Infrastructure threats: Botnets show DoS who's boss
503421
(InfoWorld) - Malware-infected botnet PCs have overtaken denial-of-service attacks as the top security issue facing Internet service providers and other Web infrastructure hosting players, according to a new survey of the organizations. Arbor Networks published the results of its third-annual Infrastructure Security Report on Monday -- a survey of 75 large ISPs, hosting companies, and other providers -- which found for the first time that botnets currently outrank DoS threats as the most serious concern for the firms. Tens of millions of PCs are likely infected with botnet programs worldwide, according to survey results, and Arbor researchers said the ISPs they questioned admitted to spending more time and resources battling botnets than ever before. Infrastructure providers are finding botnets hard to pin down, as the people responsible for controlling the zombie machines are increasingly employing more advanced detection evasion techniques, said Craig Labovitz, chief scientist at Arbor. As they can't accurately gauge the size of the problem, he said, infrastructure providers are afraid they're only scraping the tip of the iceberg in taking on the botnet phenomenon. "ISPs are spending a lot of time trying to measure, and there's a lot of subjective data, but there are such widely different qualities to the various bots that it's a real challenge to get any strong metrics," Labovitz said. "We are seeing a widening separation between the pros and the amateurs, but as easy as it is to infiltrate and measure the less sophisticated botnets, the pro grade stuff is far more problematic and harder to trace." By using the same peer-to-peer botnet propagation strategy that has made the so-called Storm worm a recurring problem in terms of generating subsequent infections, the sophisticated sect of the botnet community is moving forward at a rapid pace, according to Arbor. In eliminating the need for traditional botnet command and control centers using P2P techniques to distribute the threats, the attackers have also removed the most efficient place to attempt to take down the attacks, the researcher said. At the same time, denial-of-service (DoS) attacks -- which have long-ranked as the primary concern of ISPs and their brethren -- have not disappeared, but rather become more targeted and efficient in the application of their resources, making them even more damaging to their individual targets, according to the report. Labowitz said that while a traditional distributed DoS threats have measured at under 10GB, newer DoS attacks are reaching as high as 24GB -- enough to completely shut down a smaller ISP or Web server farm. As the attacks are getting more powerful, they are also being concentrated on smaller groups of individual targets, or groups of sites, versus being unleashed to the Internet at large. In one such situation just last week, Labowitz said, an unnamed gambling site was taken offline for a number of hours. "For the most part, if you read the press you don't hear about DoS as much, so people jump to the conclusion that it's not happening. But it's still out there," said the researcher. "The attacks may only be targeted at a small group of sites, but that can also help to increase the significance of the impact to the provider involved based on the more narrow focus." Despite the lingering threat of DoS, ISPs have become better equipped at warding off the attacks and protecting their customers, and often times have begun charging for premium services to address the issue, according to Arbor. As opposed to five years ago, when infrastructure players often had to scramble to respond to DoS campaigns as they emerged, Labowitz said most sizeable companies now have appropriate procedures and equipment to at least partially deflect the assaults. "Even though 90 percent of the attacks are a soft threat at this point, some of those remaining attacks are bigger than anyone can handle easily -- even some of the big guys," said Labowitz. Arbor predicts attacks on Internet telephony services will represent one of the next immediate pain points for infrastructure players. Only 20 percent of the companies surveyed for the report said they had any gear in place to detect VoIP threats. Only 11 percent reported that they had any plans or tools in place to mitigate VoIP-based attacks. "We haven't seen many of these threats yet, but we know the proof-of-concepts are out there," said Labowitz. "With the amount of VoIP infrastructure that is being deployed, the ISPs and telephony providers will need to ensure that they have something in place to protect those networks from attack."
641744
A small group of IT security startups are hoping to cash in on the rise of the botnet scourge as businesses -- telecommunications carriers and Internet service providers, in particular -- seek new methods for stopping the attacks.
243710
By TED BRIDIS Associated Press  WASHINGTON -- Hackers briefly overwhelmed at least three of the 13 computers that help manage global computer traffic Tuesday in one of the most significant attacks against the Internet since 2002.
592676
Sophisticated computer worm is setting up a botnet that may be hard to beat.
53791
InfoWorld - Trend Micro announced a new service to help large organizations and Internet service providers (ISPs) fight networks of zombie machines, known as "botnets."
386604
This article discusses the discovery of compromised machines in large enterprise environments, and offers some suggestions on correlating NIDS and HIPS logs to avoid false positives.
574879
InfoWorld - A small group of IT security startups are hoping to cash in on the rise of the botnet scourge as businesses -- telecommunications carriers and Internet service providers, in particular -- seek new methods for stopping the attacks.
710748
Lawmakers are on alert as hackers increase attacks on US infrastructure.
737700
Semi-organized people just as dangerous as botnets In late April, a Russian-speaking blogger upset with recent events in Estonia posted a series of dispatches calling on like-minded people to attack government servers in that country.â¦
475145
The purpose of this paper is to explain how attackers behave when they attempt to identify and defeat honeypots, and is useful information for security professionals who need to deploy honeypots in a more stealthy manner. Part 2 looks at Sebek-based honeypots, snort_inline, Fake AP, and Bait and Switch honeypots.
402450
(InfoWorld) - As director of research at the SANS Institute, Alan Paller has a unique window from which to view the U.S. governmentâs efforts to secure its vast computer networks. An original member of the National Infrastructure Advisory Council, Paller has had the ear of high-level White House officials.Â  Paller has also been a reliable critic of the governmentâs cybersecurity plans, which he says are ineffective and mired in bureaucracy. Last week, Paller was at it again, joining Eric Byres, Director of Industrial Cyber Security at Symantec to talk about cyberattacks on SCADA (supervisory control and data acquisition) systems that manage the nationâs critical infrastructure. Ahead of that event, Paller told InfoWorld Senior Editor Paul Roberts that SCADA hacks have already happened and that on the five-year anniversary of the Sept. 11, 2001, terrorist attacks, the U.S. gets an âFâÂ  for protecting its computers from hackers, terrorist or otherwise. InfoWorld: Weâve been hearing about the threat of terrorist cyberattacks for years. Is the threat for real? Alan Paller: It is a real threat, but itâs an interesting threat. What you have happening today is that terrorists are using cybercrime to get the money to buy the bombs to blow people up. But theyâre not using cyberattacks against physical things. There have been two cases that are very secret where SCADA systems that run power plants were taken over, but the crime was about extortion -- you know, âIf you donât pay us weâre going to do something bad.âÂ  In some cases the guys have proven that they can do damage by running a test denial of service attack, or a test outage. IW: Conventional wisdom was that SCADA systems are too old and idiosyncratic to be easy targets. What has changed? AP: The difference is that companies have added Windows systems to replace unknown operating systems, and then connected them to their networks, which are connected to the Internet. GAO did a great report on this back in 2004. Most of the attacks we hear about arenât aimed at SCADA systems, theyâre aimed at corporate networks, but once youâre on the network you can get into these (SCADA) systems. IW: Why should enterprise IT people care about the security of SCADA systems? AP: The big shock to us was all the places where control systems are used. NIST [National Institute of Standards and Technology] did a study that found SCADA systems were common in the electric, water, oil and gas, chemical, pharmaceutical, pulp and paper, food and beverage, discrete manufacturing, durable goods, air and rail transportation, mining and metallurgy industries. So tell me whatâs not covered there. Almost anyone who works in a major industry has this stuff on their plate.Â  IW: Is there any evidence that foreign governments are privy to information on how to attack SCADA systems in the U.S.? AP: Well, you have the statement Gen. Lord gave that the military has lost terabytes of sensitive information to the Chinese government. [Editorâs Note: Maj. Gen. William Lord told GCN in August that âChina has downloaded 10 to 20TB of data from NIPRNet, the DoDâs Non-Classified IP Router Network.â] That was the first public âoopsâ that weâve heard. It was an admission at the highest level that weâve spent all this money and systematically the Chinese have been able to come in and steal this information. IW: Recently, an article in Foreign Affairs criticized the U.S. government for playing defense on cybersecurity and missing the way terrorists are using the Internet to organize and raise money. Is that fair? AP: Youâre giving [the government] too much credit for having an active defense. They donât have an active defense. What they have is a lot of reports that have been written. Just one consulting firm increased their staff writing (cybersecurity) reports from four people to 200 in the last five years. As one chief of staff told me, the best thing to do with those reports is to pile them in front of our buildings so the terrorists canât use a car bomb to get us. IW: If you had to give the U.S. government a grade on cybersecurity, what would it be? AP: It would have to be an F. I mean, if you canât secure the boxes that you have, that would have to be an F.
472880
By Ted Bridis  WASHINGTON - Hackers briefly overwhelmed at least three of the 13 computers that help manage global computer traffic Tuesday in one of the most significant attacks against the Internet since 2002.
389353
Bot software that turns PCs into zombies spreads via holes in Symantec and Microsoft products.
391302
By ASSOCIATED PRESS  Hackers briefly overwhelmed at least three of the 13 "root" computers that help manage global computer traffic Tuesday in one of the most significant attacks against the Internet since 2002.
658952
If malware were insects, botnets would be termites -- they burrow in behind the walls of your security perimeter, lie dormant for a period of time, then attack.
206847
A newly identified malicious program not only messes up its victims' computers, it taunts them too.
432088
Many-headed foe hard to combat Network security analyst Lawrence Baldwin has helped take down his share of bot nets, but he worries that those days may largely be over.â¦