Slashdot Mirror
Researchers Infiltrate and 'Pollute' Storm Botnet
ancientribe writes "Dark Reading reports that a group of European researchers has found a way to disrupt the massive Storm botnet by infiltrating it and injecting "polluted" content into it to disrupt communication among the bots and their controlling hosts. Other researchers have historically shied way from this controversial method because they don't "want to mess with other peoples' PCs by injecting commands," said one botnet expert quoted in the article.
It's not really messing with other people so much as preventing them from messing with tons of other infected hosts. Seriously, this is no moral question. "Poisoning" Storm is nothing but a good idea.
... at 11! Place your bets!
Perhaps I am a bit naive, but if they are able to successfully "pollute" the botnet, why not simply send out code that instruct the bots to destruct (uninstall) themselves? As a former programmer, I certainly understand the difficulty in the protocol implementation, but if they've already gained enough insight to disrupt communication protocols, surely they can send out a termination signal. After instructing the bot to pass on the termination signal to the other bots, of course :-)
Is anyone else bothered by the fact the summary might as well say "skynet" instead of "botnet" and it would make just as much sense.
I think the future has arrived.
I submit that it's inherently fair and perfectly ethical to disrupt those who invade and steal from others. Even if the theft is one of compute cycles. Usually, we call those who disrupt invaders and thieves "heroes."
Invenio via vel creo
Because "What could possibly go wrong?"
Disclaimer:IANAL/MD/PhD-Just the local yokel PC "doc" ~If you're not having fun, then you are probably doing it wrong.
Add free article here.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
No, it wasn't. ;)
...like maybe perhaps research methods of disrupting botnets and see what results that type of research produces?
Ok, so here's a fun question: Lets say the botnet creators get pissed off and send out a code change that makes one of the standard commands change to be something like, oh, "wipe hard drive." The botnet creators then use different commands, but the researchers come along and issue the old command, thus wiping the users' hard drives.
Are the researchers liable since they technically issued the offending command while logged in as a remote user without the owner's permission?
It would be nice if the researchers could find a way to inject a "cure" and disable the malware on the target computer. I wouldn't have any moral/ethical problem with that. Of course, I guess it all depends on who is defining "malware." The RIAA might convince a judge that it is "OK" to innoculate pc's against P2P (pick your favorite client).
Cheers,
ISP's can shut your service off if they detect you are spamming.. I've had clients with infected machines get shut off by their ISP (their entire Internet connection), so I know they can do it.
ISP's should stop investing in killing legitimate traffic (Torrents) and put that focus on keeping the Internet clean by disconnecting infected machines until they are fixed. Most ISP's offer free AV too, and I'm sure there are still some nubs out there who have no clue. Shut them off and they'll get a clue real quick.
You're basically the Dr. McCoy to the original poster's Spock. If Mr. Spock was here, I'm sure he would disagree with an argument based on the need of the many.
To the ones worried about the ethics, at least in this case: What the researchers did, in a sense, is change the 'name' and/or 'password' the bot uses to call the bot master and authenticate itself. In short, they removed the ability of the 'bot to get more commands.
V for Vendetta: People should not be afraid of their governments. Governments should be afraid of their people.
The war. IT BEGINS.
Seriously I'm personally excited by the fact that this essentially seems to offer a great draw to people with security skills to try being offensive where most of their efforts would be used defensively before.
I predict that the botnet authors will respond with the following counter-measures:
1) Command messages sent to the botnet by the operator will employ public key cryptography and message signing so that bots can determine real commands from headquarters (i.e. the bot net operator) from fake ones.
2) The bots themselves will use encryption to communicate amongst themselves and employ secret handshakes once the encrypted channel has been established to detect imposters. It would not be difficult to arrange for the botnet to automatically coordinate and begin punative attacks against hosts which attempt to inject false commands into the botnet.
in order to save it.
Best Slashdot Co
Sometimes the disease kills the host.
who have no regard for morals or ethics, scrupulously conforming to morals and ethics hampers your ability to fight
the danger of course, is not to become what you fight by doing that
so you slightly bend the rules, all the time, without making the sort of flat out trangression of major moral issues that constitutes what criminals do
but you will still get flak from people who expect moral certitude from those who fight criminals, and criticize you like no tomorrow, all the while completely ignoring and not criticizing the criminals themselves
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Since the researchers have already published their work on the infiltration process, I'm sure by the time you read this piece of news the botnet owners and/or authors have already put an action plan in place to mitigate, or at least lessen, the effect.
Plus, if you read their published work, they readily admit that they are always one step behind the worm, and have to react whenever the attacker changes his tactics. The work mentions that "the attacker can easily change [a function of the Stormnet communication technique]... and then we need to analyze [our] binary again."
Criminals usually work faster than the good guys because they have more to lose.
The Wknd Sessions - Malaysian and South East Asia independent music
Computers in a botnet are not "peoples' PCs" anymore. They are not under control of the owner. This needs to be clarified again and again. When you see a Borg drone, you (try to) kill it. And Picard was right - you'll be doing it a favor.
I can assure you, the best way to get rid of dragons is to have one of your own.
I've seen previous allegations that Leo Kuvayev has ties to the storm botnet. It of course is known that Mr. Kuvayev is a prolific spammer.
However, there hasn't been as much spam from Mr. Kuvayev - either in my own boxes, or mentioned recently on line. This leaves me to wonder if perhaps he isn't utilizing it as much as he used to?
While certainly the botnet has been used for more than just spam propagation, and Kuvayev has sent spam to a lot more people that just me, I still can't help but wonder if it either isn't as large or as active as it once was.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Might it be appropriate to pass a law requiring all cars to have locks on the doors?
IMHO, technology people are so adverse to gov't regulation (OK, with good reason) that they are not willing to recognize that SOME regulation can be a good thing in an economic community.
If all PCs were required to have anti-virus software, and all ISPs were required to verify this, or to disconnect the customer, I suggest that the number of bots out there might drop 90%.
Yes, I realize that neither of these requirements are perfect, and there will always be SPY v. SPY competition. But right now we have SPY v. (nothing). No competition for the bad guys at all, and so we have 100 billion spams a day.
I will create a sig when innovation restarts in the U.S.
Nuke the sites from orbit, it's the only way to be sure!
If you can read this, I forgot to post anonymously.
... at the Usenix leet conference covered by slashdot.
Go look through the articles... some of them rock. The technical knowledge of these guys, how they dismantled storm, etc is amazing.
its a pain to provide technical support for even uninfected computers, and you are telling us to help people clean their infected computers.
Read radical news here
This story merely repackages this one.
That's got to be some sort of record...
Peter predicted that you would "deliberately forget" creation 2000 years ago...
..because we won. History is written by the victors of course. Don't misunderstand me -- nothing could make me defend the German army's actions (or those of many of its citizens at the time). I'm only saying that had we lost that war, a different history might look upon the "re-invasion" of Belgium as a war crime.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
And by "other peoples' PCs" they of course mean the people who control Storm. The physical possessors of the computers have already given up ownership.
It's a real shame that this is being done by researchers and not security forces. The researchers are correct, it ain't their job. It should be done by people who we have already given the authority to trespass with cause.
Not going to happen. Sadly. I live in a place where violent crime is incredibly rare, but property crime is common. The most valuable things I own are the information on my computers, and yet there is no one that I can call if I'm attacked there.* Law enforcement has the technology of Wyatt Erp while the criminals have F22 with laser guided bombs and depleted uranium ammo.
I hope the researchers don't get brought up on charges, it would set a bad precedent. Since law enforcement will never get caught up, I'd like to see a law passed that gives immunity to this kind of action. If The Law is unwilling or unable to deal with a threat, they have to deputize citizens. Too bad The Law is unwilling to admit weakness or failure.
* Even if they steal my physical laptop there's only a minuscule chance that the police will do anything but take a report and notify me "if it turns up". Insurance will cover the physical loss, but not the potential repercussions of the loss (ID theft, proprietary business info, down time, etc.**)
** Yes, I encrypt but security is not an absolute.
How much money do you really need?
If I was doing illegal botnets, I'd make a cool billion dollars or so, then retire to a tropical island.
Don't thank God, thank a doctor!
The problem with the Welchia worm is that it actively scanned for vulnerable systems and fixed them, rather than waiting for a probe and responding to the attack. It was the proactive scanning that caused all the problems, a purely reactive system would be much better.
Cant be used the botnet itself to do something more useful, like self destruct, uninstall self or display a warning to the zombie pc user?
Maybe that borg^H^Htnet have some sort of "sleep" command to make it inactive in most part.
That's not your neighbor anymore. Just another stinkin' zombie.
> net send <logged in username> "your machine is infected with the Storm rootkit, go here for the fix URL:..."
and scare them into fixing it! Just a little tough love and education is what is needed, not hosing up their machine. Anything that has the potential to damage the machine is a very bad idea, but the owner really needs to know its hacked, and then how to fix it.
those are examples of breaking the rules, of becoming what you are fighting
those are not examples of bending the rules, such as with these botnet inflitrators
so you are not correctly identifying what i am talking about
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Why don't they order the infected machines to pop up with a window that says, "This computer is infected by the Stormbot. Please report this message to your IT administrator." and include a url to a webpage with some cleaning instructions.
I couldn't agree with you more. Well said!! Mod parent down!!The real moderation bias which is a cause for concern is modding with negative mods as a substitute for "disagree". That's bullshit, and there's no excuse for it.
Thanks to Godwin's Law, Nazi Germany never fielded a successful internet discussion board.
if your neighbor is making a lot of noise attempting to repair a leaking dam, and you stick your head out the window and tell him to keep the noise down, you aren't keeping your mind trained on the larger picture
same with those who criticize the cops and have nothing to say about criminals
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Unauthorized use of another's computer is illegal. The law applies equally to "hackers" and "researchers". Oh, and "Two Wrongs don't make a right".
It's pretty simple really, we don't even need a car analogy. Oh, what the heck.... just because the "hackers" likes to take your car out for a joyride in the middle of the night doesn't mean that the "reasearchers" get to do the same thing. Heck, the "researchers" are even using the slimjim that the "hackers" left behind.
P.S. We lost the hacker vs. cracker debate over a decade ago, get over it.
The best part about spam, malware and viruses, exploits and the so called, "criminal activity" of these users, is they present a challenge to protect against them. This creates a competitive environment which benefits society, creating more diverse technology. These activities need to continue, if the world ever becomes so secure we loose are freedom, technologies those employed by storm and others would allow us protection. Likewise, without criminal activity in cyberspace, half of us would loose our jobs.
http://www.yjolt.org/7/ A little old, but this is an article I wrote on related legal issues-- legality of striking back including at zombies.
"In future work, we plan to analyze in detail the second-tier computers and try to find ways to identify the operators of the Storm Worm"
Don't kill the PCs like the Borg drones, and don't kill the botnet.
Instead, let it run, infected and reporting back, so as to track down the operators. At that point, they can be killed, arrested, or whatever consequence requires the least paperwork (depending on the country from which the sucm are operating).
The problem with this is that malware sometimes patches the flaw in order to prevent competing malware from getting onto the machine. Welchia's approach was to pro-actively patch vulnerable machines and delete Blaster if it found it.
Having just completed a PhD, I have to say that your signature is the most accurate assessment of higher education that I've ever seen. Cheers!
riiiight... So what you're saying is:
Spam KILLS! Think of the children!
Just a wee-bit dramatic, innit? A flaming, out-of-control car, rushing down-hill to crush a bunch of innocent kids, or a bunch of unsolicited email for herbal v14gr4...
And bonus points for being a car analogy.
> The researchers, from the University of Mannheim and the Institut Eurecom
The problem is, you can do it only once. Next time, the botmasters will retaliate with a DDoS so huge, the university IT infrastructure will melt like scrap iron in a blast furnace.
When servers are unaccessible for three days in a row and university students are unable to sign up for exams, professors cannot publish online, the deacon will surely those pesky researchers to find a new campus for their little cat-and-mouse game.
Otherwise, most bot people are russians, mostly from Saint-Petersburg and the american Secure Computing Corp. plainly said they have proof those online ruffians are protected by Putin's inner circle (the judo dwarf was top honcho in Leningrad back in those gool ol' KGB days).
Question: Dear researcher, do you want to receive Polonium-210 in mail? On-line crime is a huge business and the mafia will not lose some 150 million dollars a year just because of two silly scientists. They will suffer a regrettable accident, if history is any indication of what follows next.
Doesn't this violate the EULA and copyright protection of the Botnet software? How do you know I don't want to be part of a Botnet? Who are you to tell me I can't participate in large scale attacks on other networks or send out massive amounts of email that has not been requested?!?!
Now please, let me decide what software I want to unwittingly run on my computer!
One ring to bind them - should probably have more fiber and less rings in their diet.
Isn't that the same idea as "Google Turns Over Data on Suspected Pedophiles In Brazil"? http://tech.slashdot.org/tech/08/04/24/138227.shtml
Breaking rights for a good cause? Damn sure you are right!
Oh Oh - I seen this one - the command was simply "Sleep"!
Then the borg cube blew up!
Pug
An Invisible Entity of Vast Power whose existence must be taken on faith alone: Liberal Media
So now mentioning WWII is Godwinning? Is there a website somewhere that tells me what I'm allowed to talk about without being subject to a Godwinattack?
Seriously though, I've actually modified the way I talk as a result. If I feel like referring to Hitler, I substitute Bush or Saddam or Mussolini to avoid a Godwinattack (although Mussolini is a little risky). If I want to refer to concentration camps I instead refer to Gitmo.
I can't tell whether that makes Godwinazis happy or not.
Cow Cube
Troi: OH MY GOD, HE'S EXHAUSTED!
Data: That may be true, counselor, but I think he's suggesting a command to inject into the hive mind...
Yes I botched the hell out of the quote. I'm too lazy to go look it up.
What is this 'tat' that you refer to, and where can I exchange it for this first thing?
Hell, I look at it like the real world. Would I not fight back against a zombie trying to eat me simply because "he doesn't know what he's doing"? Hell no! I would fill his zombie ass fulla lead! The same thinking applies here. Sorry buddy but your zombie ass is toast!
i guess this will never be seen by the world, since it will probably get a score of 0 (uninformative, pandering) but just wanted to say thank you to the people who are doing this.
i am not a techie type at all, but my brother plays one on tv (oops, i mean he is a software engineer) and i asked him if there was something "wrong" with my computer, because my spam had dropped off from several hundred messages a day, to a half dozen or so.
he told me the white hat(?) hackers were fed up and staging an attack on the worst of the spammers.
i love it.
thank you, and keep up the great and necessary and good work