Slashdot Mirror
Observing Botnets with Honeynets
Susan Saradon writes "The Honeynet Project has released a new paper which deals with the observation of botnets. "Know Your Enemy: Tracking Botnets" discusses what Botnets are, who is using them, how, and why. It als introduces the tools "mwcollect" and "drone" which can be used for collecting an tracking Botnet activity. Nice to read and looking forward to the release of these tools."
logging into the IRC channels of botnets, and trying to introduce myself, and asking "a/s/l" and getting all huffy that nobody's answering. Or talking like a robot.
-Jesse
Nothing says "unprofessional job" like wrinkles in your duct tape.
While I was going to submit this as a story, it would seem more appropriate as a link from this one.
News.com has an interesting article talking about how bot nets have migrated mainly from DoS to wide-spread spys. A growing increase in bot nets have been used to gather sensitive identity information and install adware and spyware. The Honeynet Project estimates that some of the networks are made up of more than 50,000 computers.
I'm a virgo and on Slashdot. Coincidence? Yes.
Coral link here.
When posting stories that link to small(ish) sites, please append nyud.net:8090 to the hostname: It makes the Coral cache system cache the data. They have some tens of server worldwide to alleviate the load on the original site.
Also please load the site through Coral first before you submit the story. That way, Coral's caches are already filled, and the load on the main server can be even lighter.
Support a Europe-related section on Slashdot!
During these few months, we saw 226,585 unique IP addresses joining at least one of the channels we monitored [...] This shows that the threat posed by botnets is probably worse than originally believed
Doesn't this qualify as the understatement of the year? Never in my wildest dreams did I think a botnet would grow above a few tens of thousands hosts. There's no explanation for such a botnet other than a professional full-time organization specifically created for profit.
Anyway, I couldn't have imagined a better or more authoritative write-up of botnets. Hopefully though it doesn't add fuel to the various ??AA organization's fire of declaring IRC a scourge on humanity.
I'm a big tall mofo.
Yep.
:)
The funny thing about the bruteforce attempts I've been victim of is that they use the same password as username.
I figured this out after having a guest:guest account open for a while. Suddenly I started getting complaints from the network admin, and then one night working, I was shocked by how slow this 400MHz monster had become lately. Running ps showed me a few things I didn't want to see. However, as I didn't delete the programs compiled on that account, I could browse through the code to see how it worked, and indeed, it connected a IRC server and a channel with a key and kept listing IP addresses and codes that I never took the time to investigate.
And uhm, yeah, it was stupid having a guest:guest account.
I'd love to use bot nets to spot, stop or even patch new/unknown machines on my network.
Conformity is the jailer of freedom and enemy of growth. -JFK
In other words, the new Crypto-Gram is out.
Though I did find the whole SHA-1 article mostly unreadable because of broken quotation.
In one case, bot software detected whether the game "Diablo II" was installed on the host PC. If the game was present, the program would steal items from the player's characters and drop them at preplanned places in the online game world. The bot net's controller would then collect the items and sell them on auction site eBay, Holz said.
What the... ? Stealing identities and installing viruses is one thing; but to actually go and steal stuff from Diablo-II?? Have these guys no shame???
Moral of the story? Don't run SSH unless you really really know what you're doing! Linux distros - don't let people create accounts with stupid passwords, and especially do not run SSH by default!
For those of you that use Snort as an Intrustion Detection System, there are some excellent rules that will detect botnets located at BleedingSnort
Look for IRC rules that are non-standard ports. Very easy to run.
What gets me is how easy it is to find out which channel these bots go into and what commands they accept. What prevents any Joe-Blow with a little sniffer from logging into one of these 25,000+ bot rooms and sending them DoS or self-destruct commands? I'm really suprised that their isn't any "bot wars" from disgruntled 13-year olds (no offense to any 13 year old /.ers) who want to take control of all of thoses infected boxes.
I'm a virgo and on Slashdot. Coincidence? Yes.
Acting *and* Botnets. Damn!
668: Neighbour of the Beast
I'm an op in a large channel on the Undernet and spam is definately a growing problem. I see lots of spambots join/part our channel and an unusually high percentage of them come from Romania.
You would think that the Undernet admins could simply force users to login to X, thus dramatically reducing the problem. However they are not willing to do that. As a sysadmin myself, never in a million years would I turn a blind eye one of my services being used completely inapporpriately and I would take the steps necessary to prevent it.
For the folks who are planning to re-use those tools to analyze botnets, they should think again. The botnet "controller" usually DDoS the monitoring machine. They would also observe their bots for consistency. Moreover, they would keep changing the protocol making it difficult for people to construct clients to connect to those IRC channels.
J.
You're only jealous cos the little penguins are talking to me.
WTF? Am I the only one who thinks it's funny that so many of these bots are under the GPL - as if the criminals who use them will care about the finer points of copyright law. What idiots.
what surprises me is that there arent any antibot /.ers who'll log on those botnets and self-destruct them.
that is, if any 13 yo can do it... but IANASK (I am not a script kiddie), so...
Maybe I have been lucky but I see less then 5 attempts to my port 22 a day. I only allow accounts with existing keys (no password auth) and only from a few source ip addresses access but I can still see all of the attempts that fail. You can always see the trends by port and attack by browsing the internet storm center. See how you compare to the averages or you can look up specific port related issues from the other links on that page.
Bad boys rape our young girls but Violet gives willingly.
Note that DDoS attacks are not limited to web servers, virtually any service available on the Internet can be the target of such an attack. Higher-level protocols can be used to increase the load even more effectively by using very specific attacks, such as running exhausting search queries on bulletin boards or recursive HTTP-floods on the victim's website. Recursive HTTP-flood means that the bots start from a given HTTP link and then follows all links on the provided website in a recursive way. This is also called spidering.
Any time I see this sort of obvious attempt to build paranoia, it makes me suspicious of the whole article.
SSH is more than secure if you REQUIRE the use of private and public keys as well as a passphrase for the key. It's plain text logins that are the problem. If they don't have a key they can bang their heads against that wall all they want. Make sure to explicitly allow the accounts that are authorized to access via SSH and forbid all the others.
I do the same thing with my servers and the brute force attacks come in waves. There will be no login attempts for a week and suddenly there will be 100 attempts in a row then silence again.
When the bots become self aware, then it is time to worry.
-- my sig got
I'm really suprised that their isn't any "bot wars"
Trust me, there are. You may not notice them since they target a pretty specific population (lusers with owned boxes attacking each other until they drop off the internet won't much affect you unless you're on the same network segment as one side or the other). We have an IRC operator on our network who figured out that at least the IRC control module could be disabled on command on certain prepackaged (yay scriptkiddiez) bots, and would (ab)use his power as IRCop to find the hidden channels and disable the bots there.
I have a dummy account with a cryptic name and password and no home as the only allowed ssh login for my box, from which I must su to a normal user, then su - to admin. I'm hoping that it's unlikely to be cracked.
Put identity in the browser.
I found a gaobot variant at work a month back and ran it on a Virtual PC at home. One thing the article doesn't mention is that the variant would connect to a free dynamic IP address server (in my case *.ma.cx) to figure out the IP of the IRC server. I fired up mIRC, and joined the channel my bot was joining, and sent the OP a message. We started talking for a bit. At first he thought I was some other black hat and he started bragging about having over 50,000 machines in his network. Wanted to know if I wanted to trade bots and the like. When he figured out what I was really doing, he banned me.
I sent messages to the ISP of the IRC server (in this case IPowerWeb) and to the dynamic DNS server to the effect of "Hey, someone's using your service for hacking" with all my details and such. Nothing happened. Guess they just don't care.
.ddos.syn honeynet.org 80 99999999999999999
I've seen attacks on one of my servers about 20mins after activating a new dsl line. I've been working on a c program to read the logs and count the number of failled attempts and if it is about like 10 times or a user like root they get banned with iptables.
Taco?
At some point in the not-too-distant future, I forsee a disgruntled botnet operator (or an unethical sysadmin who's getting DDoSed) causing about 100,000 0wned home computers to spontaneously "deltree /y c:".
At that point, we may see the average end-user become slightly more concerned about network security.
In fact, I'm a little surprised it hasn't happened already.
Causation can cause correlation
We recently had a very unusual update run on one of our monitored botnets: Everything went fine, the botnet master authenticated successfully and issued the command to download and execute the new file. Our client drone downloaded the file and it got analyzed, we set up a client with the special crafted nickname, ident, and user info. But then our client could not connect to the IRC server to join the new channel. The first character of the nickname was invalid to use on that IRCd software. This way, the (somehow dumb) attacker just lost about 3,000 bots which hammer their server with connect tries forever.
http://shit.slashdot.org/article.pl?sid=05/03/15/1 341203
There are. I've seen and done it, mostly as server owner for a small (usually three or so servers, twenty channels, fifty users, lots of servers because one or the other were always in some state of broken (read: running windows)) irc network that folded up a while ago. Why someone thought an irc network run off a few peoples broadband connections would be a good place for the next botnet I will never know.
tired of online ads?
Who's to say they would notice a botnet? The average computer user will probably think, "Damn, another virus killed my internet, better go re-install...."
Wow! What an amazing read! I wonder what David Chess and similar virus gurus would have to say about this stuff.
On a tangential topic: does XP (SP2) typically have 0.02% to 0.05% network utilization (as shown in Task Manager) ongoing constantly while the system is up? I've been noticing this lately and am trying to figure out why.
Nothing unusual is showing up in the Processes tab (which doesn't say much in the event that a rootkit is being used) but I didn't nothing anything unusual as far as sockets that were open (using the netstat -a command).
However, lately I've been experiencing some slowness while playing CoD:UO on a server that used to be blindingly fast for me.
I heard a friend of mine say that another friend, who is very good at bot type things, is now working by exploiting bot's to make the zombie machines patch themselves. He is supposedly being paid to do this by a large corporation.
And I was worried because my buddy was talking about root-kits. He got that look in his eye like he used to get when we worked together and I knew that we was up to something.
I downloaded chkrootkit pretty much the moment he left.
I didn't find any rootkits.
Oh, yeah, you'd be out of a job at that point once they were gone.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
I doubt this will happen (maybe by accident or some "failed" update, though).
The botnet is so "useful", why should he intentionally wipe it out?
My guess would be that we'll just be seeing more of the same. A lot more.
Phishing will grow bigger as more clueless users get infected with keylogging bots that send their bank info home, the blackmailing crowd might move on to more high profile victims (ebay down for a day? 100k bots can do it) and the botnet/worm creators will ofcourse constantly get more creative with their payloads.
The only hope seems to be that one day people will put blame where it belongs and launch a huge lawsuit against MS, forcing them to fix their holes and close the playground. Then it's all over, maybe...
just my 2c
"THROW YOUR PC OUT OF THE WINDOW. IT'S THE ONLY WAY TO BE SURE."
:) "Defenestration"/ search?q=defenestr ation&db=*
There's a word for that, actually.
http://dictionary.reference.com
He who lights his taper at mine, receives light without darkening me.
Surprisingly we already found a Microsoft Chat Server as botnet host, and it seemed to run stable.
are they surprised it's a botnet host, or surprised that it's stable?
Just wondering, from those who know about such things - Short of doing a realtime screen capture and sending the video of the mouse moving over the buttons back to the bot controller, how could a login like this be intercepted?
One of these days I'm moving to Theory - everything works there
But doing something about known infected machines is a problem with a different scale, and it's a public hygiene problem rather than a criminal detective problem. Obviously you want to notify the ISPs of the infected boxes, but what should they do about it?
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Letting the ISPs of the infected users know is a worthwhile activity; running a public blacklist of them might also be. It sounds like they complained to some of the IRC net operators, with little success, and if you let anybody who claims to be a "university research project" crack into your net and start killing off users, you've got far worse things to worry about than a few little million-machine botnets. Also, if the researchers start cracking botnets aggressively, they may be violating computer security laws if they're not very very careful. Better to get the ISPs to help do that job if you can, or find some other organized method for doing it.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I read that there are 4 service ports that get 80% of the zombie traffic in attempts to capture machines, so I decided to put port logging and discard on those 4 ports (195-197 and 443), and see what happened.
Within ONE MINUTE of logging I discovered close to a dozen hits on port 443. It means this has been going on for months and I had no idea. The only thing that saved me was that I have a firewall. It didn't stop me from picking up 3 BHOs - which I did not expect - but I fortunately had no viruses or worms.
The lessons of history teach us - if they teach us anything - that nobody learns the lessons that history teaches us.
The botnet writers could set it so a machine isn't accepted into the botnet until there is a verified secondary machine infected - use unique IDs submitted to an irc session, usenet channel, email address or web page to verify a secondary target, then allow access to the core botnet control areas. Once the initially infected machine has access to the botnet and has the latest software and target information, it could update the secondary machine while not revealling the main botnet information.
Sure, this won't stop people who are willing to let their machine infect other machines in the persuit of your botnet, but it would stop the current honeypot approach, and cause some serious moral dilemmas for those writing honeypots.
Comment removed based on user account deletion