How to Steal a Botnet

http://www.catonmat.net/blog/how-to-steal-a-botnet-video-lecture-review/

by pkrumins • 17 years ago

92 22 17 years ago

omergertel• 17 years ago

I actually got a tingly feeling in my spine when I watched this lecture. I'm having Terminator's Skynet flashes.

Ixiaus• 17 years ago

The darkside of internet technology is very interesting... Can you imagine the ingenuity that needs to go into the creation of the software for a botnet? Kind of cool in many ways.

Vivtek4• 17 years ago

It is utterly cool. I love it, botnets and spam and all. I just wish I had the time to spend with it instead of earning a living.

Luyt• 17 years ago

Would using webpages via https also be compromised? Do these botnets also use keylogging?

pkrumins• 17 years ago

Yep, using webpages via https would be compromised. The bots hook various DLL to get the content before encryption when it's sent and after decryption when it's received.

They don't seem to use keylogging. They only capture HTML form information.

jackfoxy• 17 years ago

Can anyone comment on how effective the common AV packages are at preventing being infected by Torpig and similar know attacks, and once infected, how effective at removing the infection?

Vivtek4• 17 years ago

Once infected, forget about it.

I've been infected by viruses three times. Twice were before this year, and it takes some quick work, but both times it was no real challenge to stabilize my machine, so beyond feeling really stupid for a few hours, it ended up being kind of fun.

In November, though, I infected my machine again. Three days later, it was still phoning home to Russia and the Ukraine. There was literally nothing I could do - even Malwarebytes and the like would clean it up only to a certain extent, and the viruses were still embedded in the system software. Finally I just gave up and bought a new machine so I could start from scratch, only pulling data from the old machine.

A good AV won't let you get infected - you still shouldn't allow actions that look fishy or unexpected, but at least you're in control. But once you're infected, the botnet can respond in realtime to what you're trying to do to stop it. And they're better than you are at it.

I'm not saying it's impossible to clean up a machine that's fallen into their hands - but I am saying that even with some past success in this under my belt, I was unable to do it in any amount of time that was justified (even in terms of fun).

thaumaturgy• 17 years ago

They're definitely getting nastier. Last week we had our first client system that required a format-and-reinstall. Fortunately, this was a relatively new machine and the client didn't care about any of the data on it. (We have a strict "format-and-reinstall as a last resort only" policy on our flat-rate infected machine cleanups.)

If you can still get the machine to boot, I've had very good luck with ComboFix. (Make sure you get it from bleepingcomputer.com [1], not combofix.org, which is an unauthorized re-distribution.)

Most of the rootkits I'm seeing still aren't working directly on existing system files, a la the computer viruses of old. Instead, they're modifying ini files and then installing some cleverly hidden files in system directories. So, you can use tools like RootKit Revealer [2] to sniff them out. Actually removing any hidden files or hidden registry keys may require some expertise and serious effort -- we have a dedicated diagnostic system set up that we use to handle some of these things, with the drive removed from the client computer.

[1] http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[2] http://technet.microsoft.com/en-us/sysinternals/bb897445.asp...

ajju• 17 years ago

Why did you have to buy a new machine? Couldn't you have copied the data to an external disk instead of a new machine, then formatted the hdds, maybe flashed the bios and started over?

jonknee3• 17 years ago

I don't know why financial institutions don't all require two-factor authentication these days. Nothing else will stop attacks like this.

seiji• 17 years ago

c.f. http://www.schneier.com/blog/archives/2005/03/the_failure_of...

jonknee3• 17 years ago

Some decent points, but if you require authentication for all transactions the man in the middle attack / trojan won't work. For every transfer have a SMS or phone call triggered to the customer--"We have received a request to transfer $x to Y, to authenticate please press 1." It may get annoying for every transaction, so it could only come into play for transactions to parties that you haven't dealt with in the last X days.

nearestneighbor• 17 years ago

The bank account information is valued at $10.00 to $1,000 per account.

What can hackers do with your, say, checking account info (name and account number, I'm assuming)? Are you liable for any hacker-related losses, if you've done nothing wrong?

How to Steal a Botnet

Related Stories