Risk
11/26/2008
04:29 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

U.S. Army Goes Bot Hunting

As an automated network-flow analysis tool, BotHunter uses IDS routines to scan inbound and outbound network packet headers and payloads.

Most people whose computers have been turned into bots and linked to a botnet have no idea that their machines have been commandeered by cybercriminals. Their PCs send spam, steal information, and participate in denial-of-service attacks without any obvious sign.

But new software, funded by a grant from the U.S. Army Research Office and developed by SRI International, promises to provide users with more insight into what their computers are doing.

BotHunter, announced on Monday, is a free malware-detection application for Mac OS X, Linux/Unix, and Windows that monitors network activity. Unlike intrusion detection system (IDS) tools that scan only incoming data, BotHunter looks for patterns that indicate malware activity in both incoming and outgoing data.

"We do a lot of inbound egress monitoring," said Phillip Porras, SRI program director of enterprise and infrastructure security and lead developer of the BotHunter project. "BotHunter really flips that paradigm around."

As an automated network-flow analysis tool, BotHunter uses IDS routines to scan inbound and outbound network packet headers and payloads. It does so without revealing packet payload contents, which is necessary to protect privacy and make it usable in government environments. The machine profiles it sends to the BotHunter repository are anonymized to remove local network identification data.

The software has been downloaded some 35,000 times to date and several thousand instances are running in the U.S. military. So far, about 250 users have reported finding that their PCs have been turned into bots, said Porras.

Though the software is aimed at technically savvy users, specifically network administrators, the Windows version should install easily and should be usable by those without deep networking expertise. The Mac version requires the target machine to have Apple's developer tools installed to function.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1556
Published: 2014-09-12
Cross-site scripting (XSS) vulnerability in Synology Photo Station 5 for DiskStation Manager (DSM) 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photo_one.php.

CVE-2014-2008
Published: 2014-09-12
SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to execute arbitrary SQL commands via the TID parameter.

CVE-2014-2009
Published: 2014-09-12
The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log.

CVE-2014-4735
Published: 2014-09-12
Cross-site scripting (XSS) vulnerability in MyWebSQL 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter to index.php.

CVE-2014-5259
Published: 2014-09-12
Cross-site scripting (XSS) vulnerability in cattranslate.php in the CatTranslate JQuery plugin in BlackCat CMS 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant