Slashdot Mirror
Researchers Infiltrate and 'Pollute' Storm Botnet
ancientribe writes "Dark Reading reports that a group of European researchers has found a way to disrupt the massive Storm botnet by infiltrating it and injecting "polluted" content into it to disrupt communication among the bots and their controlling hosts. Other researchers have historically shied way from this controversial method because they don't "want to mess with other peoples' PCs by injecting commands," said one botnet expert quoted in the article.
It's not really messing with other people so much as preventing them from messing with tons of other infected hosts. Seriously, this is no moral question. "Poisoning" Storm is nothing but a good idea.
...like maybe perhaps research methods of disrupting botnets and see what results that type of research produces?
The war. IT BEGINS.
Seriously I'm personally excited by the fact that this essentially seems to offer a great draw to people with security skills to try being offensive where most of their efforts would be used defensively before.
I predict that the botnet authors will respond with the following counter-measures:
1) Command messages sent to the botnet by the operator will employ public key cryptography and message signing so that bots can determine real commands from headquarters (i.e. the bot net operator) from fake ones.
2) The bots themselves will use encryption to communicate amongst themselves and employ secret handshakes once the encrypted channel has been established to detect imposters. It would not be difficult to arrange for the botnet to automatically coordinate and begin punative attacks against hosts which attempt to inject false commands into the botnet.
ISPs aren't going to turn people off as Joe Sixpack has no idea what a bot is or where spam comes from. They would probably switch providers, as it's a lot easier than cleaning your computer.
who have no regard for morals or ethics, scrupulously conforming to morals and ethics hampers your ability to fight
the danger of course, is not to become what you fight by doing that
so you slightly bend the rules, all the time, without making the sort of flat out trangression of major moral issues that constitutes what criminals do
but you will still get flak from people who expect moral certitude from those who fight criminals, and criticize you like no tomorrow, all the while completely ignoring and not criticizing the criminals themselves
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Since the researchers have already published their work on the infiltration process, I'm sure by the time you read this piece of news the botnet owners and/or authors have already put an action plan in place to mitigate, or at least lessen, the effect.
Plus, if you read their published work, they readily admit that they are always one step behind the worm, and have to react whenever the attacker changes his tactics. The work mentions that "the attacker can easily change [a function of the Stormnet communication technique]... and then we need to analyze [our] binary again."
Criminals usually work faster than the good guys because they have more to lose.
The Wknd Sessions - Malaysian and South East Asia independent music
Computers in a botnet are not "peoples' PCs" anymore. They are not under control of the owner. This needs to be clarified again and again. When you see a Borg drone, you (try to) kill it. And Picard was right - you'll be doing it a favor.
I can assure you, the best way to get rid of dragons is to have one of your own.
I thought of that too. It might be a good way for the botnet operators to keep security researchers of their backs. Fortunately, the botnet operators don't want to damage the computers any more than the security researchers do. Less, in fact, because the botnet operators think they "own" said computer.
Write your own Choose Your Own Adventure. http://www.freegameengines.org/gamebook-engine/
bad bad idea
I'd love to be required to have antivirus software on my linux/FreeBSD/Solaris machines. If you don't have a locked down box those systems can be just as bad as a botnet windows machine.
Or requiring comcast to have a rootkit on every machine you have to ensure that it's not infected. Sony computers would love that!
Just because they put locks on car doors doesn't mean everyone uses them. Then there's the issue of thos little magentic key holders in the driver's side wheel well...
I use irony whenever I can, but my shirts are still wrinkled...
..because we won. History is written by the victors of course. Don't misunderstand me -- nothing could make me defend the German army's actions (or those of many of its citizens at the time). I'm only saying that had we lost that war, a different history might look upon the "re-invasion" of Belgium as a war crime.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln