Slashdot Mirror
Rise of the Small Botnet
wiredmikey writes "Botnets controlled by criminal enterprises all over the world continue to multiply at a steep rate, and it is now arguably the smaller, harder-to-trace operations that organizations should be the most worried about. Not only are smaller botnets cheaper and easier to build out and operate, but criminals have already realized that large-scale botnet activity attracts unwanted attention, and not just of law enforcement."
It's just like Arnold, except with a high squeaky voice. Sort of like Urkel.
Um - detectable depending on what they want to access. I've deployed a daily login attempt/file access logarithm that will alert me to any intrusion attempt - it doesn't really matter to me how many other servers the intruder attempts to intrude; in fact, I don't even look.
No, no sig. Really.
ThePromenader
Why invest in cloud computing when you can get a botnet for free?
"The ability of defenders to thwart these attacks by over-provisioning their networks does not increase proportionally with the disruptive power of botnet-driven DDoS attacks, which will grow as more Internet users come online in developing nations and fast broadband connections become available more cheaply to home users that are less educated in proper security behavior."
It seems that by now, people should be MORE educated about security and not less...but oh well.
He who knows best knows how little he knows. - Thomas Jefferson
If a botnet is small doesn't it contradict the very idea of a botnet? I mean it seriously limits its uses.
From other story: I wonder how many unidentified large botnets remain out there.
I know for a fact that Linux boxes, especially servers on the net, get compromised and used by criminals from unknown locations on the planet. But botnets are made almost entirely of PCs running Microsoft Windows. Whether it is the OS or the apps running on it or both are the ultimate cause, it all has MS Windows in common.
All this botnet crap going on all over the planet could be halted in very short order if Microsoft would "man up" and do something about it. With every new release of an OS, it makes a choice and every time it has chosen to maintain the old ways instead of fixing the problems. Perhaps my perspective on this is a little wrong. I have not yet, for example, seen a compromised Windows 7 machine. (That's not because they can't be, it's simply because I haven't seen one yet and a lot of people don't want to use Windows 7.)
If I was in control of a beef company and the bovine products I was distributing was tied to global illness and crap like that, there would be no end to the complaints and measures taken against me. But somehow, the world hasn't managed to point enough fingers at Microsoft demanding that they do something about the problem. The only finger pointers are pretty much the IT crowd and no one listens to us. It is fascinating to me because the problems with compromised Windows machines has massive economic effect which, as we all know, is far more important than global health and general public safety.
If you think that's bad, just wait until the self-aware temporary infection botnets come out.
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
To really do damage to a webserver, you need a large botnet.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Organizations shouldn't be worried about small botnets simply because they haven't attracted the attention of law enforcement -- they should be afraid because their antivirus won't have a signature for the malware being propogated by small botnets. And what's the point of advising organizations to be worried about small botnets? Fear doesn't increase security.
For some of the botnet activities, size matters. If want to steal cc numbers or passwords, being in more places mean more chances to get something useful. Other common use of botnets is sending spam, where more machines=better (harder to block because the numbers, and less chances to fill the bandwidth of those computers, and be noticed because that, if want to send a lot of spam).
Instead of just going small, there are 2 tactics that could be used by botnets: try being more stealth (i.e. sending out information only when the user does), or resizing by quality of the machines they run on (i.e. stay active only in machines where actually they are putting credit card info, or their spam is not being bounced, or having better bandwidth)
I had a heated debate once with a colleague, about how botnets operate, and he was under the impression they were all script kiddies with no morals, and just wanted to thrash all websites and infect everyone.... I tired to let him know, they were people (higher ups) with organization skills of real companies, with real business sense, using techniques to covertly avoid detection. I even heard of one botnet that would send out a few emails from each computer a minute, not more....to avoid sending up flags that 1 million emails in an hour would set off....and then there was that one that would cycle between computers in the botnet to send off mail, so that the ip address changed each time based on where the email was coming from....so you could get 300 emails all from diff. addresses not to send off a flag, so that one company with 300 employees would all get spammed.
These guys are nasty tacticians, and really only want the best way to stay in the game, even if it means uninstalling themselves for a few days, with a script that will send the computer back to a website with a payload to redownload and reinfect. This one no one believes, but I saw it....with my own eyes, and could not believe that 3 days later it was back, although it had not uninstalled itself because of me, it must have been a command from a CC.
If the botnet is for churning out large volumes of spam then a large, distributed net is better. Traffic will be lower at any one node for the same total volume. If the botnet is to be used for targeting specific installations or types of installations (ala Stuxnet) then smaller is better. The more infected nodes you operate, the greater the likelihood of detection.
Have gnu, will travel.
The biggest problem has always been - and will continue to be - ignorant or uncaring users.
Isn't that why the BOFH rules with an iron fist?
The word you're looking for is "algorithm". A "logarithm" is a number that you get by taking the exponent of a number from a certain base. For example the "common" (base 10) logarithm of 1000 is 3. What your machine is doing has nothing to do with this.
How do we know the criminals haven't just gone bigger scale? Why settle for a giant botnet when you can run a botnet full of tiny botnets? Is the attention attracted from seeing the same code on thousands of machines, or from seeing the same attack from thousands of machines? Why run DDoS attacks when you can run multiple exploit attacks instead on multiple networks to throw off any sign of a large coordinated attack?
I repair (primarily remove infections these days) computers at our family run business. About ten percent of the Windows boxes we get in are Windows 7 infected with one or more rogue programs. No Windows version is immune to infection. No OS is immune for that matter.
Where is the latest pastebin for conjob algorithms?
Build your own energy sources from scratch. http://otherpower.com/
Instructions for Linux, but can be modified to suit *BSD, some other OSes. Remember, with firewalls fascism is good.
1. install and configure denyhosts http://denyhosts.sourceforge.net/
2. use the reporting/updating feature of denyhosts to coordinate and sync botnet-dropping with other denyhosts users
3. write a script or daemon that checks for updates to denyhost's hosts-restricted file and then tells your iptables firewall to drop all packets to and from those hosts
Example of iptables firewall config file with blacklists:
# Blacklisted IP addresses: uses output of denyhosts daemon /var/lib/denyhosts/hosts-restricted|awk -F ":" '{print $1}')
#
# RESERVED_HOST=$(cat
#
# Blacklisted subnets: place banned subnets here
#
RESERVED_NET=" "
#
# Prevent packets sent to unassignable and blacklisted subnets from
# leaving the firewall (see Blacklist above)
#
$IPTABLES -N SRC_EGRESS
$IPTABLES -F SRC_EGRESS
$IPTABLES -A SRC_EGRESS -s 10.0.0.0/8 -j DROP
$IPTABLES -A SRC_EGRESS -s 172.16.0.0/12 -j DROP
$IPTABLES -A SRC_EGRESS -s 192.168.0.0/16 -j DROP
$IPTABLES -A SRC_EGRESS -s 224.0.0.0/4 -j DROP
$IPTABLES -A SRC_EGRESS -s 240.0.0.0/5 -j DROP
for NET in $RESERVED_NET
do
$IPTABLES -A SRC_EGRESS -s $NET -j DROP
done
$IPTABLES -N DST_EGRESS
$IPTABLES -F DST_EGRESS
$IPTABLES -A DST_EGRESS -d 10.0.0.0/8 -j DROP
$IPTABLES -A DST_EGRESS -d 172.16.0.0/12 -j DROP
$IPTABLES -A DST_EGRESS -d 192.168.0.0/16 -j DROP
$IPTABLES -A DST_EGRESS -d 224.0.0.0/4 -j DROP
$IPTABLES -A DST_EGRESS -d 240.0.0.0/5 -j DROP
for NET in $RESERVED_NET
do
$IPTABLES -A DST_EGRESS -d $NET -j DROP
done
# Prevent packets sent to or from blacklisted hosts from
# entering or leaving the firewall (see Blacklist above)
#
for HOST in $RESERVED_HOST
do
$IPTABLES -I INPUT -s $HOST -j DROP
$IPTABLES -A SRC_EGRESS -s $HOST -j DROP
$IPTABLES -A DST_EGRESS -d $HOST -j DROP
done
I deny that I have not avoided attaining the opposite of that which I do not want.
Of course this assumes that the botnet attack is a standard SSH-based one. Also the # RESERVED_HOST=$(cat /var/lib/denyhosts/hosts-restricted|awk -F ":" '{print $1}') line needs to be uncommented.
I deny that I have not avoided attaining the opposite of that which I do not want.
Does anyone know where the download is for Denyhosts v2.7? This is listed in the changelog for Deny Hosts, but SourceForge only has v2.6 available for download, which I believe still has a minor log injection DoS exploit.
Couldn't it be possible to have a botnet upgrade into different versions, allowing it to split?
Clarification:
Virus writer releases virus A and sets up control server A.
Botnet A gets large, and the writer is worried about authorities, so he sets up servers B and C, as well as writing two updates.
Botnet A gets update B or update C from control server A.
The update installs the new virus and removes the old one.
Botnet B gets large, virus writter sets up servers D and F.
Process continues.
If it's split before the AVs pay any considerable attention(or if you split enough to confuse them), a writer could write a fast spreading botnet, without having to worry about it getting too large.
I would imagine that setting up new servers and updates might be a hassle though.