Slashdot Mirror
Researchers Infiltrate and 'Pollute' Storm Botnet
ancientribe writes "Dark Reading reports that a group of European researchers has found a way to disrupt the massive Storm botnet by infiltrating it and injecting "polluted" content into it to disrupt communication among the bots and their controlling hosts. Other researchers have historically shied way from this controversial method because they don't "want to mess with other peoples' PCs by injecting commands," said one botnet expert quoted in the article.
It's not really messing with other people so much as preventing them from messing with tons of other infected hosts. Seriously, this is no moral question. "Poisoning" Storm is nothing but a good idea.
I submit that it's inherently fair and perfectly ethical to disrupt those who invade and steal from others. Even if the theft is one of compute cycles. Usually, we call those who disrupt invaders and thieves "heroes."
Invenio via vel creo
Add free article here.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
Ok, so here's a fun question: Lets say the botnet creators get pissed off and send out a code change that makes one of the standard commands change to be something like, oh, "wipe hard drive." The botnet creators then use different commands, but the researchers come along and issue the old command, thus wiping the users' hard drives.
Are the researchers liable since they technically issued the offending command while logged in as a remote user without the owner's permission?
To the ones worried about the ethics, at least in this case: What the researchers did, in a sense, is change the 'name' and/or 'password' the bot uses to call the bot master and authenticate itself. In short, they removed the ability of the 'bot to get more commands.
V for Vendetta: People should not be afraid of their governments. Governments should be afraid of their people.
The war. IT BEGINS.
Seriously I'm personally excited by the fact that this essentially seems to offer a great draw to people with security skills to try being offensive where most of their efforts would be used defensively before.
I predict that the botnet authors will respond with the following counter-measures:
1) Command messages sent to the botnet by the operator will employ public key cryptography and message signing so that bots can determine real commands from headquarters (i.e. the bot net operator) from fake ones.
2) The bots themselves will use encryption to communicate amongst themselves and employ secret handshakes once the encrypted channel has been established to detect imposters. It would not be difficult to arrange for the botnet to automatically coordinate and begin punative attacks against hosts which attempt to inject false commands into the botnet.
ISPs aren't going to turn people off as Joe Sixpack has no idea what a bot is or where spam comes from. They would probably switch providers, as it's a lot easier than cleaning your computer.
who have no regard for morals or ethics, scrupulously conforming to morals and ethics hampers your ability to fight
the danger of course, is not to become what you fight by doing that
so you slightly bend the rules, all the time, without making the sort of flat out trangression of major moral issues that constitutes what criminals do
but you will still get flak from people who expect moral certitude from those who fight criminals, and criticize you like no tomorrow, all the while completely ignoring and not criticizing the criminals themselves
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Since the researchers have already published their work on the infiltration process, I'm sure by the time you read this piece of news the botnet owners and/or authors have already put an action plan in place to mitigate, or at least lessen, the effect.
Plus, if you read their published work, they readily admit that they are always one step behind the worm, and have to react whenever the attacker changes his tactics. The work mentions that "the attacker can easily change [a function of the Stormnet communication technique]... and then we need to analyze [our] binary again."
Criminals usually work faster than the good guys because they have more to lose.
The Wknd Sessions - Malaysian and South East Asia independent music
Computers in a botnet are not "peoples' PCs" anymore. They are not under control of the owner. This needs to be clarified again and again. When you see a Borg drone, you (try to) kill it. And Picard was right - you'll be doing it a favor.
I can assure you, the best way to get rid of dragons is to have one of your own.
I've seen previous allegations that Leo Kuvayev has ties to the storm botnet. It of course is known that Mr. Kuvayev is a prolific spammer.
However, there hasn't been as much spam from Mr. Kuvayev - either in my own boxes, or mentioned recently on line. This leaves me to wonder if perhaps he isn't utilizing it as much as he used to?
While certainly the botnet has been used for more than just spam propagation, and Kuvayev has sent spam to a lot more people that just me, I still can't help but wonder if it either isn't as large or as active as it once was.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Nuke the sites from orbit, it's the only way to be sure!
If you can read this, I forgot to post anonymously.
bad bad idea
I'd love to be required to have antivirus software on my linux/FreeBSD/Solaris machines. If you don't have a locked down box those systems can be just as bad as a botnet windows machine.
Or requiring comcast to have a rootkit on every machine you have to ensure that it's not infected. Sony computers would love that!
Just because they put locks on car doors doesn't mean everyone uses them. Then there's the issue of thos little magentic key holders in the driver's side wheel well...
I use irony whenever I can, but my shirts are still wrinkled...
That's got to be some sort of record...
Peter predicted that you would "deliberately forget" creation 2000 years ago...
..because we won. History is written by the victors of course. Don't misunderstand me -- nothing could make me defend the German army's actions (or those of many of its citizens at the time). I'm only saying that had we lost that war, a different history might look upon the "re-invasion" of Belgium as a war crime.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
http://www.yjolt.org/7/ A little old, but this is an article I wrote on related legal issues-- legality of striking back including at zombies.
What is this 'tat' that you refer to, and where can I exchange it for this first thing?