Computer Crime Research Center

etc/word.jpg

Know your Enemy: Tracking Botnets

Date: March 17, 2005
Source: Computer Crime Research Center
By: CCRC staff

In their paper, The Honeynet Project &Research Alliance, have attempted to demonstrate how honeynets can help us understand how botnets work, the threat they pose, and how attackers control them. The research shows that some attackers are highly skilled and organized, potentially belonging to well organized crime structures. Leveraging the power of several thousand bots, it is able to take down almost any website or network instantly. Even in unskilled hands, it should be obvious that botnets are a loaded and powerful weapon. Since botnets pose such a powerful threat, we need a variety of mechanisms to counter it.

Decentralized providers like Akamai can offer some redundancy here, but very large botnets can also pose a severe threat even against this redundancy. Taking down of Akamai would impact very large organizations and companies, a presumably high value target for certain organizations or individuals. We are currently not aware of any botnet usage to harm military or government institutions, but time will tell if this persists.

In the future, we hope to develop more advanced honeypots that help us to gather information about threats such as botnets. Examples include Client honeypots that actively participate in networks (e.g. by crawling the web, idling in IRC channels, or using P2P-networks) or modify honeypots so that they capture malware and send it to anti-virus vendors for further analysis. Since our current approach focuses on bots that use IRC for C&C, we focused in the paper on IRC-based bots. We have also observed other bots, but these are rare and currently under development. In a few months/years more and more bots will use non-IRC C&C, potentially decentralized p2p-communication. So more research in this area is needed, attackers don't sleep. As these threats continue to adapt and change, so to must the security community.


Add comment  Email to a Friend

Discussion is closed - view comments archieve
2005-09-01 22:56:28 - Very nice Anelia
Total 1 comments
Copyright © 2001-2013 Computer Crime Research Center
CCRC logo