Botnets Using Ubiquity For Security 95
Trailrunner7 sends in this excerpt from Threatpost: "As major botnet operators have moved from top-down C&C infrastructures, like those employed throughout the 1990s and most of the last decade, to more flexible peer-to-peer designs, they also have found it much easier to keep their networks up and running once they're discovered. When an attacker at just one, or at most two, C&C servers was doling out commands to compromised machines, evading detection and keeping the command server online were vitally important. But that's all changed now. With many botnet operators maintaining dozens or sometimes hundreds of C&C servers around the world at any one time, the effect of taking a handful of them offline is negligible, experts say, making takedown operations increasingly complicated and time-consuming. It's security through ubiquity. Security researchers say this change, which has been occurring gradually in the last couple of years, has made life much more difficult for them. ... Researchers in recent months have identified and cleaned hundreds of domains being used by the Gumblar botnet, but that's had little effect on the botnet's overall operation."
Re: (Score:1, Funny)
That's politically incorrect in the extreme. I think the proper term is "original post".
Re: (Score:2)
Not sure why you're moderated as flamebait, I was thinking the same thing.
Some news from Australia on this (Score:4, Interesting)
"The AISI collects data from various sources on computers exhibiting 'bot' behaviour on the Australian internet.
Using this data, the ACMA provides daily reports to ISPs identifying IP addresses on their networks that have been
reported in the previous 24-hour period.
ISPs can then inform their customer that their computer appears to be compromised and provide advice on how they can fix it."
The only question seems to be when will p2p be seen as a botnet, limewire ect. Will the Anti-Counterfeiting Trade Agreement (ACTA) alter 'bot' behaviour to new areas isp use and account 'fixing'?
Will isp's get powers to pop packets to note 'bot' behaviour early on, rather than seeing their ip's reported back days later?
Re: (Score:2, Insightful)
Huh? ISPs already have this power. It's called "owning their infrastructure". If AISI stops providing accurate information, people will stop trusting it. This isn't a mandated cut-off - it's an advisory notice. ISPs aren't even obliged to pass it on.
Re: (Score:2)
For now. Like when we had filter software for the desktop and now have the vision of a national filter, advisory and obliged can turn into monitor, log, warn and disconnect.
Todays passive friendly note, is next years p2p watcher.
ISP accountability (Score:3, Interesting)
It seems to me there is an accountability gap for ISPs. Those providing network connections are not held accountable for machines on their network. Yet another example of prices and business practices not matching the real costs of activities.
To me, I would think the real solution, long term, to fixing botnets is creating a tight loop with internal scanning, reporting, warnings, verification, and then turning off Internet connection to machines that are infected. ISPs will need to be "motivated" to take responsibility for actions taken on their network, and they will have to have fully automated systems that take infected machines offline.
It doesn't seem like this is a priority for ISPs yet. Its easier and cheaper to simply ignore the problem.
Re: (Score:3, Insightful)
how would the ISP inform the customer that they've been infected?
obviously web or email would just open them up to the usual phishing.
Re: (Score:2)
Once they lose their connection I have a feeling the customer will take care of initiating the necessary dialog :p
Re: (Score:1, Insightful)
Here's why an ISP won't do that (disconnect the customer)--because the customer WILL take care of it by SWITCHING ISPs. ISPs hope to MAKE money, not lose it. So they won't do something that drives customers away.
Why should the ISP be responsible for a problem that is the customer's problem anyway?
Re: (Score:2)
And what if all the ISPs had a similar law? What if they were mandated to by the state? Sounds draconian but it just might force Microsoft and the end user to get their ducks in a row regarding security.
Re: (Score:2)
Maybe it's just me, but I don't see how this would force Microsoft to do anything.
People will just buy a newer Microsoft operating system or even a whole new computer, to 'fix' the problems they are having.
Re: (Score:1)
Furthermore the only real security microsoft could possibly enter to guarantee no viruses is a simple "signed code only" policy (you know, like the iPhone). After that, microsoft has a security-justified veto over what software can run on windows machines.
Let's not propose cures that are far worse than the disease. This suggestion has about the same value as curing a painful toe by killing the patient.
Re: (Score:2)
The iPhone doesn't have a signed code only policy.
A quote: "Apple supports two platforms. First is HTML5, open and uncontrolled platform. He says the company fully supports it and behind it 100 percent - and stresses that it’s fully open. Second platform is the App Store — a curated platform with more than 225,000 apps and calls it the most vibrant app store on the planet. Interesting reference to curated as a asset of App Store."
The HTML5 isn't signed. ;-)
Re: (Score:1)
Is this a joke ?
Imagine if microsoft would say : you can only install microsoft-approved applications, but we include a webbrowser.
Would you call that free ?
thought so
Re: (Score:2)
Yes it was a, really bad one at that, joke
Re: (Score:2)
The HTML5 isn't signed. ;-)
But the HTML5 DOM exposed by Safari does not necessarily expose all useful hardware features. Good luck making an app that displays three-dimensional graphics in HTML5. Good luck making video chat over Wi-Fi in HTML5.
Re: (Score:2)
Lennie said iPhone (Score:2)
The iPhone doesn't have a signed code only policy. [...] The HTML5 isn't signed.
the HTML5 DOM exposed by Safari does not necessarily expose all useful hardware features.
HTML5 Quake [running on a Mac]
How many frames per second do you get on an iPhone running that app?
Re:ISP accountability (Score:4, Insightful)
You know, that's very true. Residential customers may stick with their provider (how many AOL users are still out there), but hosting customers will jump ship if they get disconnected. I had a friend who's SQL server got unplugged when a MSSQL worm was going around. It wasn't infected, but for the "safety of the datacenter" one of the techs walked around and pulled the power cord on any machine labeled "SQL". He called, and they couldn't resolve the problem. They said "we don't see anything wrong." When he got there, he found his machine was unplugged, just like quite a few other customers SQL boxes. Two days later, his equipment was in another datacenter.
Re: (Score:2)
Since everyone on slashdot regularly complains that they don't have a choice in ISPs I doubt that'd be a problem and lets be honest, if a non-slashdot person got that kind of notification their first thought wouldn't be "i must change ISPs" it'd be either:
1 - Lie to the ISP, "yeah it's fixed"
2 - Panic and get their computer cleaned.
Re: (Score:2)
Really? Is it that easy to get ahold of your ISP? Around here, I'm lucky if I can get someone on the phone after 30 minutes on hold, and that's without hundreds of people calling about deactivations.
Re: (Score:1)
My ISP sends an e-mail to customers in this case. The e-mail says to contact the ISP.
Yes there is a phishing risk, but given that most people don't expect these kinds of e-mails, there is not much more phishing risk than if they didn't send them. I'd be suspicious of an e-mail from my bank asking me for my password, regardless of whether my bank normally sends me such e-mails or not.
Re:ISP accountability (Score:4, Insightful)
The cost to the ISPs would be fairly significant. It's not simply the potential lost revenue from disabling unwitting users, but forcing the issue will also generate a good deal of customer interaction. Talking with customers will generally result in additional costs as well as dealing with potential infections.
It's not an act of benevolence, but rather it is assuming responsibility. If you don't treat the issue for the customer then they may simply take the path of least resistance. ie, they may ultimately simply find another provider. Conversely, attempting to correct the problem will also result in issues as you now have the responsibility of restoring the customers computer to working order.
Ultimately, all of these risks and more would have to outweigh the costs of fixing the problem. I'm glad I don't have to deal with these kinds of issues anymore because trying to pitch an act of altruism to the company owner probably would not have worked.
With that said there are basically a few ways to approach the issue. Tighter regulation which states ISP's have to shepard their flock, fines on non-compliance or grants to award certain infection threshold reductions. In the end it really is about making one choice more expensive then the other.
Re:ISP accountability (Score:4, Interesting)
BS, ISPs are just lazy. Here in Denmark at least a couple of the ISPs will actively block your connection if they detect botnet-like activity from your machine. When flagged any requests will be directed to a homepage where they tell you that you probably are infected and asks you to contact support for further assitance.
Re: (Score:3, Interesting)
It's a very dangerous route to go down. If all isps did that, I'm pretty sure that botnets would start encrypting their c&c data. Then what? If you just block all data you can't understand, say good-bye to vpn, legit p2p applications, and private communications between actual people.
Of course, if you detect that your customers are ddosing some server, that's a different story.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
" . . . And the alternative is?"
Do your best evil laugh and go over to the dark side.
Re: (Score:2)
Re: (Score:2)
Where did you get that from? Where in my post does it suggest they charge customers for this?
Botnet and spam activity cost bandwith, it's in the interest of the ISP to get rid of it - no one would dare charging for this service, when I worked in NOC for one of them we would happily guide you through installation of free anti virus and help you clean it up.
You know, there are still countries in this world where companies try to satisfy their customers.
Re: (Score:2)
Re: (Score:2)
You are thinking in terms of small to no impact with such an administrative change. In any environment with a significantly large customer base this would be handled by customer service representatives. They will generally be trained and have material for troubleshooting connection issues.
Now, you have to support removing or explaining why the infection is a problem and deal with the issue.
Is it cheaper to allow the customer to consume bandwidth or deal with the problem? Since many organizations already hav
Re: (Score:2)
Dumb solution. ISPs are idiots. They detect valid mailing lists as 'botnet activity from your machine' No thanks. They give me a pipe and the bandwidth I pay for. They aren't the Internet Police. Maybe if they'd listen to customer complaints about other customer traffic, or better yet THEIR OWN. I once had a firewall crash because its log partition filled due to the raw amount of invalid DHCP traffic the ISP was spewing over the line from one of its own servers. And you want me to trust *THEM* with
Re: (Score:2)
Sounds like you are the moron my friend.
1. This is for consumers, want something where you can freely spam, sorry, send out on mailing lists? Go buy a line designed for that. Don't know of any ISP in Denmark that let any traffic pass from consumer to port 25
2. You claim to be such an avid user, yet your firewall crashes from something as simple as log entries?
Your kind is the worst to support when you sit in the NOC, you know just enough to fuck up big time, jargo enough to get through level 1 and 2, yet ac
Re: (Score:2)
Having actually performed both as a system and network engineer role at a fairly large ISP in my youth it isn't any concept of being lazy.
This is especially true when you get to larger corporate environments which translates a single decision effecting hundreds of thousands of customers. At a given level of customer volume even small changes have larger repercusions.
Sure, if you have a lower then 5000 sub count you can get by with helping everyone fix their computer. It's not like the office will be fieldin
Re: (Score:2, Insightful)
"...fines [fining ISPs] on non-compliance..."
Why not fine the actual owner of the computer that's causing the problem? That would generate more motivation both to ISPs and end users. The user would seek an ISP that has excellent and quick detection and alerting facilities to protect him/her from fines. The user would be motivated to keep his/her machine more up-to-date. The user would have monetary motivation to purchase help if he/she can't administer his/her own computer effectively from someone compe
Re: (Score:1)
Why not fine the actual owner of the computer that's causing the problem?
Great, except of course that it can only work by
1) bringing all IP address assignments under government control, down to the individual user (translation : goodbye p2p, for obvious reasons)
2) creating a world government that has enforcement capabilities in all internet-connected countries (translation : bye-bye piratebay, whereever you host, you get shot)
3) obviously since this method has zero use unless truly every country participates, what are we going to do ? Attack any non-compliant government ? Discon
Re: (Score:2)
Slightly more on the extreme side, but some valid points as well.
Once you create an infrastructure to easily identify everyone such an infrastructure would be abused to no end.
Re: (Score:2)
To identify a user would require a subpoena for the information.
This would be a significant cost and undertaking across multiple jurisdictions. ie, the crime, detected in new york, but the bots would be scattered across the united states and globe. Also take note of the volume of dealing with 1000's of subpoenas across the nation.
To me it seems like such a system with the current infrastructure would be more affordable to ignore.
The point is it has to cost more to not treat the infection as opposed to the c
Re:ISP accountability (Score:5, Insightful)
It seems to me there is an accountability gap for ISPs. Those providing network connections are not held accountable for machines on their network.
And the moment they do that, they'll be expected to police for other illegal or immoral activity, like video and music downloading, content monitoring, deep packet inspection, and more. The operating costs go up as well, making them less competitive compared to other ISPs that do not monitor their customer's habits.
No, security needs to be managed by the owner of the machine. The ISP only has the responsibility to ensure that the customer has reasonable access through its networks, and perhaps a measure of QoS filtering/rate limiting/etc., to manage a shared (and limited) resource. Unless the bot is commanding the machine to use lots of network resources, its impact to other users is negligible from the ISPs perspective.
Re: (Score:2)
Unless the bot is commanding the machine to use lots of network resources, its impact to other users is negligible from the ISPs perspective.
Except that in most cases I know about, the bot is in fact "commanding the machine to use lots of network resources".
Re:ISP accountability (Score:4, Insightful)
It seems to me there is an accountability gap for ISPs. Those providing network connections are not held accountable for machines on their network.
And why should they be? If I sell you a fishing line, it isn't my job to ensure you don't choke somebody with it. Or for an even better analogy, look at the phone networks. Generally, if someone is calling you on the phone and harassing you, the phone company will not disconnect that person. They'll offer to change your number. It takes a _lot_ of complaints for them to cut off service to an offender. Same thing goes on the internet. Yes, botnets _will_ eventually be cut off, but it takes a lot of complaints. Otherwise, who decides what's malware?
Re: (Score:2)
Re: (Score:2)
So? You aren't going to get arrested just because you happened to rent someone a tool and they used it to kill someone. I mean you might get arrested initially if they discover that you have the fishing line, but you'll be let go. I mean, assuming a perfect world and all (because this is all about what _should_ happen), you would prove you didn't have the fishing line at the time the guy was killed, and you would be released without any charges. Possession of a murder weapon isn't a crime.
Re: (Score:2)
Re:ISP accountability (Score:4, Informative)
They do exactly that at my University. Students get disconnected from the network when a bot or worm or rootkit is detected. I'm not sure what methods they use to detect, but when this happens, the user is REQUIRED to bring their computer to the Residential Computing Desk and have it reformatted. (They are allowed to and assisted with make(ing) backups of their personal files.)
The users are sent an email informing them of the situation, but usually they never get it, and just visit or call the desk when their internet won't work.
It's always pretty funny (but rare) when a Mac needs to be reformatted, the user is almost always blown away that they can be infected.
Re: (Score:2)
They are almost certainly just using some sort of IDS (or "network virus scanner", which amounts to the same thing in the security appliance world.) Unfortunately, these are usually fairly prone to false positives. It wouldn't surprise me at all if the Macs that were caught were falses.
Skype, for some reason, really throws our IDS for a loop. Whenever a machine that has just been reimaged triggers our IDS, invariably the user had started Skype just before the alert was triggered. But other software caus
Mac Infections (Score:1)
Re: (Score:2)
Re: (Score:1)
God forbid you get a false positive and they wipe out your machine for it. It seems like every major AV marks remote administration programs as malicious backdoors now.
Re: (Score:1)
They seem to throttle their "attacks" as well. (Score:5, Interesting)
Re:They seem to throttle their "attacks" as well. (Score:5, Insightful)
There's no point sending any spam, if not your estimated 30 million messages, only to collapse the server and not relay the messages to the recipients.
The botnet operators probably think of this as an optimization problem and not good manners.
Re: (Score:3, Interesting)
Tie your spam filtering software into your firewall. Nothing says loving like dropping their inbound traffic. :) We only receive about 20k spams/day now (versus more than 300k before), just by having rolling blacklists based on spammy inbound traffic. You'll get a handful through, but nothing else will come in for days.
Re: (Score:2, Insightful)
Re: (Score:2)
I'm not really knowledgeable about e-mail servers so I can't tell it from the wikipedia article. Does this method work only for computers sending out spam, or can it be run on everyone's server and cause spam-bots to slow down noticeably? If the latter, I'm surprised it's not standard practice worldwide.
Efficiency (Score:3, Interesting)
Re: (Score:2)
Alternatively, there can come a time where we no longer "own" our computers, only license them. Then, during idle-times, the companies owning the license can justifiably use your system to do other computing-intensive processes.
Or better yet, do the same, except always have a subsection of your computing processes relegated to said computing processes (such as mission-critical services like emergency broadcasts and tracking). For that note, there are plenty of reasons why to diversify and spread out computi
Finally a use for Firefox Ubiquity? (Score:1, Offtopic)
Sadly no.
It turns out even botnetters haven't yet figured out a good use for Mozilla's Ubiquity extension.
DAAA DA DAAA DA DA DAAA DA DA DA DAAA DAAA (Score:4, Funny)
top-down C&C infrastructures, like those employed throughout the 1990s
My C&C keeps going down because the &*#$ing Harvester goes after Tiberium next to the enemy tanks :(
With many botnet operators maintaining dozens or sometimes hundreds of C&C servers around the world at any one time
Oh I wish.
Re: (Score:1, Informative)
My C&C goes down when the other guy builds Mammoth Tanks on the same grid location as his Tesla Coil.
Re: (Score:2)
Funniest thing I've read all day.
Bring back the biff! (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Just wait a little longer (Score:1)
I wonder, when they gain sanity and rise against their puny human masters,
Sounds like... (Score:1)
Clarification please... (Score:2)
So you are telling me instead of loading all the botnets with just a script to log on and receive commands, that a lot of them now are also quasi C&C centers...wow, imagine that, who would have thought, instead of making just drones, they are making more generals too....sounds a lot like C&C (command and conquer) strategy.... ; )
I always though the best botnet would be would compromised machines that uses torrent abilities to get pieces of itself that is still missing, but start with smaller parts,
Decentralization (Score:2)
Decentralization makes things more robust. I think we've known that for about two decades now.