Slashdot Mirror
Visual DDoS Representation and Its Ramifications
winterbc writes "Prolexic has a report on Zombie infections that bring a visual representation of a DDoS attack. Besides being a rather cool picture, it brings to mind a possible future of personal computing. I would love to see a real-time picture of my 'net connections as my desktop picture, allowing me to change my 'net habits based on what I see. For example, I can download new images from the OPTE Project and set my desktop that way, but a more individual pathway highlighted with my favorite color could happen someday. My point is that while DDoS are painfully ubiquitous today, tomorrow visual mapping in real-time could be a path to the source of the problem."
Is the a new programming language from Microsoft?
Can it build a map for a /.ing?
Also, it's nice to see that, for once, a story on Slashdot uses "its" correctly.
I hope not!
isn't the whole point that there's redundancy and stuff to make things reliable and invisible to the end user?
time spent visualising problems is a total waste unless you use it to stop the problem happening again. and prevention is better than cure.
This site has a much better visualisation of zombie infections.
From TFA, Overall, Europe has the most zombie infested networks ranking over the United States.
Considering the PC usage in United States, versus Europe, it is really surprising that most zombie infested networks are in Europe... Is it because people in US are better at defending their PC, than Europe... ? (comparitively speaking)
"Prolexic has a report on Zombie infections that bring a visual representation"
That would be a report, which brings a visual representation. These kinds of grammar errors come from the speaker/writer paying more attention to the last word they spoke/wrote ("infections") than to the subject of the sentence ("report") with which their next words must agree. The choice of "that/which" is a subtle style point in which few are skilled these days. But getting the plural of the subject and adjective to agree should be natural. Spoken English requires quick thinking, but written English allows a chance to reread the sentence before publishing it. The publishing effort is going to pay off a lot more when the statements are intelligible consistently by most readers.
--
make install -not war
They forgot to list zombies per operating system.
Oh, wait...
Circumcision is child abuse.
For all intents and purposes, that could just be a list of largest ISP networks. Large ISPs generally don't have the time to perform broad sweeps against zombie computers.
What is surprising is the European zombie count is higher than that of the United States. I wonder why.
The site is short on details. I'm kind of curious how their DoS filtering systems work. How can you detect the difference between a valid client and one that that's just part of an attack?
When all freedom is outlawed only the outlaws have freedom
From that, you can find the ISP
From that, you can find the machine
From that, you can put a sniffer on the line and trace the communications to find the person running the botnet.
Yet I'm not hearing any stories about these botnets being broken by the cops. Why not?
But have they hacked the Gibson yet?
On our home network I watch the infections eminating from the grandsons Windoze gaming boxen with etherape - http://etherape.sourceforge.net/ it's not a desktop background, but it's cool (the grandson reckons its sick)
Go well
This story reminds me of the Spinning Cube of Potential Doom.1 /1747223.shtml
:P
http://developers.slashdot.org/developers/04/06/0
It seems the source for this is still unavailable.
Does anyone know where to get binaries or a similar program?
The concept is fantastic and would certainly help in security.
Although, I'd prefer to have a text version similar to how Nethack displays in text mode.
Call me old school, can't shake my affinity for text only Linux.
With more and more ISP's offering DDoS protection in the cloud I have to wonder how much longer DDoS in it's current form will remain relevant. Most of the Tier I backbone providers are shutting down these things in the cloud keeping the traffic from ever reaching the customer Gateway (for customers that subscribe to this service), however these systems are looking for uncompleted TCP connections and scripted browsing sequences. So in the next round of DDoS arms escalation, any thoughts on what the next evolution of the zombie net attacks will be?
"Where do you want to go today?"
...which exact people/bots do the most requests.
Servers should get the IPs that do the most of said refreshing, and create a public Most Likely IPs To Slashdot Your Server(TM) list, so other web servers can restrict traffic a bit to them (maybe serve their pages after casual readers get them?). It's either that or sticking with no one seeing the page for a while as usual, after every hot topic...or something like that. (Of course, IPs can and often are dynamic, in which case I have no clue for a plan-B.)
You can hold down the "B" button for continuous firing.
I've only been monitoring this sort of thing with EtherApe for about 4 years now.
http://etherape.sourceforge.net/
Ubuntu: If at first you don't succeed, blindly slap a sudo in front of it
From what I remembered, he depicted computer networks as having visual representation, describing how colors changed based on the level and types of network activity.
What is given in the novel is more of a virtual reality type thing, though. I thought that was nifty. Now, if only we could get some diagrams like the one in the article done in 3D and rendered in real time as variables changed.
FTFA:
"Interesting Notes:
AOL is the most infested network on the Internet."
Gee. I wonder why.
Authority questions you. Return the favor.
...they almost look like a "web" of some sort...
Authority questions you. Return the favor.
I would love to see a real-time picture of my 'net connections as my desktop picture, allowing me to change my 'net habits based on what I see.
:(.
Try Carnivore. It's a simple sniffer that acts as a backend to any visualizer you can write (in a number of supported languages). There's a nice online library of those frontends on their site as well. The only downside is that currently there's no linux version
Digital Information Graphics
"The information age has brought inconceivable amounts of data to every area of life-at home and in the office, for leisure and travel, for shopping and banking. While the Internet provides instant freedom and instantaneous access to hundreds of valuable resources, navigating through the streams of cyber-information can be maddening. Today's web designers are beginning to understand that it's not just how good the home page looks, but how quickly and easily information can be displayed, accessed, and delivered. Digital Information Graphics confronts the issues that directly affect our interaction with the screen, whether for the World Wide Web, multimedia programs, or even small-screen devices like mobile phones or PDAs. Filled with tested principles, surefire strategies, and scores of examples and case studies, here are the effective, proven ways to present deep arrays of data for the information age. Readers will discover how to display complex environment and infrastructure in simple, innovative ways; analyze and present data gathered from demographics and news sources; convey complex events and situations in a clear, straightforward manner; and push today's technology to its limits, resulting in brand-new ways for navigating a website or interacting with the computer. Filled with 500 stunning examples from top information designers from around the world, Digital Information Graphics makes a vital part of design available to everyone living and working in the digital age."
it's not the single challange/response that's identifiable but the fact that seldom is an attack a single transaction, by monitoring the stream of activity both signature and learning filters can do a good job. Config-free IPS's are not impossible.
It's funny just to think what percentage of these boxes are Windows machines. Has anyone ever even heard of botnet boxes being run on Linux/*BSD/non-Windows machines? I guess there's one thing Microsoft should be thanked for... Inadvertently starting a new technology market.
John
Which one is the picture of the site being Slashdotted?
"Which one is the picture of the site being Slashdotted?"
The one with the mushroom cloud above it."
---
"Slow Down Cowboy!
Slashdot requires you to wait till hell freezes over between each successful posting of a comment to allow everyone a fair chance at posting a comment about Taco's weight.
It's been 1,000 BC since you last successfully posted a comment that didn't poke fun at CowboyNeal."
This is Slashdot. You should have used "it's" in the story title, then the grammar Nazis could have had fun shooting you down.
Okay, so you hve the IP address of a cracked machine ...
...
...
From that, you can find the ISP
From that, you can find the machine
From that, you can put a sniffer on the line and trace the communications to find the person running the botnet.
Yet I'm not hearing any stories about these botnets being broken by the cops. Why not?
"In America, first you get the sugar, then you get the power, then you get the women."
When I was a kid, we only had one Darth.
Am I going blind, or is there a color missing in the key? Or perhaps it's a firefox rendering error? At any rate, I can't find out what light blue is supposed to represent.
Dear diary: Today I stuffed some dolls full of dead rats I put in the blender.
If somebody takes the time to 0wn a server, it's likely because that server is on a fat pipe. If the purpetrator throttles his network usage it could go undetected and have much more serious reprecussions than a dozen infected desktop PC's on DSL. Then again, not all computers on fat pipe's are non-windows boxes... I had to clean up a Serv-U hack on our T1. =/
So, what you're saying is that current botnets function like the prayer chain of Satan, the Lord of Spam?
Etherape is a good real-time program for visualizing connects to you and their relative traffic. While it only runs on *nixes, you can set up box for monitoring your uplink. Also check this post from last year: http://developers.slashdot.org/article.pl?sid=04/0 6/17/135220&tid=172&tid=141&tid=8
but it's goddamn pointless. who gives a fuck if you have a picture of it or not?
OPTE is using LGL to make their graphs. Their website is at http://bioinformatics.icmb.utexas.edu/lgl/.
I have tried to get it running on Linux and FreeBSD, but it doesn't want to compile due to mismatches in their C++ classes. This is with gcc 2.95, 3.3 and 3.4. (See http://www.mavetju.org/~edwin/lgl.fail.txt for the full log)
Has anybody gotten LGL to compile on their machines? Or does know patches to get it working?
Thanks in advance, Edwin
bash$
go on then trelanexiph u cheeky little chappie, tell us about one of these linux dosnets you've seen.... how did you learn of it? exactly
Thousands of ramifications. (quite literally).
What it is lacking in however, is utility. Other than noticing that denial of service attacks use thousands of zombies all over the world, this doesn't really help you.
There is an audio network status tool called peep.
http://sourceforge.net/projects/peep/
Give it a try!
Back in "the day" we used to put an AM radio on top of the IBM 1130 and listen to the resulting noise to determine if the programs were working properly. Every program had a different sound and every phase of operation of each program was usually discernible from the sound.
Dog is my co-pilot.
that isn't warez, mp3, or sex-based, #chatzone, it would at least be nice if you could acknowledge the existance of certain botnets, their owners, etc. That and give -us- some level of information on what -we- can do against them.
:P
This isn't directly referring to those botnets used for IP DDoS'ing - UnderNET users typically have very little notice of them, I'm sorry that the UnderNET servers obviously do by sheer connection/disconnection power - but more to those used to DDoS channels and users by crapflooding/messaging/ctcp'ing/etc.
I'm talking about botnets like those under control by AlkkatraZ (username Almighty1 - connects using a plethora of vhosts). Some of which can be dealt with by a simple ban due to their structure, others could be dealt with if there was such a thing as a regex ban and banning capabilities on the username part - but alas.
But all in all, they could most easily be dealt with by crippling them. For example: flagging all of these bots as not being able to receive messages.
At best, the botnet operator will wonder why the frick his bots are no longer responding.
At semi-worst, there's somebody real behind one of those infected machines as well and they'll wonder why their friends are no longer messaging them.
At worst, the botnet operator figures it out and goes on a revenge-tour and DDoS's UnderNET servers.
Oh, and for what it's worth, yes we do contact the ISPs behind the infected machines, and although response rate isn't 100%, it's not zero either. We think it's worth the try - why wouldn't you ?
Please note that 'you' here isn't directed at you personally, but at IRCopers and Admins of UnderNET. I just think it's lame that obviously you have automated tools to detect them, but then you (apparently, from your own post) do diddly-squat about them.
Just my 2 cents. For what it's worth, UnderNET still kicks EF/DAL/IRCnet ass
I met with them a while back and I think outsourcing the sinking and scrubbing of DOS traffic is a great idea. I'd like to hear from anyone using their service though.
A big thank you to the admins at TMNet. You have finally made Malaysia one of the best at something.
http://timyang.com/