Meet the Botnet Hunters

An anonymous reader writes "The Washington Post is running a pretty decent story about 'Shadowserver,' one of a growing number of volunteer groups dedicated to infiltrating and disabling botnets. The story covers not only how these guys do their work but the pitfalls of bothunting as well. From the article: 'Even after the Shadowserver crew has convinced an ISP to shut down a botmaster's command-and-control channel, most of the bots will remain infected. Like lost sheep without a shepherd, the drones will continually try to reconnect to the hacker's control server, unaware that it no longer exists. In some cases, Albright said, a botmaster who has been cut off from his command-and-control center will simply wait a few days or weeks, then re-register the domain and reclaim stranded bots.'"

Comments

Botnet Hunters!

[blinkless]

We don't need their scum.

Re:Botnet Hunters!

[Anonymous Coward]

I think I'd have them swarm karma whores who respond to unrelated first posts so they can get their "insight" near the top of the page.

Re:Botnet Hunters!

[kev0153]

Yes Sir

Re:Botnet Hunters!

[clem]

No disintegrations!

Re:Botnet Hunters!

[JasonTik]

It would be quite helpful. All I would have to do is shutdown your primary and backup sites for a week, and you would never be able to recover the bots.

Re:Botnet Hunters!

[cyberscan]

If I were making money via bots, I would have a secondary means of control. This would involve code that uses gnutella protocol to search for a specific file (the filename can reflect a certain daye, etc) the contents of that file would be encrypted with a private key so that only the botmaster could implant control commands. When a bot becomes stranded, it could use gnutella or another p2p protocol to extract the address of the new control server. Botnets will continue to exist as long as there are people who do not take simple precautions when on the net or use insecure programs such as Internet Explorer and Windows under administrative accounts.

info on botnets

[flynt]

Is there a central location that tracks the current largest botnets, what their purpose is, their communication mechanisms, etc? I googled and couldn't find much.

Re:info on botnets

[Anonymous Coward]

Shadowserver have started something akin to what you're looking for.

Hmmmm

[Anonymous Coward]

Those first two paragraphs sound like a movie pitch. A wierd movie pitch...

Re:Hmmmm

[Random Destruction]

I before e except afer c or when sounded as 'ay' as in neighbour and weigh, or in weird words like weird.

Re:Hmmmm

[Random Destruction]

haha. *after
</spelling nazi>

Re:Hmmmm

[Peter Mork]

I before e except afer c or when sounded as 'ay' as in neighbour and weigh, or in weird words like weird and science .

Re:Hmmmm

[somersault]

but in science the i is before the e. *wonders what a natural language processor would make of this sentence* actually /. could likely make any remotely/artificially intelligent english lover want to commit suicide :D

Re:Hmmmm

[somersault]

indeed. That rule needs to be made more snappy, I'd forgotten the except after c by the time I'd got to the end.. stupid internet really creating a deficit in me attention span :s

Botmasters will switch to distributed C&C

[putko]

Botmasters will switch to gossip-based protocols (like p2p) to achieve their goals. The good ones have done this already.

This is required for other reasons: if you have more than 10K or so bots, you are better off with a distributed mechanism.

Interestingly enough, most of the botmasters are not so technical - they wouldn't be able to comprehend virtual synchrony if it smacked them in the face.

Re:Botmasters will switch to distributed C&C

[toad3k]

What I don't understand, is if these guys can see every bot on the network, have an infected honey pot of their own, why can't they take control of the computers, tell them to pop up a "you've been infected, moron" window and format themselves? In the end it is probably better for the individual than allowing them to get keylogged etc.

Or are the backdoors they are using more sophisticated than that?

Re:Botmasters will switch to distributed C&C

[sumdumass]

I would imagine fear of the law and getting suied or thrown in jail. Not to mention poping open a window might be as unoticed as the popup wanting to increase my member size. It would take some sort of government imunity to prosecution to aviod getting getting tangled in the same laws that make computer tresspass ilegal. Maybe some program that you can sighn up with and keep detailed logs or let them keep the logs.

Now on another note, If we did allow these people to do as you say and included the "i'm doing good not evil" as an excuse, how many real attackers can use that as thier claim to inocence when they do eventualy get busted? I mean if I can avoid prosecution for poping up a windows that says your infected, I could end all my botnet attacks that way and make the window apear to be a standard popup from spyware that also effecting the computer.

I don't see why the law isn't going after these bot net people like they would if I broke into some companies mainframe and used thier computers to compile code. Maybe instead of having the ISP turn the domain off, they should alert the proper athorities (in each country involved) and see if they can get enough information to make an example of them. I doubt it would take mor ethen a couple dozen prosecutions with maximum penalties to discourage the vast majority of these net operaters form trying it in the first place.

Re:Botmasters will switch to distributed C&C

[Otto]

I would imagine fear of the law and getting suied or thrown in jail.

So, here's a clue: Don't tell anybody you did it.

I mean, really. Make a popup or something that says you've been infected to the users, or better yet, just have the bot kill itself quietly and not do anything else. No need for it to be damaging, it's enough to have the bot just stop running and kill it's own restart sequence. Voila, instant botnet death.

Hell, maybe it's a normally available patch that just hasn't been applied, in which case opening Windows Update in a browser window might be enough to get the user to apply the patches, thinking that Windows did it itself, like it's actually prone to do sometimes.

I can think of dozens of ways to avoid prosecution. Hell, this guy has a hard enough time getting the botnet OWNER in trouble, injecting a few commands into the network that you know will do some good and not do any actual harm should be freakin' trivial.

The first rule of not getting in trouble is not getting caught.

Re:Botmasters will switch to distributed C&C

[arivanov]

For 90% of the zombies out there even if the computer screams through the speakers "You are infected moron" and displays this on screen permanently the owner will not clean it up. At best they will call Dell and tell that the spanking new PC they bought one week ago has broken speakers.

Just history repeating itself.

Nearly 14 years when I lived in a country on the other side of what used to be the iron curtain I saw one of these cases with my own eyes. Two newly fledged "politology scientists" (no comment on what they were in reality) with some fresh funds from USA donors for a "freedom of information study project" bought themselves the highest possible spec new PC with the biggest and baddest monitor they could buy. It was mostly used by their kids to play tetris and a few other games (the "scientists" did not know how to use a computer). As usually it in a few days it was throughly infected including that funny virus that used to drop the letters down on the screen (SWAP, Cascade or something like this). They looked at it and took the monitor in for repairs screaming that they have been sold damaged goods. We were getting parts from the same supplier so I had about an hour of free entertainment listening to the tech trying to tell the stupid "politically aware c**t" that she is infected.

So making the bots scream at their owners will have no effect. Besides that it is illegal in US, UK and a few other countries laws.

Re:Botmasters will switch to distributed C&C

[diegocgteleline.es]

why can't they take control of the computers, tell them to pop up a "you've been infected, moron" window and format themselves?

Those bots "patch" the backdoors so nobody else can get in through the hole

Re:Botmasters will switch to distributed C&C

[ostiguy]

Why would a bot master want to use a protocol that likely has packet signatures on IDS/IPS? Or packet shaping signatures on educational/ISP networks that might manage bandwidth but not content?

Re:Botmasters will switch to distributed C&C

[raduf]

      Making examples doesn't really... feel ok. Many of us had their "rebel days" in our youth, and I wouldn't have liked getting thrown in jail with a permanent record for remotely rebooting someone's server. Not that I ever did that of course :) but I could have. The real problem is that it takes too much effort to catch all those guys "by hand". Catching a few and chopping their right arm may work, and I may even go with it, but I'll never like it. And I wouldn't advertise it either.

Re:Botmasters will switch to distributed C&C

[99BottlesOfBeerInMyF]

I would imagine fear of the law and getting suied[sic] or thrown in jail. Not to mention poping[sic] open a window might be as unoticed[sic] as the popup wanting to increase my member size. It would take some sort of government imunity[sic] to prosecution to aviod[sic] getting getting tangled in the same laws that make computer tresspass[sic] ilegal[sic].

I can back you up here. I know some security researchers who monitor botnets and they don't shut them down for legal reasons. They do get the command networks killed when they start to be maliciously used. As an aside, some of the botnets are actually honeynets and every now and again a researcher will share some logs that shows them monitoring one another while posing as "legitimate" botnet operators.

Re:Botmasters will switch to distributed C&C

[plover]

Maybe [...] they should alert the proper athorities (in each country involved) and see if they can get enough information to make an example of them. I doubt it would take more then a couple dozen prosecutions with maximum penalties to discourage the vast majority of these net operaters form trying it in the first place.

From what I've seen of the chat logs of these botnet operators (interviews, news articles, etc.) they typically don't speak English-as-a-first-language, which implies they're operating outside of the USA.

Many of these operators work out of countries that have police who can barely keep up with the local street crime. Their police certainly don't have time to worry about some rich guy's PC in the USA. And given the current state of dislike for the U.S. that's found across the world, it's possible the local police would refuse to cooperate with an American investigation.

And if they do say they'll cooperate, chances are not bad that if one of these officers was tasked with busting someone running a botnet from a cafe, they'd say "I hear you're hacking PCs in the USA and made $10,000. For $5,000 I'll let you know if Interpol starts asking about you."

Re:Botmasters will switch to distributed C&C

[sumdumass]

Well we are walking a thin line here. Suppose I start a monitoring station and report everythign to the governments and capture his or your commands. Now you are on the watch list and could be blamed and you didn't "tell anyone".

As for windows update? From time to time you will see that windows update will break certain aplications and hardware devices. What happenes when this update gets another update that doesn this exactly. Shure a patch might be avalible for the hardware or product but maybe not for the old version you own that does everythign you need it to. Now your stuck either updating your software and (maybe) paying for it or reloading you windows. Not to mention the time it takes. I think it was the slamer worm that someone made another worm whos job was just to shut down the slammer. The author of it got into as much trouble as if he wrote the slammer/slapper worm itself. What if a drive is bad and when the computer gets shut down, it never starts again leaving the user with lots of lost data and a snort log pointing to the well intentioned white-hat trying to shut down the bot networks. I'm not sure it would even matter happened other then you accessed the computer and data is missing now.

Maybe tracking the IP address and finding some way to complain to thier ISP and have them send an automated email with a disconect notice could be the answer. I know I would be pissed if I found someone in my computer without my express permision no matter what thier intentions are. Now i'm not the type to go around with an infected computer but, that doesn't mean nothing will ever come in under the radar and take a bit of time to notice. Almost every exploit goes for some time before the white-hats have the resources neccesary to contain/counter it.

Re:Botmasters will switch to distributed C&C

[misleb]

I think the ability to popup a message would have to be specifically programmed into whatever backdoor program they are using. AFAIK, the trojans/backdoors are configured to do very specific things such as send spam, install malware, DDoS, etc. I don't think a botnet owner really has full control over a zombie in most cases.

-matthew

Re:Botmasters will switch to distributed C&C

[odyaws]

tell them to pop up a "you've been infected, moron" window

I had a friend in our security group who needed to notify somebody at another university that their machine had been cracked and was attacking others. She sent a note to their local printer - I can only imagine the look on their face when a "You have been hacked, please clean your machine" note printed at their desk!

Re:Botmasters will switch to distributed C&C

[MisterOblivious]

I did that a few times with the sub7 bot. There used to be quite a few infected machines left with the default password in place attacking an irc server I used. Seems strange to me now, but the author included feature to remove the sub7 code from the infected machine. After removing the bot from a number of the machine, the controller started setting a password on newly infected machines. I eventually figured out the dynamic host name the infected machines were connecting to and had the service point the domain name to 127.0.0.1. A smallish botnet shut down with a simple phone call.

Re:Botmasters will switch to distributed C&C

[Otto]

I didn't say to actually update the thing. Just make it pop up the website. Let the user run his own update. There's a difference between throwing suggested courses of action in the users face and taking that action for yourself.

Yes, doing so would be against the law too. Well, you know what? Fuck the law. The law isn't solving the problem. The law is never going to solve the problem. People keep bitching that users are not fixing their shit, and this is true, so I suggest that instead of trying all this legal and proper bullshit, that you get in the user's face about it. Emailing people to tell them their computer is fucked is not going to work.

The reason that the exploits are effective are because the users don't care enough to patch their shit and the only way to solve it is to make it so annoying to not patch their shit that they will actually go and do it.

I'm not saying to do it for them. That would be going too far. But there are other means available than actually modifying their computer. If they're owned, then they should be told. If you can disable a botnet, then you should do so. Letting it run and fucking over half the planet with the spam it's sending out just so you can work your ass off to get the law to do something about the spammer, when the law could not care less about whole fucking thing, well, that's just not a real good fucking solution, is it?

The system is broken. Working through a broken system doesn't get shit done. If you want to call it vigilantism, well, then you're missing the point of what I'm saying, but so be it.

Re:Botmasters will switch to distributed C&C

[sumdumass]

I see and understand what your saying. I just don't think two wrongs actualy make a right. It does make you feel better but if you murder some one because they murdered someone were close to, guess what that still makes you a murderer.

Notifying the ISP and having them cut thier service off is something that isn't being pursued enough. Time warner would send out emails with deadlines when your computer was thought to be infected and spreading virus's. I'm not sure if they st ill do. As i see the problem, ISPs are immune to prossecution for the shit people spew on thier networks because they don't have an active knowledge or control on it. Maybe going after them with somethign like a DMCA notice were once they are informed about thier networks (or computers on it) damaging other systems and not longer immune after they are made aware of the situation. In this situation, I provide valid logs claiming that computers with these ip adresses at these times are working in a botnet then they have to take action to inform thier customers, disconect them, or suffer a lawsuite and maybe even criminal penalties. This is better then a popup that they are already used to because they don't understand spyware (and clicked in the last your infected message only to find more popups happening) or windows update poping up like it does once a month on my computers whenever internet explorer is opened and ignored once again.

You see, breaking the law to preserver the law is only effective in life and death situations. If you want to shut down a botnet by violating the same laws then suffer any penalties you might incure. But to ask or expect someone else to do the same ins't sane. I'm not saying the system is perfect or that it isn't broke. I'm saying it can be fixed without becoming who your attemping to protect us from. Something can be changed before you are seen as the problem (more then the botnets). Even working to get a law passed that specificaly says, "registar with this service or organization and you can disable botnets any way you deem neccesary as long as you don't disrupt a legitimate network" is an option. Then you aren't exposing yourself or others to penalties and you havn't become the criminal your out to get.

Lets face it, we are in agreement that some people are clueless and won't take the time to fix thier computers or become educated on the problem. We are in agreement that the current system isn't working. We are in agreement that something else needs to be done. We are in agreement that the current system poses a risk to our networks and computers. However, the only thing we are not in agreement on is the course of action. I'm all for stoping them but I want it done legaly instead of breaking the same laws because your pissed about it. We set a dangerous precedent when we justify breaking laws because we don't agree with thier outcome. We even open an avenue that helps the defense of the criminals the we are pissed at if they chose to claim they were doing "the same disabling of botnets".

Re:Botmasters will switch to distributed C&C

[Otto]

As i see the problem, ISPs are immune to prossecution for the shit people spew on thier networks because they don't have an active knowledge or control on it. Maybe going after them with somethign like a DMCA notice were once they are informed about thier networks (or computers on it) damaging other systems and not longer immune after they are made aware of the situation. In this situation, I provide valid logs claiming that computers with these ip adresses at these times are working in a botnet then they have to take action to inform thier customers, disconect them, or suffer a lawsuite and maybe even criminal penalties.

See, I dislike this notion completely, and I'll tell you why: The end result of such actions are worse than the disease.

As soon as you start making ISPs and network providers liable for what their customers send out, the first thing that's going to happen is that those same ISPs will start blocking everything from their customers but port 80 traffic. You'll turn the entire internet into a receive only system. Only corporations with the cash to shell out for a direct network drop will be able to provide content. Yes, it's going this way already, but making ISPs liable for what their customers send out only leads to those ISPs stopping their customers from sending out anything, and they'll do it in a totally heavy handed and blanket manner.

Stopping spam is not worth destroying the network's ability to connect.

Re:Botmasters will switch to distributed C&C

[sumdumass]

OK, i wasn't thinking of that side effect. It is a very scary one indeed. Maybe we are left with getting a law passed that says you can disable a botnet if you discover one and certain other requirments have been meet. As i have pointed out, my concerns about doing this is with violating laws as they stand. It seems logical that the law should be changed but in a way that allows control over what is hapening so that liability for other damages can be minimalized or negated. Even with a registared systems, a dummy site could be setup that does nothing but forwards anonymous complaints, evidence and other usefull information that would allow someone who is registard to take action.

How does somehtign like that sound?

Re:Botmasters will switch to distributed C&C

[Otto]

As i have pointed out, my concerns about doing this is with violating laws as they stand.

I prefer to consider them guidelines.

Here's my problem with the law: It's rigid. It is a rigid and unflexible architecture designed to describe pretty much all aspects of human behavior. However, because of that rigidity, it cannot account for situations that were not thought of by the people who wrote it. Therefore it is always behind the actual reality of human behavior, which is in a constant state of change. And the rate of that change is increasing as well.

We attempted to build some flexibility into law with things like judges and juries. Their function was to read the rigid law and understand the supposed violations of that law, and then apply some flexibility according to current standards of behavior and such, thus keeping the law up to date. The system of "precedent" is wholly based on such a notion.

But then we invented lawyers, and they fucked it all up.

Ask any lawyer about what the function of a jury is, and they will tell you that the jury is not supposed to think, but that they are supposed to apply the law as it reads, word for word. They can cite precedent that says so. They will argue it until their last dying breath. It was drilled into them in law school. They don't question it, they *know* it to be true.

And that is of course total nonsense, because any idiot can read the law and apply it word for word. You don't need 12 people picked off the street to do that. No, the purpose of the jury is to bring social standards into the courtroom. The judge applies the law, the jury applies common sense, despite whatever the common sense happens to be at the time.

And that's why I'm against the whole notion of "law". It completely fails in it's purpose and design if you actually think that you're supposed to apply it exactly as it says. Doing that is not fair and it is not just.

So no, I say fuck the law. If you want to work to change the law, more power to you. I won't waste my time. Instead, I simply work outside the law when I find it necessary to do so. I feel no need for laws to protect me, but I'll accept any laws you feel necessary to protect you. However, I will only obey those laws when it suits me to do so. Hey, call me a rational anarchist.

delete themselves

[Anonymous Coward]

There should be a way to reverse engineer the clients so that they can delete themselves, I'm not exactly a botnet admin, but they have file access from what I have learned. Should they not just be able to use a friendly botnet server to tell the computers to delete the client software?

Re:delete themselves

[Soporific]

I believe you would be able to do that, however then you take on the liability of screwing up peoples machines even more or causing some other unforseen problem.

~S

Re:delete themselves

[Furp]

When you issue a command or code to cause a botnet to self destruct, you are crossing the line from greyhat hacking to blackhat hacking. You're no longer a witness. Which also makes you liable under whatever laws exist in your country of residence for hacking. Because you're gaining illicit access to their computers (the infected botnet) And accessing data (causing the botnet to self destruct)

Which is why if you're going to do botnet hunting you either get to ally yourself with law enforcement and contact the ISPs, or kill the botnets. Personally I would prefer the safer of the two.

Re:delete themselves

[Furp]

Well, depending on your personal ethics, the moral ground isn't the important one to be considering. It's the legal one. I do have a little experience with the amazing abilities of the judicial system to screw people over, and I would really NOT want to put myself in that situation. Causing damage is exactly what you would be doing by making the botnet self destruct. It's not a matter of weighing which is more damage, leaving the botnet up or destroying it, it's a matter of the fact that you're causing damage in the first place. And that's the way the courts will look at it.

Re:delete themselves

[Tweekster]

Well figure this: since the botnet creator isnt being gone after when they ARE being destructive... what is the chances they will come after you when you more than likely wouldnt be destructive (unless a freak accident)... I would guess less than zero. they are not doing anything about the damage being done now...why would that changeif something went awry and causes some minor problems The fact that the courts will never be involved is the key point, the system currently is doing nothing about the botnets to begin with and have no ambition to at this point. If they have no interest in it, they will not bother with you either.

Re:delete themselves

[Furp]

Unless the FBI or some other TLA is involved (Either from the USA or other countries), and are already monitoring the botnet and gathering evidence for prosecution? Quite honestly, issuing a command like self destruction would seem like the criminal is ditching and running, and they would have your IP address at that point...

Again, that's a lot of risk to be taking on. Because there *are* convictions for people running botnets, which means that there *are* governmental agencies monitoring some of them, trying to catch the ringleader(s).

Re:delete themselves

[glas_gow]

Forget actually propagating the self-destruction of bots, even thinking about unauthorised access is an offense punishable by law.

Re:delete themselves

[Reaperducer]

And what if the zombie computer is running air traffic, or life support monitoring, or some other mission-critical task when the botnet hunter starts tampering with an already compromised system? Will he take responsibility when something lethal happens?

Re:delete themselves

[chrisatoremus]

Well, in that case you have the right to remain silent.

It would be interesting to see what would happen if a hypothetical bothunter 'stole' the IP addresses of the bots on the botnet, and uninstalled the bot software at a given time, such as 9:27 am on October 28th 2001. Undetectable until that date and then *boom* the botnet disappears.

Re:delete themselves

[somersault]

I think Microsoft should take responsibility. I'm mostly joking, but really.. what kind of moron releases their OS with everything wide open by default v.v You'd have thought that they'd get the message by around Win2K time, rather than XP SP2.

Also it's frustrating how so many people will just put up with spyware infected systems because they dont know any better - we need more basic training, or aptitude tests that take place every time you boot up your machine o_=

They are on the web

[9mm Censor]

www.shadowserver.org/

Bitter irony, Slashdot is thy home (or hangout...)

[The_REAL_DZA]

"...Albright sent an e-mail to the FBI including all the evidence he collected about the attack..."

Apparently, Mr. Albright doesn't frequent Slashdot or watch CNN...

Domain..

[onion2k]

In some cases, Albright said, a botmaster who has been cut off from his command-and-control center will simply wait a few days or weeks, then re-register the domain and reclaim stranded bots.'

Why don't the hunters register the domain for themselves? Or just ask the registrar controlling it to transfer it to their control? If the botnet owner tries to complain it's been hijacked he'd have to explain the botnet..

Re:Domain..

[Mr. Funky]

Or have the toplevel provider blocking it with a 'REGISTRAR-LOCK'.
It is very hard to get that unlocked, I found out :(

Re:Domain..

[BoRegardless]

& then...

Issue a reformat command ;-)

Great plot!

[Rob T Firefly]

This whole loose-knit bunch of humans doing their part against a force of cold, malignant bots has a great edge to it! Someone should make a movie or three like this.

Re:Great plot!

[CCFreak2K]

Spoilers.

Isn't that was SkyNet is? A big botnet? A self-aware one, anyway.

Interesting Deal

[DeadManCoding]

So, these guys find botnets, collect the info to have them shut down, and then get the channel shut down? While this is great, it does little to stem the tide of bots. Adware/spyware and viruses are still being made to create more bots. So, while Shadowserver goes after the host servers, there are still millions of computers that are infected and transmitting, including that physician that was sending patient data!! If we really want to shut botmasters down, we need to battle the root of the problem. Unfortunately, we're still not allowed to kill of the bottom of the gene pool. Either that or switch from XP to a better OS platform that has fewer known vulnerabilities (Mac, *nix).

Re:Interesting Deal

[Arkan]

Would you have RTFineA, you'd have noted the following:

"A few months ago, Taylor became obsessed with tracking a rather unusual botnet consisting of computers running Mac OS X and Linux operating systems."

I bet that your plan for security through statistics isn't looking good.

The final and ultimate answer to bots, spyware and such is knowledgeable users. I've been called an extremist when advocating a few years ago for a mandatory licence to get the right to connect a home PC to Internet, and I still think that it should be implemented: given the pile of cash those frickin' viruses and worms cost us, it should no longer look like a stupid idea pretty soon.

--
Arkan

Re:Interesting Deal

[dnixon112]

So how does switching to Mac or *nix help when, like the article points out, the majority of infections come from clueless users who click on unknown e-mail attachments?

Re:Interesting Deal

[OldeTimeGeek]

Why is it the users' fault? Computers are vulnerable to attack because almost all of the security measures that have been added to consumer-grade operating systems have been added as an afterthought. Why should users be trained to react to something that shouldn't be there in the first place?

Rather than add another level of bureaucracy (who would be the licensing authority - your local geek?), why not take the real culprits to task? Would you blame the driver or the manufacturer if a car's wheel falls off due to bad design?

Re:Interesting Deal

[yog]

I had assumed that most of these "dangerous attachments" were Windows executable files that would not work on Mac/Linux. So if they do work on Mac X and Linux, what the heck are they? Shell scripts that contain previously unknown root exploits?

As a Linux user, I find this rather disturbing. Even on Linux, I never open attachments from unknown senders and even known senders' attachments go into a kind of quarantine, but up till now I had assumed that there was little cause for concern. Maybe MS Word files opened in OpenOffice with macros enabled might do some such as communicate back to the sender, but they still wouldn't have root privileges to do anything really evil. Or maybe they don't need root privileges, just internet access.

Hmm. I'm opening all Word docs in gmail.com from now on!

Re:Interesting Deal

[Dimensio]

Shell scripts that contain previously unknown root exploits?

Actually, most of the attachments are Windows executables without any "exploits". They take advantage of the fact that quite a few idiots run as Administrator all the time.

Re:Interesting Deal

[Criterion]

And since the parent was asking about *nix specifically, you're grand observation about win executables pretty much misses the mark.

Re:Interesting Deal

[MindHack]

I find it insulting that Miscrosoft will wait months before releasing the fix to a known vulnerability, yet worm coders will have an attack ready to exploit the hole in a matter of days. Now, what if these white-hat freedom fighters used worms as a propogation mechanism for bugfixes? Patch the hole BEFORE the machine becomes a zombie? Or, instead of patching said hole, why not instruct the machine to only allow your IP address to enter the hole? Some kind of backdoor authentication mechanism? This way you would be able to use the same worm to propogate many patches over several months until microsoft finally closes your hole.

Oh, I don't know...

[Channard]

.. with all this mention of 'The Botmaster' it sounds more like a cue for a gay porn movie with a Neuromancer style theme.

Drones

[Anonymous Coward]

Like lost sheep without a shepherd, the drones will continually try to reconnect to the hacker's control server, unaware that it no longer exists.

Since we're discussing drones, wouldn't a more appropriate analogy have been "like lost bees without a queen"?

Re:Drones

[theJML]

What, like Borg? (sorry, this thread went too far without a trek reference.)

Be vewy vewy quiet...

[Tackhead]

Be vewy vewy quiet! We're hunting botnets!

Buggy bot: Would you like to shut us down now or wait 'till you get home?
Daffy fuck: SHUT HIM DOWN NOW! SHUT HIM DOWN NOW!
Buggy bot: You keep out of this. He doesn't have to shut you down now.
Daffy fuck: He does SO have to shut me down now! I demand that you shut me down now. (Nyeah!)

Spammer: daffy# shutdown -now
Botnet: *reboots*

Daffy fuck: Let's read those logs again.
Buggy bot: Okay. bugbot: would you like to shut us down now or wait 'till you get home?
Daffy fuck: daffy: shut him down now
Buggy bot: bugbot: you keep out of this, he doesn't have to shut you down now
Daffy fuck: Aha! Hold it right there. DNS cacne poisoning. It's not 'he doesn't have to shut you down now, it's he doesn't have to shut me down now.' Well, I say he does have to shut me down now! So shut me down now!

Spammer: daffy# shutdown -now
Botnet: *reboots*

Secure SMTP?

[RunFatBoy.net]

So many of these Botnets are used to send SPAM. I get a gut feeling that efforts would better be expended on getting widespread adoption of a more secure, universal SMTP protocol.

-- Jim http://www.runfatboy.net/

Re:Secure SMTP?

[morcheeba]

That would help in detection, but what's to stop the bot from using the host-computer's credentials? Most machines are set up to send email already.

Re:Secure SMTP?

[ArcherB]

Banning email is a not-so subtle way of notifying admins that their servers have been compromised. Maybe when a few CEO's find that their staff can't send emails, they'll hire some competent admins.

Re:Secure SMTP?

[drinkypoo]

The problem is frequently not a lack of admin competency, but a lack of corporate willingness to do what IT says. CEO goes to IT, says, "Mister IT Man! It hurts when I do this!" IT guy says "Well, don't do that" and CEO says "What, are you fucking crazy? I want to play my ActiveX games! I like clicking on everything that comes into my inbox! Go fuck yourself!" And so, the security never improves.

Re:Secure SMTP?

[Criterion]

"The problem is frequently not a lack of admin competency, but a lack of corporate willingness to do what IT says. CEO goes to IT, says, "Mister IT Man! It hurts when I do this!" IT guy says "Well, don't do that" and CEO says "What, are you fucking crazy? I want to play my ActiveX games! I like clicking on everything that comes into my inbox! Go fuck yourself!" And so, the security never improves."

Man!! This is just too true! I know an admin, who wanted every machine in the building behind the firewall (duh), but one of the upper muckity mucks wanted one machine to be outside of the firewalled network (forget why.. some stupid reason, like to make it more easily accessable for someboy.. yeah.. no shit, but he was "the man" so it was so). Then, they get the call from the FBI to say they are hosting a phishing site, which is when they found that server had been compromised. Dumb shit. Then again, that company has had dumb shits at the helm for a long time now.

Re:Secure SMTP?

[jmv]

I get a gut feeling that efforts would better be expended on getting widespread adoption of a more secure, universal SMTP protocol.

Damn, you better tell that idea to the IETF guys ASAP. I'm sure they've never thought of doing *that*!

botnets remain undetected

[digitaldc]

"However, now I see how many malicious files tied to major botnets remain undetected" by the most popular anti-virus programs.

Sounds like a golden opportunity for ingenious programmers to design something to seek out and destroy these botnets, and then sell it to Microsoft for a fortune.
Another botnet hunter article from eWeek.

Spyware Scanners Don't Work

[michaelhood]

FTA: "I know many users within my former organization who felt that anti-virus and spyware scanning would save them," Di Mino said. "However, now I see how many malicious files tied to major botnets remain undetected" by the most popular anti-virus programs.

This, unfortunately, is the most common viewpoint from end-users and IT alike.

It's unfortunate because it's so dangerously inaccurate. Lots (LOTS) of spyware is not detected by any of the mainstream detection applications. The best solution I've found is using HijackThis to manually remove suspicious entries, but this is hardly a feasible solution for the average user.

Re:Spyware Scanners Don't Work

[Otto]

FTA: "I know many users within my former organization who felt that anti-virus and spyware scanning would save them," Di Mino said. "However, now I see how many malicious files tied to major botnets remain undetected" by the most popular anti-virus programs.

So WTF? Why is he not forwarding these files on to the major anti-virus vendors like the good netizen he claims to be? ALL of the major vendors have submission mechanisms and are glad to work with researchers to detect this sort of thing. Is this guy sitting on his hands or what?

Things don't get better until people MAKE them get better.

Re:Spyware Scanners Don't Work

[TubeSteak]

AFAIK, a program like TCPView will show all incoming and outgoing connections to your windows box.

I pop it up from time to time just to make sure nothing odd is going on.

It's also handy because it allows you to close the connection any malicious program is making. Very very useful when the program is stealthed & won't show up in the task manager.

Re:Spyware Scanners Don't Work

[0xA]

The best solution I've found is using HijackThis to manually remove suspicious entries, but this is hardly a feasible solution for the average user.

This is part of the problem though. When someone finds an piece of malicious software they often fail to submit it the AV and anti spyware companies so definitions can be updated. I'm guilty of it myself in the past as well but we do need to be responsible community members.

Re:Spyware Scanners Don't Work

[jimwelch]

From the website [URL:http://www.shadowserver.org/news.php] Methods/Mission...

Shadowserver is responsible for:
* Analyzing and reducing cyber-threats and vulnerabilities against potential targets.
* Disseminating cyber threat information
* Coordinating incident response
* Disassembling and sandboxing viruses and trojans.
* Tracking and reporting on botnet activities.
* Monitoring and reporting on malicious attackers.
Shadowserver works alongside other security agencies such as CERT/CC, InfoTex, Dshield, Drone Armies, ISC, Whitestar, and Nepenthes to establish and coordinate defensive strategies.

Re:Spyware Scanners Don't Work

[crabpeople]

Ewido and hijack this, when both run in safe mode (with networking so you can get updates), cleans them up once and for all. I have yet to encounter anything that persisted after these two steps were taken and an antivirus package was installed on the machine. Anything remaining after that point is probably a semi ligitimate (borderline adware) system service or some sort of hard to detect rootkit. At the risk of being flamed, i would recomend the Norton AV Corp 10x series from symantec. Its corportate so none of the gay activation or useless slow features and in this release they have started to detect certain spyware as viruses. Most people are turned off of symantec for there absolutely garbage horid products such as NIS. Symantec is a big company and their corporate shit has been for the most part reliable.

The most important thing is to do all this in safe mode. Most people dont even do that so what can you do?

Re:Spyware Scanners Don't Work

[drinkypoo]

Symantec is a big company and their corporate shit has been for the most part reliable.

I haven't use SAV10 but SAV9 was pure, unadulterated garbage. Whether managed or no, clients would stop getting updates and never start again until the client is uninstalled and reinstalled. This went both for program updates and virus definitions. It's also the second-slowest virus scanner in common use (behind Kaspersky Labs' AVP[oo].

You can recommend anything you like, and I won't even flame you, but SAV is crap. I was using SAV9 Corp on my home desktop box - under school licensing - but it turned out that AVG Free did a better job in every way. Symantec is also among the slowest when it comes to making the virus definition updates, probably because they know their corporate client will freak out and stop downloading them anyway.

Re:Spyware Scanners Don't Work

[pipingguy]

...none of the gay activation...

I'm not homosexual or bisexual, but I question your use of the word, "gay" as a negative adjective in this context. There are more descriptive words that can communicate your intended meaning much more effectively.

Re:Danger, Will Robinson

[FirmWarez]

I must be the only nerd here who wears a shoulder holster to work. (and no, I'm not a cop)

A different approach

[laursen]

Why not simply convince the ISP's to block infected machines from accessing the internet to start with? They [the ISP's] can probably easy spot botnet traffic and could seriously stop botnets.

Just my 2 cents.

Re:A different approach

[955301]

By mac address? Then just infect future systems with software which will try multiple mac addresses as well to get around the blocks.

Re:A different approach

[Anonymous Coward]

Why not simply convince the ISP's to block infected machines from accessing the internet to start with?

'Cause they are too busy throttling that nasty VoIP traffic that might compete with their "business partner", the local telco.

Re:A different approach

[redelm]

Yes. Some ISPs do just that. SBC blocks outbound port 25 used to send spam. If you run your own sendmail, you can request it be unblocked.

This reduces the attractiveness of SBC machines to host bots. But SBC cannot block ports like 80 (HTTP), so SBCbots can still be used for DDoS.

Re:A different approach

[east coast]

Users just don't see being part of a botnet a problem as long as it isn't slowing down their computer.

More likely is that the user is unaware of what their system is doing. Most users are dolts, not malignant henchmen. If the ISP could bring this to their intention perhaps they'd take some interest in keeping a more secure computer system.

Re:A different approach

[east coast]

There's a quote that sums it up better than I can: "Any sufficiently advanced incompotence is indistinguishable from malice."

Maybe educating the users will make them less incompotent?

As for the moderation... metamoderate more often, there are a lot of people who throw around these kinds of mods with little cause.

Re:Danger, Will Robinson

[Tweekster]

oh no a pimply faced "mobster" might come after you.... give me a break

Hey, I've seen that mentality before!

[eldavojohn]

Like lost sheep without a shepherd, the drones will continually try to reconnect...

Sounds like my sister when her cell phone cuts out.

Re:Hey, I've seen that mentality before!

[Placido]

>> >> Like lost sheep without a shepherd, the drones will continually try to reconnect...

>> Sounds like my sister when her cell phone cuts out.

Or after I left her for your Mom.















Sorry, sorry. I couldn't help it. It was either this or "Is she hot?".

There goes my "no enemies" status.

Re:Hey, I've seen that mentality before!

[smidget2k4]

I'm sorry, this is really OT but I couldn't help but smirk at your sig.

A sig dealing with existence written by a man who probably never existed.

Turn your computer off

[gatkinso]

Only a partial solution (not even really a solution), but many of the hijacked PC's are left on all night to spew their viagra spam to the net or take part in DOS attacks (or whetever the hell they do).

So... turn your computer off when you are not using it.

Hell you will even same some electricity while you are at it.

Seems like taking 8 or 9 hours out of the day for the bot to actually operate will atleast decrease some of the traffic these bots are generating.

The practice people have developed of leaving their computers on 24/7 should stop... unless of course the computer is doing something more productive than generating elaborate mazes of 3 dimensional plumbing schemes.

Re:Turn your computer off

[CagedBear]

Yes! I also tell users to press the standby button on top of the cable modem every time they walk away from the computer. They always ask me what that button does. How come the cable co. doesn't explain it when they install the darn things???

Re:Turn your computer off

[pnuema]

The practice people have developed of leaving their computers on 24/7 should stop

I don't know about anyone else, but 100% of the hardware failures I have had have been during a cold reboot. Keeping your hardware warm keeps it alive longer.

Re:Turn your computer off

[TheSkyIsPurple]

I don't know about all my problem, but

<offtopic>
Well... I killed a machine by stepping on a power strip once.
Who the hell thought it was a good idea to make power strips out of metal!?

Lovely flame or plasma cloud or whatever it was though...

Re:Turn your computer off

[rob_squared]

There is a valid reason to keep your computer on continuously. And that is because of thermal expansion. Since the circuitry in a motherboard is rather small, and the same holds true for the CPU and motherboard, then the repeated heating and cooling fo these components may make them brittle and more prone to failure.

And, well, think of the CPU time wasted by not downloading from bittorrent and emule (or SETI/Folding@home for the more noble ones out there).

Re:Turn your computer off

[gatkinso]

Well, I have a Celeron 400 downstairs that I have had since 1997. It gets cycled every day. It runs like a clock.

Stories aside, your reason has been proven to be BS in many forums.

Re:Turn your computer off

[gatkinso]

I have seen HW go bad during all phases of the power cycle.

Most during a warm boot, in my experience.

More information on same subject

[smooth wombat]

I don't normally check the Washington Post site but after reading the article I went to main page to see what was there. Near the bottom of the page, in a section called Security Fix, Brain Kregs had posted a story on March 9th titled 'Shadowboxing with a Bot Herder' wherein he talks about his conversation with a botnet owner called Witlog.

Besides the usual info about how many pcs he had infected (30,000 by his count), how he had done it (found software on a site) there was this bit at the end of the article from Symantec:

According to stats released this week by computer security giant Symantec Corp., the most common computer operating system found in botnets is Microsoft's Windows 2000, an OS predominantly used in business environments. Indeed, the vast majority of bots in Witlog's network were Win2K machines, and among the bots I saw were at least 40 computers owned by the Texas state government, as well as several systems on foreign government networks. At least one machine that he showed me from his botnet was located inside of a major U.S. defense contractor.

The permanent linnk for the article can be found here.

Re:More information on same subject

[Covetous Knight]

Yup. That story was posted to the front page of Slashdot as well.

And he didn't get a visit?

[SomeoneGotMyNick]

Let me get this straight. Summing up TFA, he found evidence of the bots, even saw persanal medical info, and turned it into the authorities WITHOUT any suspicion cast his way????

If I would have done such a good deed (and it was a good deed in my book), I'd have probably been hauled off for questioning. That's the fear as to why I don't "get involved" trying to stop these jerks myself.

Re:Danger, Will Robinson

[Zak3056]

Nice until they run into a mobster-botmaster with a gun.
This is a task for the government, not for pimpled nerds.

Someone needs to be doing it, and the story indicates that government just isn't interested in this--and even if they are, they can't seem to successfully prosecute. The end of the article really jumped out at me:

"Our data can't be used to gather a warrant," Albright said. "Law enforcement has to view the traffic first hand, and they are limited on what and when they can view."

How can there be any legal barriers here? Is this supposed to be some twisted view of the 4th amendment?

Better ways to stop them...

[Otto]

First, if you can access the botnet to the degree at which this guy claims to be able to do, then you can take control of it. And with any decent botnet, you can make the things run arbitrary code. With only minor analysis of the bot, you could make the entire network self-destruct without too much difficulty. Have it kill it's own startup on reboot sequence, then have it create a new RunOnce to delete it's own executable on reboot. Then shut down or force a reboot or just pop a message up on the screen telling the user he's been infected. As soon as somebody notices they'll likely reboot and possibly install updates and patches to their bloody machine.

This is less risky than the obvious angle of simply patching the box so it can't get infected, because you know that the bot is not supposed to be running on the machine in the first place. Patching the box might go bad or have other unknown consequences, but having the bot kill itself is not nearly as bad. And by possibly informing the user of the facts, you can still scare them into patching their box. Screw shutting down the botnet owner's connection, shut down the botnet itself. Take away their tool in one swift stroke. Make 'em have to build a new one, hopefully from a whole new set of boxes.

Re: Better ways to stop them...

[jimwelch]

I can not even count the number of laws that this violates! (see line 2 below)

From shadowserver Mission Statement:

  Shadowserver is NOT
      A vigilante group
      A "hack the hackers" group
      A money-making venture
>> less risky
No, this is a big risk. The cure is worse than the disease!

Re: Better ways to stop them...

[Otto]

From shadowserver Mission Statement:

    Shadowserver is NOT
            A vigilante group
            A "hack the hackers" group


Ah. So they're totally ineffective and useless then. Thanks for the clarification.

Why the FBI doesn't act

[kilodelta]

The FBI wants there to be a minimum of $20,000 of verifiable loss before they'll even send an agent out.

I know this from having been an I.T. guy for a state prosecutors office. We had to do everything ourselves and did we ever.

Re:Why the FBI doesn't act

[Tweekster]

Simply make up a number... do it like the big corps do: Yes, that infect 500 of our machines at $2000 a piece... Hey it works everywhere else. you can easily bullshit like thtat and the FBI wont care or know as long as they get to be involved with a big money item like that. AT&T tried to do that years back claiming a document that was secret cost like $100,000+ to produce (they included the entire years salary of the person to type it, the computer, the printer)

Re:Why the FBI doesn't act

[Frobisher]

Most of them don't have email addresses...

Re:Why the FBI doesn't act

[enrgeeman]

I remember that, the E911 document. I can't remember if it was $7 or $12, but it ended up that they were selling it for less than $20, for the full version, not the editted one.

Re:Why the FBI doesn't act

[Tweekster]

Exactly... the only reason they couldnt charge that much was because they were selling them, had it been just a normal company document they could have charged the 100K as damages

An analogy..

[mattpointblank]

So in a way, these guys are the Buffy (Season One) to the Botnet's Master? They "slay" the host machine, the source of the trouble, but all the undead zombies are left lurching and crippled, waiting for someone else to lead them, who of course, eventually shows up. ... so, can someone hook me up with the main Shadowserver girl?

Great fun for geek kids!

[Anonymous Coward]

I used to do that back in the day.

1> Search for EXE's off the latest P2P network or skulk around in some IRC channel until a some chap offers it to you.

2> Take apart that self-extracting zip and look through the mirc script.

3> Work out where they're sending there zombies. Masquerade as a bot for a bit.

4> Figure out a way to issue commands to the bots if possible.

5> Figure out a generic command to issue that stops the bodged mirc from launching or removes it outright.

6> Send it and laugh like a crazy fool at those 74M3RZ as they curse you and you're silly bot killing ways.

Ahh, the folly of youth.

Re:Great fun for geek kids!

[99BottlesOfBeerInMyF]

Yeah, you're a step or two behind in the arms race now. Most of the botkits send encrypted, self decoding binaries that make them a bit harder to reverse engineer. They also, occasionally cull the herd by doing things like sending updates, then quickly running a check and booting anyone who does not respond correctly, or update control channels twice in rapid succession. You have to a little better at reverse engineering. Given the right tools, however, I know at least one person who can turn around the code in about 15 minutes.

Of course with all this press most of the smart operators have probably long since ditched IRC leaving only the clueless. I've heard talk of a Tor based setup even, although I haven't seen it. Now that there is big money I imagine there will be some real clever solutions as well as more of those nice Web based control portals for those who rent bots by the hour.

Sad...but true.

[RagingFuryBlack]

"Anything you submit to law enforcement may help later if an investigation occurs," he said. "Chances are, though, it will just be filed away in a database."

I'm forced to wonder here. Why exactly won't Law Enforcement take care of a case that they're handed? I mean, last time I checked, someone handing you your entire case takes no effort whatsoever to investigate. If you take down some of these botmasters, you may see alot of people start backing off as they'll realise that people committing the crime are in fact being procecuted.

Then again, this is the US Government we're talking about here.

Re:Sad...but true.

[CagedBear]

They said it in the article. Data handed to the fuzz by a civilian isn't admissible before a judge. They can only use the information to aid in launching their own investigation, which of course requires resources.

Nintendo R.O.B.

[saboola]

Call me when they start a group of hunters for the Nintendo R.O.B. . They are the bots we should be really watching out for.

I've done something similar

[c6gunner]

Formating the guy's HD might be a little extreme, but back when I actually used IRC, I used to get bots trying to infect me all the time. So I'd run the file, capture and analyze the packets it sends as it's connecting, then shut it down, reconnect using mIRC, and take over the botnet. From there it was a simple matter to get them to accept a script which would eradicate all the bots.

They're getting more complex these days, but the same principles still apply. Once you get one on your system, it's a simple matter to analyze it and use it to take control off, and destroy, the rest of them.

Re:I've done something similar

[plover]

Some are moving that way already. The botnet developers are beginning to realize the monetary value of their little operations, and are moving to protect their investments. There has been enough published crypto that these guys can basically drop in a secure signalling system. And one of the botnet researchers has said some are already using encrypted channels.

Others are using a "cellular" or P2P model -- instead of a central IRC-style server, the bots are chatting only with the PC that infected them. It makes rolling up a botnet and tracking it back to "node zero" very difficult.

The nice thing about the botnets (from the operators perspective) is the ease with which he can roll out updated software. Shadowcrew getting too close? New code time!

Re:Danger, Will Robinson

[couchslug]

Which network protocol supports the transmission of bullets?

rerun

[psbrogna]

Wasn't this an episode of Stargate: SG-1?

Unusual, but Not Impossible

[Quantam]

A few months ago, Taylor became obsessed with tracking a rather unusual botnet consisting of computers running Mac OS X and Linux operating systems.

As that means that there a large numbers of breachable OS X and Linux machines out there, that pretty much puts to death the myth that OS X and Linux are sufficiently secure out of the box.

Re:Unusual, but Not Impossible

[DevanJedi]

I don't think many people make the claim that "Unix" and OSX are _sufficiently_ secure out of the box, though that may be the perception. Security is always _comparitive_; OSX is more secure than XP out of the box. Also, saying "Unix" doesn't mean much unless we are talking about a particular distribution of Linux or a particular variety of UNIX (BSDs, HP, Sun). In both cases, the out-of-the-box security varies vastly from distribution to distribution.

Re:Unusual, but Not Impossible

[Dan Ost]

This has nothing to do with how secure the underlying OS is. These botnets aren't created by system vulnerabilities. They are created by users who execute untrustworthy code.

Re:Unusual, but Not Impossible

[drinkypoo]

Well, actually, botnets ARE sometimes created through worms that exploit insecurities in the host OS. It's just that it's more commonly done the other way, and we have no way of knowing how these particular systems were exploited at the moment.

Wrong

[mabu]

Vigilantism is still against the law in this case. Computer tampering is computer tampering.

The solution to this problem is to put a few of these guys in jail. The solution is for the feds to get off their goddam lazy asses and prosecute these people. You don't poke around in someone's compromised computer, for good or evil.

What these people are doing is against the law and it has always been against the law. The problem we have is that the law enforcement authorities seem more obsessed with Tommy Cheech selling bongs online than they are real gangs of organized criminals who are interfering with commerce, privacy and national security. Go figure?!

Re:Wrong

[jjohnson]

Except that, as was mentioned in the article, the people running these botnets are sitting in countries like Taiwan and Morocco, which have even weaker computer crime laws than the U.S., and require international law enforcement co-operation to attack. The practical barrier to prosecution is simply too high for a crime who's priority is too low.

Re:Wrong

[Otto]

Vigilantism is still against the law in this case.

Fuck the law. The law is not working to solve the problem. And until it does, other measures must be taken.

Despite the popular saying, two wrongs CAN make a right.

Computer tampering is computer tampering.

Amazingly enough, it's not. There is a difference between actively patching somebody's computer and popping up a message saying "your shit is broken, do you want to fix it (yes/no)?"

The law may not recognize that difference, but like I said before, fuck the law.

The solution to this problem is to put a few of these guys in jail. The solution is for the feds to get off their goddam lazy asses and prosecute these people.

Waiting for the "feds" to get off their asses and get some shit done is all well and noble and civilized, but oddly enough, it means shit doesn't get done until they actually do that. And there's really no sign of them doing it anytime soon.

And on another note, imposing punishments for crime usually does not deter other would-be criminals. If it did, there'd certainly be no more filesharing services out there, now would there? Hell, just look at how many speeding tickets there are written every day...

You don't poke around in someone's compromised computer, for good or evil.

It's one thing to actually "poke around". It's another thing to send a "shutdown" command to the entire botnet.

Re:Wrong

[mabu]

Otto,

If you think flirting with the law will make things better, go for it. I don't have a problem with that.

However, you might want to look at history and recognize the fact that vigilantes have historically tended to be prosecuted more often than those whom they fight against. I'm just being realistic here. If I thought vigilantism would actually be effective, I might suggest it because trust me, I hate spam even more than you do.

Now if you want to launch a one-man attack against all botnets on the planet, you have my support. If you want to launch a program that will wipe the hard drive of any zombie computer clean, I will spend my money to fly out and hold up a picket sign at your computer tampering trial. I promise. Go for it!

btw, are you the otto on EE?

Re:Wrong

[Otto]

However, you might want to look at history and recognize the fact that vigilantes have historically tended to be prosecuted more often than those whom they fight against. I'm just being realistic here.

You have a point, but I think there's an important difference here. I'm not advocating fucking over zombie machines. I'm advocating disabling the zombies on those machines *without* messing with the rest of the machines themselves. Yes, technically it's illegal. However, I think anybody would be hard pressed to argue that such an action was immoral or wrong.

If you want to launch a program that will wipe the hard drive of any zombie computer clean

See, that's exactly what I'm *not* talking about. Why is it that any suggestion of fighting the zombie networks by using them is met with instant cries of "Vigilante scum!" or similar? There's a real difference between having a zombie shut itself down without harming anything else and "wiping the hard drives".

btw, are you the otto on EE?

Probably not, without knowing exactly what "EE" is. But then again, who knows. I get around and don't tend to use other aliases.

Related story

[clevershark]

There's an excellent story about this sort of thing here (via another tech site with a digging-related name).

At what cost?

[trazom28]

From TFA...

"Now 27, Albright supports his wife and two children..."

" "I take my [handheld computer] everywhere so I can keep tabs on the botnets when I'm not at home," Albright said in a recent online chat with a washingtonpost.com reporter. "I spend at least 16 hours a day monitoring and updating." "

Anyone else consider this sad? He's putting so much of himself into the work.. when does he have time to be just "dad" ? If the start of all this was his father's suicide.. maybe he could use a few sessions to deal with his anger, rather than what he is doing now. I don't think it's worth the price.. but then again, I'm a father who actually ENJOYS spending time with his kids.

Re:At what cost?

[horngod25]

I was kind of thinking the same thing. The guy's spending hours and hours doing a job (for free) that does very little to eliminate botnets in the grand scheme of things. Meanwhile, his children are probably growing up with very little paternal influence. It sounds to me like this guy needs a SERIOUS lesson in perspective...

ISPs "Detect & Destroy"?

[BoRegardless]

So why don't ISPs simply write software to allow them to detect and automatically disconnect BOTs?

Come on here. BOTs harm their systems, and they ought to be willing to put in the time to shut them off.

Then the end user of a BOT calls up, and the ISP say's "Reformat and reinstall your OS with appropriate anti-baddy software or we won't let you use our ISP.

Yeah, I know, they want the fees, but they don't want the extra bandwidth use nor the problems, and if the major ISPs blacklist BOTs, how long before we get rid of most of them?

For out of the country BOTs, well I would imagine there has to be a way. I don't care to ever receive anything from anyone in Rwanda, Uganda, or even Russia.

Re:ISPs "Detect & Destroy"?

[99BottlesOfBeerInMyF]

So why don't ISPs simply write software to allow them to detect and automatically disconnect BOTs?

Most major ISPs have software that can pretty much do that. I'm looking at some of it right now in another tab of my browser. The problems are operationalizing it so that it is not too expensive. The support costs for a couple hundred thousand calls asking why they've been shut off and how to go about fixing it and then confirming that it has been done would be very high. Maybe some big players could partner with another company. Get your PC cleaned, patched, and certified and we'll turn your internet back on. The problem with this is there are still a lot of old Windows boxes out there. No security patches are available. A new Windows OS is expensive and won't run on the machine anyway. So the ISP might save a little on transit, but they lose a boatload of customers and the steady revenue those customers provide.

Now some ISPs have plans to implement a notification of compromised machines with an automated system. It may help the problem and the ISP can bill it as a feature. But that is just one more escalation in the arms race. Next bots will be stealthy, mimicking other machines on the subnet, or just sending encrypted tunnels. Anyway, the short answer to your question is "money."

Re:ISPs "Detect & Destroy"?

[mazg]

I work in tech support at an ISP and I can tell you that very few ISPs would do this.

In my experience, the people most likely to have bots running on their systems are also the people least likely to know how to reformat their systems. Also, those people usually don't want to spend more money on their computer then they already do. All we can really do is tell people how they can get rid of the malware and hopefully they will try.

My guess is that an ISP that would do this would most likely lose more business because of this than it's worth.

Re:Danger, Will Robinson

[ArcherB]

"Our data can't be used to gather a warrant," Albright said. "Law enforcement has to view the traffic first hand, and they are limited on what and when they can view."

How can there be any legal barriers here? Is this supposed to be some twisted view of the 4th amendment?
--
What part of "shall not be infringed" is so hard to understand?


I think your sig says it all!

If people bitch when the NSA listens to calls from suspected terrorists, who are not in the US and not citizens, could you imagine the outcry if the gov't started sniffing packets? (OK, OK, I'm sure they already do... and people bitch about it.)

Not an Issue

[Anonymous Coward]

"I would imagine fear of the law and getting suied or thrown in jail."

Based on the number of botnets and spams that doesn't seem to be an issue currently.

How to fix this easily

[JustNiz]

There needs to be more accountability/traceability in order to register a domain. You should have to prove ID etc. so that if your domain is clearly a botmaster then the authorities can find you in person easily and nail your ass.

Re:Easy way to shut down value of botnets

[drinkypoo]

Why not just disallow all incoming port 25 traffic that doesn't have a matching SPF TXT record? It would be computationally more expensive (mailserver has to do the screening) and consume more network resources to boot, but at least those of us who are doing The Right Thing(tm) wouldn't have our internet services marginalized.

Sounds like anime...

[fithmo]

So Botnet hunters are tracking rogue Botnet puppet masters, taking them out using their own ISP, then tracking the Botnet drones who wander the net like 'lost sheep without a shepherd, ... continually try[ing] to reconnect to the hacker's control server, unaware that it no longer exists'?

Sounds like a totally kick ass anime!

Naturally I imagine all these Botnet hunters are hyper-attractive ultra-well-endowed women who's clothes get partially torn off every time they have a Hack-net Battle a Botnet Drone with their emasculatingly over-sized gun/sword!

eh?.........no?

Re:Easy way to shut down value of botnets

[pe1chl]

Unfortunately some broadband ISPs here in the Netherlands have completely misunderstood the problem, and when blocking port 25 they blocked it on traffic from the Internet to the customer, instead of the other way around...
Maybe this was done after they read about the "open relay used for spamming" problem, mostly something of the past.
Anyway, blocking port 25 on outgoing connects would have solved that just as well.

So when you ask them to filter port 25, make sure they understand which direction you mean!

Re:Easy way to shut down value of botnets

[pe1chl]

Because most domains still don't have an SPF record, and worse: many domain registration & DNS services do not offer the creation of TXT records. So even when the owner of the domain knows about SPF, they cannot install it.

Re:Easy way to shut down value of botnets

[drinkypoo]

We're only talking about disallowing traffic from well-known blocks of Dynamic IPs. How is that a problem? These people always have the option to use a real mailserver if they really must send SMTP from their local machine to the 'net at large, and not use their ISP's mailserver.

Tis a pity ...

[Infernal Device]

They should spend their time doing something more useful.

Like tagging botmasters for the kill.

Relevant Article

[glas_gow]

This article has a nice example of how a Russian botnet was hunted: http://www.newyorker.com/fact/content/articles/051 010fa_fact A few weeks later, on a Saturday in March, Ivan slipped up: he logged in to the chat room without disguising his home Internet address. The same day, Turner happened to be online, and decided to look up eXe's registration information. To his astonishment, he found what appeared to be a real name, address, and phone number: Ivan Maksakov, of Saratov, Russia. Lyon dashed off an e-mail to the authorities with the subject line "eXe made a HUGE mistake!"

Re:Easy way to shut down value of botnets

[mabu]

AOL had a very simple approach: use port 587 instead of 25. As a result of their bold and aggressive move, most e-mail clients now have easy ways to change the smtp port if they didn't already.

Obviously, someone who works at Verizon or Earthlink modded me down ;p Not my fault you guys SUCK.

"Stop me? BWAHAHAHAHA"

[abb3w]

And with any decent botnet, you can make the things run arbitrary code.

Speaking as an Evil Genius with standards, and one who's read the Warhol Worm paper, I'd say any "decent" botnet doesn't take orders from just any old Bill, Fred, or Otto who wanders by waving an executable at it. A "decent" bot wouldn't run code handed to it unless the executable was cryptographically signed with a private key matching the public key it knows belongs to its One True Beloved Master.

So, all of your plans should work just fine... once you determine how to recover a GPG private key of the 4096-bit keypair needed to sign the RUNME code, using the public key taken from the sample bot.

HANGE. (Have A Nice Geologic Epoch.)

(Note: I have better projects to occupy my Evil Genius than botnets.)

Re:"Stop me? BWAHAHAHAHA"

[Otto]

A "decent" bot wouldn't run code handed to it unless the executable was cryptographically signed with a private key matching the public key it knows belongs to its One True Beloved Master.

No, that would be a "well-designed" bot. Most botnets are being controlled by script-kiddies running code that they didn't write or possibly even read. Half of them wouldn't be able to pronounce "cryptography", much less use it.

Re:"Stop me? BWAHAHAHAHA"

[abb3w]

Most botnets are being controlled by script-kiddies running code that they didn't write or possibly even read.

Formerly accurate; however, the trend has been increasingly that the botnets are run by professional criminals of increasing sophistication intent on extortion, spamming, and other lucrative criminal capers.

*nix and Mac are safe :: You wish !!!

[rockypg]

" Either that or switch from XP to a better OS platform that has fewer known vulnerabilities (Mac, *nix)."

From TFA:

A few months ago, Taylor became obsessed with tracking a rather unusual botnet consisting of computers running Mac OS X and Linux operating systems. Working a week straight, Taylor located nearly all of the infected machines and had some success..

from one who works with shadowserver

[app13b0y]

I've been working with the shadowserver group for a while now and can say that it has been very interesting. to give some facts on the project

SS == shadowserver

* SS rarely shuts down botnets asap, but rather waits to see if they can figure out who the owner is, and several arrests have been made because of this.

* there has been talk on what is going to happen when the botnets switch to a different method other than irc. for more information, search for the botnet mailing list hosted by whitestar

* most of the trojans are found by running nepenthes

* SS has a HUGE repository of botnet scripts and C&C information.

* SS could always use more contacts with ISPs, domain registrars, and foreign LEAs. (we're in #shadowserver on freenode)

* botnets aren't the only thing we've been tracking (you'll see what I'm talking about in the news later)

Not Probable

[Absentminded-Artist]

I call Bull Puckies. What botnet? Why haven't we heard of it? You think the currently anti-Mac press would pass up a chance to herald OS X botnets as a failure of OS X security? Or even Linux? ZDnet New Zealand would personally wet themselves over this story. I think it's part of their reason for being to blast Apple every chance they can get. And yet we hear nothing.

I took the liberty to scan through www.shadowserver.org's RSS feeds for any news on OS X botnets and all I could find were mentions of the same security vulnerabilities we heard about all through February. Now, I'm not registered with that site so I couldn't use their site search, but I'm fairly certain I won't find anything there. A botnet running on compromised OS X machines would be too juicy for sites like C|Net and ZDnet to pass up.

I don't want to come across as an Apple apologist. Heck, I was so alarmed by the Safari zip file vulnerability that I dedicated a web site to exploring it. But this casual mention of botnets on Linux and Mac OS X just doesn't add up.

Re:Danger, Will Robinson

[app13b0y]

no. the problem is more that many LEAs are quite dumb when it comes to handling this stuff. Luckily, shadowserver has just recently come into contact with a few good guys that are learning quite fast about what is going on. The other problem is how can they trust the data in court? somebody could argue falsification of logs. Now, when it comes to what Albright is talking about, I'm not quite sure what he means about that in relation to the 4th amendment.

The other problem is the jurry. when they're dumb and you're trying to explain a bunch of techincal stuff to them which they could care less about, then what are you supposed to do?

Re:Easy way to shut down value of botnets

[pe1chl]

I think "static" or "dynamic" IP has nothing to do with the issue.
All ADSL and most Cable providers here give you a static IP, yet the number of bots and infected PC's here is the same as in the US, where dynamic IP seems to be the norm.

This is of course to be expected. When the bot writer uses a clever enough protocol to be able to control a PC on a dynamic IP, it will certainly work on a static IP.

Don't kid yourself. Security needs some paranoia!

[wild_berry]

A bit of googling finds a comment attributed to David Taylor at http://blog.washingtonpost.com/securityfix/2005/10 /it_must_be_zombie_season.html. It spreads by making use of a PHP vulnerability, so may have be harmful to OSX systems too.

This blog post identifies a bot called Q8 for Linux/Unix systems. Honeynet's paper on bots (http://www.honeynet.org/papers/bots/) says:

Q8bot is a very small bot, consisting of only 926 lines of C-code. And it has one additional noteworthiness: It's written for Unix/Linux systems. It implements all common features of a bot: Dynamic updating via HTTP-downloads, various DDoS-attacks (e.g. SYN-flood and UDP-flood), execution of arbitrary commands, and many more. In the version we have captured, spreaders are missing. But presumably versions of this bot exist which also include spreaders.

Once you get one on your system

[wiredog]

Are you nuts? I want to keep the damned thongs off my system.

Re:Once you get one on your system

[c6gunner]

:D

Maybe I should have put a disclaimer on my post:

WARNING: Proffessional bot-wrangler on a special machine. Do not attempt this at home.

Re:Easy way to shut down value of botnets

[drinkypoo]

Well, I didn't really mean to say dynamic I guess, but here in the states, it's almost impossible to get static without paying extra, and/or getting a business-class account which of course also costs more. And most cable providers won't give you static for love nor money. Well, maybe you could go in and give the execs a ride or something... What I mean to say is home users, who almost without exception have another SMTP server to use; their ISP's.

Re:Easy way to shut down value of botnets

[pe1chl]

I understand, but this makes it clear that the situation is not that black-white.

I think a good solution would be to block outgoing (and maybe incoming) port 25 traffic by default, and have some option per customer to enable the port, with a webpage that explains the risks. Most customers will never notice what they are missing with filtered port 25, but for the few that need it, it is very inconvenient when it is closed for everyone.

Unfortunately the infrastructure does not always make it simple to do this (no separate access list per customer, and a combined accesslist would get much too long)

An ISP's SMTP server is not always a solution. I am running a mailserver on my own system (and use the same setup at work) to which the MX records for my domain are pointing, and which uses callbacks to verify source addresses whenever mail comes in. The callbacks require outgoing port 25 access and cannot be done via the ISP server.
Advantage of sending mail directly instead of via ISP server is that you can watch the queue. Mail that is not getting delivered is apparent because it sits in your own queue. ISP queues are of course not visible to ordinary customers.

But for the average Windows user with Outlook Express and a POP account this is not important and blocking port 25 is no problem.

Ouch

[wiredog]

Interesting freudian slip/unintentional double entendre in my previous post...