Slashdot Mirror
Tools To Squash the Botnets
Roland Piquepaille writes "This is the intention of Paul Barford, a computer scientist at the University of Wisconsin-Madison. He wants to build a new line of defense against malicious traffic which has become today a billion-dollar 'shadow industry.' As one of 'the most menacing aspects of botnets is that they can go largely undetected' by a PC owner, he developed a new computer security technique for detecting network intrusions. His system has a 99.9% detection rate of malicious signatures, roughly equivalent to some of the best commercial systems. But it has zero false positives when commercial systems have high numbers. This new system could soon be available commercially."
The last line says it "could soon be available commercially". Wonder if I need to start saving pocket change so I can put it on my SimplyMEPIS box? Oh, wait they must be talking about having it run along side of Redmond-warez. nothing here - move on...........
When the easiest way to DDoS someone's site is to have the zombie army keep hitting the pages ... how will any tool identify or protect you from that threat?
The zombies can simply flood your pipeline. There are that many of them.
"Our new security company, Nemean Networks, has developed a new IPS technology that will cure cancer and raise the dead."
What's with this blatant ad? When and if they ship a product or release their technology, we can talk about it. But right now it's just a bunch of hot air.
People still have to install it and use it, correct? If so, then why do we believe there aren't going to continue to be hundreds of thousands to millions of users out there who don't give a damn, like there currently are? How is this much of an improvement over the current state of things?
All packets originating from botnets must set the malicious bit to 1. That is all. Then the system is 100% foolproof.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Title: Toward Self-directed Network Intrusion Detection and Prevention
Abstract:
Network attacks and intrusions have been a fact of life in the Internet
for many years and continue to present serious challenges for network
researchers and operators alike. The objective of our work is to develop
tools and systems that automate or otherwise enhance key activities of
network security analysts. In the first part of this talk, I will describe
our malicious traffic assessment activities using our Internet Sink
(iSink) system for dark address space monitoring. iSink is a highly
scalable system that includes both passive packet capture and a set of
stateless active responders that enable details of exploits to be
captured. Our results illustrate the variability in the traffic on dark
address space and the feasibility of efficient classification of attack
types. I will also describe how data from dark address space monitors can
be used to provide near real time network "situational awareness" for
security analysts. iSink data is also the basis for our Nemean system that
automatically synthesizes signatures for intrusion detection. Unlike
standard intrusion signatures, Nemean's signatures are protocol aware
which we show greatly enhances their resilience to false alarms. I will
describe Nemean, and conclude with a brief description of our current
activities in adapting Nemean into a real time intrusion prevention
system.
Where: Grad. Lounge
When: Thursday 27th Oct 2005 11 am.
2 years from lab to startup, not bad dude.
How we know is more important than what we know.
Hello Slashdotters! I have made a new invention as well! It's called "Removing Plug from Wall!" With my new invention, nobody will have to worry about botnets, spammers, trolls and those pop-up ads ever again! Until you plug it back in!
How about certain thing named Common Sense to be added to the list?
This is the problem with the education system in the US... This guy can use public funds and time at school to come up with something that he will then sell commercially. Bullshit - it should be open-sourced. Why should people at university get the benefit of tax-payer funding and turn it into self-gain? While I hate big government, regulation in this are is a must. Any developments coming out of tax-payer funding should be free and open to all. It disgusts me to see universities patenting things or doing things like this. Just like any government subsidized company (drug industry, transportation, etc) - should all be non-profit, for the good of all, not just the good who can afford it and the exclusion of those who paid for it thru taxes and now cannot afford it.
Gee. Lookit this big bad threat.
Boo! Botnet! Boo!
Bad Botnet! Bad! Bad! Bad!
We can save you! We have Patented Technology!
All Hail our most Holy Precious Intellictual Property!
Hail IP! Hail! Botnet! Boo!
OK, can some one 'splain to me Lucy why this obvious and fact lacking
bit of pre-IPO spin made it to SlashDot? Is there anyone that can tell me
excactly how technology that allows for 99.9 percent accuracy with zero false
positives actually works? Remember, we're talking millions of infected botnet
systems with ZERO false positives. Make millions of ANYTHING and you're going
to have a few errors here and there.
This is great if it's true, however, I'm highly skeptical without more hard
facts that this is anything other than vaporware and high hopes for an early
buyout. Gee! FOUR patents!
I'll bet I could get four patents on a process to pick my teeth with a toothpick.
Not that I think it honest, you understand...
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
if the botnet thing is that serious, wouldn't it be a better solution if it was free?
i'm not trying to say it HAS TO be free. hell, most of the people that have compromised machines won't know they need the software and where to get it, free or commercial or whatever. just kind of wondering out loud is all.
"To stop the terrorists."
That would mean that the ISP's would be BLOCKING traffic based upon his system.
Yeah, like that will go over well.
Not to mention that, AGAIN, the most commonly used protocol in infecting those machines is HTTP (with SMTP being a close second).
I though some of the hype Micro$oft was chattering about was how secure Vista was. Shouldn't the maker of the operating system take some steps to secure their product before calling it secure? Or maybe the real problem is in the routing. Can't routers become more smart to know what packets are real vs packets from botnets?
Life just seemed so much simpler back in the good old Commodore days.
I buy Windows AND this new stuff (developed at a publically funded U.), and THEN I'll have a safe PC that I can utterly neglect and still feel responsible? Great...fantastic.
Why don't isp's implement firewalls at their end that effectively eliminate all traffic except those protocols demanded by the user.
It would be relatively simple to create a web page that could enable/disable these protocols... the page would know which IP, as you would be connecting from it, and could be protected by a simple captcha or password to make it difficult for malware to enable these protocols itself.
Obviously, the user could disable all filtering if they so desired.
This solution would prevent a ton of issues for most users, while still allowing those of us who are wise enough to monitor our own systems to enable everything ourselves.
In addition, why don't ISP's notify the user if they suddenly see an unusual amount of traffic on an unusual port or protocol... a simple email to say "we are seeing IRC traffic on your connection, you have never used IRC in the past. Some malicious software communicates via IRC protocols which may cause this unusual activity. Please read this linked article if you would like to know more."
I realize that most of us would rather our ISP stay out of our online activity... however I feel that if they actively participated in preventing the spread of malware on thier customers machines, they would not only increase customer satisfaction, but reduce the bandwidth being wasted. At first it would be an expense, but as the network was cleared of wasted traffic it would eventually pay for itself.
Sometimes the best solution is to stop wasting time looking for an easy solution.
I can accept an ad that describes the advances. This article says NOTHING.
... but there are an almost infinite number of patterns for exploits.
And the claims he is making do NOT fit with how machines are infected or how the zombies are used.
Intrusion Detection Systems are based around knowing YOUR traffic. And finding patterns that do NOT match what is normal for your network.
They include patterns for known exploits
But there SHOULD be a finite number of LEGITIMATE patterns on your corporate network.
Instead of claiming "new" ways of "faster" identification of "bad" stuff, a real improvement would be faster identification of LEGIT patterns.
I'm thinking "snake oil" here.
I use Snort on our company network and I have absolutely no problems with it. I don't see how anything else could be better.
... I also do things like block out-bound SMTP from anything other than my mail server and check the logs to see if anything is happening.
But then
There's not enough info in that "article" ("ad") to say whether his work is even as good as Snort. Let alone better.
Does he think slashdot readers don't read the article or something?
Someone who isn't going to patch his mail server is going to install this new IDS? Correctly? And keep it patched?
Now, what if the mail server is responding with a "user not found" error in a multi-line format? Does that trigger your IDS?
If not, why? Or are you going to set patterns for EVERY possible, legitimate, response so you'll be able to find the ones that don't match it?
Yeah, good luck with that. You should start working on it now. Maybe in 10 years of so you'll have caught all the possible legit patterns for everything available today.
That is why current IDS's depend so much upon the ADMINS training the IDS's to what is LEGIT traffic for their particular network.
Which yields a LOT of "false positives" in the early stages (and immediately after upgrades). But if I'm running Exim4, why should my IDS be looking for patterns of Exchange responses? Or Sendmail responses? Or anything else?
Despite what that guy claims, there is no easy way to identify the bad without having a person identify what is good.
http://www.cyber-ta.org/releases/botHunter/
From the site: BotHunterTM is a novel, dialog-correlation-based engine (patent-pending), which recognizes the communication patterns of malware-infected computers within your network perimeter. BotHunterTM is a passive traffic monitoring system, which ties together the dialog trail of inbound intrusion alarms with those outbound communication patterns that are highly indicative of successful local host infection. When a sequence of in and outbound dialog warnings are found to match BotHunter's infection dialog model, a consolidated report is produced to capture all of the relevant events and event sources that played a role during the infection process.
There's also a great PDF available showing a full dissection of a Storm variant.
I'd mod you up myself, but I've already commented today!
Bah! This article isn't even worthy of Digg. Is Roland on their payroll maybe?
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Apple is going to rape them.
http://seclists.org/focus-ids/2003/Feb/0031.html
And that is with 30 seconds of Google searching. I thought I had heard of that concept before.
Search Google with "worm 'protocol validation'".
They tend to test against a VERY limited set of threats.
... it does amazingly well against that very limited set of threats. Mostly because the set of "good" is also very limited.
And since their product is based upon defeating that very limited set of threats
The concept of protocol validation is good. But not for an IDS. It is better as part of the firewall protecting that server running that service. BUT! That also means that it needs to be able to shut off access to that server when it sees ANYTHING it doesn't understand.
Can you say DoS?
Otherwise, it's nothing more than a warning AFTER you've been cracked. Because it is possible to crack with one machine and control with a different one.
There are really only two reasons why botnets and their associated malware have become so prevalent. All other apparent causes stem from these two reasons:
- The Windows monoculture. When this accounts for over 90% of all desktop installations, it's much easier to write a single worm/trojan/virus/etc that can single-handedly infect many thousands of hosts. This greatly reduces the number of vulnerabilities that need to be targeted and the knowledge necessary to exploit them on a large scale, which is a situation that favors the blackhats tremendously. If nature handled genetics this way, then the first lethal contagious disease to come along would destroy civilization. There are good reasons other than their business practices why the Microsoft monopoly is a bad idea. No matter how hard they work to improve security, there will be vulnerabilities, and due to this monopoly any single vulnerability will instantly affect millions of hosts. If you want the Internet overall to be a more secure place, this is not a good start. I believe this would be the case with any single vendor controlling this much of the market. Consider also that security is not the only selling point of Windows; convenience and "easier to use than EVER!" are also major factors and (especially convenience) are not compatible with security. The boilerplate nature of most commercial software is also a factor here.
- The lack of education of the average user. I don't really know whether this is more or less difficult to address than the first item. The fact is that most users don't give a damn about security, at least not until their identity gets stolen or their data gets deleted or $AUTHORITY_FIGURE knocks on their door asking why their machine is attacking other machines. This appears to be because they don't see their security as their responsibility; they feel that this is entirely $VENDOR's problem. That they would feel this way is a foreseeable consequence of widespread "more convenient and easier to use than ever!" marketing, since this sets up the expectation that it will Just Work with no effort. While it would be easy to blame this on Microsoft since they have profited handsomely from it, I personally believe that this is an aspect of our general instant-gratification culture that effectively says nothing is worth putting any time and effort into; Microsoft merely had the business sense to realize that catering to it is the path to profit. It's difficult to seriously blame a company for doing something when nearly everyone is rewarding them for it. Because of this, if you try to educate people regarding things like system security, what you will find is that not only are most users ignorant, they don't WANT to learn. They see "all that technobabble" as an inconvenience, yet they insist on using equipment that requires some technical skill to properly maintain. This is something of a Catch-22 because Microsoft would build a much more secure Windows if no one would buy Windows otherwise, but average users with little technical skill are not going to create this kind of market.
Just like after-the-infection virus and spyware removal tools, this botnet detector is NOT a real solution, it's a form of damage control and should only be represented as such.What I really want to see a long-term plan for dealing with those two points. Until these factors change, we are going to keep having the same kind of problems again and again as the arms race between blackhats and whitehats continues. You are never going to have perfect security, but the current situation where one piece of malware can do tremendous damage on a massive scale is a situation that many people have worked very hard to bring about. Too bad that in a superficial society like ours, we have a huge phobia of actually addressing the roots of our problems because we keep hoping to find some form of an "easy way out" of situations that took a long time to become what they are.
It is a miracle that curiosity survives formal education. - Einstein
In fact, forget the peace and love.
Maybe he was trying to RTA FROM the zombie army, and was duly blocked.
The major ISPs do not want to implement any kind of IDS or traffic monitoring. Why? Because they really enjoy their status as common-carriers. It absolves them of any blame for how the end users use the internet. If they start examining and filtering traffic even for legitimate reasons like detecting malicious traffic, they put that distinction in jeopardy. People and potentially the civil courts would assign the Telco the responsibility of policing their traffic. People would start suing the Telcos because they didn't detect that joe-blow had his computer compromised or they didn't detect and squash the DDOS attack directed against some company. Next step is forcing the Telcos to listen to all phone calls for the words 'bomb' or "Allah is great". Afterall that's NSAs job. :}
Similarly, you can eliminate SPAM in the lab, but the moment you release it, the SPAM makers will adjust their strategy. That's how arms races work. So get back with us once your solution is still working 6 months from now.
I know this isn't a slashdot survey but there is a very good tool to use(no not that tool you pervert).
LINUX!
Seeing that I was one of those who made inflammatory comments against Roland, I want to say some things.
You should notice that he stopped hiding links to his blogs in there and his topics are now about stuff a bit more, shall we say concrete. I say we let him post (Not that I'm in a place that allows me that authority but still) and not flame his better posts.
Let the flames against Roland stop...
My last sig was ridiculed
Set your routers up to do OS fingerprinting. Drop all traffic from Windows boxes. This will have the handy side-effect of killing 99% of the spam that's out there too.
The source is nowhere to be found. Unfortunately.
Every intrusion detect vendor has hawked ways to reduce or eliminate false positives that have met with marginal success. Put that puppy in a live network and see what te fasle postivies are.
Now there are certain behaviors that bots exhibit even when they are quiet waiting for commands. So looking at network traffic alone, if you have a bunch of hosts all talking to the same server for a long, long time (days, weeks, hours), that seem to move in unison, you probably have a botnet. This is differnet than traffic where a bunch of users are hitting a popular site like Youtube or Facebook where the traffic pattern looks more like web traffic (port 80, lots of small packets to teh server, lot of bigger packets coming back, interative behavior, etc).
Don't believe the zero false positives until you see it.
It's not the Window monoculture so much as the fact that the Windows HTML control is designed to allow you to pass it a chunk of code and say "run this" and if you smell right... it will! How anyone in the world could look at this design and not go "you mean, if I can get some trust hormones and smear them on my program, everyone who looks at it using Internet Explorer will run it?". I mean, this is such a completely insane design that I'm honestly boggled Microsoft hasn't been creamed by a trillion dollar class action suit over it yet. This is like Ford building autos that kick the owners out and follow you home if you wave a yellow hanky at them.
What the hell is wrong with people that anyone, for one minute, could think this is a good idea? It's not. It's so lousy an idea that it makes only moderately lousy ideas like Java's security model look good by comparison, even to people like me who know better. It's so lousy it'd still be scratching after a week in pyrethrin. It's so lousy... gah... there's not an analogy corny enough to do justice to how lousy it is.
Bigger botnets?
RTFM
Write a legitimate program to remote-control your computer with IRC. Bet you get a false positive then.
Why not just create (and keep creating) "good" virii that will infect computers and look for malicious traffic. They can perhaps closely imitate the code signatures of the infections they're trying to thwart - if the user has enough anti-virus nous to remove the offender, it also removes the "good" virus, no long-term harm done.
In the meantime, fight fire with fire. If there's a hole in that approach, I'd like to hear it.