Zombies Blend In With Regular Web Traffic

An anonymous reader writes "Hackers controlling farms of zombie computers are now trying to blend in with web traffic, News.com reports. Instead of traditional IRC controls, many zombie farms are moving to simple web-based control schemes, which makes them harder to track down." From the article: "The change in tactics makes it harder to identify zombies on a network, and it becomes tougher for security professionals to use the hackers' own tools to spy on them. In addition, the switch to Web-based control increases the threat of zombies to enterprises and other organizations, as that method can't be blocked as easily as the previous technique."

Comments

NAT!

[CdBee]

If every home internet connection had a NAT router it would cut down incoming TCP80 traffic a fair amount (so long as uPNP doen't f*ck it up anyway)

Centralized botnet control

[nevesis]

The problem with zombies has always been the centralization required to control them. For example, if the zombies are controlled via IRC and all pointed at EFnet, idling in #my31337botnet -- all it takes is an EFnet admin to close the channel. So the owners routed them to private IRC servers via their IP.. but now all it takes is the owner of the box or network hosting the server to shut it down. So the owners used dns so they could move the server if needed, but now all it takes is having the domain suspended or the dns removed. And now, if these bots are just polling a website for commands - it shouldn't be difficult to close the website. This problem resonates with just about any protocol used - be it IRC, AIM/ICQ, or a website. The problem is that there are more children creating ddos nets than there are good samaritans/PO'd network admins having them shut down. So join the botnets mailing list and donate a hour a week.

Re:Centralized botnet control

[Anonymous Coward]

Except that we're already seeing fully decentralised p2p encrypted botnets, and at a simpler level partitioned botnets which serve their own DNS so the C&C server can be moved to a new botted host quickly and easily. Not that they shouldn't be fought, but the best botnets are very well put together and very difficult to shut down (especially if one is constrained to legal methods.)

We need significantly improved average-host security and strong/proactive ISP level detection/countermeasures to make a real dent in the botnet epidemic, neither of which will happen anytime soon. Until then it's just going to get worse.

Re:Centralized botnet control

[doublebackslash]

The problem with blocking is this:
User Content on Large/Important websites

All a hacker must do is create a bot to make logons on some social networking sites, flickr, photobucket, wikipedia, etc and re-direct the captchas to a legitimate pornography site to have real humans crack. Once the bots are on the sites thousands of them can upload content with encrypted stenographic messages. In the case of pictures they will be undetectable, since encrypted messages show up as noise, just as is introduced by a camera.
Now you have a large, distributed control network that can be self-healing (give status updates to eath other, have a web of control instead of a single link, dead peer detection, peer sharing, etc)

How would one fight that?

Re:Centralized botnet control

[nevesis]

You're absolutely right. Luckily, this level of sophistication has not yet been seen in botnets. Luckily, most botnets are operated by 14 year old irc warriors. So, please, don't start coding black hat. :P

Google?

[tepples]

And now, if these bots are just polling a website for commands - it shouldn't be difficult to close the website.

Unless the web sites get indexed by Google, and zombies use specially chosen keywords to search for their latest encrypted instructions.

Re:Impact to advertising

[Anonymous Coward]

Oh yes. Fraudulent clicks has been a botnet money-making channel for quite some time now. Google et al do have methods of trying to detect it, but I would imagine it pretty much boils down to identifying suspicious sudden spikes, because the botnet guys are intelligent and motivated and there's no real technical countermeasure that's not intrusive (e.g. captcha) and therefore unusable as it would put legitimate users off. It's a serious problem for them.

how comforting

[Jasper__unique_dammi]

At the end of the article: "That said, the good guys control the infrastructure, so we ultimately have the last word. If we don't like what they're doing, we can shut them down."

That's a good one, remember if i ever get life-threateningly sick, that i can always shoot myself. (that will teach those virussus/bacteria/cancercells!)