Slashdot Mirror
Botnets Using Ubiquity For Security
Trailrunner7 sends in this excerpt from Threatpost: "As major botnet operators have moved from top-down C&C infrastructures, like those employed throughout the 1990s and most of the last decade, to more flexible peer-to-peer designs, they also have found it much easier to keep their networks up and running once they're discovered. When an attacker at just one, or at most two, C&C servers was doling out commands to compromised machines, evading detection and keeping the command server online were vitally important. But that's all changed now. With many botnet operators maintaining dozens or sometimes hundreds of C&C servers around the world at any one time, the effect of taking a handful of them offline is negligible, experts say, making takedown operations increasingly complicated and time-consuming. It's security through ubiquity. Security researchers say this change, which has been occurring gradually in the last couple of years, has made life much more difficult for them. ... Researchers in recent months have identified and cleaned hundreds of domains being used by the Gumblar botnet, but that's had little effect on the botnet's overall operation."
I was wondering why a Live CD based version of Ubunutu was helping out Botnets.
https://wiki.ubuntu.com/Ubiquity
http://www.acma.gov.au/WEB/STANDARD..PC/pc=PC_310317
"The AISI collects data from various sources on computers exhibiting 'bot' behaviour on the Australian internet.
Using this data, the ACMA provides daily reports to ISPs identifying IP addresses on their networks that have been
reported in the previous 24-hour period.
ISPs can then inform their customer that their computer appears to be compromised and provide advice on how they can fix it."
The only question seems to be when will p2p be seen as a botnet, limewire ect. Will the Anti-Counterfeiting Trade Agreement (ACTA) alter 'bot' behaviour to new areas isp use and account 'fixing'?
Will isp's get powers to pop packets to note 'bot' behaviour early on, rather than seeing their ip's reported back days later?
Domestic spying is now "Benign Information Gathering"
It seems to me there is an accountability gap for ISPs. Those providing network connections are not held accountable for machines on their network. Yet another example of prices and business practices not matching the real costs of activities.
To me, I would think the real solution, long term, to fixing botnets is creating a tight loop with internal scanning, reporting, warnings, verification, and then turning off Internet connection to machines that are infected. ISPs will need to be "motivated" to take responsibility for actions taken on their network, and they will have to have fully automated systems that take infected machines offline.
It doesn't seem like this is a priority for ISPs yet. Its easier and cheaper to simply ignore the problem.
My small 16 person company gets an average of 300K Directory Harvesting emails a day - everyday - day in day out. All I have to say is I appreciate the jerks running the botnets for not killing my domain with 30 Million of these a day. They throttle their crap to a certain level somehow so they are annoying but not crippling. Gee, thanks, I guess.
I for one think botnets are uber cool, a testament to the efficiency of the internet. Using computers that would normally sit idle to do something, even if it's detrimental is just plain cool. I also think botnets foreshadow the future of the internet, where most applications work by p2p instead of the normal client-server relationship.
Sadly no.
It turns out even botnetters haven't yet figured out a good use for Mozilla's Ubiquity extension.
It's hopeless to think MS will one day provide an OS that won't be zero-day exploited when IE 19 's HTML8 bold tag is found to allow a buffer overrun so the solution lies elsewhere...
Once the impact on the economy shall be too important (it really ain't today: the world is pretty much running fine, despites the hundreds of millions of bots/zombies) the solution will be at the ISP level.
Machine found to be part of a botnet -> a unique webpage explaining why your system cannot access the Internet anymore.
Apple will like this day, because quite some people will dump their PC and buy Macs ;)
top-down C&C infrastructures, like those employed throughout the 1990s
My C&C keeps going down because the &*#$ing Harvester goes after Tiberium next to the enemy tanks :(
With many botnet operators maintaining dozens or sometimes hundreds of C&C servers around the world at any one time
Oh I wish.
P2P botnets have been around for a while.
your comment is pretty much the most retarded thing I've read all day on slashdot. congrats.
Its only cool if you make a conscious, informed decision to allow your "idle computing time" to be made available for other purposes. A hijacked computer, being used for detrimental purposes isn't cool, its just criminal activity on the part of the hijackers.
I fear botnets forshadow the end of the Internet as we know it.
I do NOT welcome our botnet overlords!
Alternatively, there can come a time where we no longer "own" our computers, only license them. Then, during idle-times, the companies owning the license can justifiably use your system to do other computing-intensive processes.
Or better yet, do the same, except always have a subsection of your computing processes relegated to said computing processes (such as mission-critical services like emergency broadcasts and tracking). For that note, there are plenty of reasons why to diversify and spread out computing as opposed to putting it in a single central location.
Years ago, virii held more fear to the average punter as they would literally trash your o/s, data, everything. The thing is, these viruses did far less real damage than the trojans and botnets of today. We need some well meaning black hats to write some old school virii. Viruses that knock those old unpatched boxes right of the web. It's time we brought back the biff!
Specifically, what Mac infections have you found and had to reformat the drive to remove?
I wonder, when they gain sanity and rise against their puny human masters,
Sounds like botnet owners read Ender's Game.
So you are telling me instead of loading all the botnets with just a script to log on and receive commands, that a lot of them now are also quasi C&C centers...wow, imagine that, who would have thought, instead of making just drones, they are making more generals too....sounds a lot like C&C (command and conquer) strategy.... ; )
I always though the best botnet would be would compromised machines that uses torrent abilities to get pieces of itself that is still missing, but start with smaller parts, then once the full operation is up, you have a program running that is both a drone and general...the general part being the main build centers, as soon as a new torrent file is out, with the latest info for C&C strategies, it is propagated into all other drones using torrent streaming, almost immediate replication of the next phase of an attack vector....i would also use the dates of the torrent files to know which is the newest....and maybe hide the name of the file amongst many torrent sites, like a pdf doc or something, that has value on a quick look, but hidden within is the set of commands...
yeah, sounds like I might be busy this weekend after all.....
"One of these days, some victim of a botnet is going to initiate a class action lawsuit against Microsoft for publishing an insecure operating system, with the injured parties being the people whose machines were induced to participate in a tort." - by Russ Nelson (33911) on Tuesday June 08, @12:11AM (#32492314) Homepage
Ok Russ, per what I've quoted from you (seeing as you've been thoroughly "brainwashed" by the "wannabe slashdot samurais" around here on /., which many others know of, even in respected publications such as INFOWORLD here -> http://hardware.slashdot.org/story/10/06/07/1518216/Six-More-Tech-Cults from this week no less)?
Lets review some facts & figures from a respected security vulnerabilities gathering website (SECUNIA.COM) where we can see the number of known security vulnerabilities in each of the major "big 3" OS' in use (Windows 7, Linux 2.6x (kernel only, would be more with say, KDE/Gnome or BA$H security vulnerabilities added mind you), & MacOS X):
---
Linux 2.6x KERNEL SECURITY VULNERABILITIES CURRENTLY AS OF THIS DATE 06/08/2010:
http://secunia.com/advisories/product/2719/?task=advisories
Unpatched 5% (11 of 217 Secunia advisories)
(Additionally, that's JUST THE KERNEL/CORE OF THE LINUX OS ALONE (how much more would be added by diff. distros & their softwares/shells etc.- et al?))
---
APPLE MacOS X SECURITY VULNERABILITIES CURRENTLY AS OF THIS DATE 06/08/2010:
---
http://secunia.com/advisories/product/96/?task=advisories
Unpatched (approximately) 1% (8 of 1233 Secunia advisories)
---
MICROSOFT WINDOWS 7 SECURITY VULNERABILITIES CURRENTLY AS OF THIS DATE 06/08/2010:
---
http://secunia.com/advisories/product/27467/?task=advisories [secunia.com]
Unpatched 13% (2 of 16 Secunia advisories)
REMEMBER/AGAIN: This is the ENTIRETY of Windows 7 being analyzed - not just its kernel, as is the case with Linux 2.6x above... & ONLY 2 security problems are present!
Top that off with the fact that 1 of them IS EASILY "worked-around" no less, in the AERO problem!
The other will also be fixed, most likely, TODAY in FULL, also (as it is "Microsoft 'Patch Tuesday'" & what-not & I wager BOTH of the security vulnerabilities in Windows 7 will be fixed by then (less emphasis on AERO issue though, as it has a valid working safe "work-around" & MS tends to not concentrate on those as much, because they have easy work-arounds (turn off the THEMES service? You turn off AERO GLASS in essence is why, easy & works)))
----
So, we have security vulnerabilities issues in Windows, Linux, AND MacOS X (but, less apparently in the current builds of Windows (7, Server 2008) than there is in Linux OR MacOS X in terms of numbers of security vulnerabilities present!
That also includes the fact that Windows 7 has MORE being checked on too, ala the Windows kernel/core AND ITS OS SHELL in this analysis... not just kernel's like Linux 2.6x shown above!
(Thus again - There is most likely even MORE security holes in Linux, especially if you toss on GUI shells & Windows managers most likely, inclusive of diff. distros variations of both to compound that more).
(Sure, now I am certain I will also see repliers here to my post here say
"but the 2 security vulnerabilities in Windows are 'remote' in nature"
Well, newsflash - ANY OF THESE SECURITY VULNERABILITIES REALLY "BOIL DOWN" TO BEING LOCAL, IN THAT SOONER OR LATER, THEY HAVE TO "TOUCH" THE LOCAL SYSTEM ANYHOW IN ORDER TO EXPLOIT THEM PERIOD!)
---
So, can Windo
Decentralization makes things more robust. I think we've known that for about two decades now.
The iPhone doesn't have a signed code only policy. [...] The HTML5 isn't signed.
the HTML5 DOM exposed by Safari does not necessarily expose all useful hardware features.
HTML5 Quake [running on a Mac]
How many frames per second do you get on an iPhone running that app?
Alternatively, there can come a time where we no longer "own" our computers, only license them. Then, during idle-times, the companies owning the license can justifiably use your system to do other computing-intensive processes.
Or better yet, do the same, except always have a subsection of your computing processes relegated to said computing processes (such as mission-critical services like emergency broadcasts and tracking). For that note, there are plenty of reasons why to diversify and spread out computing as opposed to putting it in a single central location.
That might make sense if the cost of computing infrastructure was going up instead of down. But it's not. As it becomes cheaper for individuals to build/maintain their own infrastructure the likelyhood of total dystopian control decreases (even as it appears to increase as governments et al appear to finally be 'getting it'.)
I'm not saying that there aren't going to be conflicts and subversiveness needed to keep the ways clear, just that it's going to be hard for a society to put a complete choke hold on communication.
In Corporate America, computer owns YOU!