Moving Ahead in the War Against Botnets

Use Netsparker


This effort started quite a long time ago, I was just checking up to see how they were getting on, but there’s not much news of their progress.

perating under the theory that if you kill the head, the body will follow, a group of high-profile security researchers is ramping up efforts to find and disable the command-and-control infrastructure that powers millions of zombie drone machines, or bots, hijacked by malicious hackers.

The idea is to open up a new reporting mechanism for ISPs and IT administrators to report botnet activity, especially the C&C (command-and-control) system that remotely sends instructions to botnets.

A botnet, which is short for “robot network,” is a collection of broadband-enabled computers that have been commandeered by hackers for use in spam runs, distributed denial-of-service attacks or malware installation.

Botnets are often used in script kiddy DDoS wars or more commonly nowadays for Eastern block extortion scandals. “Pay us $xxxx or we will take down your site” this of course is especially effective against sites such as online Casinos which do their business solely through their websites.

Evron, who serves as the Israeli CERT manager and is a leader in many global Internet security efforts, said the group includes representatives from anti-virus vendors, ISPs, law enforcement, educational institutions and dynamic DNS providers internationally.

Over the last year, the group has done its work quietly on closed, invite-only mailing lists. Now, Evron has launched a public, open mailing list to enlist the general public to help report botnet C&C servers.

The new mailing list will serve as a place to discuss detection techniques, report botnets, pass information to the relevant private groups and automatically notify the relevant ISPs of command-and-control sightings.

It is true hackers code for cash nowdays, not for anarchy or chaos, money can be made being an online hitman and extortion has moved from physical beatings to online terrorism.

Websense’s Hubbard agrees there’s no silver bullet to solve the problem. “We’re seeing a major crossover,” he said. “Bots are now coming with keyloggers. We’re seeing botnets being used in conjunction with phishing attacks. The effort has to get buy-in from everyone, including law enforcement authorities, ISPs, dynamic DNS providers and the general public.

“I don’t think we’ll ever shut down botnets. The problem is just going to change with time,” Hubbard added. “The techniques are becoming better and more sophisticated as we come out with new defense techniques. We’re just trying to slow them down, really.”

I do agree, but it’s good to see efforts being made, the main counter of course is always education, remove the ignorance of PC owners and OS developers and there will be no botnets any more..but well that would be an ideal world wouldn’t it?

Botnets mailing list

Darknet also reported on Shadowserver Battling the Botnets.

Source: Eweek

Posted in: Countermeasures, Malware

, , , , , , ,


Latest Posts:


SCADA Hacking - Industrial Systems Woefully Insecure SCADA Hacking – Industrial Systems Woefully Insecure
airgeddon - Wireless Security Auditing Script airgeddon – Wireless Security Auditing Script
Airgeddon is a Bash powered multi-use Wireless Security Auditing Script for Linux systems with an extremely extensive feature list.
Acunetix v12 - Pause & Resume Acunetix v12 – More Comprehensive More Accurate & 2x Faster
Acunetix, the pioneer in automated web application security software, has announced the release of Acunetix v12 - more comprehensive, accurate & 2x faster.
CloudFrunt - Identify Misconfigured CloudFront Domains CloudFrunt – Identify Misconfigured CloudFront Domains
CloudFrunt is a Python-based tool for identifying misconfigured CloudFront domains, it uses DNS and looks for CNAMEs which may be allowed to be associated with CloudFront distributions.
Airbash - Fully Automated WPA PSK Handshake Capture Script Airbash – Fully Automated WPA PSK Handshake Capture Script
Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing, it is compatible with Bash and Android Shell.
XXEinjector - Automatic XXE Injection Tool For Exploitation XXEinjector – Automatic XXE Injection Tool For Exploitation
XXEinjector is an XXE Injection Tool that automates retrieving files using direct and out of band methods. Directory listing only works in Java applications.


Comments are closed.