Perimeter
12/10/2010
05:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

The Hazards Of Bot Volunteerism

Not only can you get caught, you can also get 0wned if the bot software is malicious

I've been wondering about the volunteer "bots" who have downloaded the code in order to help flood Visa, MasterCard, PayPal, and others during the past few days in protest against companies they say are deterring Internet freedom of information and speech by turning their backs on WikiLeaks and its recently jailed founder, Julian Assange.

Are they mainly high school and college students? If they're employed adults, then do they DDoS during their day jobs? I'm sure there must be some who just want to join in the attack and could care less about Julian Assange and WikiLeaks. Regardless, I'm curious if they were at all hesitant at first to download the bot tool and fire away.

When you offer up your computer to join a distributed denial-of-service (DDoS) attack, you could also be ultimately exposing yourself to an attack. Aside from the obvious legal risks -- which a 16-year-old Dutch boy who participated in the so-called Operation Payback just learned upon his arrest yesterday -- there's always a chance the attack code you download could be rigged to turn on you.

I'm not saying the DDoS code being used in Operation Payback infects those who use it. Security experts who have unraveled it say they don't see any sign of backdoors or other malicious activity in the Low Orbit Ion Cannon (LOIC) DDoS tool. But this type of code could easily be booby-trapped with a backdoor, rootkit, or code that steals information from the bot's machine. Jose Nazario, senior security researcher at Arbor Networks, says the source code appears to do just what it says it does -- DDoS -- but it does have some capability for abuse. "If these tools have backdoor access, you may wind up with more than you bargained for," Nazario says. "But we haven't seen that happen yet" with this program, he says.

Another risk with volunteer bot duty is exposing your IP address and possibly your identity to the victim organization or law enforcement. If your IP address gets blacklisted, you're toast, especially if you have a static IP address.

Nazario notes the law is clear that it's illegal to disrupt a business' operations or break in, although how that applies to voluntary botnets is a bit unclear. Tal Be'ery, Web research team lead for Imperva's Application Defense Center, argues that because the LOIC tool is clearly for DDoS'ing, volunteer bots can't plead ignorance if they do get caught. "The interface of the LOIC software is very clear about the intention of the tool -- it makes it create a DDoS attack. It's very clear to everyone who's using the tool that they are attacking a website," Be'ery says.

Be'ery has been monitoring the IRC discussions among Operation Payback participants, and he says many of them aren't asking whether it's legal or if they should worry about getting caught. "I'm pretty sure they're not realizing this," he says.

There is both a traditional command-and-control bot type version of the LOIC DDoS tool as well as a version that's a JavaScript plug-in for users that can just DDoS from their browser only. "If you're not the admin and you can't download or install software, or you are afraid this is really malware that can take over your computer, then you can use this JavaScript version of it and create a denial-of-service attack with your browser only," Be'ery says.

All along I've been envisioning the Operation Payback DDoS'ers using their own personal machines. But given how easily accessible these opt-in botnet attacks are today, chances are that some are using their employers' or schools' systems. Gunter Ollmann, vice president of research at Damballa, wrote a report (PDF) on opt-in botnets on the rise and how organizations need to be aware and prepare for this type of event.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) on Twitter: http://twitter.com/kjhiggins

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.