Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/11/2010
03:33 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

More Researchers Going On The Offensive To Kill Botnets

Another botnet bites the dust, as more researchers looking at more aggressive ways to beat cybercriminals

Yet another botnet has been shut down as of today as researchers joined forces with ISPs to cut communications to the prolific Lethic spamming botnet -- a development that illustrates how botnet hunters increasingly are going on the offensive to stop cybercriminals, mainly by disrupting their valuable bot infrastructures.

For the most part researchers monitor and study botnets with honeypots and other more passive methods. Then security vendors come up with malware signatures to help their customers scan for these threats. But some researchers are turning up the heat on the bad guys' botnet infrastructures by taking the lead in killing some botnets: Aside from last weekend's takedown by Neustar of Lethic, which is responsible for about 10 percent of all spam, FireEye last November helped shut down the MegaD botnet. And researchers at the University of California at Santa Barbara in May revealed they had taken the offensive strategy one step further by infiltrating the Torpig botnet, a bold and controversial move that stirred debate about just how far researchers should go to disrupt a botnet.

Back in 2008 after two major ISPs halted traffic to malicious hosting provider McColo, spam worldwide dropped around 70 percent because McColo had been the main home to most botnet command and control (C&C) servers.

But deploying more offensive tactics to stop botnets and bad guys is not so straightforward: Researchers walk a fine line as to how far they can go legally and ethically, and sometimes taking down a botnet actually backfires, either with the bad guys returning the favor with a denial-of-service (DoS) attack, or learning how to better evade investigators next time. There's the danger that getting inside a botnet will just give its operators more tools and insight into how to strengthen their operations; botnet operators are notorious for reinventing themselves with stealthier botnets and new forms of malware.

Still, some researchers say playing so much defense and relying on user education today just isn't working in the fight against cybercrime.

"Preaching to people to improve their security only goes so far. It is time to take the fight to cybercriminals themselves," says Marc Maiffret, chief security architect for FireEye. Maiffret says this means getting out ahead of the botnet, like FireEye did with MegaD, or exploring ways to disrupt these operations.

But that doesn't mean manipulating or interacting with infected bot machines, he says. "You have to proceed with caution. You never want to do anything against infected computers. But if you have a way of getting those computers by way of normal propagation come back to your sinkhole, you can fairly easily disrupt" a botnet like FireEye did with MegaD, he says. FireEye was able to "blackhole" the communications to the botnet.

"FireEye chopped the head off the thing," Maiffret says. "That's one way of going after these guys."

But while taking down a botnet has obvious short-term benefits and chalks one up for the good guys, experts say it can also backfire. Gadi Evron, an independent security strategist based in Israel, says there needs to be a more offensive approach to taking down cybercriminals and botnets. "But that approach still needs to be defined [and collaborative]," Evron says. That will take a careful and cohesive strategy that likely entails legal changes and ensures any efforts don't backfire and instigate the bad guys, according to Evron.

"We need to careful that we're not starting a war on the Net that we can't win," Evron says."We have a lot to lose in this war -- [the cybercriminals] can just take down the Net. Many of these criminals are heavily invested, but have shown they are willing to play [with] a scorched-earth policy."

Steven Adair, a researcher with the Shadowserver Foundation, says other botnets are quietly being taken down around the world. "But not all get written about," Adair says. Adair says more researchers are hunting botnets today than ever before, which may account, in part, for the increase in botnet busts and debate about how to kill these malicious infrastructures.

And in some cases, he says, taking down or shutting down parts of a botnet just results in the bad guys retrenching elsewhere. "There have been a few cases where ... it has been a wasted effort," he says.

But Adair says the security community should be more proactive. "At some point you need to get involved and do a takedown with the registrars," he says.

Meanwhile, it's unclear whether the recent silencing of the Lethic botnet is a short-term victory or will have long-lasting effects on the spam operation. Neustar worked with ISPs that hosted the botnet's F servers to knock the botnet out of commission. But while the spam was nearly gone as of yesterday, some Lethic bots were still trying to communicate with a new C&C server, according to researchers at M86 Labs who study the botnet. So it was unclear whether some residual pieces of Lethic are still alive out there.

Lethic mostly focused on pharmaceutical, replica, and diploma spam campaigns. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I told you we should worry abit more about vendor lock-in.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .