Feeds

Zombie tactics threaten to poison honeypots

Hive minds vs bot herders

The essential guide to IT transformation

Innovations in botnet technology threaten the usefulness of honeypots, one of the main ways to study how bot herders control networks of zombie PCs.

Computer scientists led by Cliff Zou and colleagues at the University of Central Florida warn that bot herders can now avoid honeypots - unprotected computers outfitted with monitoring software - set up by security firms.

Ethical concerns mean that security firms do not allow their infrastructure to be used in sending spam or running attacks against victims. By monitoring such instructions it's therefore possible for cybercrooks to program command and control servers to disable or simply ignore these machines, thus depriving security firms of vital intelligence in how zombie botnets are operating in the real world.

Zou and his team are working on techniques to make stealthier honeypot traps to trick bot herders. "Honeypot research and deployment still has significant value for the security community, but we hope this paper will remind honeypot researchers of the importance of studying ways to build covert honeypots, and the limitation in deploying honeypots in security defence," Zou said. "But all that effort will be for naught if honeypots remain as easily detectable as they are presently."

Preliminary findings from the Florida team's research were published in a recent edition of the International Journal of Information and Computer Security, as explained here.

Security and anti-virus firms say that the problem is already on their agenda.

Luis Corrons, PandaLabs technical director at Spanish anti-virus firm Panda Security, explained: "While you can and must filter the traffic generated by the bot inside a honeypot, you can filter and decide what will go out, and what does not. For example, if the bot herder is telling the bot to send spam, you can let the bot receive all the information, and even let him send out the spam messages but redirect them with a proxy to avoid it reaching any victims.

If the bot then contacts the Command and Control server to say the messages have been sent, you can let that info pass through, so the bot herder will think everything works fine.

There are some other ideas the bot herder could take, such as being one of the recipients to check that the spam is really being sent. In this case, there’s little that can be done from our side, as we won’t participate in letting threats spread.

Amichai Shulman, CTO at database security firm Imperva, suggested that rather than monitoring the behaviour of infected machines miscreants could instead attempt to identify virtual machines. "Most honeypot machines are based on a virtualisation platform (most often VMWare). By detecting this attribute of the infected platform, malware developers will probably be able to detect most honeypots out there,” he said.

While conceding that building a honeypot is tricky Shulman suggested a number of approaches designed to camouflage such systems from the eyes of cybercrooks:

Many Honeypot researchers are contemplating on the question of how to impersonate infected behaviour while not taking part in any evil, destructive activity.

I do think however that the problem described by the researchers is much exaggerated. There are many techniques that Honeypot developers employ that would make it very difficult for the malware / botnet to detect honeypot behaviour. Some examples include unlimited outbound communications for a relatively short period of time, deflecting outbound communications to known attack targets, outbound bandwidth control and outbound signature detection.

Most often the time of infection and the time when a recruited zombie becomes maliciously active are far apart, thus there is no need to immediately shutdown any outbound communications of the infected computer upon infection.

®

Next gen security for virtualised datacentres

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?