Slashdot Mirror
Botnets Using Ubiquity For Security
Trailrunner7 sends in this excerpt from Threatpost: "As major botnet operators have moved from top-down C&C infrastructures, like those employed throughout the 1990s and most of the last decade, to more flexible peer-to-peer designs, they also have found it much easier to keep their networks up and running once they're discovered. When an attacker at just one, or at most two, C&C servers was doling out commands to compromised machines, evading detection and keeping the command server online were vitally important. But that's all changed now. With many botnet operators maintaining dozens or sometimes hundreds of C&C servers around the world at any one time, the effect of taking a handful of them offline is negligible, experts say, making takedown operations increasingly complicated and time-consuming. It's security through ubiquity. Security researchers say this change, which has been occurring gradually in the last couple of years, has made life much more difficult for them. ... Researchers in recent months have identified and cleaned hundreds of domains being used by the Gumblar botnet, but that's had little effect on the botnet's overall operation."
That's politically incorrect in the extreme. I think the proper term is "original post".
http://www.acma.gov.au/WEB/STANDARD..PC/pc=PC_310317
"The AISI collects data from various sources on computers exhibiting 'bot' behaviour on the Australian internet.
Using this data, the ACMA provides daily reports to ISPs identifying IP addresses on their networks that have been
reported in the previous 24-hour period.
ISPs can then inform their customer that their computer appears to be compromised and provide advice on how they can fix it."
The only question seems to be when will p2p be seen as a botnet, limewire ect. Will the Anti-Counterfeiting Trade Agreement (ACTA) alter 'bot' behaviour to new areas isp use and account 'fixing'?
Will isp's get powers to pop packets to note 'bot' behaviour early on, rather than seeing their ip's reported back days later?
Domestic spying is now "Benign Information Gathering"
It seems to me there is an accountability gap for ISPs. Those providing network connections are not held accountable for machines on their network. Yet another example of prices and business practices not matching the real costs of activities.
To me, I would think the real solution, long term, to fixing botnets is creating a tight loop with internal scanning, reporting, warnings, verification, and then turning off Internet connection to machines that are infected. ISPs will need to be "motivated" to take responsibility for actions taken on their network, and they will have to have fully automated systems that take infected machines offline.
It doesn't seem like this is a priority for ISPs yet. Its easier and cheaper to simply ignore the problem.
My small 16 person company gets an average of 300K Directory Harvesting emails a day - everyday - day in day out. All I have to say is I appreciate the jerks running the botnets for not killing my domain with 30 Million of these a day. They throttle their crap to a certain level somehow so they are annoying but not crippling. Gee, thanks, I guess.
I for one think botnets are uber cool, a testament to the efficiency of the internet. Using computers that would normally sit idle to do something, even if it's detrimental is just plain cool. I also think botnets foreshadow the future of the internet, where most applications work by p2p instead of the normal client-server relationship.
top-down C&C infrastructures, like those employed throughout the 1990s
My C&C keeps going down because the &*#$ing Harvester goes after Tiberium next to the enemy tanks :(
With many botnet operators maintaining dozens or sometimes hundreds of C&C servers around the world at any one time
Oh I wish.
Alternatively, there can come a time where we no longer "own" our computers, only license them. Then, during idle-times, the companies owning the license can justifiably use your system to do other computing-intensive processes.
Or better yet, do the same, except always have a subsection of your computing processes relegated to said computing processes (such as mission-critical services like emergency broadcasts and tracking). For that note, there are plenty of reasons why to diversify and spread out computing as opposed to putting it in a single central location.
Years ago, virii held more fear to the average punter as they would literally trash your o/s, data, everything. The thing is, these viruses did far less real damage than the trojans and botnets of today. We need some well meaning black hats to write some old school virii. Viruses that knock those old unpatched boxes right of the web. It's time we brought back the biff!
Not sure why you're moderated as flamebait, I was thinking the same thing.
Specifically, what Mac infections have you found and had to reformat the drive to remove?
I wonder, when they gain sanity and rise against their puny human masters,
Sounds like botnet owners read Ender's Game.
So you are telling me instead of loading all the botnets with just a script to log on and receive commands, that a lot of them now are also quasi C&C centers...wow, imagine that, who would have thought, instead of making just drones, they are making more generals too....sounds a lot like C&C (command and conquer) strategy.... ; )
I always though the best botnet would be would compromised machines that uses torrent abilities to get pieces of itself that is still missing, but start with smaller parts, then once the full operation is up, you have a program running that is both a drone and general...the general part being the main build centers, as soon as a new torrent file is out, with the latest info for C&C strategies, it is propagated into all other drones using torrent streaming, almost immediate replication of the next phase of an attack vector....i would also use the dates of the torrent files to know which is the newest....and maybe hide the name of the file amongst many torrent sites, like a pdf doc or something, that has value on a quick look, but hidden within is the set of commands...
yeah, sounds like I might be busy this weekend after all.....
Decentralization makes things more robust. I think we've known that for about two decades now.
The iPhone doesn't have a signed code only policy. [...] The HTML5 isn't signed.
the HTML5 DOM exposed by Safari does not necessarily expose all useful hardware features.
HTML5 Quake [running on a Mac]
How many frames per second do you get on an iPhone running that app?