Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Should ISPs Monitor Users' PCs To Stop Botnets?

Homeland Security's proposed code of conduct for notifying users when their PCs are infected by malware raises privacy concerns.

The Department of Homeland Security (DHS) and the National Institute of Standards and Technology (NIST) are proposing that service providers notify their customers whenever they detect a botnet infection on the user's PC, and then coordinate the subsequent removal of that malware.

But what's the best way to detect botnets and coordinate notifications? To answer that question, DHS and NIST last week released a voluntary notification proposal for comment--until November 4, 2011--in the Federal Register. In particular, they're seeking "information on the requirements of, and possible approaches to creating, a voluntary industry code of conduct to address the detection, notification, and mitigation of botnets." The agencies also want suggestions for "potential models for detection, notification, prevention, and mitigation of botnets' illicit use of computer equipment."

Busting botnets is a priority for the government because of "the potential economic impact of botnets and the problems they cause to computer systems, businesses, and consumers," said DHS and NIST. Notably, these networks of zombie computers are often rented out to be used as spam relays, in phishing attacks, and to launch massive, distributed denial-of-service attacks.

Furthermore, the incidence of botnets being used to commit crimes continues to increase. More coordinated botnet notifications, however, might help reduce the overall number of botnet infections, making zombie PCs more scarce. That, in turn, could make botnet-driven attacks more costly for criminals, as well as difficult to execute.

[Are your Web-connected photocopiers, scanners, and VoIP servers compromising your enterprise security? Learn more at Corporate Espionage's New Friend: Embedded Web Servers.]

The cornerstone of any such notification program would likely be for service providers--not least because they already have both contact details and a working relationship with so many PC users--to detect infections via network traffic and notify affected customers. That approach has been used since December 2010 in Australia, and recently introduced in Germany and Japan.

Businesses and government agencies in the United States also have some experience with informing botnet-infected PC owners about their malware issues. In October 2010, Comcast implemented botnet notifications as part of its Constant Guard service, run by computer security firm Damballa. According to Comcast, it may email a "service notice" to Comcast email addresses when it suspects that a user's PC is infected by malware. The email then directs users to the Constant Guard website for instructions on how to eliminate the malware.

After the FBI took down the Coreflood botnet earlier this year, any PC infected with the malware redirected to a replacement government command-and-control server, which remotely disabled the botnet. Authorities then alerted the user's service provider, requesting that it warn the user that their PC was infected with the Coreflood malware, and offer advice for eradicating the infection.

But the practice of detecting botnet infections on people's PCs raises privacy questions. "If we agree to having our packets inspected as they traverse the Internet, will the temptation to use this information to track your activities, or sell your surfing habits to marketers, be too great for ISPs to resist?" said Chester Wisniewski, a senior security advisor at Sophos Canada, in a blog post.

But he said the proposal offers great promise, as well as pragmatism in a world that too often obsesses over high-profile but incredibly rare attacks, such as Stuxnet. "The vast majority of attacks are using our own computing resources to compromise our infrastructure," he said.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This gives a new meaning to blind leading the blind.
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21441
PUBLISHED: 2021-06-16
There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Attack can be performed by sending specially crafted e-mail to the system and it doesn't require any user intraction. This issue affects: OTRS A...
CVE-2020-9493
PUBLISHED: 2021-06-16
A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.
CVE-2021-28815
PUBLISHED: 2021-06-16
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link vers...
CVE-2021-3535
PUBLISHED: 2021-06-16
Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. A specific search criterion and operator combination in Filtered Asset Search could have allowed a user to pass code through the provided search field. ...
CVE-2021-32685
PUBLISHED: 2021-06-16
tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-5...