Original URL: http://www.theregister.co.uk/2006/04/20/war_against_botnets/

Stop the bots

Knock 'em off, but do it the right way

By Kelly Martin

Posted in Security, 20th April 2006 10:10 GMT

I found the opening scene to the 1991 movie sequel, Terminator 2, to be one of the most powerful SciFi film openings ever. There's a massive firestorm, chunky metal warriors waging war against humans, and then the camera zooms into a metal robot foot crushing a human skull. It’s very graphic. The world has been taken over by terminator robots, first created by man and now bent on destroying us. It's Skynet. What interested me most about this SciFi classic was how real and plausible this future could be, understanding the dark side of human nature that creates evil and some people's inherent need to cause harm.

It's now 15 years since that movie sequel appeared. In 2006, the most primitive Skynet botnets are already quite powerful, even if they’ve got a long way to go before becoming self aware. Today they're also one of the greatest sources of evil on the internet. They’re strong and growing, although their growth is often proportional to the announcement of new major vulnerabilities and viruses that exploit them. They’re nowhere near as powerful or intelligent as Skynet yet, but give it time. Botnets barely existed just three or four years ago, but they have grown dramatically and are highly flexible in the number of criminal and evil things they can do. In another 15 years, they might be ready.

What is a botnet? Today it's an illegal collection of hundreds, thousands, tens of thousands or even hundreds of thousands of compromised computers all being controlled with a common infrastructure. There's even one case where a real botnet was found with about 1.5m machines under one person's control. Incredible. According to Symantec's latest Internet Threat Report, 26 per cent of all bot-infected computers are also located in the United States - making it the number one source of bots. These are most often home computers with viruses or web servers with buggy software that are compromised and then linked together for evil purposes. They’re usually controlled from a central location as well, providing a single point of failure, but as peer-to-peer botnets are developed, the ability to fight this evil will certainly change.

Spam botnets

I started writing this column on a topic near and dear to everyone’s heart: spam. Three years ago spam was a real nuisance to everyone, but it wasn’t really a security issue - except for email-borne viruses that were starting to use social engineering to convince people to click on them. How things have changed in a few short years.

I first thought about some security issues with email:

There are many more. As I started thinking more and more about spam, my brain itself became a discolored lump of low-quality meat with a jelly-like substance surrounding it. Despite all the hard work and the promising technologies that have gone into fighting spam over the years, there has been no real progress whatsoever.

I started to realise that one big source of the problem is actually the botnets now being used to send out spam. They're the transport (and sometimes hosting) mechanism. Since any computer on the internet is allowed to send mail (1), a botnet is an ideal vehicle for spammers to avoid getting shut down. (1 - Many ISPs now block port 25, which is an excellent trend). You can even rent botnets by the hour for this very purpose. We have to address the botnet issue if we’re ever going to combat spam, phishing scams, and other email-related security issues. Filtering and SPF just isn't going to cut it.

Botnets are a major source of internet evil

Botnets also do much more harm than just send out spam and phishing scams, however. In aggregate they are often used for denial-of-service attacks and extortion against legitimate companies, Google and Yahoo advertising click fraud, and more - such as hosting phishing sites. When the same botnet sends out phishing emails and hosts the phishing site, you’ve got one-stop shopping. The computer hosting the next Citibank or credit union fraud might be tracked down to your Uncle Bob, who just got a new computer for Christmas but he didn't apply all the security patches fast enough.

Botnets received some good coverage in an excellent article in the Washington Post recently (including accidental disclosure of the botnet owner's tiny home town) because their operators can earn significant money when they install sleazy spyware on all the bots under their control. The bot software (usually, a type of Trojan with keylogger capabilities too) often plays a dual role, stealing the unaware user’s passwords, banking information, and credit card numbers. While we think of the danger botnets pose to the Internet as a whole, we must also remember these computers are being used in people’s homes. Therefore we can assume that the software is stealing the user’s private data as well - in addition to his computer’s bandwidth and resources.

There’s no legitimate purpose for a botnet. And they are now an amplifier for much of the evil on the internet. A few of them have been shut down by law enforcement (including the one that was first thought to have a population of 100,000, but actually controlled 1.5m machines!), but most remain. Some have tens or hundreds of thousands of machines under a single person's control. A few of them are being hunted by well-meaning people, but most are unabated. Most people secure their own borders and leave the wild west quite alone. Most people say, "It’s not my problem." Well, it is.

Legal and ethical issues

If you found some Trojan bot software on your parents' computer, stealing their credit card information and distributing viruses, would you just wipe the computer, reinstall, and leave it at that? Has it become your problem yet? Would you analyse the botnet, log in yourself as a bot and see if you can disable its command and control centre? Is there any point in helping thousands of people along the way?

There are clear legal and ethical issues involved in disabling botnets, especially when they involve thousands of machines that span dozens of countries with different legal systems. But doing nothing at all to stop them is worse than trying to help. I think too many people get caught up in the legal side of fighting back, however, when the very nature of botnets are a perversion of the internet. Knocking them offline is a good thing, you just have to do it the right way. I wish more people would fight this kind of evil - in their spare time - and try to clean things up. The benefits are reduced spam, fewer phishing scams, perhaps less spyware, fewer stolen identities, and the knowledge that you helped potentially thousands of people against what is now becoming organised crime.

A few smart people are doing this and documenting their efforts (article 1, article 2). Honeypots can be a great way to capture bot software and start to analyse what it does. There are a few cases of public "zombie hunters" and the "return of the web mob" where people are fighting botnets and willing to go public. I applaud their efforts, I just wish more people would join in.

If you have the technical ability to help solve this source of evil that affects millions of people, why would you sit back and just watch?<br/>

Disabling botnets

Disabling botnets is not easy, particularly when one needs to disassemble a Trojan just to figure out how the botnet works. Or sniff the traffic to see what it is doing. It’s beyond the technical ability of many people. Even so, it's still a big step from just logging in to actually disabling a botnet. But there are exceptions.

Some simple botnets exploit known vulnerabilities in web servers to download Perl scripts that cause the server to join an IRC channel and wait for commands. Check your web server logs. Most readers would have the ability to read the logs, find the attack attempt, download the script themselves, and see how it works. While this is a simple (but real) example, a short foray into the underworld by someone with good intentions of shutting a botnet down can be a fascinating experience. If a quick scan reveals that the botnet’s command center is vulnerable to a Teardrop attack or any simple vulnerability, would you not take it down? You definitely should.

With good intentions of fighting a known evil that harms people and the internet, I personally don’t have any ethical issues with people disbanding botnets - provided they don't give further harm to the bots themselves. I think disbanding a botnet is a very good thing to do. They cause so much harm and are used for so many illegal puposes. It’s a little vigilante, but very good for the internet. To do it right, you'd perhaps notify the rightful owners of every one of the computers that had been infected too, else the machines will only be infected by a different botnet. But there are real implications by doing this, too.

Some botnets even have the ability to distribute patches - but it’s used by the botnet operator to retain control, rather then patch and then release the machines that are compromised. And then there are botnets fighting other botnets, a turf war over machines that neither operator owns.

In fairytale land I can imagine someone gaining control of a botnet, distributing a patch to fix the compromised bots, and disbanding the botnet - but even this is wrought with potential harm as well. And one can argue that it’s not his responsibility to fight botnets. Agreed. It’s probably not. It’s really the realm of law enforcement to do this, but let’s be realistic and understand that their limited resources are pretty swamped as it is.

Hello, Skynet

The rise of the botnets may just be the great-grandfather of a Skynet in the distant future. It’s a disturbing trend of evil that is mostly unchecked by all but a few talented people and limited law enforcement. Today most botnets still use some kind of centralised command and control centre - a single point of failure, such as an IRC server. There’s a window of opportunity to shut them down before new peer-to-peer botnets become commonplace, which won't have any single point of failure.

The next generation is coming. It’s a worrisome trend. I wonder if we’ll start to do anything about it en masse in the coming dozen years, before the first signs of Skynet start to appear.

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

Kelly Martin has been working with networks and security since 1986, and he's editor for SecurityFocus, Symantec's online magazine.