Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

12/10/2010
05:05 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

The Hazards Of Bot Volunteerism

Not only can you get caught, you can also get 0wned if the bot software is malicious

I've been wondering about the volunteer "bots" who have downloaded the code in order to help flood Visa, MasterCard, PayPal, and others during the past few days in protest against companies they say are deterring Internet freedom of information and speech by turning their backs on WikiLeaks and its recently jailed founder, Julian Assange.

Are they mainly high school and college students? If they're employed adults, then do they DDoS during their day jobs? I'm sure there must be some who just want to join in the attack and could care less about Julian Assange and WikiLeaks. Regardless, I'm curious if they were at all hesitant at first to download the bot tool and fire away.

When you offer up your computer to join a distributed denial-of-service (DDoS) attack, you could also be ultimately exposing yourself to an attack. Aside from the obvious legal risks -- which a 16-year-old Dutch boy who participated in the so-called Operation Payback just learned upon his arrest yesterday -- there's always a chance the attack code you download could be rigged to turn on you.

I'm not saying the DDoS code being used in Operation Payback infects those who use it. Security experts who have unraveled it say they don't see any sign of backdoors or other malicious activity in the Low Orbit Ion Cannon (LOIC) DDoS tool. But this type of code could easily be booby-trapped with a backdoor, rootkit, or code that steals information from the bot's machine. Jose Nazario, senior security researcher at Arbor Networks, says the source code appears to do just what it says it does -- DDoS -- but it does have some capability for abuse. "If these tools have backdoor access, you may wind up with more than you bargained for," Nazario says. "But we haven't seen that happen yet" with this program, he says.

Another risk with volunteer bot duty is exposing your IP address and possibly your identity to the victim organization or law enforcement. If your IP address gets blacklisted, you're toast, especially if you have a static IP address.

Nazario notes the law is clear that it's illegal to disrupt a business' operations or break in, although how that applies to voluntary botnets is a bit unclear. Tal Be'ery, Web research team lead for Imperva's Application Defense Center, argues that because the LOIC tool is clearly for DDoS'ing, volunteer bots can't plead ignorance if they do get caught. "The interface of the LOIC software is very clear about the intention of the tool -- it makes it create a DDoS attack. It's very clear to everyone who's using the tool that they are attacking a website," Be'ery says.

Be'ery has been monitoring the IRC discussions among Operation Payback participants, and he says many of them aren't asking whether it's legal or if they should worry about getting caught. "I'm pretty sure they're not realizing this," he says.

There is both a traditional command-and-control bot type version of the LOIC DDoS tool as well as a version that's a JavaScript plug-in for users that can just DDoS from their browser only. "If you're not the admin and you can't download or install software, or you are afraid this is really malware that can take over your computer, then you can use this JavaScript version of it and create a denial-of-service attack with your browser only," Be'ery says.

All along I've been envisioning the Operation Payback DDoS'ers using their own personal machines. But given how easily accessible these opt-in botnet attacks are today, chances are that some are using their employers' or schools' systems. Gunter Ollmann, vice president of research at Damballa, wrote a report (PDF) on opt-in botnets on the rise and how organizations need to be aware and prepare for this type of event.

-- Kelly Jackson Higgins, Senior Editor, Dark Reading Follow Kelly (@kjhiggins) on Twitter: http://twitter.com/kjhiggins

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27184
PUBLISHED: 2021-05-14
The NPort IA5000A Series devices use Telnet as one of the network device management services. Telnet does not support the encryption of client-server communications, making it vulnerable to Man-in-the-Middle attacks.
CVE-2020-27185
PUBLISHED: 2021-05-14
Cleartext transmission of sensitive information via Moxa Service in NPort IA5000A series serial devices. Successfully exploiting the vulnerability could enable attackers to read authentication data, device configuration, and other sensitive data transmitted over Moxa Service.
CVE-2021-32613
PUBLISHED: 2021-05-14
In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.
CVE-2021-24192
PUBLISHED: 2021-05-14
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers insta...
CVE-2021-24193
PUBLISHED: 2021-05-14
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, wh...