Slashdot Mirror
What a Botnet Looks Like
Esther Schindler writes "CSO has an annotated, zoomable map of real botnet topologies showing the interconnections between the compromised computers and the command-and-control systems that direct them. The map is based on work by security researcher David Voreland; it has interactive controls so you can zoom in and explore botnets' inner workings. Hackers use botnets for spamming, DDoS attacks and identity theft. One recent example is the Storm botnet, which may have comprised 1 million or more zombie systems at its peak. As with any networking challenge, there are good (resilient) designs and some not-so-good ones. In some cases the topology may be indicative of a particular botnet's purpose, or of a herder on the run."
To get a good look at a botnet they say, "You need to upgrade your Flash Player". How true!
No calls now, I'm
here's a photo of a botnet. Ok, it's a small botnet but if the botnet was a semi you wouldn't see the computers, now would you?
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
all of the IP addresses. Can I get that in a text format? I want to add them to my hosts file.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
because I don't work in this area, but I think a simpler explanation for the crazy hodge-podge of IP's on the map is dynamic IP's being given to a few infected PC's.
How can one say with confidence that the design is purposeful?
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
http://www.artsci.washington.edu/news/Autumn05/largermap_sexualnetworks.htm
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
It would be nice to be able to search my static IP or a range of IPs to see if they are on the map.
There are lots of well constructed stars, where a handful of master nodes control several slaves. Each slave knows two or three masters for redundancy. That's good design, and I expected it.
But what's hilarious is that there are some ip addresses that are slaves to four or five different botnets. I wonder what the owners of those machines think?
"Man, the internet sure is slow today!"
"I need a new computer, this one's all slow."
"Sweet! Five botnets and counting! I'm part of something! I belong!"
Use the Firehose to mod down Second Life stories!
Who modded this "offtopic"? The site requires the latest and greatest flash player to look at a freaking image when everyone knows that Flash has big fat holes in it. They might as well made it IE only.
...would like to see more. Was there actually an article there, or was that just a picture? How about something about the methodologies used, a description of the organization of the network, maybe even some metrics like centrality. Something other than a picture, ferchrissakes.
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
No, it sucks. I zoomed in to close and saw my IP!
There are fields, Neo. Endless fields where bot beings are no longer born. Are grown. For the longest time I wouldn't believe it and then I saw the fields with my own eyes...
One of the nodes backendportal.info is registered to Horatio Nelson!
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
The Tao of math: The numbers you can count are not the real numbers.
If you zoom in, you'll see a lot of the concentration of spiderwebs are around sites like honeynet.cz.
I can see my house from...oh wait..oh :/
Power corrupts. Absolute power...is even more fun.
Was it just me, or did anyone else imagine parent as speaking in the voice of max headroom?
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
Wait, 127.0.0.1 is in there. That is my IP address!
Is perfect security possible? Serious question.
If the answer is yes, then there would be some point to your idea. It would probably not be practical to do what you're suggesting, and it may run counter to some people's ideas of personal freedom. Probably you would piss off a hell of a lot of people.
If the answer is no, then the same flaws apply as above, except that it would be ultimately pointless. There's an evolutionary principle called the Red Queen effect that you should be aware of. It's kind of a consequence of selective pressure in an environment. Basically, if you close off all the security holes you know about, this creates a strong pressure for someone to find another security hole.
So, should we use draconian methods to try to achieve a perfectly secure internet? It seems like the same argument as the anti-terrorism efforts. I do not think such efforts would be successful, or worth the cost.
Those who advocate genocide deserve every protection afforded by law, and none afforded by common human decency.
allow people to register with information like:
Registrant Contact:
elnopic
elnopic elnopic (elnopic@elnopic.com)
+1.2435543
Fax: +1.5555555555
123 sdhdsa g
asdf, AD 34215
US
Do they not even try to verify this information?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
And this, dear parents, is why you make an image of your kids computer and just put it back when the computer gets "slow".
It will save you that day of irritation and removing all the junk.
I guess that's worth a few bucks, isn't it?
Privacy is terrorism.
If it was this easy, then all of the crap you've installed would be blocking botnet activity - but it's not. Reality is that botnet activity is obfuscated and buried in normal transactions and behaviors. All the firewalls on the planet cannot stop bot activity no matter what vendor marketing slicks say.
There must be too many bots - I can't even get it to render! All I get is a white page with no nodes and no links :\
;) )
Either that or they've rendered the botnet on a white background in apple white with light grey lines.
(i.e. it seems to be Slashdotted
isn'that the point though? Close off all easy security holes(put some dead bolts on those doors, and poly films to prevent glass breakage) security holes will still exist but will both be harder to take advantage of(robbery at gun pint for keys, social engineering) Or brute forcing passwords.
*nix's aren't hacked very often in mass groups, yet you put a non patched windows system on the net and it will be pwned by the time you can download the security updates.
Lock the windows and force the crackers to find other flaws. let them be your Quality control team, and your consumers are used to being beta testers anyways.
i thought once I was found, but it was only a dream.
And why's this so much news?
Any self-respecting revolutionary knows that you have a distributed network, so that even if a cell goes down, you can still pass messages.
Hell... I wish IRC could learn from this, I've had enough of netsplits. By rights only the server that goes offline should be affected if it goes down, it shouldn't split the network into 2 massive sections.
Yeah the image looks nice, and is all "ooohhhh ahhhh" and lends itself to "Hey... that's me", but really "News"? I think not
Call me when they have an article as to how they got this information
-1 "Cynical Bastard"
I will not give in to the terrorists. I will not become fearful.
...And people say nobody uses IRC anymore.
Spelling mistakes, grammatical errors, and stupid comments are intentional.
Anyone knows if there's a tool to check an IP and see if it's part of a botnet?
I'm not arguing against increased security efforts. I'm just arguing against draconian methods of doing so, on the basis that they may ultimately be ineffective, in the sense that they would not alter the eventual outcome.
Those who advocate genocide deserve every protection afforded by law, and none afforded by common human decency.
That looks alot like the map of our network where I am emplo... oh crap...
Seriously, is it supposed to look like that?
I zoomed in and saw "pimpin.opendns.be" attatched to 1.3.3.7 Has someone been messing with them or something? Anyone else seen any weird ones?
LOL.
I had a computer error. Swear i didn't write it like that.
haha.
To make this truly useful, the addresses should be in a text searchable format. Then, one could truly look for one's own address, or a client's address, or a friends address, or just block email from them, or whatever. This is only eye-candy, and we all know what that is only useful for.
InnerWeb
Freud might say that Intelligent Design is religion's ID.
Wow, I can see my house's IP address from the zoom-out. It looks like a little ant from up here.
Table-ized A.I.
you could hook it up to Google Earth. That would allow Google to do all the pan/joom heavy lifting.
Engineering is the art of compromise.
hacker != blackhat /. we're smarter then this, we not supposed MSM misinformed terminology
... come on, this is
David is lead on the Czech Honeynet Project - http://www.honeynet.cz/?mmenu=home&smenu_int=0&lang=en&vmetr=1
"It doesn't cost enough, and it makes too much sense."
A little off topic, but my use of non-text tools is a bit limited. :) How would one go about mimicing the ability to make that Botnet map?
What those who want activist courts fear is rule by the people.
there hasn't been a *nx monoculture since the 1970's when it was first developed. Even in Linux you have 4-5 major distributions, with different libraries and software versions.
There is no monoculture in *nix. There never really was one.
i thought once I was found, but it was only a dream.
Actually the vast majority of botnet infections right spread by e-mail trojans and drive-by installs. These are not problems firewalls are meant to address. For the latter, you can sandbox your browser or at least keep your patches up to date. For the former, we expect people not to be idiots.
So, in reality, what you should say is that all the security advice on the planet cannot stop bot activity, no matter how smart people claim to be.
Wow, uhm...
... How much RAM do you have that the loading of the ASCII-encoded file is a serious difficulty?
0.0.0.0 is smaller in RAM than 127.0.0.1 because the numbers look smaller?