Perimeter
12/10/2010
05:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

The Hazards Of Bot Volunteerism

Not only can you get caught, you can also get 0wned if the bot software is malicious

I've been wondering about the volunteer "bots" who have downloaded the code in order to help flood Visa, MasterCard, PayPal, and others during the past few days in protest against companies they say are deterring Internet freedom of information and speech by turning their backs on WikiLeaks and its recently jailed founder, Julian Assange.

Are they mainly high school and college students? If they're employed adults, then do they DDoS during their day jobs? I'm sure there must be some who just want to join in the attack and could care less about Julian Assange and WikiLeaks. Regardless, I'm curious if they were at all hesitant at first to download the bot tool and fire away.

When you offer up your computer to join a distributed denial-of-service (DDoS) attack, you could also be ultimately exposing yourself to an attack. Aside from the obvious legal risks -- which a 16-year-old Dutch boy who participated in the so-called Operation Payback just learned upon his arrest yesterday -- there's always a chance the attack code you download could be rigged to turn on you.

I'm not saying the DDoS code being used in Operation Payback infects those who use it. Security experts who have unraveled it say they don't see any sign of backdoors or other malicious activity in the Low Orbit Ion Cannon (LOIC) DDoS tool. But this type of code could easily be booby-trapped with a backdoor, rootkit, or code that steals information from the bot's machine. Jose Nazario, senior security researcher at Arbor Networks, says the source code appears to do just what it says it does -- DDoS -- but it does have some capability for abuse. "If these tools have backdoor access, you may wind up with more than you bargained for," Nazario says. "But we haven't seen that happen yet" with this program, he says.

Another risk with volunteer bot duty is exposing your IP address and possibly your identity to the victim organization or law enforcement. If your IP address gets blacklisted, you're toast, especially if you have a static IP address.

Nazario notes the law is clear that it's illegal to disrupt a business' operations or break in, although how that applies to voluntary botnets is a bit unclear. Tal Be'ery, Web research team lead for Imperva's Application Defense Center, argues that because the LOIC tool is clearly for DDoS'ing, volunteer bots can't plead ignorance if they do get caught. "The interface of the LOIC software is very clear about the intention of the tool -- it makes it create a DDoS attack. It's very clear to everyone who's using the tool that they are attacking a website," Be'ery says.

Be'ery has been monitoring the IRC discussions among Operation Payback participants, and he says many of them aren't asking whether it's legal or if they should worry about getting caught. "I'm pretty sure they're not realizing this," he says.

There is both a traditional command-and-control bot type version of the LOIC DDoS tool as well as a version that's a JavaScript plug-in for users that can just DDoS from their browser only. "If you're not the admin and you can't download or install software, or you are afraid this is really malware that can take over your computer, then you can use this JavaScript version of it and create a denial-of-service attack with your browser only," Be'ery says.

All along I've been envisioning the Operation Payback DDoS'ers using their own personal machines. But given how easily accessible these opt-in botnet attacks are today, chances are that some are using their employers' or schools' systems. Gunter Ollmann, vice president of research at Damballa, wrote a report (PDF) on opt-in botnets on the rise and how organizations need to be aware and prepare for this type of event.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) on Twitter: http://twitter.com/kjhiggins

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1421
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVE-2013-2105
Published: 2014-04-22
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.

CVE-2013-2187
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVE-2013-4116
Published: 2014-04-22
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVE-2013-4472
Published: 2014-04-22
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Best of the Web