Slashdot Mirror
Botnet Expert Wants 'Special Ops' Security Teams
CWmike writes "Criminal cybergangs must be harried, hounded and hunted until they're driven out of business, a noted botnet researcher said as he prepared to pitch a new anti-malware strategy at the RSA Conference in SF. 'We need a new approach to fighting cybercrime,' said Joe Stewart, director of SecureWorks' counterthreat unit. 'What we're doing now is not making a significant dent.' He said teams of paid security researchers should set up like a police department's major crimes unit or a military special operations team, perhaps infiltrating the botnet group and employing a spectrum of disruptive tactics. Stewart cited last November's takedown of McColo as one success story. Another is the Conficker Working Group. 'Criminals are operating with the same risk-effort-reward model of legitimate businesses,' said Stewart. 'If we really want to dissuade them, we have to attack all three of those. Only then can we disrupt their business.'"
A bunch of fat, cheetos eating super hero's I can identify with!
The musings of just another geek and his junk.
This still doesn't address drive by exploits, XSS, SQL injections, or any number of other threats. That being said, vigilantism isn't the approach either. You have to get countries and governments on board, with treaties signed and all that jazz.
-- Requiring ISPs to send out warnings to zombie machines would help, but I'm not sure if I'd like to give them the opportunity to use packet inspection on my connection to verify the nature of the traffic. That's a slippery slope.
-- How does the Internet Police cross international boundaries in a legal fashion? A Status of Forces Agreement, perhaps? Would England really like Argentina (for example) to shut customers off because they're supporting a botnet?
-- What enforcement tools would be utilized to force people to use anti-virus/malware programs? What are the consequences for the user if they choose not to? There's quite simply too many potholes for a one-nation or government solution, I think. I can't think of a country that's fixed all of their own individual problems, much less open up an Internets Po-Po division to take care of a global problem as well.
If they start doing that, then botnet writers will have an incentive to have their rootkits start deleting emails (when a common email program loads up). I don't think they'll be that choosy about what they delete either.
I'd call that a abject failure, a speed bump at best. It was a temporary takedown that was reinstated long enough for the baddies to copy all of their goods off to another site and reset the command and control to point to that other site.
We get Dick Cheney to run the computer security task force, give him no oversight and a redacted budget. Then tell him there's oil in the Internet.
I guarantee, all your regulatory problems will mysteriously vanish, just like all of the(*)#(*)@R_ *CARRIER LOST*
I don't believe in time. It's a grand conspiracy designed to sell watches.
If user education was going to work, it would have worked by now.
~ Anti-virus researcher Vesselin Bontchev
Stewart... acknowledged he doesn't have all the answers. "I'm more of an idea guy."
Thanks for the idea! Because nobody has thought of this before. Congrats on the ComputerWorld article, though.
By necessity, the work would have to be done in secret, so as to not alert hackers that a group is on their trail.
But... you just published your idea to the world.
Stewart declined to comment on whether there were teams organized along the lines he suggests already in operation. "I don't want to comment on ones that have or have not started," he said.
So... this may or may not be your own original idea, because there may or may not be teams like this already in existence?
Liberal? Conservative? Compare perspectives at Left-Right
Any solution that relies on people not being lazy morons is never going to work.
If they start doing that, then botnet writers will have an incentive to have their rootkits start deleting emails (when a common email program loads up). I don't think they'll be that choosy about what they delete either.
Sending warning emails to users is a pointless exercise. Assuming that they read/understand the email in the first place (BIG assumption), I guarantee that the majority of them will just delete it. Why should they care if their computer's a zombie? It still works well enough to do whatever it is they're online to do.
No, I think the solution is for zombied computers to be quarantined. Use DNS and routing tricks to redirect any attempts to go anywhere "on the internets" (i.e. a web browser) to a site which explains that they're quarantined, and what they have to do to get out.
Unfortunately, that would raise call volumes to the ISP support lines, and require commitment on the ISPs' part to train their support monkeys. If ISPs started facing financial penalties for zombied users, then maybe the economics would balance out.
I'm sure I'm not the first person to think of this, though, so I'm probably missing something.
A host is a host from coast to coast...
Unless it's down, or slow, or fails to POST!
There are several posts advocating larger ISP involvement and nobody has mentioned the obvious slippery slope with ISP's being put into a "policing" role.
If ISPs are allowed to "track down" botnets and botnet zombies, then why can't they "track down" torrents? Or porn? or any other thing that the powers-that-be don't want you downloading? Am I the only one who sees major problems with ISP's being put in a watchdog role?
I can't believe nobody has brought this up. Am I in the right place? Is this slashdot?