Perimeter
12/10/2010
05:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

The Hazards Of Bot Volunteerism

Not only can you get caught, you can also get 0wned if the bot software is malicious

I've been wondering about the volunteer "bots" who have downloaded the code in order to help flood Visa, MasterCard, PayPal, and others during the past few days in protest against companies they say are deterring Internet freedom of information and speech by turning their backs on WikiLeaks and its recently jailed founder, Julian Assange.

Are they mainly high school and college students? If they're employed adults, then do they DDoS during their day jobs? I'm sure there must be some who just want to join in the attack and could care less about Julian Assange and WikiLeaks. Regardless, I'm curious if they were at all hesitant at first to download the bot tool and fire away.

When you offer up your computer to join a distributed denial-of-service (DDoS) attack, you could also be ultimately exposing yourself to an attack. Aside from the obvious legal risks -- which a 16-year-old Dutch boy who participated in the so-called Operation Payback just learned upon his arrest yesterday -- there's always a chance the attack code you download could be rigged to turn on you.

I'm not saying the DDoS code being used in Operation Payback infects those who use it. Security experts who have unraveled it say they don't see any sign of backdoors or other malicious activity in the Low Orbit Ion Cannon (LOIC) DDoS tool. But this type of code could easily be booby-trapped with a backdoor, rootkit, or code that steals information from the bot's machine. Jose Nazario, senior security researcher at Arbor Networks, says the source code appears to do just what it says it does -- DDoS -- but it does have some capability for abuse. "If these tools have backdoor access, you may wind up with more than you bargained for," Nazario says. "But we haven't seen that happen yet" with this program, he says.

Another risk with volunteer bot duty is exposing your IP address and possibly your identity to the victim organization or law enforcement. If your IP address gets blacklisted, you're toast, especially if you have a static IP address.

Nazario notes the law is clear that it's illegal to disrupt a business' operations or break in, although how that applies to voluntary botnets is a bit unclear. Tal Be'ery, Web research team lead for Imperva's Application Defense Center, argues that because the LOIC tool is clearly for DDoS'ing, volunteer bots can't plead ignorance if they do get caught. "The interface of the LOIC software is very clear about the intention of the tool -- it makes it create a DDoS attack. It's very clear to everyone who's using the tool that they are attacking a website," Be'ery says.

Be'ery has been monitoring the IRC discussions among Operation Payback participants, and he says many of them aren't asking whether it's legal or if they should worry about getting caught. "I'm pretty sure they're not realizing this," he says.

There is both a traditional command-and-control bot type version of the LOIC DDoS tool as well as a version that's a JavaScript plug-in for users that can just DDoS from their browser only. "If you're not the admin and you can't download or install software, or you are afraid this is really malware that can take over your computer, then you can use this JavaScript version of it and create a denial-of-service attack with your browser only," Be'ery says.

All along I've been envisioning the Operation Payback DDoS'ers using their own personal machines. But given how easily accessible these opt-in botnet attacks are today, chances are that some are using their employers' or schools' systems. Gunter Ollmann, vice president of research at Damballa, wrote a report (PDF) on opt-in botnets on the rise and how organizations need to be aware and prepare for this type of event.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) on Twitter: http://twitter.com/kjhiggins

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.