Risk
9/27/2011
08:54 AM
Connect Directly
RSS
E-Mail
50%
50%

Should ISPs Monitor Users' PCs To Stop Botnets?

Homeland Security's proposed code of conduct for notifying users when their PCs are infected by malware raises privacy concerns.

The Department of Homeland Security (DHS) and the National Institute of Standards and Technology (NIST) are proposing that service providers notify their customers whenever they detect a botnet infection on the user's PC, and then coordinate the subsequent removal of that malware.

But what's the best way to detect botnets and coordinate notifications? To answer that question, DHS and NIST last week released a voluntary notification proposal for comment--until November 4, 2011--in the Federal Register. In particular, they're seeking "information on the requirements of, and possible approaches to creating, a voluntary industry code of conduct to address the detection, notification, and mitigation of botnets." The agencies also want suggestions for "potential models for detection, notification, prevention, and mitigation of botnets' illicit use of computer equipment."

Busting botnets is a priority for the government because of "the potential economic impact of botnets and the problems they cause to computer systems, businesses, and consumers," said DHS and NIST. Notably, these networks of zombie computers are often rented out to be used as spam relays, in phishing attacks, and to launch massive, distributed denial-of-service attacks.

Furthermore, the incidence of botnets being used to commit crimes continues to increase. More coordinated botnet notifications, however, might help reduce the overall number of botnet infections, making zombie PCs more scarce. That, in turn, could make botnet-driven attacks more costly for criminals, as well as difficult to execute.

[Are your Web-connected photocopiers, scanners, and VoIP servers compromising your enterprise security? Learn more at Corporate Espionage's New Friend: Embedded Web Servers.]

The cornerstone of any such notification program would likely be for service providers--not least because they already have both contact details and a working relationship with so many PC users--to detect infections via network traffic and notify affected customers. That approach has been used since December 2010 in Australia, and recently introduced in Germany and Japan.

Businesses and government agencies in the United States also have some experience with informing botnet-infected PC owners about their malware issues. In October 2010, Comcast implemented botnet notifications as part of its Constant Guard service, run by computer security firm Damballa. According to Comcast, it may email a "service notice" to Comcast email addresses when it suspects that a user's PC is infected by malware. The email then directs users to the Constant Guard website for instructions on how to eliminate the malware.

After the FBI took down the Coreflood botnet earlier this year, any PC infected with the malware redirected to a replacement government command-and-control server, which remotely disabled the botnet. Authorities then alerted the user's service provider, requesting that it warn the user that their PC was infected with the Coreflood malware, and offer advice for eradicating the infection.

But the practice of detecting botnet infections on people's PCs raises privacy questions. "If we agree to having our packets inspected as they traverse the Internet, will the temptation to use this information to track your activities, or sell your surfing habits to marketers, be too great for ISPs to resist?" said Chester Wisniewski, a senior security advisor at Sophos Canada, in a blog post.

But he said the proposal offers great promise, as well as pragmatism in a world that too often obsesses over high-profile but incredibly rare attacks, such as Stuxnet. "The vast majority of attacks are using our own computing resources to compromise our infrastructure," he said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-5142
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.

CVE-2010-5302
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb before 1.15 as of 20100908 (r88), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.

CVE-2010-5303
Published: 2014-08-21
Cross-site scripting (XSS) vulnerability in the displayError function in timthumb.php in TimThumb before 1.15 (r85), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to $errorString.

CVE-2014-0965
Published: 2014-08-21
IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted SOAP response.

CVE-2014-3022
Published: 2014-08-21
IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted URL that triggers an error condition.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.