Slashdot Mirror
Botnet Expert Wants 'Special Ops' Security Teams
CWmike writes "Criminal cybergangs must be harried, hounded and hunted until they're driven out of business, a noted botnet researcher said as he prepared to pitch a new anti-malware strategy at the RSA Conference in SF. 'We need a new approach to fighting cybercrime,' said Joe Stewart, director of SecureWorks' counterthreat unit. 'What we're doing now is not making a significant dent.' He said teams of paid security researchers should set up like a police department's major crimes unit or a military special operations team, perhaps infiltrating the botnet group and employing a spectrum of disruptive tactics. Stewart cited last November's takedown of McColo as one success story. Another is the Conficker Working Group. 'Criminals are operating with the same risk-effort-reward model of legitimate businesses,' said Stewart. 'If we really want to dissuade them, we have to attack all three of those. Only then can we disrupt their business.'"
Teach users to be safe on the internet and not download any old thing that pops up on the screen... seems cheaper and easier than waging an all out witch hunt on botnet admins.
Crackin' Wise - Blogging about whatever we want
A bunch of fat, cheetos eating super hero's I can identify with!
The musings of just another geek and his junk.
they need cooperation of ISPs. If only ISPs worldwide would at least send warning to customers that run 'zombie machines'.
-- Requiring ISPs to send out warnings to zombie machines would help, but I'm not sure if I'd like to give them the opportunity to use packet inspection on my connection to verify the nature of the traffic. That's a slippery slope.
-- How does the Internet Police cross international boundaries in a legal fashion? A Status of Forces Agreement, perhaps? Would England really like Argentina (for example) to shut customers off because they're supporting a botnet?
-- What enforcement tools would be utilized to force people to use anti-virus/malware programs? What are the consequences for the user if they choose not to? There's quite simply too many potholes for a one-nation or government solution, I think. I can't think of a country that's fixed all of their own individual problems, much less open up an Internets Po-Po division to take care of a global problem as well.
I'd call that a abject failure, a speed bump at best. It was a temporary takedown that was reinstated long enough for the baddies to copy all of their goods off to another site and reset the command and control to point to that other site.
If user education was going to work, it would have worked by now.
~ Anti-virus researcher Vesselin Bontchev
Stewart... acknowledged he doesn't have all the answers. "I'm more of an idea guy."
Thanks for the idea! Because nobody has thought of this before. Congrats on the ComputerWorld article, though.
By necessity, the work would have to be done in secret, so as to not alert hackers that a group is on their trail.
But... you just published your idea to the world.
Stewart declined to comment on whether there were teams organized along the lines he suggests already in operation. "I don't want to comment on ones that have or have not started," he said.
So... this may or may not be your own original idea, because there may or may not be teams like this already in existence?
Liberal? Conservative? Compare perspectives at Left-Right
When the researchers came for the malware authors,
I remained silent;
I was not a malware author.
Then they locked down the adult sites,
I remained silent;
I was not a pervert.
Then they came for the bittorrent trackers,
I did not speak out;
I was not a pirate.
Then they came for the internet,
I did not speak out;
I was not a blogger.
When they came for me,
there was no where left to speak out.
Domestic spying is now "Benign Information Gathering"
Most hacker groups I have seen are set up in such a way where no one needs to trust anyone else. Status is based on what you contribute to the group, so if someone doesn't contribute much, they no longer get access to the work of the collective.
For someone to "infiltrate" a group, all they need to do is contribute to the work being done, and I highly doubt IRC logs will be very admissible as evidence.
My point is, if someone is going to get to the level where they can put anyone of any importance in jail, they are first going to need to contribute a significant amount to the underground community, which would probably cause more problems than it would solve.
There is no crime if nobody got hurt in the real life. There is (or should not be) any such thing as cyber-murder, cyber-theft, cyber-kidnapping etc, simply because everything that's "cyber" is "information", and information, by definition cannot be murdered, stolen or kidnapped.
Are you serious?
This isn't about virtual murder. It's about botnets that may steal your credit card information, be directed to launch attacks against servers, etc. There is significant potential for financial harm. Suppose your credit lines were maxed out by someone else, rendering your payments late, and then your bank got DoS'd so you couldn't access your money? What if you lived in Estonia, whose governmentand banks were essentially shut down during a massive cyberattack?
Liberal? Conservative? Compare perspectives at Left-Right
There are several posts advocating larger ISP involvement and nobody has mentioned the obvious slippery slope with ISP's being put into a "policing" role.
If ISPs are allowed to "track down" botnets and botnet zombies, then why can't they "track down" torrents? Or porn? or any other thing that the powers-that-be don't want you downloading? Am I the only one who sees major problems with ISP's being put in a watchdog role?
I can't believe nobody has brought this up. Am I in the right place? Is this slashdot?
Googling for conficker gave me wikipedia's entry
http://en.wikipedia.org/wiki/Conficker
Looking through conficker's entry gave me the vector MS08-067
Googling for the vector gave me this article
http://www.phreedom.org/blog/2008/decompiling-ms08-067/
Is it that win32 lack a high-quality, well-tested, easily reusable path class, or is it that microsoft is such a large company that a rogue programmer circumventing the approved safe path class and engaging in not-invented-here-roll-your-own antics is commonplace?