Botnets are indeed a growing problem, we’ve seen serious cases of DDoS extortion, the most recent example would be the attacks against the ‘million dollar homepage’ and the problems it caused the owner.
Botnets have been used for quite some time as spam networks and mostly for script kiddies to have DoS wars on IRC networks, but now they have released they can go back to the old mafia tactics of protection money and make a few bucks from it.
Botnets are the workhorses of most online criminal enterprises today, allowing hackers to ply their trade anonymously — sending spam, sowing infected PCs with adware from companies that pay for each installation, or hosting fraudulent e-commerce and banking Web sites.
As the profit motive for creating botnets has grown, so has the number of bot-infected PCs. David Dagon, a Ph.D. student at Georgia Tech who has spent several years charting the global spread of botnets, estimates that in the 13-month period ending in January, more than 13 million PCs around the world were infected with malicious code that turned them into bots.
Shadowserver is an effort to take out these botnets, they are made up of volunteers with some experience in computer security and have the thankless job of informing ISPs of infected machines and getting them to deny access.
Even after the Shadowserver crew has convinced an ISP to shut down a botmaster’s command-and-control channel, most of the bots will remain infected. Like lost sheep without a shepherd, the drones will continually try to reconnect to the hacker’s control server, unaware that it no longer exists. In some cases, Albright said, a botmaster who has been cut off from his command-and-control center will simply wait a few days or weeks, then re-register the domain and reclaim stranded bots.
That’s the problem, even after they have shut them down, they can spring up again in a few days. There are so many unprotected Windows machines, it’s an uphill battle..
Shadowserver is using some kind of custom Honeynet to collect samples of the Bot seeding malware and examine it using reverse engineering techniques.
I predict it will get worse and as more machines from developing nations come online (using outdated and pirated copies of Windows) more more and vulnerable machines will be available to these ‘bot herders’…
Recent media attention to the Shadowserver project has generated interest among a new crop of volunteers eager to deploy honeynet sensors and contribute to the effort. Albright says he’ll take all the help he can get, but he worries that the next few years will bring even more numerous and stealthy botnets.
“Even with all the sensors we have in place now, we’re still catching around 20 new unknown [bot programs] per week,” he said. “Once we get more sensors that number will probably double.”
It’s only going to get worse.
Source: Washington Post
- WAF-FLE – Graphical ModSecurity Console Dashboard
- LOKI – Indicators Of Compromise Scanner
- Integrit – File Verification System
- Bot Infections Surges to 1.2 Million
- Moving Ahead in the War Against Botnets
- Productive Botnets
Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 119,811 views
- Password Hasher Firefox Extension - 117,560 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,653 views