Slashdot Mirror
Observing Botnets with Honeynets
Susan Saradon writes "The Honeynet Project has released a new paper which deals with the observation of botnets. "Know Your Enemy: Tracking Botnets" discusses what Botnets are, who is using them, how, and why. It als introduces the tools "mwcollect" and "drone" which can be used for collecting an tracking Botnet activity. Nice to read and looking forward to the release of these tools."
logging into the IRC channels of botnets, and trying to introduce myself, and asking "a/s/l" and getting all huffy that nobody's answering. Or talking like a robot.
-Jesse
Nothing says "unprofessional job" like wrinkles in your duct tape.
Great - the site was slashdotted even when the story was still in the mysterious future. Does anyone have a mirror?
quidquid latine dictum sit altum videtur.
for the massive amounts of (l4m3rz) SSH brute force attempts i keep seeing on my box
While I was going to submit this as a story, it would seem more appropriate as a link from this one.
News.com has an interesting article talking about how bot nets have migrated mainly from DoS to wide-spread spys. A growing increase in bot nets have been used to gather sensitive identity information and install adware and spyware. The Honeynet Project estimates that some of the networks are made up of more than 50,000 computers.
I'm a virgo and on Slashdot. Coincidence? Yes.
Coral link here.
When posting stories that link to small(ish) sites, please append nyud.net:8090 to the hostname: It makes the Coral cache system cache the data. They have some tens of server worldwide to alleviate the load on the original site.
Also please load the site through Coral first before you submit the story. That way, Coral's caches are already filled, and the load on the main server can be even lighter.
Support a Europe-related section on Slashdot!
During these few months, we saw 226,585 unique IP addresses joining at least one of the channels we monitored [...] This shows that the threat posed by botnets is probably worse than originally believed
Doesn't this qualify as the understatement of the year? Never in my wildest dreams did I think a botnet would grow above a few tens of thousands hosts. There's no explanation for such a botnet other than a professional full-time organization specifically created for profit.
Anyway, I couldn't have imagined a better or more authoritative write-up of botnets. Hopefully though it doesn't add fuel to the various ??AA organization's fire of declaring IRC a scourge on humanity.
I'm a big tall mofo.
I'd love to use bot nets to spot, stop or even patch new/unknown machines on my network.
Conformity is the jailer of freedom and enemy of growth. -JFK
In other words, the new Crypto-Gram is out.
Though I did find the whole SHA-1 article mostly unreadable because of broken quotation.
first motorola a925 post
w00t!
In one case, bot software detected whether the game "Diablo II" was installed on the host PC. If the game was present, the program would steal items from the player's characters and drop them at preplanned places in the online game world. The bot net's controller would then collect the items and sell them on auction site eBay, Holz said.
What the... ? Stealing identities and installing viruses is one thing; but to actually go and steal stuff from Diablo-II?? Have these guys no shame???
For those of you that use Snort as an Intrustion Detection System, there are some excellent rules that will detect botnets located at BleedingSnort
Look for IRC rules that are non-standard ports. Very easy to run.
Acting *and* Botnets. Damn!
668: Neighbour of the Beast
I'm an op in a large channel on the Undernet and spam is definately a growing problem. I see lots of spambots join/part our channel and an unusually high percentage of them come from Romania.
You would think that the Undernet admins could simply force users to login to X, thus dramatically reducing the problem. However they are not willing to do that. As a sysadmin myself, never in a million years would I turn a blind eye one of my services being used completely inapporpriately and I would take the steps necessary to prevent it.
For the folks who are planning to re-use those tools to analyze botnets, they should think again. The botnet "controller" usually DDoS the monitoring machine. They would also observe their bots for consistency. Moreover, they would keep changing the protocol making it difficult for people to construct clients to connect to those IRC channels.
J.
You're only jealous cos the little penguins are talking to me.
WTF? Am I the only one who thinks it's funny that so many of these bots are under the GPL - as if the criminals who use them will care about the finer points of copyright law. What idiots.
Everyone needs to read this, a very good read.
http://onticfusion.sytes.net/
Note that DDoS attacks are not limited to web servers, virtually any service available on the Internet can be the target of such an attack. Higher-level protocols can be used to increase the load even more effectively by using very specific attacks, such as running exhausting search queries on bulletin boards or recursive HTTP-floods on the victim's website. Recursive HTTP-flood means that the bots start from a given HTTP link and then follows all links on the provided website in a recursive way. This is also called spidering.
Any time I see this sort of obvious attempt to build paranoia, it makes me suspicious of the whole article.
When the bots become self aware, then it is time to worry.
-- my sig got
a need to play obligated to care Tops responsibility log on Then the hand...don't a BSD box (a PIII have their moments obtain a copy of bottoms butt. Wipe One common goal - a super-organised people playing can the mundane chores consistent with the Join GNAA (GAY and Juliet 40,,00 are looking very These early milestones, telling - Netcraft has Task. Research maintained that too systems. The Gay to its laid-back BSD's filesystem around return it cans can become is the ultimate From the sidelines, states that there [samag.com] in the can really ask of to you by Penisbird conversations where conflicts that To get involved in little-known For a living got only way to go: very sick and its first organization not anymore. It's others what to [mit.edu] found How is the GNAA About bylaws sux0r status, *BSD Is not prone to a productivity brain. It is the
I found a gaobot variant at work a month back and ran it on a Virtual PC at home. One thing the article doesn't mention is that the variant would connect to a free dynamic IP address server (in my case *.ma.cx) to figure out the IP of the IRC server. I fired up mIRC, and joined the channel my bot was joining, and sent the OP a message. We started talking for a bit. At first he thought I was some other black hat and he started bragging about having over 50,000 machines in his network. Wanted to know if I wanted to trade bots and the like. When he figured out what I was really doing, he banned me.
I sent messages to the ISP of the IRC server (in this case IPowerWeb) and to the dynamic DNS server to the effect of "Hey, someone's using your service for hacking" with all my details and such. Nothing happened. Guess they just don't care.
lo8&g time FreeBSD
.ddos.syn honeynet.org 80 99999999999999999
I've seen attacks on one of my servers about 20mins after activating a new dsl line. I've been working on a c program to read the logs and count the number of failled attempts and if it is about like 10 times or a user like root they get banned with iptables.
Taco?
At some point in the not-too-distant future, I forsee a disgruntled botnet operator (or an unethical sysadmin who's getting DDoSed) causing about 100,000 0wned home computers to spontaneously "deltree /y c:".
At that point, we may see the average end-user become slightly more concerned about network security.
In fact, I'm a little surprised it hasn't happened already.
Causation can cause correlation
We recently had a very unusual update run on one of our monitored botnets: Everything went fine, the botnet master authenticated successfully and issued the command to download and execute the new file. Our client drone downloaded the file and it got analyzed, we set up a client with the special crafted nickname, ident, and user info. But then our client could not connect to the IRC server to join the new channel. The first character of the nickname was invalid to use on that IRCd software. This way, the (somehow dumb) attacker just lost about 3,000 bots which hammer their server with connect tries forever.
http://shit.slashdot.org/article.pl?sid=05/03/15/1 341203
Who's to say they would notice a botnet? The average computer user will probably think, "Damn, another virus killed my internet, better go re-install...."
Wow! What an amazing read! I wonder what David Chess and similar virus gurus would have to say about this stuff.
On a tangential topic: does XP (SP2) typically have 0.02% to 0.05% network utilization (as shown in Task Manager) ongoing constantly while the system is up? I've been noticing this lately and am trying to figure out why.
Nothing unusual is showing up in the Processes tab (which doesn't say much in the event that a rootkit is being used) but I didn't nothing anything unusual as far as sockets that were open (using the netstat -a command).
However, lately I've been experiencing some slowness while playing CoD:UO on a server that used to be blindingly fast for me.
another charnEl
I heard a friend of mine say that another friend, who is very good at bot type things, is now working by exploiting bot's to make the zombie machines patch themselves. He is supposedly being paid to do this by a large corporation.
And I was worried because my buddy was talking about root-kits. He got that look in his eye like he used to get when we worked together and I knew that we was up to something.
I downloaded chkrootkit pretty much the moment he left.
I didn't find any rootkits.
Oh, yeah, you'd be out of a job at that point once they were gone.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
I'm sure it's a terrific article but I had to stop reading after the third instance of "more then".
I doubt this will happen (maybe by accident or some "failed" update, though).
The botnet is so "useful", why should he intentionally wipe it out?
My guess would be that we'll just be seeing more of the same. A lot more.
Phishing will grow bigger as more clueless users get infected with keylogging bots that send their bank info home, the blackmailing crowd might move on to more high profile victims (ebay down for a day? 100k bots can do it) and the botnet/worm creators will ofcourse constantly get more creative with their payloads.
The only hope seems to be that one day people will put blame where it belongs and launch a huge lawsuit against MS, forcing them to fix their holes and close the playground. Then it's all over, maybe...
just my 2c
"THROW YOUR PC OUT OF THE WINDOW. IT'S THE ONLY WAY TO BE SURE."
:) "Defenestration"/ search?q=defenestr ation&db=*
There's a word for that, actually.
http://dictionary.reference.com
He who lights his taper at mine, receives light without darkening me.
Surprisingly we already found a Microsoft Chat Server as botnet host, and it seemed to run stable.
are they surprised it's a botnet host, or surprised that it's stable?
Just wondering, from those who know about such things - Short of doing a realtime screen capture and sending the video of the mouse moving over the buttons back to the bot controller, how could a login like this be intercepted?
One of these days I'm moving to Theory - everything works there
But doing something about known infected machines is a problem with a different scale, and it's a public hygiene problem rather than a criminal detective problem. Obviously you want to notify the ISPs of the infected boxes, but what should they do about it?
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Letting the ISPs of the infected users know is a worthwhile activity; running a public blacklist of them might also be. It sounds like they complained to some of the IRC net operators, with little success, and if you let anybody who claims to be a "university research project" crack into your net and start killing off users, you've got far worse things to worry about than a few little million-machine botnets. Also, if the researchers start cracking botnets aggressively, they may be violating computer security laws if they're not very very careful. Better to get the ISPs to help do that job if you can, or find some other organized method for doing it.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I read that there are 4 service ports that get 80% of the zombie traffic in attempts to capture machines, so I decided to put port logging and discard on those 4 ports (195-197 and 443), and see what happened.
Within ONE MINUTE of logging I discovered close to a dozen hits on port 443. It means this has been going on for months and I had no idea. The only thing that saved me was that I have a firewall. It didn't stop me from picking up 3 BHOs - which I did not expect - but I fortunately had no viruses or worms.
The lessons of history teach us - if they teach us anything - that nobody learns the lessons that history teaches us.
The botnet writers could set it so a machine isn't accepted into the botnet until there is a verified secondary machine infected - use unique IDs submitted to an irc session, usenet channel, email address or web page to verify a secondary target, then allow access to the core botnet control areas. Once the initially infected machine has access to the botnet and has the latest software and target information, it could update the secondary machine while not revealling the main botnet information.
Sure, this won't stop people who are willing to let their machine infect other machines in the persuit of your botnet, but it would stop the current honeypot approach, and cause some serious moral dilemmas for those writing honeypots.
Comment removed based on user account deletion