Slashdot Mirror
Tools To Squash the Botnets
Roland Piquepaille writes "This is the intention of Paul Barford, a computer scientist at the University of Wisconsin-Madison. He wants to build a new line of defense against malicious traffic which has become today a billion-dollar 'shadow industry.' As one of 'the most menacing aspects of botnets is that they can go largely undetected' by a PC owner, he developed a new computer security technique for detecting network intrusions. His system has a 99.9% detection rate of malicious signatures, roughly equivalent to some of the best commercial systems. But it has zero false positives when commercial systems have high numbers. This new system could soon be available commercially."
When the easiest way to DDoS someone's site is to have the zombie army keep hitting the pages ... how will any tool identify or protect you from that threat?
The zombies can simply flood your pipeline. There are that many of them.
"Our new security company, Nemean Networks, has developed a new IPS technology that will cure cancer and raise the dead."
What's with this blatant ad? When and if they ship a product or release their technology, we can talk about it. But right now it's just a bunch of hot air.
People still have to install it and use it, correct? If so, then why do we believe there aren't going to continue to be hundreds of thousands to millions of users out there who don't give a damn, like there currently are? How is this much of an improvement over the current state of things?
Gee. Lookit this big bad threat.
Boo! Botnet! Boo!
Bad Botnet! Bad! Bad! Bad!
We can save you! We have Patented Technology!
All Hail our most Holy Precious Intellictual Property!
Hail IP! Hail! Botnet! Boo!
OK, can some one 'splain to me Lucy why this obvious and fact lacking
bit of pre-IPO spin made it to SlashDot? Is there anyone that can tell me
excactly how technology that allows for 99.9 percent accuracy with zero false
positives actually works? Remember, we're talking millions of infected botnet
systems with ZERO false positives. Make millions of ANYTHING and you're going
to have a few errors here and there.
This is great if it's true, however, I'm highly skeptical without more hard
facts that this is anything other than vaporware and high hopes for an early
buyout. Gee! FOUR patents!
I'll bet I could get four patents on a process to pick my teeth with a toothpick.
Not that I think it honest, you understand...
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
Why don't isp's implement firewalls at their end that effectively eliminate all traffic except those protocols demanded by the user.
It would be relatively simple to create a web page that could enable/disable these protocols... the page would know which IP, as you would be connecting from it, and could be protected by a simple captcha or password to make it difficult for malware to enable these protocols itself.
Obviously, the user could disable all filtering if they so desired.
This solution would prevent a ton of issues for most users, while still allowing those of us who are wise enough to monitor our own systems to enable everything ourselves.
In addition, why don't ISP's notify the user if they suddenly see an unusual amount of traffic on an unusual port or protocol... a simple email to say "we are seeing IRC traffic on your connection, you have never used IRC in the past. Some malicious software communicates via IRC protocols which may cause this unusual activity. Please read this linked article if you would like to know more."
I realize that most of us would rather our ISP stay out of our online activity... however I feel that if they actively participated in preventing the spread of malware on thier customers machines, they would not only increase customer satisfaction, but reduce the bandwidth being wasted. At first it would be an expense, but as the network was cleared of wasted traffic it would eventually pay for itself.
Sometimes the best solution is to stop wasting time looking for an easy solution.
Someone who isn't going to patch his mail server is going to install this new IDS? Correctly? And keep it patched?
Now, what if the mail server is responding with a "user not found" error in a multi-line format? Does that trigger your IDS?
If not, why? Or are you going to set patterns for EVERY possible, legitimate, response so you'll be able to find the ones that don't match it?
Yeah, good luck with that. You should start working on it now. Maybe in 10 years of so you'll have caught all the possible legit patterns for everything available today.
That is why current IDS's depend so much upon the ADMINS training the IDS's to what is LEGIT traffic for their particular network.
Which yields a LOT of "false positives" in the early stages (and immediately after upgrades). But if I'm running Exim4, why should my IDS be looking for patterns of Exchange responses? Or Sendmail responses? Or anything else?
Despite what that guy claims, there is no easy way to identify the bad without having a person identify what is good.
Bah! This article isn't even worthy of Digg. Is Roland on their payroll maybe?
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Why does this get posted in every story involving TCP/IP manipulation? ISPs do not and never have had common carrier status.