Slashdot Mirror
Is the Botnet Battle Already Lost?
An anonymous reader writes "Researchers are finding it practically futile to keep up with evolving botnet attacks. 'We've known about [the threat from] botnets for a few years, but we're only now figuring out how they really work, and I'm afraid we might be two to three years behind in terms of response mechanisms,' said Marcus Sachs, a deputy director in the Computer Science Laboratory of SRI International, in Arlington, Va. There is a general feeling of hopelessness as botnet hunters discover that, after years of mitigating command and controls, the effort has largely gone to waste. 'We've managed to hold back the tide, but, for the most part, it's been useless,' said Gadi Evron, a security evangelist at Beyond Security, in Netanya, Israel, and a leader in the botnet-hunting community. 'When we disable a command-and-control server, the botnet is immediately re-created on another host. We're not hurting them anymore.' There is an interesting image gallery of a botnet in action as discovered by security researcher Sunbelt Software."
The problem has already been solved the same way that people used to get onto an old BBS. You need to be invited to go to a channel or the channel is hidden.
It is a pity that the general open channels are a thing of the past, but so are private BBS'.
I work at a hospital. Sometimes I wonder whether our computers really are as secure as they should. All the computers have AVG installed, but is there something else I can do to check?
this whole thing is just ridiculous. yes, sure if you treat existing poorly engineered systems as inviolate and try to work around them its a never ending battle. but the basic tools to provide systemic distributed security have been published for quite some time. fix the problem at its source and stop screwing around.
yes, pkis are not flawless, but it would be a huge step above this kind of flailing
"Resistance is futile. You will be assimilated."
use a big stick. Didn't we learn anything in American History? Roosevelt pwned.
PWN'd IP: 62.48.12.123
Current Command: Spam Partypoker links
Respond to this command to update commands:#
One can always create reverse honey-pot servers that connect to the chat channel and when given a command, reply with "I am sorry Dave, I cannot do that..." and then recite some multi-gigabyte random poem into the channel :)
The key here is "unpatched server" and of course it happens to be a windows box... hmmm...
Why hasn't anybody created a "good" trojan that uses as many common exploits as possible to infect these already infected machines with a port-80 restrictive firewall? I think for every somewhat bright for-profit trojan creator, there are thousands of brighter people that can come up with an intelligent plan to do this effectively. Use all spreading techniques that the best of the worst use, but minimize the wasted & bloated traffic, while fixing as many computers as possible. Should be simple!!
Only issue I see is legality. Technically however, I see this as very feasible.
take off and nuke the site from orbit, it's the only way to be sure
What's needed is for someone like NY Attorney General Elliot Spitzer to charge Microsoft with reckless endangerment for knowingly, willfully, and negligently distributing and continuing to distribute systems vulnerable to such attacks.
Meanwhile, we may need some brutal firewalls:
We're probably going to see some companies going to a locked down firewall like that.
Modern botnets clients are pretty adaptable; they will download patches, modifying themselves to beat disinfectors. With care, and unless the net manager has taken extreme measures to prevent it, one can induce the clients to remove or disable themselves, rather than just trying to kill the control channel. Should that fail, one should be able to determine what fallback channels the botnet clients use and disable those before killing the current command channel.
What we need is a large number of ISPs to get together and say, "We trust each other to deal with botnets." Then, with a single command, any trusted ISP within the network could instantly send a command to another ISP to shutdown a site or server that is running a botnet. All of these actions would be logged and would be reviewed to make sure that it is only being used against botnets; any sort of abuse (like using it to shut down protest sites or copyright violation sites) would result in an instant revocation of privileges. This system would be much better than what we currently have: trying to call the other ISP, trying to get them to listen to you, trying to get them to trust you ... it can take days, if ever, to shut down a botnet on another network.
Cyde Weys Musings - Scrutinizing the inscrutable
The botnet battle was lost many, many years ago.
Well command and control didn't help.
I wonder if it's time to revisit that real-time zombie monitoring network idea again.
Why not just physically unplug your computer from the network?
... but I honestly don't see this as such a big issue.
Basically this is a problem with people owning computers who don't know how to maintain them properly, and with MS making it unreasonably difficult, expensive, and time-consuming to maintain a Windows machine properly.
But as someone who doesn't run Windows, I don't really care. I'm sure some of the spam I get is from these bots, but spam would exist with or without botnets, and without a major redesign of the e-mail infrastructure and standards, spam can only be mitigated, not cured. My mitigation measures work for me.
Another theoretical possibility is that I could get extorted by somebody carrying out a DDOS attack. But in reality, that seems more like a worry for a big corporation, not an individual like me.
Another possibility is that somebody I do business with could get their machines owned, and gangsters could steal my identity. Well, it hasn't happened to me yet, and it hasn't happened to anyone I know.
I'm a lot more worried about global warming and nuclear proliferation.
Find free books.
Why can't we all just hit "delete"? takes only a few seconds.
If you can check it, therein lies the problem. The paradox is in its mere existence, it thinks, therefore it already has. ___________________________________ LunarLodge: "The Last Best Space"®
Botnet, Skynet, whatever... We effectively lost the war against the robots when we first invented computerization, thus creating the posibility for the future war against the robots.
SOS
I am no expert in this area, but a thought occurs.
Why isn't it possible to simply identify the exploit being used to spread a particular botnet, and write software that uses the same exploit to travel throughout the net before activating (perhaps at some specific time) to both wipe out the botnet software and seal off the exploit?
It seems that as soon as you have the original botnet software, re-engineering it for this purpose would be relatively trivial. Plus there would be the immense satisfaction of fighting fire with fire. The software could even remove itself as its final act, saying "I know now why you cry, but it is something I can never do" (although someone else might have to press the button to lower it into molten metal - "I cannot self-terminate").
The only reason I can think that this wouldn't work is that the 'antidote' software would be breaching computer security all over the place - basically doing the precise thing we are trying to stop. However, surely some sort of 'good samaritan' clause could be worked into the law - or the government could adopt responsibility for this process, or at least for pushing the button that sets each counter-botnet loose in the wild.
Of course this may already be the approach taken - I don't know much about the field, as I say.
Read Pynchon.
Of course this stuff is all over. My sister's PC was infested with malware and a member of a botnet. She has a teenage daughter that clcks on everything sent her way. I discovered, before a complete system wipe, two processes that run on start up using telnet, at least three many pop-up services, two browser tool-bars, a page hijack stacked upon another page hijack that got had it's registry keys still intact, but was disabled by the other hijack, and the system had Python installed and was compiling source code! After all that, they better change their browser habits. I only hope my sister dosen't make her daughter stop using the PC or the web altogether. That's the wrong answer, and hopefully I can educate them and give them an alternative.
The eternal struggle of good vs. evil begins within one's self.
If destroying the host won't work, as the bot herders just create another... what about taking the host over, and hijacking the botnet itself? If you could do that, couldn't you "disband" that botnet by ordering all the bots to patch themselves against the vulnerability, seal off certain ports, etc.?
why don't they build into Vista and update XP (since nobody's going to buy Vista) so that you can't send repeated connection requests up to a reasonable limit.
Is it just me or is it not going to upgrade to Vista in here?
So, err, do we need some kind of international police force to keep the Internet clear of botnets? Should the UN run it? Do they get cool blue suits and have their own swat teams around the world?
How we know is more important than what we know.
The so-called botnet battle is no different than the war on spam or the anti-virus front, or any of the others.
It's not a failure of technology. It's BAD PEOPLE, exploiting BAD SOFTWARE, who aren't being dealt with because of BAD EXECUTION of BAD LAWS. Fix the software, the law, and the enforcement of the law (esp. jurisdiction), and you'll neutralise 95+% of the bad people.
This crap is criminal. Crimes like this are sheltered by discussions about philosophy, politics, jurisdiction, and technology. If people would stop discussing and arguing, and start working together on the problem, it could be eliminated in under 24 months.
But convincing people to work together is impossible, so we might as well get used to it.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
The simple problem with the fight against botnets is that it's asymmetric, and not in our favor. The bots are in a place that is particularly difficult for someone attempting to dismantle the network to reach, the property of someone else. It's not the technical problems that make a botnet so difficult to dismantle, but the legal ones.
The botnet creators don't give a damn, their objective involves breaking the law (where there is one) in order to hijack someones computer. Someone attempting to destroy the botnet is likely to be atempting to operate within the law, which requires notifying and enlisting the support of the owners of the compromise machines, many of which:
a) are difficult or impossible to contact
b) don't speak your language
c) don't understand anything about the problem
d) don't care
Any single instance of a botnet may have weaknesses that permit its demise without running into potential legal problems (such as a poorly-secured disable command), however botnets as a concept have no real theoretical weakness given the appropriate cryptography and care of construction. Decentralised, failure resistant networks of cooperating nodes is a well researched area and at the level botnets operate, barely constitute a challenge to anyone with the necessary knowledge of protocols, cryptography and programming.
They're here to stay, there is no practical non-desperate legal changes or technical tricks which will kill the concept entirely. Even if the general level of internet security increased 10-fold, there'd still be more than enough vulnerable computers to support botnet operators, and lets face it, that level of security change is not going to happen. Even if the general OS level improves, old and embedded (non-patchable) devices are still plentiful, and there will be more no-patch applicance like systems in the future which will continue to be exploited.
As a systems administrator or someone otherwise concerned with the impact, the rules are simple. Stay patched, Stay vigilant. If a large botnet decides to get you, hope your ISP subscribes to something like tipping-point that will give them a head start on deflecting the inbound traffic. That's about it.
You can't win a fight.
Run for your lives! Oh... wait.
This has been discussed on Slashdot before, but it seems relevant here. If it proves impossible to stop self-replicating worms by patching holes, you can either have mandatory auto-updates provided by a "trusted" source (your friendly OS provider), or launch active defenses: white-hat worms whose payload is the patch itself. Or an anti-botnet which DOS'es infected hosts (similar to what BlueFrog tried to do for spam). Of course these cause problems and can be gamed (someone spoofs an attack as coming from you, bringing the anti-botnet to bear against you, etc.)
The basic problem is: manual patching is never going to keep up with automated discovery of vulnerable machines. You either need an automated fixing process (immune system), or you need to clamp down heavily on allowed interaction (boy-in-a-bubble style).
That should keep my Windows box safe, right?
I mean, those updates fix all the security holes and stuff right away, right?
Those botmasters couldn't possibly have time to root by box between the time they discover the security hole and the time it's fixed, right?
What's needed is for someone like NY Attorney General Elliot Spitzer to charge Microsoft with reckless endangerment for knowingly, willfully, and negligently distributing and continuing to distribute systems vulnerable to such attacks.
Sue the IRC networks first; that's what makes it dumb shit easy for these guys to set up their botnets.
I had a machine hacked by a german movie filesharing group, and they incldued a bot which logged into their channel on Rizon. Like a good little admin, I logged into rizon, checked out the channel. It had several thousand users, a whole slew of fserves...and ZERO conversation. None.
I went to #help and reported the botnet attack and the response was: "hey, you want us to shut down one of the most popular channels here because of a evidenceless accusation that you were hacked by them and used as one of their fserves? LOL ZOMG GET SECURITY AHAHAHAHAHA LUSER P0WNZORED" etc. etc.
It is patently obvious that the Rizon admins are FULLY aware that they have dozens, if not hundreds, of illegal filesharing groups that are using botnets to set up fserves, attack other systems for more bots, etc. They're doing jack shit about it (and in fact, they're making it easier- they now support SSL connections) and I think it's time someone sued them to hell and back. It's time IRC operators were taught that you can't knowingly support criminal activity, and that if users report hackings- they need to look into said reports and act on them. I also think it's time IRC traffic was considered "highly suspicous" and monitored by ISPs for fserve commands and such; fserves have no real legitimate purpose today, except illegal filesharing.
PS: Next time you download a movie or program, bittorrent or IRC DCC....realize that it was distributed, most likely, by a group that hacked unix systems. Those systems were owned and administered by people just like you, and that person is going to have to deal with the damage and headaches. Just like you will, some day.
Please help metamoderate.
This isn't a battle for/against botnets. They're just the symptoms. What this really means is that the battle to have secure home PCs is lost. I won't even get into the Windos vs. Real OS discussion. The point is deeper still: Our homes are safe from burglars because those with the great skills and expert tools don't break into homes, they break into banks.
Not so on the Internet. Due to automation you can play the numbers game, and taking over 100,000 machines is feasable, less risky yet possibly just as profitable as breaking into one bank.
The best non-computer equivalent I can think of is the plague. Welcome to the crowded cities of the middle ages. Even if you, personally, are safe, you're still affected. Think about it.
Assorted stuff I do sometimes: Lemuria.org
Because every now and then there's a vulnerability in PNG.
No shit. Simply decompile the exec, get the password (shouldent be hard, unless it is encrypted, usually isnt), get the server ip/port/password/channel and possibly channel key, join the channel, login to the bots (.l password or what ever) and do
Now now. I am a Linux fan and such, but blaming Microsoft here is just stupid! You know why? Because usaully the thing is exploited hasent been patched yet. Every program has bugs, thats just how it is. Get over it. And how is it expensive to maintain windows machines properly? Windows Update is free, no?
While *nix botnets arent nearly as prevalent as Windows botnets, there are still ones out there...Dont think you are exempt.
Its very easy to get your identity stolen these days..Simply do some SQL injection on a pron site or what ever, then boom, you got yourself 5k credit cards. Were you dropped a child? On Windows, you cant delete a exec if its running..and most botnet execs fuck up things like the task manager and have backups of themselfs on your box. Easier said than done. How does your 'software' know what on the machine is a trojan? That wouldent be very good would it if your 'software' illegally compromised hosts trying to get rid of the trojans and accidently got some guys stuff that isnt infected? Also consider, when ever a new exploit is leaked in to the wild, all of the current botnet trojans are updated with it...There are widely diffrent...there is no plasuable way to just rid of all hosts comprimised with hole ____
Seriously. Does this beowulf botnet run linux? Are linux hosts being deprived of the global machine endeavor to sell us more v1agra and inform us of opportunities to participate in online gaming? Can we not assist in the provision of "bulletproof hosting"? Does *BSD not deserve to take it's place in the pantheon of truly "highly available, totally reliable, even if netops doesn't want to run them" services? I say if an open source OS can't support these services, what good is it? This is the future of clustering I tell you!
TFA says only this:
Surely something can be done to get our linux and BSD boxen involved in this noble global effort! Sure, with their limited user base all ten of the OSS servers on these internets would hardly make a splash in the ocean of Windows boxes, but every little bit helps. Something must be done. Somebody start a project or six on Sourceforge and do something about this.
Help stamp out iliturcy.
BTW... does anyone know what TFA is about anyway?
To do list for Windows
This was the subject of "As the worm turns", in the first Stealing the Network (an AWESOME book). The protagonist disassembles a worm and then figures out how to fix, with some unintended consequences. A great read, the story is fictional but the technology is VERY real. Almost a HOWTO in fact.
"Chinese Amazons, power armor, laser swords.... things just meant to be." - Shampoo, A Very Scary Bet
ARP should not matter on the firewall.
Anyway, the easiest way is to monitor traffic by IP address, at the firewall, during times when no one should be using the computer with that address. If the machine is doing anything that goes through the firewall at 1 am, you should investigate.
On a home network? Probably no one.
On a business's network, that's completely different. If you leave your network open and are cracked and you lose you credit card numbers, that's between you and the bank. If a business leaves its network open and is cracked and loses YOUR credit card number, they can be sued.
The problem is that not many "network administrators" really know anything about their network or security. There are an almost infinite number of things you can that will take time and money but that will not actually increase the security of your systems.
Education is the beginning.
ISPs that tolerate insecure computers need to get blocked. Blocked from everything. It COULD happen, if Comcast and AT&T both decide they've had enough.
This would have the added benefit of stopping a lot of spam.
Yes, RBLs didn't get rid of spam. But they sure did (do) help. And a good part of the reason they don't work better is botnets. (remember Blue Security?
-Daniel
Ownyourphone.com. Custom ringtones, cheap and easy
This is a global policing issue, NOT a server manager's issue. The vile thieves behind bots need to be aggressively identified, and the punishments made so crippling, not even the most amoral would dare risk it. End of story.
There have been attempts at doing so with worms
In theory, there is nothing stopping the "researchers" from having the zombies identify their OS's, download any patches, install a personal firewall and automatically updating anti-virus program and then removing the original infection.
Sure, many would be re-created due to the user's ignorance, but this is the only way to "deal" with the zombie problem at the "researcher's" level.
No need for a trojan / worm / virus. They should have sufficient control of the zombies that a script could do it.
Slashdot needs a mod option: +1, Whatever.
What does it matter, really, if you've been rooted?
The sad fact is that no matter how often you're rooted, as the other post quite clearly pointed out, you're never going to get approval to remove the defective software that allowed it. If knowing creates willful negligence but not knowing doesn't, there's a certain advantage in not looking.
Just watch your netops keep uninstalling the more obvious malware and reimaging your boxes every few years and pretending everything is ok. Nod when they call the AV and the firewall edge box due diligence and don't watch those road warriors connect their notebooks to your localnet. You never get documents with executable content in email from outside your network anyway and if you did the virus scanner would stop it before delivery, wouldn't it?. Nobody on your network would click a suspicious link. These are not the rootkits you're looking for. Repeat after me: "I am so shocked! Gosh those hackers are clever. I hope they go to prison for a long time if they're ever caught using their completely anonymous fault tolerant botnet."
Now go heal some sick people, and never get admitted to your hospital under your own name.
Help stamp out iliturcy.
I think this comment is somewhat tongue in cheek. However, since others are taking its draconian firewall suggestions seriously, I want to make a point of balance here.
(Note: nothing below excuses an IT group from doing everything it can against bots in ways that don't necessitate modification of user behavior.)
Yes, the bots are out there. Yes, they are potentially quite dangerous.
But, there is real value to users (and organizations) in maintaining the breadth of Internet functionality.
Conclusion:
There is a cost to locking things up more tightly; there is a cost (and a potentially very great cost in the future) in leaving functionality unchanged. There is no 'right' answer. You've got to weigh the costs (and risks) against each other. It seems to me, each organization will end up making its own judgement call.
Unitl people are punished for their system's behavior, nothing is ever going to happen. Yeah it's annoying for most people to get rooted, but other than that, why should they care? Now if you were legally liable for the damages your system did, regardless of whether or not it was rooted, we'd see a major change in botnets, and a LOT less people with rooted machines.
People only react to that which causes them difficulty, punish them for not taking care of their responsibilities and things will get better. But until then, it will only get worse.
You're part of a botnet? Pay a fine! Didn't know? Too bad. Just like your dog getting out and destroying property, if you don't care enough to protect others from your wanton disregard, it's going to cost you.
when high technology was its own idiot filter are long gone.
It is illegal to drive a car on any public road without a drivers licence, for the safety of other road users. Why shouldn't it be illegal to connect a computer to the internet without the proper qualifications, again for the common good? Keep all the stupid off the internet and the situation is bound to improve because there will be less opportunity for the greedy to exploit them.
If companies know the means of advertising (i.e. malware) are illegal, why aren't we going after the companies that use such methods? Admittedly, some viagra knock off company in Mexico is difficult to go after, but wouldn't it be easier to get rid of these intrusive networks by cutting off any reason for them to exist?
Publicly executing a few dozen botherders would be a good next step.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
It's going to hurt. It's going to be painful. But when you're losing a war, you have to take defensive steps that work.
Sue the IRC networks first; that's what makes it dumb shit easy for these guys to set up their botnets.
That's like saying "sue the website networks for distributing illegal content". IRC is a chat protocol. Anybody can run it. It is also widely used for open source development and other legitimate services. Apparently, your mind has been warped so badly by Instant Messaging services that you think any such service needs to be controlled by some big corporate entity.
I had a machine hacked by a german movie filesharing group, [...] by a group that hacked unix systems.
I strongly suspect you're just spreading FUD: you don't sound like you're in any position to run a UNIX system, and even if you are, based on your comments, you don't sound capable of securing it, so it's no surprise that you got hacked.
it all points back to Microsoft Windows, since the MS-EULA only gives the end user the right to use the software and not own it then Microsoft is responsible for the vulnerabilities in thier products...
Politics is Treachery, Religion is Brainwashing
Now if you were legally liable for the damages your system did, regardless of whether or not it was rooted, we'd see a major change in botnets,
You'd see a major change in government and the law swiftly gone is what you'd see. Well, in any democracy, anyway. This simply won't resonate with people's sense of justice; to most people it would seem like holding you responsible for what any maniac does with your stolen property. And I'm not even talking about stolen weapons here, but any stolen car, hammer or length of rope.
But there could be a kind middle ground: require ISPs to quarantine infected machines, and fine _them_ if tey don't. Just like regular quarantine: not punishment, just necessary protection until the threat is gone, even if the individual is not at fault. The hard part would be motivating the ISPs to follow the rules, i.e. the technical ability to check if they're doing it properly, having the capacity to perform those checks, and suitable readctions if they don't.
Of course, both these strategies have the gaping flaw that they only work within each legislastion, which the internet famously does not.
sudo ergo sum
I'm sorry, but when i saw the following in the little slide show linked to in the summary:
This is an example of the welcome message from a live botnet IRC session. This is what a victim machine would see -- lots of cryptic data (potentially code), an IRC connect message
i'm seriously starting to doubt the guy that set up the slide show. Maybe it's cryptic to him, but to anyone that has actually taken a look at how irc works it's plainly obvious that these are simply the server reporting what it can and cannot support in terms of modes for channels and nicks.
People replying to my sig annoy me. That's why I change it all the time.
No. We can stop this war from happening.
All we need to do is send a single person back in time to the year 1955 (perhaps powered by some combintaion of The Wayback Machine and Google's Solar Panels to assassinate Sara^H^H^H^HMary Gates before Bill is born, this will prevent the formation of Microsoft, stopping the PC timeline with Tim Paterson's QDOS and relegating Steve Baller to a life as CEO of a frozen yogurt chain. Windows will never get written and Botnet will never be able to replicate and come online!
Want to find and fix any infected machines at work? Build a tool for your sysadmins to find them with, do an audit of the machines that need cleaning to find the *other* things wrong with them as well as identifying those that are running potentially critical activities that need to be salvaged carefully instead of by scorched-earth, and let them use whatever tools are appropriate to fix the holes it finds.
Want to find and fix the buggy machines on your cable-modem company's network? Build the tool and sell it to them, or give it to them and teach them how to run it. Don't go looking like Yet Another Zombie-Master who's trying to maintain some pretense of legitimacy - if you're going to be legit, be legit, and if your cable company's too clueless to accept your 1337-k3wl program, then build a different program to block packets from your fellow customers or get yourself an ISP that's clueful enough that they don't need your program.
Want to fix the buggy machines in Korea or the spammer-friendly hosting in China? Go ahead, make their day, but don't tell them *I* said it was a good idea.... And besides, it's really easy to blackhole-route them so you and any machines you control simply don't get packets from there and can't send packets back.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
The most effective way I have found in fighting the botnet pandemic is quite simply educating people about the threat, and convincing them not to download stupid shit.
I caught the Mountain Wumpus! He gave me his treasure chest ($100) to let him go free again.
The battle is not lost. Some online casinos fought and won the battle.
Read here here.
Grundgesetz * 23. Mai 1949 - 30. November 2007 - http://www.vorratsdatenspeicherung.de/
Most people, including extremely technical people, don't know exactly what is going on on their systems at all times, be those Windows, Mac, or Unix systems, or anything else. Why don't you tell us your foolproof method for knowing exactly what code is running on a system in the presence of rootkits and thread injection?
Your dog analogy is broken: a good dog owner knows what the dog is doing at any moment in which it could cause harm to someone else's property. Even a competent technical person has no idea what's going on on their computer with a rootkit cloaking the traces.
Guess what? I've been a professional reverse engineer for three years, and I still say this.
Picture 2 and 3 are really just normal IRC connect picutures and an abandoned channel with X still in it. Any body who knows a bit about IRC knows that X is NOT a "cryptic controller" but just a function of the IRC network that protects a channel from rogue takeovers. Picture 7 ain't really thousands upon thousands of bots, just the "eavesdropper" and two regular operators. And it is the eavesdropper that is isuing the commands?
Please o please, let me have some security proffesionals who knows what they are talking about.
Will work for bandwidth!
``Is the Botnet Battle Already Lost?''
No. There are measures that will completely eliminate botnets. The question is: how far do we want to go? There comes a point at which the cost of botnets is less than the cost of the countermeasures. For many amateur admins, that point is right now; they don't notice if their machines are compromised, so they don't have much of an incentive to secure them properly. That's why we're losing the war.
Please correct me if I got my facts wrong.
The screenshots in the article slideshow indicate that the particular live botnet operation they used as illustration is most likely serbian.
The word "KPAJNHA" occurring in a IRC server name is actually the serbian word "KRAJINA" writen in cyrillic, using latin alphabet characters to represent similar cyrillic characters (P for R, N for I, H for N). "krajina" translates roughly to "shire" or "county" in serbian and "Krajina" with capital K was also the name of the ill-fated rogue serbian republic that existed on croatian soil between 1991-1995. In another screenshot we see an IRC channel named "armija" which is serbian for "army" -- I can imagine an operator would name his swarm of bots an "army".
Sig erased via substitution of an identical one.
a port-80 restrictive firewall
And how would this prevent exploits in applications that can use the port 80, like browsers ?
Sites like http://secunia.com/ are full of reasons why a restrictive firewall is clearly not enough.
How about installing a botnet that you use to target the computer systems of the bad guys?
I appreciate the work these people are doing in trying to stop the botnets, but in order to fix something in many cases there needs to be a disaster. I say let the botnets do their thing. When 100,000 people get together for a class action lawsuit to sue an OS or application vendor for poor security that allowed their computer to get zombified and participate in illegal activity the world will wake up.
http://www.9999hp.net/botnet/
Trying to stop botnets by taking-down servers is like trying to stop rock-throwing by confiscating rocks.
An exercise in futility.
You stop rock-throwing by going after the throwers. If these propeller-heads would stop playing with their toys long enough to spend fifteen minutes talking to the nearest cop they would realize this.
Ignore the silly botnets and invest the resources to find and punish their creators. Criminal behavior declines only when there is substantial risk of substantial punishment. Until that risk exists, you're just wasting everyone's time.
'Nuff said.
Regards;
Wow! You're such an antisocial wierdo! Your idea is ridiculous. Well, Slashdot is frequented by idiots, so I suppose that's what I should expect.
You know what; we should do what you're suggesting. However, while we're at it, I have a few reforms along the same lines.
1. Change the laws so that anyone buying stolen goods immediately goes to prison, irrespective of whether they knew the goods were stolen. You're taken advantage of by criminals? Go to jail! Didn't know? Too bad! If you don't care enough to protect others from your wanton disregard, it's going to cost you.
2. Absolute zero tolerance for all driving offences, plus multiply all existing penaltied by 10. Forget to indicate? Go to prison for 3 months. After all, you're risking other people's lives. No appeals! Indicator bulb blew while you were driving? Tough! If you don't care enough to protect others from your wanton disregard, it's going to cost you.
3. Force anyone with a contagious illness to stay indoors at all times. Going outside with a sniffle? It could be influenza. How do you know that you won't infect old people, or sick kids. Massive penalties for those who disobey. After all, they deserve it. If you don't care enough to protect others from your wanton disregard, it's going to cost you.
4. Any ommission of any detail, no matter how trivial, from your tax return merits a fine of $5000. Forgot to put 5c interest that you received from a savings account? $5000 fine.
5. Driving a car with a damaged catalytic converter? Sure, the problem may not be visible from the outside, but your NO and CO is killing people. Instant fine! After all, you deserve it. If you don't care enough to protect others from your wanton disregard, it's going to cost you.
... or boot into a second "bare bones" installation of Windows on a different partition so that you can do maintenance on the primary Windows installation. Doing so makes it trivially easy to backup the Windows2000 registry for example. Simply copy the "system32\config" directory and its contents to a backup location. I also use the second copy of Windows to degrag and run virus scans of the primary Windows installation, and to delete problematic files.
That's one of my complaints about Linux; ie, why can't I have two or more installations of Linux on the same machine just like I can with Windows 2000? At present I have a triple boot system that can boot into either one of two versions of windows or one version of Linux (Mandriva at the moment).
9/11 Eyewitnesses to Explosive WTC Demolition 1 of 2
I think the general solution is to not have people with full-function read-write OS and filesystems. 99% of people don't need a full blown "computer". They surf the web and do email and that's it. What they need is something like an X-terminal where there is a browser and email software in firmware, and that's it. Updates could be done but everything would be signed digitally and come from a secure location, or done manually, and never without operator approval.
If IRC went away tomorrow, botnets would be back in maybe a week at most. There are plenty of options for them. Peer to Peer command and contro, setting up their own IRC servers on someof the compromised machines in the botnet, etc.
If you mod me down, I shall become more powerful than you could possibly imagine.
If "tubgirl" is anywhere nearly as disgusting as "goatse", I feel very fortunate to have never viewed it.
9/11 Eyewitnesses to Explosive WTC Demolition 1 of 2
What OS are the vast majority of the nodes on these botnets running? How would botnets be possible without a readily available supply of easly compromised Desktops.
"Next time you download a
It's not necessary to hack an IRC server to set up a botnet just set up your own channel. Tell us what are the names of these hacked Unix servers running botnets.
re Re:Sue/address the IRC networks, first.
davecb5620@gmail.com
this whole thing is just ridiculous... but the basic tools to provide systemic distributed security have been published for quite some time
What's ridiculous is that these systems are getting so damned complex that now we've got pwning via buffer overflows in video card drivers.
When you can't even trust your own hardware not to betray you, then who you gonna call? Ghost busters?
Nice to see that Eweek and Slashdot editors failed to note Gadi's hobby as NANOG troll. His chicken little ravings about botnets aren't taken seriously there, nor should they here.
I always thought the botnet problem stemmed from a fundamental problems in Windows security. With Windows NT, we could secure the file system, secure printers, and secure network shares. We still could not secure the processor. The processor would run whatever code that happened to be loaded. Internet Explorer allows anyone that can figure out how to get the smallest piece of executable code onto your system a chance to run it.
Since Windows NT, we have Windows 2000 and Windows XP. Each seemed to progressively water down the security model until today, where every XP user is pretty much logged in with Admin rights.
We can secure the file system. Why can't we effectively limit what code the CPU executes?
I have a lovely wife who surfs the internet constantly. She has a bot on her Windows Box. I noticed it when we sent out 86 thousand emails in one day. (it helps to monitor your port 25!!). Okay.. so she is compromised.
Norton, Spybot, etc CANNOT detect what she has. Netstat shows the connection but taskmanager etc does not. I block port 25 from her computer as a precaution and the darn computer starts searching for smtp servers on the local network. I use qmail-auth and it prevents it.. however I have no trust that it cant use UPnP or something else to change my main router.
So.. HOW IN THE HECK do you REMOVE stuff that you cant find? I really.. REALLY.. dont want to reformat and reinstall because there is no way this should be hidden to adminstrator on Windows XP.. but it IS!
I can program myself out of a Hello World Contest!!
Are security costs an external cost related to running Windows?
If security costs had to be borne by Windows users, would we live in a different computing world?
Hold users accountable for the damaged caused by botnets. If I leave dangerous crap on my lawn, it's my fault. If I leave a gun on my porch, and someone uses it to rob a bank, I'm accountable. If my company runs an open SMTP relay, and people get spammed, it's my fault.
Why should an insecure computer be any different?
It's not like you don't have a choice. De facto, purchasing a Mac or Linux computer renders you 100% invulnerable to this kind of crap, with only theoretical vulnerabilities out there.
Use a Windows computer, don't secure it? Pay the price. If you don't want to risk your system becoming a bot, run something that doesn't get rooted.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
No, a competent technical person should damn well be able to know what THEIR computer is doing at all times, at least as far as network access is concerned, and that's the concern when it comes to botnets.
If you lack the ability or knowledge to monitor what your computer is doing on a network it's connected to, you've got no business being called technical. A packet sniffer on the network isn't affected by a rootkit on . Simple access rules on a consumer grade router can cut off access to any particular IP space you don't personally use or find suspicious, and are utterly unaffected by a rootkit on its local network.
No, Joe Average can't do that, but any reasonably computer savvy person can install Linux on a junked PC, run ethereal, see what's going where, and close off access in their router.
that most people don't care a shit. And people who do care either have to learn to live with banging their heads into major walls, or just give up. Most things that sound sensible, for example disconnect infected computers when reported and only reconnected them when they are guaranteed clean, and have the owner pay a reconnection fee, are not going to work for several reasons like customers move to the next ISP which doesn't care, or the overhead of such measurements. And so we will live in the Wild, Wild, West of the Internet for probably 10-20 years more, letting the criminals get (even more) firm roots.
Perl Programmer for hire
The combover is ALIVE i tell you, ALIVE! Hooray for Patrick Jordan!
Hey, I attended a computer engineering graduate seminar at my school (University of Central Florida) last week, and the topic was about Modeling and Measuring botnets. Dr. Cliff C. Zou had some novel ideas and has recieved a grant from the NSF to further his research. His published works can be found by searching google scholar (I just checked).
Proposal, How about we just get rid of electrons and photons? They cause more headache then they are worth.
I have to disagree with you on all counts. I check my systems regularly, of course my systems are pretty iron clad at this point, mainly because having one of the older domains on the internet hacking attempts occur almost hourly on my system. If you're going to have a windows box attached to the internet, and you're not keeping an eye out for attacts, then you should at least be running some sort of virus protection on a daily basis. I have my destop system buried behind multiple layers and I still check its traffic daily and run regular virus, spyware, and adware checks on it.
If you're going to run on the information super highway, you need to take at the very least the basic precautions. Otherwise you're as guilty as the dog owner who lets his dog run wild in the neighborhood cause he didn't bother building a fence. And just as guilty.
I'm not talking about the good owners after all, I'm talking about the bad ones. Which on the internet is a rather large number. Otherwise there would be no financial incentive for spammers in the first place, correct? And the Botnets would be small or non-existant, right?
That's not the hardware. That's residual closed-source software.
Maybe I WILL go with Intel the next system I buy. They seem to be the only Open-Source option. (Matrox seems to only sell multi-headed systems.)
Hey, AMD! Are you listening to me? I've spec'd you for my last several systems, but this is a big enough deal to make me change my mind. It's not the performance, I have Intel down as being charged a 20% penalty for bad corporate behavior. It's having Open-Source code. That's worth around 25% just by itself.
I don't do fancy graphics manipulation. I just want a high reslolution screen...with open source drivers. Unfortunately, the nv drivers won't go very high, and the reason for this is fairly clearly laid at NVidia's feet. ATI is reported not to be any better. This isn't my area of specialty...I just know how I want my screen to look. 1280x1024 is fine. 1024xWhatever isn't. (Were I to get a larger screen, I might want a higher resolution.)
I think we've pushed this "anyone can grow up to be president" thing too far.
"...but we're only now figuring out how they really work"
it's not like it's an alien virus.
Jeez, they're created by people, I suspect that they know how they work.
The Kruger Dunning explains most post on
*Sigh* Children.
it's the best post of this millenium!
The Kruger Dunning explains most post on
Officer - "Your knife killed the man, you're charged with murder"
Homeowner - "But I didn't know it was missing!"
Officer - "Doesn't matter, the murderer stole it from your house."
Strawman.
Now if you were leaving guns laying out in the street and some one came along and killed someone, you'd go to jail for sure.
We need to figure out the protocols botnets use, crack them to destroy themselves and reveal the owner, then torch the owner's house. Then we torch the owner. And then we sue the family for damages, including the cost of the blowtorch. Yes, I'm kidding, I just wanna see one of those charts for this solution.
Please, for the good of Humanity, vote Obama.
Remember those Windows Messenger Service spam messages that became popular with Windows XP? When you get attacked by a botnet, try to send a WMS message to each of the attacking IPs. e.g. "You are infected with botnet software. Please remove it." I know that most XP machines have the WMS service turned off by now, but the cost to trying to send a message is negligable and I'd be willing to bet that there is considerable overlap between unpatched XP systems and systems with WMS on.
Lost the botnet wars are .....
It's obviously a self-selecting test.
If you care about efficiency, or if you care about your computer, you won't keep stupid, "edge-wasting" defaults that leave the "Start" Icon in such a vulnerable position. Glad I'm not vulnerable...