Moving Ahead in the War Against Botnets


This effort started quite a long time ago, I was just checking up to see how they were getting on, but there’s not much news of their progress.

perating under the theory that if you kill the head, the body will follow, a group of high-profile security researchers is ramping up efforts to find and disable the command-and-control infrastructure that powers millions of zombie drone machines, or bots, hijacked by malicious hackers.

The idea is to open up a new reporting mechanism for ISPs and IT administrators to report botnet activity, especially the C&C (command-and-control) system that remotely sends instructions to botnets.

A botnet, which is short for “robot network,” is a collection of broadband-enabled computers that have been commandeered by hackers for use in spam runs, distributed denial-of-service attacks or malware installation.

Botnets are often used in script kiddy DDoS wars or more commonly nowadays for Eastern block extortion scandals. “Pay us $xxxx or we will take down your site” this of course is especially effective against sites such as online Casinos which do their business solely through their websites.

Evron, who serves as the Israeli CERT manager and is a leader in many global Internet security efforts, said the group includes representatives from anti-virus vendors, ISPs, law enforcement, educational institutions and dynamic DNS providers internationally.

Over the last year, the group has done its work quietly on closed, invite-only mailing lists. Now, Evron has launched a public, open mailing list to enlist the general public to help report botnet C&C servers.

The new mailing list will serve as a place to discuss detection techniques, report botnets, pass information to the relevant private groups and automatically notify the relevant ISPs of command-and-control sightings.

It is true hackers code for cash nowdays, not for anarchy or chaos, money can be made being an online hitman and extortion has moved from physical beatings to online terrorism.

Websense’s Hubbard agrees there’s no silver bullet to solve the problem. “We’re seeing a major crossover,” he said. “Bots are now coming with keyloggers. We’re seeing botnets being used in conjunction with phishing attacks. The effort has to get buy-in from everyone, including law enforcement authorities, ISPs, dynamic DNS providers and the general public.

“I don’t think we’ll ever shut down botnets. The problem is just going to change with time,” Hubbard added. “The techniques are becoming better and more sophisticated as we come out with new defense techniques. We’re just trying to slow them down, really.”

I do agree, but it’s good to see efforts being made, the main counter of course is always education, remove the ignorance of PC owners and OS developers and there will be no botnets any more..but well that would be an ideal world wouldn’t it?

Botnets mailing list

Darknet also reported on Shadowserver Battling the Botnets.

Source: Eweek

Posted in: Countermeasures, Malware

, , , , , , ,


Latest Posts:


GKE Auditor - Detect Google Kubernetes Engine Misconfigurations GKE Auditor – Detect Google Kubernetes Engine Misconfigurations
GKE Auditor is a Java-based tool to detect Google Kubernetes Engine misconfigurations, it aims to help security & dev teams streamline the configuration process
zANTI - Android Wireless Hacking Tool Free Download zANTI – Android Wireless Hacking Tool Free Download
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using mobile.
HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
trape - OSINT Analysis Tool For People Tracking Trape – OSINT Analysis Tool For People Tracking
Trape is an OSINT analysis tool, which allows people to track and execute intelligent social engineering attacks in real-time.
Fuzzilli - JavaScript Engine Fuzzing Library Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.
OWASP APICheck - HTTP API DevSecOps Toolset OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties.


Comments are closed.