Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Researchers 'poison' Storm botnet

German team goes on the attack.

Article comments

A group of German researchers has unveiled the first publicly released research attempting to actively disrupt a peer-to-peer botnet - using as their case study the notorious Storm worm.

The researchers were able not only to infiltrate Storm, gaining in the process the most precise estimates of its size to date, but also had success in disrupting its communications through a "poisoning" technique, according to the study.

The study, "Measurements and Mitigation of Peer-to-Peer-based Botnets", was authored by five researchers working with the University of Mannheim and Institut Eurécom, and was presented at the Usenix Workshop on Large-Scale Exploits and Emergent Threats (LEET) earlier this month in San Francisco.

Related Articles on Techworld

Botnets have become among the most pressing threats on the internet, accounting for most spam and capable of directing large-scale denial-of-service and other categories of attacks.

Most recently, botnets such as that created by the Storm worm have begun using peer-to-peer techniques for communications, eliminating the need for a central control server and making them far more difficult to shut down.

By taking a more active approach, the researchers found a way to "poison" the communications of the Storm bots, effectively disrupting them.

"Our strategy can be used as a way to disable the communication within the Storm botnet to a large extent," they wrote in the study. "As a side effect, we are able to estimate the size of the Storm botnet, in general a hard task."

Previous research has been based on passive techniques such as observing network events such as the number of spam emails thought to have originated from a particular botnet, the researchers said.

They said the new study is the first to use active techniques, crawling the P2P network, keeping track of all peers and distinguishing infected peers from benign ones based on behaviour.

Crawling the "Stormnet" every 30 minutes from the beginning of December 2007 to the beginning of February 2008, the researchers found between 5,000 and 40,000 peers online at any given time, with a sharp increase in bots during the Christmas and New Years Eve periods.

The bots were located in more than 200 countries, with the biggest proportion in the US, at 23 percent.

The "poisoning" techique involves the keys used by Storm bots to establish communication. The researchers published a large amount of false content for particular keys.

"Our experiments show that by polluting all those hashes that we identified to be storm hashes, we can disrupt the communication of the botnet," the researchers wrote.

Another technique, called a "sybil" or "eclipse" attack, aiming to separate a part of the P2P network from the rest, proved ineffective.

Active interference with a botnet may carry serious legal consequences for researchers, since the botnet hosts are effectively computer systems belonging to third parties, who ordinarily are unaware that their systems are being misused.

In part because of this factor, previous research has focused on passive techniques for identifying the size and control structure of a botnet, leaving law enforcement authorities to take action, the researchers acknowledged.

The researchers said future efforts will focus on analysing a second tier of systems that issue the actual commands, which might allow the identification of the operators of the Storm worm.



Share:

More from Techworld

More relevant IT news

Comments

Rob said: I agree with Dante if someone has an active bot spamming the universe they should be shut downIgnorance is not an excuse to cry foul if they get shut down You get a STOPPED for running a RED LIGHT right

Dante said: It would be a much better service to society if these researchers poisoned the bots also Therell be no attacks if these stupid zombies PCs are all dead Keep killing off these zombie PCs and the retards may one day actually learn to use anti-virus software and stop annoying the human race with their online stupidity



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *