by Mr Kumar Manthri - Marketing Director
To an avid IT security connoisseur, the recent news of mass cyber-attacks using “bots and Zombies” would not be alarming. This would not make this enthusiast think, even for a
by Mr Kumar Manthri - Marketing Director
To an avid IT security connoisseur, the recent news of mass cyber-attacks using “bots and Zombies” would not be alarming. This would not make this enthusiast think, even for a moment, that the computer world has been over taken by the living dead or better yet alien forces, but only one thing would come to mind "Botnets".
Botnet, according to google, is a collection of Internet-connected programs communicating with other similar programs in order to perform tasks1. The term bot is derived from “ro-bot “. Bot is a generic term used to describe a script or set of scripts designed to perform predefined functions in automated fashion2.
Because of their network-based, coordinated and controlled nature; Botnets are currently one of the most dangerous species of attacks that roam the Internet.
Deriving their power both in their cumulative bandwidth and their access capabilities, botnets can cause severe network outages through massive distributed denial-of-service attacks3.
Because of their distributed architecture, and their propagating, self-organizing, and autonomous framework that is under a command and control (C2 or C&C) infrastructure, botnets are quietly different from other types of known malwares. They can spread over millions and millions of computers with the same nature as worms do. However what makes it even more dangerous is that unlike worms, zombie nodes in a single botnet can work in co-operation and at the same time be managed from a single “hive-like” mentality.
Because of this, botnets cannot be classified into the standard groups of threats like we do for other malwares. From the many works that try to summarize the taxonomy of botnets, we can understand that there are main classification areas of botnets are the topology of C&C architecture used, the propagation mechanism, the exploitation strategy and available set of commands used by perpetrator4.
The creation of a botnet requires high level of planning, coordination and deep technical skill. A good, functional botnet can be characterized as a professionally designed and built tool, intended to be re-entered or sold for use by anyone with a novice skill set, on up5. However the elements used for the infection and subsequent hijacking of a computer into a botnet are only 3:
1. Used to infect the computers by tricking users into clicking an executable file. This can be done in a variety of ways such as drive-by infections, malicious PDFs and infected USB sticks6.
2. Used to enables the cyber-criminal to issue instructions to the infected computer’s Trojan6.
3. Used for the collection of information harvested from victims 6.
Besides being used to perform the normal set of attacks spamming, malware spreading, sensitive information leakage, identity fraud, click fraud; this ingenious technique are very valuable instruments in carrying out Advanced Persistent Threats (APT) for critical organizations.
Nevertheless the most famous, and yet very dangerous, threat posed by the use of Botnets is “Denial of Service” (DoS) attacks. This can be even made much more severe by ensuring that the targeted organization's network bandwidth is consumed from wide range of IP addresses, i.e. a distributed environment (DDos), where the victim's system/network administrator would not be able to isolate the source IP addresses used in the exploit, i.e. to add to the blacklist, as it would seem to come from regular end-user.
Even if evidence reveals that most commonly implemented by botnets are TCP SYN and UDP flooding attacks (Freiling, Holz, & Wicherski, 2005), the newest botnets are designed in such a was to make discovering and eliminating the source of control even more difficult. Instead of using the traditional command and control, server-centric model (such as IRC Server), the new botnet is said to utilize the peer to peer protocol that has been made popularized on the internets by many file sharing applications found on many plat forms.Using peer to peer, or p2p, it is no longer necessary to send commands from a physical server location. The internet protocol address, or IP, is dynamic (meaning constantly changing). The benefit of this is that it is much more difficult to trace back to the source7.
In 2007 this new kind of botnet arrived using an encrypted implementation that was based on the eDonkey protocol, originally called W32/Nuwar but later gained fame as the Storm worm.
Storm had about 100 peers hard