Perimeter
12/10/2010
05:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

The Hazards Of Bot Volunteerism

Not only can you get caught, you can also get 0wned if the bot software is malicious

I've been wondering about the volunteer "bots" who have downloaded the code in order to help flood Visa, MasterCard, PayPal, and others during the past few days in protest against companies they say are deterring Internet freedom of information and speech by turning their backs on WikiLeaks and its recently jailed founder, Julian Assange.

Are they mainly high school and college students? If they're employed adults, then do they DDoS during their day jobs? I'm sure there must be some who just want to join in the attack and could care less about Julian Assange and WikiLeaks. Regardless, I'm curious if they were at all hesitant at first to download the bot tool and fire away.

When you offer up your computer to join a distributed denial-of-service (DDoS) attack, you could also be ultimately exposing yourself to an attack. Aside from the obvious legal risks -- which a 16-year-old Dutch boy who participated in the so-called Operation Payback just learned upon his arrest yesterday -- there's always a chance the attack code you download could be rigged to turn on you.

I'm not saying the DDoS code being used in Operation Payback infects those who use it. Security experts who have unraveled it say they don't see any sign of backdoors or other malicious activity in the Low Orbit Ion Cannon (LOIC) DDoS tool. But this type of code could easily be booby-trapped with a backdoor, rootkit, or code that steals information from the bot's machine. Jose Nazario, senior security researcher at Arbor Networks, says the source code appears to do just what it says it does -- DDoS -- but it does have some capability for abuse. "If these tools have backdoor access, you may wind up with more than you bargained for," Nazario says. "But we haven't seen that happen yet" with this program, he says.

Another risk with volunteer bot duty is exposing your IP address and possibly your identity to the victim organization or law enforcement. If your IP address gets blacklisted, you're toast, especially if you have a static IP address.

Nazario notes the law is clear that it's illegal to disrupt a business' operations or break in, although how that applies to voluntary botnets is a bit unclear. Tal Be'ery, Web research team lead for Imperva's Application Defense Center, argues that because the LOIC tool is clearly for DDoS'ing, volunteer bots can't plead ignorance if they do get caught. "The interface of the LOIC software is very clear about the intention of the tool -- it makes it create a DDoS attack. It's very clear to everyone who's using the tool that they are attacking a website," Be'ery says.

Be'ery has been monitoring the IRC discussions among Operation Payback participants, and he says many of them aren't asking whether it's legal or if they should worry about getting caught. "I'm pretty sure they're not realizing this," he says.

There is both a traditional command-and-control bot type version of the LOIC DDoS tool as well as a version that's a JavaScript plug-in for users that can just DDoS from their browser only. "If you're not the admin and you can't download or install software, or you are afraid this is really malware that can take over your computer, then you can use this JavaScript version of it and create a denial-of-service attack with your browser only," Be'ery says.

All along I've been envisioning the Operation Payback DDoS'ers using their own personal machines. But given how easily accessible these opt-in botnet attacks are today, chances are that some are using their employers' or schools' systems. Gunter Ollmann, vice president of research at Damballa, wrote a report (PDF) on opt-in botnets on the rise and how organizations need to be aware and prepare for this type of event.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) on Twitter: http://twitter.com/kjhiggins

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2188
Published: 2015-02-26
The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connecti...

CVE-2015-0594
Published: 2015-02-26
Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS) and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq54654 and CSCun1...

CVE-2015-0632
Published: 2015-02-26
Race condition in the Neighbor Discovery (ND) protocol implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service via a flood of Router Solicitation messages on the local network, aka Bug ID CSCuo67770.

CVE-2015-0651
Published: 2015-02-26
Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753.

CVE-2015-0882
Published: 2015-02-26
Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/init_includes/init_sanitize.php an...

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.