
    • TCP port 80 is all you get outgoing. Incoming, forget it. UDP, forget it. If you want to message, use the phone.
    • You have a machine or two around that are outside the firewall for when you desperately need to do something else. Those machines have a canned read-only disk image that's refreshed on each reboot or logout, like Internet cafe machines.

    We're probably going to see some companies going to a locked down firewall like that.

    • If you're gonna go to all that trouble . . . (Score:5, Insightful)

      by thesoffish ( 852987 ) <thesoffish@gmail.com> on Monday October 16, 2006 @11:17PM (#16463617) Homepage
      Why not just physically unplug your computer from the network?

    • Re:We need a really big lawsuit against Microsoft (Score:4, Insightful)

      by linuxbert ( 78156 ) on Monday October 16, 2006 @11:32PM (#16463731) Homepage Journal
      If you your self won't work like that, then don't waste time suggesting it. these measures are really nothing more then window dressing designed to give the apperance of security. I would hazard a guess that more corporate security people are worried about data theft via usb drives, then they are about becoming part of a botnet.
    • "You have a machine or two around that are outside the firewall for when you desperately need to do something else. Those machines have [b]a canned read-only disk image that's refreshed on each reboot[/b] or logout, like Internet cafe machines."

      A brazilion studies show just how quickly machines get infiltrated. If they're vulnerable they'll get taken over in a matter of minutes as opposed to hours or days so all this really does is avoid an accumulation of baddies - which might actually be a good thing a

    • Re:We need a really big lawsuit against Microsoft (Score:5, Insightful)

      by Geoffreyerffoeg ( 729040 ) on Monday October 16, 2006 @11:49PM (#16463845)
      Attachments are converted to .odf or .png, as appropriate.
      There are many applications which require macros to be present in Word documents. If you translate the macros to ODF's format (does it even support macros?), you've gained nothing. If you don't, you've caused confusion for many customers. And as far as converting images, how do you ensure the buffer overflow (or worse, the WMF arbitrary-code loophole in the specification - this wasn't technically a bug in the parser) isn't present on the firewall itself? I would think a rooted client machine is much better than a rooted firewall.

      No more "Web 2.0"; those sites just stop working.
      There are quite a few Web 1.5 sites that critically depend on JS, Flash, Java, etc. Facebook loses a lot if you even have just a partial JS interpreter (and I have seen it happen), and Facebook's coding is arguably not 2.0. Yahoo passwords lose a lot of their security if you disable JS, because then you can't do any sort of key challenges - you have to send the password itself, HTTPS or not. Etc.

      Web browsing to secure sites via SSL is only permitted if the site has a SSL cert that is a high-grade "we really know who this is" cert.
      You have locked out many universities (MIT is a major one; OU and UL also come to mind) that do not feel like paying a 3rd-party commercial company to certify their identity when they can just pass out root certificates.

      TCP port 80 is all you get outgoing. Incoming, forget it. UDP, forget it. If you want to message, use the phone.
      Wonderful. No e-mail. No file sharing. No VPNs. No intranets. Web-only is fine for home users on AOL. Home users who do anything else, and corporate users, need other ports.

      Your internet-café machines are far more usable than your "normal use" machines at this point.

      • Re: (Score:2)

        by 1u3hr ( 530656 )
        Attachments are converted to .odf or .png, as appropriate.
        There are many applications which require macros to be present in Word documents. If you translate the macros to ODF's format (does it even support macros?), you've gained nothing. If you don't, you've caused confusion for many customers.

        I must be an exception then. I've been using email for about 15 years and NEVER ONCE has anyone sent me a document with a macro in it that was actually necessary, as opposed to several that were malicious. If you

      • It's going to hurt. (Score:3, Insightful)

        by Animats ( 122034 )

        It's going to hurt. It's going to be painful. But when you're losing a war, you have to take defensive steps that work.

    • Sue/address the IRC networks, first. (Score:5, Interesting)

      by SuperBanana ( 662181 ) on Tuesday October 17, 2006 @12:02AM (#16463925)

      What's needed is for someone like NY Attorney General Elliot Spitzer to charge Microsoft with reckless endangerment for knowingly, willfully, and negligently distributing and continuing to distribute systems vulnerable to such attacks.

      Sue the IRC networks first; that's what makes it dumb shit easy for these guys to set up their botnets.

      I had a machine hacked by a german movie filesharing group, and they incldued a bot which logged into their channel on Rizon. Like a good little admin, I logged into rizon, checked out the channel. It had several thousand users, a whole slew of fserves...and ZERO conversation. None.

      I went to #help and reported the botnet attack and the response was: "hey, you want us to shut down one of the most popular channels here because of a evidenceless accusation that you were hacked by them and used as one of their fserves? LOL ZOMG GET SECURITY AHAHAHAHAHA LUSER P0WNZORED" etc. etc.

      It is patently obvious that the Rizon admins are FULLY aware that they have dozens, if not hundreds, of illegal filesharing groups that are using botnets to set up fserves, attack other systems for more bots, etc. They're doing jack shit about it (and in fact, they're making it easier- they now support SSL connections) and I think it's time someone sued them to hell and back. It's time IRC operators were taught that you can't knowingly support criminal activity, and that if users report hackings- they need to look into said reports and act on them. I also think it's time IRC traffic was considered "highly suspicous" and monitored by ISPs for fserve commands and such; fserves have no real legitimate purpose today, except illegal filesharing.

      PS: Next time you download a movie or program, bittorrent or IRC DCC....realize that it was distributed, most likely, by a group that hacked unix systems. Those systems were owned and administered by people just like you, and that person is going to have to deal with the damage and headaches. Just like you will, some day.

      • Re: (Score:3, Interesting)

        by dosius ( 230542 )
        I can assure you, neither of my IRC channels that have fservs have bots from compromised hosts. I wouldn't stand for it anyway. I'd rather my bandwidth be legitimately bought and paid for (or donated as the case may be).

        -uso.
      • I don't know if you realise, but pretty much anyone can set up an IRC server. In fact I'd speculate that only the really small bot-nets piggy pack on known IRC networks, as anyone with a reasonable sized herd would probably be running their own network of servers (ie - compromised machines).
      • Sue the IRC networks first;

        Or better yet, sue the internet.

        I think you're barking up the wron tree. IRC is convenient to use for admin because it is already there, and the peoelp writing this stuff are already well versed in it. If it was not there, rigging up some sort of dedicated infrastructure would not be particularly hard. For example some sort of p2p net between infected machines.
      • Sue the IRC networks first; that's what makes it dumb shit easy for these guys to set up their botnets.

        That's like saying "sue the website networks for distributing illegal content". IRC is a chat protocol. Anybody can run it. It is also widely used for open source development and other legitimate services. Apparently, your mind has been warped so badly by Instant Messaging services that you think any such service needs to be controlled by some big corporate entity.

        I had a machine hacked by a german mov
    • Maybe it's time to stop blaming the victim and start blaming the perpetrators. It's real easy to point fingers at Microsoft, but let's face it, the consequences of a radical redesign of the core software would be too great to handle in one generation. If the shoe were on the other foot and you had to redesign, rewrite, recompile and distribute Linux from scratch and do the same for all the application software, while maintaing some degree of backward compatibility, how long would it take? What would be the
    • Because every now and then there's a vulnerability in PNG [cert.org].

    • Re: (Score:2)

      by Tom ( 822 )

      Meanwhile, we may need some brutal firewalls:

      * All incoming e-mail is reformatted. Attachments are converted to .odf or .png, as appropriate. Stuff that can't be converted is dropped. HTML is parsed, checked for syntax, and Javascript dropped.
      * All web browsing to non-secure sites is proxied. Javascript is removed. Flash is removed. Java is removed. All binary data is removed. Images are reformatted to .png format and the HTML adjusted to match. No m

    • Re: (Score:2)

      by BrynM ( 217883 ) *

      All incoming e-mail is reformatted. Attachments are converted to .odf or .png, as appropriate. Stuff that can't be converted is dropped. HTML is parsed, checked for syntax, and Javascript dropped.

      A utility I use on my server's admin accounts is a simple ~10 line PHP script run by the input filter via Xmail. It just runs strip_tags() [php.net] on the body text of the email after which I drop non-image attachments. This basically makes sure all of my admin mail is text at SMTP. I originally did it because I was using

    • Re: (Score:2)

      by Phroggy ( 441 ) *
      Take a look at MIMEDefang [mimedefang.org], which can do the e-mail part of that (it runs ClamAV and SpamAssassin for you as well). Fully configurable with some Perl hacking.

  • use the clients against themselves (Score:4, Interesting)

    by TheSHAD0W ( 258774 ) on Monday October 16, 2006 @11:11PM (#16463591) Homepage
    Modern botnets clients are pretty adaptable; they will download patches, modifying themselves to beat disinfectors. With care, and unless the net manager has taken extreme measures to prevent it, one can induce the clients to remove or disable themselves, rather than just trying to kill the control channel. Should that fail, one should be able to determine what fallback channels the botnet clients use and disable those before killing the current command channel.
  • What we need is a large number of ISPs to get together and say, "We trust each other to deal with botnets." Then, with a single command, any trusted ISP within the network could instantly send a command to another ISP to shutdown a site or server that is running a botnet. All of these actions would be logged and would be reviewed to make sure that it is only being used against botnets; any sort of abuse (like using it to shut down protest sites or copyright violation sites) would result in an instant revocation of privileges. This system would be much better than what we currently have: trying to call the other ISP, trying to get them to listen to you, trying to get them to trust you ... it can take days, if ever, to shut down a botnet on another network.

    • Re:We need a trusted network of ISPs (Score:5, Funny)

      by StrawberryFrog ( 67065 ) on Tuesday October 17, 2006 @07:05AM (#16466299) Homepage Journal
      Your post advocates a

      (x) technical (x) legislative ( ) market-based ( ) vigilante

      approach to fighting botnets. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

      ( ) No one will be able to find the guy or collect the money
      ( ) It is defenseless against brute force attacks
      (x) It will stop botnets for two weeks and then we'll be stuck with it
      (x) Users of windows will not put up with it
      ( ) Microsoft will not put up with it
      ( ) The police will not put up with it
      ( ) Requires too much cooperation from botherders
      ( ) Requires immediate total cooperation from everybody at once
      (x) Many pc users cannot afford to lose business or alienate potential employers
      (x) Anyone could anonymously destroy anyone else's career or business

      Specifically, your plan fails to account for

      ( ) Laws expressly prohibiting it
      (x) Lack of centrally controlling authority for the internet
      (x) Ease of searching tiny numeric address space of all IP adresses
      (x) Asshats
      (x) Jurisdictional problems
      ( ) Unpopularity of weird new taxes
      ( ) Public reluctance to accept weird new forms of money
      (x) Armies of worm riddled broadband-connected Windows boxes
      (x) Eternal arms race involved in all filtering approaches
      (x) Extreme profitability of botnets
      ( ) Joe jobs and/or identity theft
      ( ) Technically illiterate politicians
      ( ) Extreme stupidity on the part of people who do business with botherders
      ( ) Dishonesty on the part of botherders themselves
      (x) Scope creep of any powerfull monitoring tool that is introduced to deal with a particular burning issue
      (x) The old "Who watches the watchmen" problem
      (x) The powerfull temptation to use it as a tool for censorship.

      and the following philosophical objections may also apply:

      ( ) Ideas similar to yours are easy to come up with, yet none have ever
      been shown practical
      ( ) Any scheme based on opt-out is unacceptable
      ( ) Connections should not be the subject of legislation
      (x) Blacklists suck
      ( ) Whitelists suck
      (x) We should be able to use P2P without being censored
      ( ) Countermeasures should not involve wire fraud or credit card fraud
      (x) Countermeasures should not involve sabotage of public networks
      ( ) Countermeasures must work if phased in gradually
      ( ) Sending email should be free
      (x) Why should we have to trust you and your servers?
      ( ) Incompatiblity with open source or open source licenses
      ( ) Feel-good measures do nothing to solve the problem
      ( ) Killing them that way is not slow and painful enough

      Furthermore, this is what I think about you:

      (x) Sorry dude, but I don't think it would work.
      ( ) This is a stupid idea, and you're a stupid person for suggesting it.
      ( ) Nice try, assh0le! I'm going to find out where you live and burn your
      house down!

  • ... but I honestly don't see this as such a big issue.

    Basically this is a problem with people owning computers who don't know how to maintain them properly, and with MS making it unreasonably difficult, expensive, and time-consuming to maintain a Windows machine properly.

    But as someone who doesn't run Windows, I don't really care. I'm sure some of the spam I get is from these bots, but spam would exist with or without botnets, and without a major redesign of the e-mail infrastructure and standards, spam c

    • Re:Maybe I'm being complacent, ... (Score:4, Insightful)

      by Dunbal ( 464142 ) on Monday October 16, 2006 @11:32PM (#16463741)
      Basically this is a problem with people owning computers who don't know how to maintain them properly

            The cry of "I know, let's invent a computer that is smart enough to maintain itself!" was heard in the boardroom, and thus SkyNet was born - with the dual mission of perfecting itself and eradicating the useless humans that weren't even able to maintain it!

    • Re: (Score:2)

      by Oswald ( 235719 )
      It's fun to bash Microsoft. I do it myself. They're way behind the power curve on proactive security measures and slow to fix vulnerabilities. However, maintaining my WinXP machines consists of checking the radio button labelled "Automatic (Recommended)" in the Automatic Updates dialog. It's not difficult, it's not expensive and it's not time-consuming. I run Ad-aware every once in a while just for grins, but so far it only finds trivial stuff, and I don't think I would be any worse off without it.

      Of c

      • Re:Maybe I'm being complacent, ... (Score:5, Insightful)

        by bcrowell ( 177657 ) on Tuesday October 17, 2006 @12:14AM (#16463981) Homepage

        However, maintaining my WinXP machines consists of checking the radio button labelled "Automatic (Recommended)" in the Automatic Updates dialog. It's not difficult, it's not expensive and it's not time-consuming.
        A serious question, then: what do you think makes your outcome different from the outcome experienced by the people who are getting their machines owned? I don't know the answer, because I don't run Windows, but I could speculate:

        Is it because they intentionally download stuff that infects their machine with spyware? If so, then maybe security is too difficult for them, because they aren't technologically sophisticated enough to realize that this is a bad idea, and maybe MS is helping to make it too difficult for them, by creating a culture where it's normal for every user to run with unlimited privileges.

        Another possibility is that they aren't sophisticated to realize that the simple, commonsense measures you've taken (a router/firewall, doing updates) would be more sensible than measures such as buying anti-virus software, or taking their computer to Circuit City to get it fixed when it "gets slow."

        I think the real problem is that a lot of people own more computer than they need. All they really need is a word processor, e-mail, and a web browser. They really don't need a general-purpose computer at all, and don't have the skills needed to maintain one. They might be better off with an internet appliance, or a thin client. The problem is that they don't understand how much they don't understand. It's like the people who have to own a Harley Davidson because it's cool, even though it's an utterly impractical motorcycle for what they want to do.

        • Re: (Score:3, Insightful)

          by taylortbb ( 759869 )
          I must agree with you that people intentionally download things that will harm their machine. I do computer support and I have had more than one client say "But the included smilies aren't good enough, why did you remove my other ones?" after they ask me to make their machine run faster. As long as spyware/adware/botnet software can be distributed with "free" software that users want the problem isn't going anywhere. Once Vista arrives the UAC stuff will help with remote exploits but people wont understand

          • Re: (Score:3, Insightful)

            by gbjbaanb ( 229885 )
            and will happily do it if it gets them some new smileys. This is how Linux is so secure,

            No, Linux is more secure because you don't get those smiley packs for it. That and Linux users aren't generally using it for the smileys and assorted mass-consumer crap that is targetted at Windows users.

            However, if someone produced a tool that the average linux user wanted to use (say, for example a new fancy bittorrent client) that contained some kind of malware, you'd start to see the exact same problems that the wind

    • Re: (Score:3, Interesting)

      by account_deleted ( 4530225 )
      Comment removed based on user account deletion

  • A modest proposal (Score:5, Insightful)

    by caitsith01 ( 606117 ) on Monday October 16, 2006 @11:30PM (#16463725) Journal
    I am no expert in this area, but a thought occurs.

    Why isn't it possible to simply identify the exploit being used to spread a particular botnet, and write software that uses the same exploit to travel throughout the net before activating (perhaps at some specific time) to both wipe out the botnet software and seal off the exploit?

    It seems that as soon as you have the original botnet software, re-engineering it for this purpose would be relatively trivial. Plus there would be the immense satisfaction of fighting fire with fire. The software could even remove itself as its final act, saying "I know now why you cry, but it is something I can never do" (although someone else might have to press the button to lower it into molten metal - "I cannot self-terminate").

    The only reason I can think that this wouldn't work is that the 'antidote' software would be breaching computer security all over the place - basically doing the precise thing we are trying to stop. However, surely some sort of 'good samaritan' clause could be worked into the law - or the government could adopt responsibility for this process, or at least for pushing the button that sets each counter-botnet loose in the wild.

    Of course this may already be the approach taken - I don't know much about the field, as I say.
    • Because for some reason, the people who code "good samaritan" software seem to be very stupid.

      Seriously, you could write software like this that DOESN'T spit out traffic. You want to stop a lot of botnets? Hang out on IRC, wait for infected hosts to do their thing, and then patch them. And THEM ONLY. Put up webpages with your exploit, and ONLY PATCH THOSE ALREADY INFECTED.

      The problem is, everyone tries to write this stuff a la the original worm/trojan - spewing itself out to hosts all over the Internet, the

    • Re:A modest proposal (Score:4, Interesting)

      by ZSpade ( 812879 ) on Tuesday October 17, 2006 @12:03AM (#16463927) Homepage
      This was done with klez... a good Samaritan wrote a virus that would spread to computers as effectively as klez, look for it, and then eliminate it if found. You know how you knew if you had the Good Samaritan virus? Klez like symptoms. That is a major system slow down, as well as many, many bugs/crashes.

      Good times. Viruses like that operate at levels that were only really meant for system tasks, and yet they are were never part of that system. Windows being the careful balancing act that it already is will topple over readily when you add anything to the base.
      • A) You can't expect the first couple of tries at anti-virus-viruses to be perfect. Just because the prototypes had failings does not mean that the idea itself is not sound. Look how many thousands of regular viruses it took before the regular viruses became relatively competent.

        B) Since the goal here in this article is to cripple the botnets, an anti-virus-virus that makes a system unusuable is a positive outcome. If the user can't use it, chances are the botnet can't use it either.

        In many jurisdictions t

    • Re: (Score:3, Informative)

      by NightHwk1 ( 172799 )
      The impression I got from the article is that once infected, the bots will only accept (PGP?)-signed commands, and the original vulnerability is most likely patched to prevent another botnet herder from stealing it. There is no way to order the botnet to self-destruct.

    • Re: (Score:2)

      by Tom ( 822 )
      This was discussed and dropped many times.

      One of the reasons it doesn't work is that many exploit-scripts already plug the hole they used to get in - not to be nice, more in order to make sure the machine isn't re-taken by someone else.
    • The real question is, why do we have exploits? 99% of the ones out there could be eliminated entirely by using a typesafe language for applications and the operating system. Of course you can't entirely remove bugs, but what you can do is prevent systems from running arbitrary code on your system from hacked unsafe programs.

      For instance, I have absolutely no problem running Azareus and getting hundreds of connections for random unknown computers because since it is written in a typesafe language (Java) it
    • Anything positive you can do to improve computer security by writing a vulnerability-checking bot, you can also do by writing a scanner tool that a legitimate administrator or user can use to check their systems, and the scanner can do it in a way that doesn't overwhelm network resources, doesn't lead to the vulnerable machines you found creating an exponentially increasing number of probes checking other machines causing the checker and checkee machines and the network to grind to a halt, (doesn't decide
  • Of course this stuff is all over. My sister's PC was infested with malware and a member of a botnet. She has a teenage daughter that clcks on everything sent her way. I discovered, before a complete system wipe, two processes that run on start up using telnet, at least three many pop-up services, two browser tool-bars, a page hijack stacked upon another page hijack that got had it's registry keys still intact, but was disabled by the other hijack, and the system had Python installed and was compiling source
    • I think you've just hit on the real reason Intel is making an 80-core processor: 34 cores for mass mailers, 15 for some botnets, 27 for norton antivirus, 2 cores to correct my math, and then 2 left over to run SETI@Home.
  • So, err, do we need some kind of international police force to keep the Internet clear of botnets? Should the UN run it? Do they get cool blue suits and have their own swat teams around the world?

  • Come on folks, "lost"??! (Score:5, Insightful)

    by swordgeek ( 112599 ) on Monday October 16, 2006 @11:42PM (#16463803) Journal
    The so-called botnet battle is no different than the war on spam or the anti-virus front, or any of the others.

    It's not a failure of technology. It's BAD PEOPLE, exploiting BAD SOFTWARE, who aren't being dealt with because of BAD EXECUTION of BAD LAWS. Fix the software, the law, and the enforcement of the law (esp. jurisdiction), and you'll neutralise 95+% of the bad people.

    This crap is criminal. Crimes like this are sheltered by discussions about philosophy, politics, jurisdiction, and technology. If people would stop discussing and arguing, and start working together on the problem, it could be eliminated in under 24 months.

    But convincing people to work together is impossible, so we might as well get used to it.

    • Re: (Score:2)

      by Dunbal ( 464142 )
      Fix the software, the law, and the enforcement of the law (esp. jurisdiction)

            Therein lies the problem. Easier said than done. How do you propose to address these issues, specifically?

    • It's not a failure of technology. It's BAD PEOPLE, exploiting BAD SOFTWARE, who aren't being dealt with because of BAD EXECUTION of BAD LAWS. Fix the software, the law, and the enforcement of the law (esp. jurisdiction), and you'll neutralise 95+% of the bad people.

      This crap is criminal. Crimes like this are sheltered by discussions about philosophy, politics, jurisdiction, and technology. If people would stop discussing and arguing, and start working together on the problem, it could be eliminated in under

    • Re: (Score:2)

      by bunions ( 970377 )
      > Fix the software, the law, and the enforcement of the law (esp. jurisdiction), and you'll neutralise 95+% of the bad people.

      Wow, just fix everything and the problem goes away. Damn, why didn't I think of that??

  • It's simple. They don't care. (Score:5, Insightful)

    by PhiRatE ( 39645 ) on Monday October 16, 2006 @11:46PM (#16463831)
    The simple problem with the fight against botnets is that it's asymmetric, and not in our favor. The bots are in a place that is particularly difficult for someone attempting to dismantle the network to reach, the property of someone else. It's not the technical problems that make a botnet so difficult to dismantle, but the legal ones.

    The botnet creators don't give a damn, their objective involves breaking the law (where there is one) in order to hijack someones computer. Someone attempting to destroy the botnet is likely to be atempting to operate within the law, which requires notifying and enlisting the support of the owners of the compromise machines, many of which:

    a) are difficult or impossible to contact
    b) don't speak your language
    c) don't understand anything about the problem
    d) don't care

    Any single instance of a botnet may have weaknesses that permit its demise without running into potential legal problems (such as a poorly-secured disable command), however botnets as a concept have no real theoretical weakness given the appropriate cryptography and care of construction. Decentralised, failure resistant networks of cooperating nodes is a well researched area and at the level botnets operate, barely constitute a challenge to anyone with the necessary knowledge of protocols, cryptography and programming.

    They're here to stay, there is no practical non-desperate legal changes or technical tricks which will kill the concept entirely. Even if the general level of internet security increased 10-fold, there'd still be more than enough vulnerable computers to support botnet operators, and lets face it, that level of security change is not going to happen. Even if the general OS level improves, old and embedded (non-patchable) devices are still plentiful, and there will be more no-patch applicance like systems in the future which will continue to be exploited.

    As a systems administrator or someone otherwise concerned with the impact, the rules are simple. Stay patched, Stay vigilant. If a large botnet decides to get you, hope your ISP subscribes to something like tipping-point that will give them a head start on deflecting the inbound traffic. That's about it.

    • Re:It's simple. They don't care. (Score:5, Interesting)

      by RAMMS+EIN ( 578166 ) on Tuesday October 17, 2006 @03:47AM (#16465121) Homepage Journal
      ``d) don't care''

      And that is a matter of economics; specifically, externalities. You would bear the cost of securing your system, but you aren't seeing the cost of running an insecure one.

      In the Netherlands, at least one large network employs a detection mechanism for exploited hosts using honeypots. A lot of the IPs on the network get assigned to honeypots, so that a compromised host is likely to hit a honeypot sooner or later. The compromised host is that put in quarantine, denying it normal Internet access (only access to information and removal tools is still available). This hurts users when their machines are compromised, encouraging them to secure their systems.

      It surprises me that this isn't done more often. Surely ISPs have something to gain from eliminating all the traffic that compromised hosts generate (seeing that 90% of email traffic is spam, and the bulk of it comes from compromised machines, just to name one thing).
  • This has been discussed on Slashdot before, but it seems relevant here. If it proves impossible to stop self-replicating worms by patching holes, you can either have mandatory auto-updates provided by a "trusted" source (your friendly OS provider), or launch active defenses: white-hat worms whose payload is the patch itself. Or an anti-botnet which DOS'es infected hosts (similar to what BlueFrog tried to do for spam). Of course these cause problems and can be gamed (someone spoofs an attack as coming fro

  • larger battle (Score:5, Insightful)

    by Tom ( 822 ) on Tuesday October 17, 2006 @12:25AM (#16464053) Homepage Journal
    This isn't a battle for/against botnets. They're just the symptoms. What this really means is that the battle to have secure home PCs is lost. I won't even get into the Windos vs. Real OS discussion. The point is deeper still: Our homes are safe from burglars because those with the great skills and expert tools don't break into homes, they break into banks.
    Not so on the Internet. Due to automation you can play the numbers game, and taking over 100,000 machines is feasable, less risky yet possibly just as profitable as breaking into one bank.

    The best non-computer equivalent I can think of is the plague. Welcome to the crowded cities of the middle ages. Even if you, personally, are safe, you're still affected. Think about it.

  • My comments.. (Score:5, Interesting)

    by paulmer2003 ( 922657 ) on Tuesday October 17, 2006 @12:27AM (#16464073)
    A long time ago, I used to run botnets and that other bullshit...So take it as I know what I am talking about.

    It is a pity that the general open channels are a thing of the past, but so are private BBS'.
    This is not true at all. There are plenty of -sp channels on IRC. Hell, just do a /list on EFnet...thousands upon thousands. And usually, when just going around IRC, you arent just going to walk up upon a botnet..
    With care, and unless the net manager has taken extreme measures to prevent it, one can induce the clients to remove or disable themselves, rather than just trying to kill the control channel.
    No shit. Simply decompile the exec, get the password (shouldent be hard, unless it is encrypted, usually isnt), get the server ip/port/password/channel and possibly channel key, join the channel, login to the bots (.l password or what ever) and do .rm and boom, they lost their entire net (thats assuming they have it set so *!*@* can login).
    Basically this is a problem with people owning computers who don't know how to maintain them properly, and with MS making it unreasonably difficult, expensive, and time-consuming to maintain a Windows machine properly.
    Now now. I am a Linux fan and such, but blaming Microsoft here is just stupid! You know why? Because usaully the thing is exploited hasent been patched yet. Every program has bugs, thats just how it is. Get over it. And how is it expensive to maintain windows machines properly? Windows Update is free, no?
    But as someone who doesn't run Windows, I don't really care.
    While *nix botnets arent nearly as prevalent as Windows botnets, there are still ones out there...Dont think you are exempt.
    nother possibility is that somebody I do business with could get their machines owned, and gangsters could steal my identity.

    Its very easy to get your identity stolen these days..Simply do some SQL injection on a pron site or what ever, then boom, you got yourself 5k credit cards.
    Why can't we all just hit "delete"? takes only a few seconds.
    Were you dropped a child? On Windows, you cant delete a exec if its running..and most botnet execs fuck up things like the task manager and have backups of themselfs on your box.
    Why isn't it possible to simply identify the exploit being used to spread a particular botnet, and write software that uses the same exploit to travel throughout the net before activating (perhaps at some specific time) to both wipe out the botnet software and seal off the exploit?
    Easier said than done. How does your 'software' know what on the machine is a trojan? That wouldent be very good would it if your 'software' illegally compromised hosts trying to get rid of the trojans and accidently got some guys stuff that isnt infected? Also consider, when ever a new exploit is leaked in to the wild, all of the current botnet trojans are updated with it...There are widely diffrent...there is no plasuable way to just rid of all hosts comprimised with hole ____

    • Re: (Score:2)

      by olman ( 127310 )
      On Windows, you cant delete a exec if its running..and most botnet execs fuck up things like the task manager and have backups of themselfs on your box.

      Not to mention going to extreme lengths to avoid being wiped out, usually. Try to sneak in that "run during login" registry item to remove the offending "winlogon" registry item? Gone as soon as you hit enter (from your point of view).

      Try to be even more clever and put another login item to run a batch file (or whatever) to remove/corrupt the offending dll?

  • Seriously. Does this beowulf botnet run linux? Are linux hosts being deprived of the global machine endeavor to sell us more v1agra and inform us of opportunities to participate in online gaming? Can we not assist in the provision of "bulletproof hosting"? Does *BSD not deserve to take it's place in the pantheon of truly "highly available, totally reliable, even if netops doesn't want to run them" services? I say if an open source OS can't support these services, what good is it? This is the future of

  • RBL (Score:4, Interesting)

    by theglassishalf ( 216497 ) on Tuesday October 17, 2006 @12:35AM (#16464139) Homepage
    In the end, this problem is only going to get mitigated if we take it as seriously as we did the spam problem. For a long time, ISPs would allow spammers onto their servers because there was no incentive to kick them off. RBLs changed all that.

    ISPs that tolerate insecure computers need to get blocked. Blocked from everything. It COULD happen, if Comcast and AT&T both decide they've had enough.

    This would have the added benefit of stopping a lot of spam.

    Yes, RBLs didn't get rid of spam. But they sure did (do) help. And a good part of the reason they don't work better is botnets. (remember Blue Security [securityfocus.com]?

    -Daniel

  • Until people are punished for their system's behav (Score:3, Interesting)

    by Banner ( 17158 ) on Tuesday October 17, 2006 @01:06AM (#16464361) Journal
    Unitl people are punished for their system's behavior, nothing is ever going to happen. Yeah it's annoying for most people to get rooted, but other than that, why should they care? Now if you were legally liable for the damages your system did, regardless of whether or not it was rooted, we'd see a major change in botnets, and a LOT less people with rooted machines.

    People only react to that which causes them difficulty, punish them for not taking care of their responsibilities and things will get better. But until then, it will only get worse.

    You're part of a botnet? Pay a fine! Didn't know? Too bad. Just like your dog getting out and destroying property, if you don't care enough to protect others from your wanton disregard, it's going to cost you.

    • Now if you were legally liable for the damages your system did, regardless of whether or not it was rooted, we'd see a major change in botnets,

      You'd see a major change in government and the law swiftly gone is what you'd see. Well, in any democracy, anyway. This simply won't resonate with people's sense of justice; to most people it would seem like holding you responsible for what any maniac does with your stolen property. And I'm not even talking about stolen weapons here, but any stolen car, hammer or

  • The Good Old Days... (Score:2, Interesting)

    by Horar ( 521864 )
    when high technology was its own idiot filter are long gone.

    It is illegal to drive a car on any public road without a drivers licence, for the safety of other road users. Why shouldn't it be illegal to connect a computer to the internet without the proper qualifications, again for the common good? Keep all the stupid off the internet and the situation is bound to improve because there will be less opportunity for the greedy to exploit them.
  • If companies know the means of advertising (i.e. malware) are illegal, why aren't we going after the companies that use such methods? Admittedly, some viagra knock off company in Mexico is difficult to go after, but wouldn't it be easier to get rid of these intrusive networks by cutting off any reason for them to exist?
  • Publicly executing a few dozen botherders would be a good next step.
  • The battle is not lost. Some online casinos fought and won the battle.
    Read here here [csoonline.com].

    • Re: (Score:3, Informative)

      by Percy_Blakeney ( 542178 )

      The incident described in CSO magazine is the exception that proves the rule. How did the online casino "defeat" the botnet attack? By spending a million dollars on bandwidth and equipment; they outscaled the attack. That sort of approach may (or may not) work for companies with millions of dollars in web revenue, but it is simply not a feasible way for most online entities to deal with an attack. There are hundreds of thousands of online businesses that, if faced by even a small botnet attack, would h

  • Why? Because there's NO PENALTY! (Score:3, Insightful)

    by Hasai ( 131313 ) on Tuesday October 17, 2006 @08:23AM (#16467217)
    Trying to stop botnets by taking-down servers is like trying to stop rock-throwing by confiscating rocks.

    An exercise in futility.

    You stop rock-throwing by going after the throwers. If these propeller-heads would stop playing with their toys long enough to spend fifteen minutes talking to the nearest cop they would realize this.

    Ignore the silly botnets and invest the resources to find and punish their creators. Criminal behavior declines only when there is substantial risk of substantial punishment. Until that risk exists, you're just wasting everyone's time.

    'Nuff said.

    • Re: (Score:3, Insightful)

      by 99BottlesOfBeerInMyF ( 813746 )

      Trying to stop botnets by taking-down servers is like trying to stop rock-throwing by confiscating rocks.

      Or, install shutters on your Windows so you can ignore the rock throwing and hire a security guard to go shoot the rock throwers or drive them off.

      If these propeller-heads would stop playing with their toys long enough to spend fifteen minutes talking to the nearest cop they would realize this.

      The cops often can or will do little in these instances. A lot of the time botnets are rented out by the

  • How do you Know and REMOVE them? (Score:3, Interesting)

    by lordmage ( 124376 ) on Tuesday October 17, 2006 @10:28AM (#16469697) Homepage
    I have a lovely wife who surfs the internet constantly. She has a bot on her Windows Box. I noticed it when we sent out 86 thousand emails in one day. (it helps to monitor your port 25!!). Okay.. so she is compromised.

    Norton, Spybot, etc CANNOT detect what she has. Netstat shows the connection but taskmanager etc does not. I block port 25 from her computer as a precaution and the darn computer starts searching for smtp servers on the local network. I use qmail-auth and it prevents it.. however I have no trust that it cant use UPnP or something else to change my main router.

    So.. HOW IN THE HECK do you REMOVE stuff that you cant find? I really.. REALLY.. dont want to reformat and reinstall because there is no way this should be hidden to adminstrator on Windows XP.. but it IS!

Slashdot Top Deals

"An idealist is one who, on noticing that a rose smells better than a cabbage, concludes that it will also make better soup." - H.L. Mencken

Close