Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Raising a Botnet In Captivity

timothy posted more than 3 years ago | from the cute-until-they-escape dept.

Botnet 60

holy_calamity writes "Technology Review reports that researchers installed 3000 copies of Windows XP on a high performance cluster at a Canadian university and set loose the Waledac botnet on them. It's the first time researchers have built and operated their own botnet as a strategy to better understand those at large on the internet. Doing it inside an experimental computing cluster removes the legal and ethical complications of experimenting with live botnets that control innocent users' machines."

cancel ×

60 comments

Sorry! There are no comments related to the filter you selected.

Real environments (1)

Anonymous Coward | more than 3 years ago | (#34598424)

I'm not quite sure why they chosen to do that; where is the fun in running a botnet in a simulated environment? Wouldn't it be much better to do it in real environment?

Re:Real environments (0)

Anonymous Coward | more than 3 years ago | (#34598552)

Not really. Sure you have some reliable bots, but most are regularly d/c-ing, which makes examination or control of a single bot sometimes difficult.

Re:Real environments (0)

Anonymous Coward | more than 3 years ago | (#34599192)

Doing it inside an experimental computing cluster removes the legal and ethical complications of experimenting with live botnets that control innocent users' machines.

Please Slashdot, do not ever confuse "innocence" with "terminal stupidity".

Re:Real environments (3, Insightful)

GameboyRMH (1153867) | more than 3 years ago | (#34599406)

Terminal stupidity?

How to catch a virus:

1. Install/buy a new PC with Windows 7, now more secure than ever!

2. Install the usual apps, like the ever popular Adobe Reader, Flash, and Java RE, maybe even Firefox because it's faster and more secure! Also make sure you have an AV, whether it's AVG or the 1-year subscription to Norton or McAffee that came with your PC.

3. Using the new super-secure IE8 browser (or even Firefox) at any time when the number of zero-day/unfixed exploits for it or any of the apps you installed in step 2 is greater than zero, browse your legitimate website of choice.

4. A malicious ad with brand-new and/or metamorphic code exploits one or more of the apps mentioned in steps 2-3 and pwns your user account with no user interaction required. In some cases it may exploit a vulnerability in Windows itself and infect your whole machine.

5. Congratulations! You're a botnet peer!

Yes, terminal stupidity. (1)

r00t (33219) | more than 3 years ago | (#34603940)

Us non-stupid users run OpenBSD on sparc64, Linux on PA-RISC, or FreeBSD on IA-64.

Note: do not browse the web with telnet unless you want to get pwn3d. It has everything to do with **terminal** stupidity, as in ESC [ evilness.

Re:Real environments (1)

easyTree (1042254) | more than 3 years ago | (#34598780)

I'm not quite sure why they chosen to do that

I guess it's one more string to their bow. Now they're able to offer students experience with botnets - ready for the real world where they can go on to become some of the best botnet authours around :D

PS. I'm sure you can do better than seven banner ads per eight-paragraph page. Please try harder.

Re:Real environments (-1)

Anonymous Coward | more than 3 years ago | (#34598878)

My name is Mr.Moses Odiaka.I work in the credit and accounts department of
Union Bank of NigeriaPlc,Lagos, Nigeria. I write you in respect of a
foreign customer with a Domicilliary account. His name is Engineer Manfred
Becker. He was among those who died in a plane crash here in Nigeria
during the reign of late General Sani Abacha.

Since the demise of this our customer, Engineer Manfred Becker, who was an
oil merchant/contractor, I have kept a close watch of the deposit records
and accounts and since then nobody has come to claim the money in this a/c
as next of kin to the late Engineer. He had only $18.5mllion in his a/c
and the a/c is coded. It is only an insider that could produce the code or
password of the deposit particulars. As it stands now,there is nobody in
that position to produce the needed information other than my very self
considering my position in the bank.

Based on the reason that nobody has come forward to claim the deposit as
next of kin, I hereby ask for your co operation in using your name as the
next of kin to the deceased to send these funds out to a foreign offshore
bank a/c for mutual sharing between myself and you. At this point I am the
only one with the information because I have removed the deposit file from
the safe.By so doing, what is required is to send an aplication laying
claims of the deposit on your name as next of kin to the late Engineer. I
will need your full name and address telephone/fax number,company or
residential, also your bank name and account,where the money will be
transfer into.

Finally i want you to understand that the request for a foreigner as the
next of kin is occassioned by the fact that the customer was a foreigner
and for that reason alone a local cannot represent as next of kin. When
you contact me, then we shall discuss on how the money will be split
between us and others we shall also speak in details.I am currently in
europe for a six months course,you can reach me on this number for further
discussion 0031 623 866 723.Kindly send your reply to my private email
address stated below mosesodig1@zwallet.com or mosesodiaka1@yahoo.com

Trusting to hear from you,

I remain Respectfully yours,

Mr Moses Odiaka.
mosesodig1@zwallet.com or mosesodiaka1@yahoo.com
(0031 623 866 723)

Re:Real environments (1)

easyTree (1042254) | more than 3 years ago | (#34598904)

Hi

Would you be kind enough to use the contact page on my website to send me a private message:
  * http://www.419eater.com/ [419eater.com]

Thanks :D

Re:Real environments (1)

GameboyRMH (1153867) | more than 3 years ago | (#34599452)

I wonder if these guys are using some kind of app that "broadcasts" spam onto a number of different commenting systems, including Slashdot, the worst place on the Internet to spam.

Re:Real environments (0)

Anonymous Coward | more than 3 years ago | (#34599672)

I wonder if you lack a sense of irony. Let me explain it for you: a notorious SPAM message posted in the comments section of a story about an experimental botnet is an example of irony.

Re:Real environment (0)

Anonymous Coward | more than 3 years ago | (#34600006)

Oops. That was $18.5. Never mind.

Imagine... (-1)

Anonymous Coward | more than 3 years ago | (#34598434)

...a beowulf cluster of those...

Obligatory XKCD (5, Funny)

NickFortune (613926) | more than 3 years ago | (#34598438)

Re:Obligatory XKCD (2)

chichilalescu (1647065) | more than 3 years ago | (#34598470)

do you think they're going to cite him when they publish their results?

Re:Obligatory XKCD (1)

Pharago (1197161) | more than 3 years ago | (#34598702)

this is the first thing i thought upon reading the article :)

Re:Obligatory XKCD (1)

oiron (697563) | more than 3 years ago | (#34598812)

Really, what else is one to think?

I wonder if they actually have a graph display...

Re:Obligatory XKCD (0)

camperdave (969942) | more than 3 years ago | (#34599866)

That may have been what gave them the idea in the first place.

Were they.. (2, Insightful)

Anonymous Coward | more than 3 years ago | (#34598476)

licensed copies?

Re:Were they.. (4, Funny)

AndGodSed (968378) | more than 3 years ago | (#34598574)

Where They...

*Puts on Sunglasses*

Licensed Copies?

YYYEEAAAAHHHHHhhhhh!

Re:Were they.. (-1)

tautog (46259) | more than 3 years ago | (#34600096)

Fuck yo couch, nigga!

Re:Were they.. (2)

fahlenkp (1939942) | more than 3 years ago | (#34599074)

At a large University, Windows XP licenses are trivally cheap. I believe at my last job $5. If you tell them you are running an experiment like this, it is even cheaper. People give M$ a bad rap on licensing. A lot of times it is cheaper than Red Hat when you have a number of computers.

Re:Were they.. (1)

AHuxley (892839) | more than 3 years ago | (#34599270)

XP would be fine for this as the University has paid for "MS XP" for all over a set time.
MS has learned from this "friendly" era and now likes the idea of a 24/7 on site computer system to count the "number of computers" using MS products and then count much more $ flowing back.
The bad rap on licensing is getting more real, the past was just playing 'nice' to get MS products on site.
A real fun study would be some pretty 'graph' of total cost of ownership/longterm rental/cleanup/admin teams for 3000 copies of Windows XP vs other more mature/secure OS options at that time, year after year ...

Re:Were they.. (0)

Anonymous Coward | more than 3 years ago | (#34599482)

At a large University, Windows XP licenses are trivally cheap. I believe at my last job $5. If you tell them you are running an experiment like this, it is even cheaper. People give M$ a bad rap on licensing. A lot of times it is cheaper than Red Hat when you have a number of computers.

MS still deserves a bad rap on licensing. It's not just a moneymaker for them. It's a form of leverage they can pull out whenever it's convenient. They turn a blind eye to piracy when it suits their marketshare figures for example.

The only reason they let university students/staff have Windows so cheap is not the goodness of their hearts for the next generation or some crap like that. They want the next generation of students and research and important projects to all rely on Windows. They want students working with it from cradle to grave knowing nothing else. They derive more value from that than you do from the discounts they offer, therefore IMO they are still shafting you.

If you want Red Hat and you want it cheap it's called Fedora and community support. I don't understand why you'd complain about licensing costs for software available under the GPL. Presumably your university has its own IT department so you wouldn't need vendor support.

Re:Were they.. (0)

Anonymous Coward | more than 2 years ago | (#34602126)

Oh give it up already, really. The evangelism is pointless here, so it's annoying with no cause. People on Slashdot who use Windows are doing so for reasons beyond the corporate hegemony controlling their sheeplike brains. Save your preaching.

Re:Were they.. (0)

Anonymous Coward | more than 2 years ago | (#34602786)

Oh yeah?
Well fuck you!

Re:Were they.. (0)

Anonymous Coward | more than 2 years ago | (#34602198)

At most universities, the Engineering department already has unlimited MS licenses to dish out to all students and faculty.

http://msdn.microsoft.com/en-us/academic/default

Re:Were they.. (1)

X0563511 (793323) | more than 3 years ago | (#34605284)

You should learn what a MAK [wikipedia.org] is for.

To the cloud!!? (0, Troll)

Anonymous Coward | more than 3 years ago | (#34598496)

Considering that they most assuredly have the go ahead from Redmond to install 3000 copies of XP. (because Canadian universities sure as hell could not afford to license it legally). Perhaps this is really just an experiment in cloud computing sponsored by Microsoft....

Re:To the cloud!!? (0)

Anonymous Coward | more than 3 years ago | (#34598634)

The used windows XP because windows 7 would be infected too fast for them to have time to study.

Re:To the cloud!!? (2)

tibit (1762298) | more than 3 years ago | (#34598684)

They most likely have a volume site license, and they didn't have to do anything special -- just installed it and that's it. 100% legal.

Only if you pay (0)

Anonymous Coward | more than 3 years ago | (#34599348)

Contrary to what seems to be common belief here, you don't get free XP because you have a volume license. You have to pay for those copies.

Re:Only if you pay (2)

Tacvek (948259) | more than 3 years ago | (#34599610)

True enough, although the costs of volume licenses can be absurdly cheap.

Microsoft also has quite a few different licensing programs beyond the standard Volume licensing one. For example they have at least one program for Academic Institutions where you pay per product per staff member, rather than per product per installed computer. For example, the Microsoft Enrollment for Education Solutions program works like that.

point being? (2)

internet-redstar (552612) | more than 3 years ago | (#34598506)

... and they discovered it's utterly uselessness?

Re:point being? (1)

BSAtHome (455370) | more than 3 years ago | (#34598820)

it is called Windows Genuine Advantage...

Re:point being? (-1)

Anonymous Coward | more than 3 years ago | (#34598908)

They must get real tired of hearing the Windows system error chime looping on 3000 machines. Probably sounds like someone threw a ton of hand bells down the stairs of one of the World Trade Center towers. You know, before the sand niggers blew them up.

Re:point being? (0)

Anonymous Coward | more than 3 years ago | (#34603416)

hey! jews prefer to be called kikes.

Re:point being? (0)

Anonymous Coward | more than 3 years ago | (#34599186)

I figure the same... I mean, wouldn't it be a mono-culture of identical machines? even the speed between the machines would have been pretty similar... I'm not sure what new information they would be testing,,,

Re:point being? (1)

GameboyRMH (1153867) | more than 3 years ago | (#34599484)

XP is still by far the most popular OS, and Windows 7 has much better security so it probably has a much smaller percentage of infected machines than XP, on top of its smaller market share. So using an all-XP environment isn't that unrealistic.

Grammar, please. (0)

Anonymous Coward | more than 3 years ago | (#34604578)

Try:

a) And they discovered its utter uselessness?
b) And they discovered it's utterly useless?

a + b != c

Shouldn't they use a bigger sandbox. (2)

PDX (412820) | more than 3 years ago | (#34598532)

After effects, more research needed. Cylon sentience attained on the first day. They keep it running until Tricia Helfer steps out of their 3D printer.

Re:Shouldn't they use a bigger sandbox. (1)

ColdWetDog (752185) | more than 3 years ago | (#34600536)

They keep it running until Tricia Helfer steps out of their 3D printer.

Why the hell would you stop then?

Wow (-1, Flamebait)

exa (27197) | more than 3 years ago | (#34598586)

Fucking monkeys doing research with windows botnets! Hilarious! :)

Really? (2)

yerktoader (413167) | more than 3 years ago | (#34598800)

This is the FIRST time a botnet has been studied in captivity? Did they need an excuse? A hall pass?

Anyone got a good reason why it took this long to study a botnet in captivity when researchers have been able to purchase these tools on black hat sites for as long as they have? Otherwise I call shenanigans. [ebaumsworld.com] Red tape, bureaucracy, what have you.

Re:Really? (1)

Anonymous Coward | more than 3 years ago | (#34599086)

I have personally built clusters to test out viruses and botnets. In fact, I'd be willing to bet that almost every single botnet is born in an environment like this. 3000? that's just a waste of money. I wrote my own personal botnet (for late night take overs to run automated tests) using a collection of VMs (6) on my desktop. Once it felt good I just installed it somewhere. What do they really hope to gain by watching the same thing happen 3000 times?

What a waste of resources, hope they at least made the payload f@h or something.

Re:Really? (0)

Anonymous Coward | more than 3 years ago | (#34599110)

ebaumsworld? really?

Re:Really? (1)

AHuxley (892839) | more than 3 years ago | (#34599346)

Could be some fine print in the 'for edu use only' bulk discount?
You get to study using the OS, not so much study the workings of the OS?

!botnet (0)

Anonymous Coward | more than 3 years ago | (#34599894)

This is the FIRST time a botnet has been studied in captivity?

Probably not, but isn't a botnet without a 'net connection just a worm?

I thought the whole point of a botnet was that it received external commands.

From TFA: Fortunately, the new approach is being tested using a high-powered computing cluster that is safely isolated from the Internet.

Re:!botnet (1)

gnapster (1401889) | more than 3 years ago | (#34600734)

...isn't a botnet without a 'net connection just a worm?

Not if the controlling computer of the botnet is on the same virtual network. They might even introduce virtual servers so they can try out DDoS attacks.

Re:Really? (1)

pinkushun (1467193) | more than 2 years ago | (#34601660)

This project, which started some 7 years ago, was delayed while waiting for the 3000 XP PC's to catch up with automatic updates.

Re:Really? (1)

owlstead (636356) | more than 2 years ago | (#34603188)

Quickly, somebody mod this up! I want to see how this ends before I need to restart my computer - it just finished downloading them automatic updates.

Re:Really? (2)

JMonty42 (1961510) | more than 2 years ago | (#34601996)

This definitely isn't the first time this has been done. Maybe it's the first time anybody has done it with an unnecessarily large cluster of 3000 (all infected) computers. I also think this study is flawed and mostly pointless. First of all, command and control-style botnets are getting easier and easier to mitigate. The real threat is from peer-to-peer botnets. The most useful research taking place as of late is not being done in a closed environment cut off from the rest of the world on a botnet that hasn't been a threat for several months. That research is being done by taking over or infiltrating known botnets that are using newer peer-to-peer botnet protocols [T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling. "Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm." In USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2008.] and [B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, and G. Vigna. "Your Botnet is My Botnet: Analysis of a Botnet Takeover." Technical report, University of California, May 2009.] Also, instead of infected every single computer on the cluster, they should have studied more about the ways the botnet spreads by only infecting 25% or so of the network. Other useful projects related to peer-to-peer botnets is in trying to be one step ahead of the botnet developers. These kind of projects predict what the new peer-to-peer botnet protocols will be so they can better protect computers against being infected by them [Günther Starnberger, Christopher Kruegel, and Engin Kirda. "Overbot: A Botnet Protocol Based on Kademlia." In Proceedings of the 4th Conference on Security and Privacy in Communication Networks (SecureComm’08), pages 1–9, 2008.] I just think this "research" project is getting more press than it should while others that are doing more aren't getting as much.

Re:Really? (1)

dbIII (701233) | more than 3 years ago | (#34603506)

Until relatively recently MS had never heard of clusters so doing this would have been a huge time wasting pain. It probably is one of the first times this has been done at such a scale. Even now it's a case of "ok, so I can cluster MS Windows now - but WTF can I run that can make use of it being a cluster?". Without the software to run on the things they are rare.

This can't be a first (0)

Anonymous Coward | more than 3 years ago | (#34598884)

Seriously, is this the first time this and been done?

    I would have thought that mcafee and semantic and the other anti-virus companies would have been doing this as a matter of course for the past decade.

What on earth are their subscription fees for?

Re:This can't be a first (1)

metageek (466836) | more than 3 years ago | (#34599174)

profit

Dissection Vs. Observation (1)

Anonymous Coward | more than 3 years ago | (#34598914)

I think it's interesting that our software mechanisms have become so advanced that we can't dissect them to understand what they are doing, we have to observe them in their environments to understand how they work or perhaps they just couldn't be bothered to sink resources into better analysis techniques of bytecode...

innocent users! (0)

Anonymous Coward | more than 3 years ago | (#34599338)

innocent users

Ha! I like that.

They aren't really studying the problem (2)

FlapHappy (937803) | more than 3 years ago | (#34599370)

It would be far more beneficial to (almost) everyone if they studied the people involved in creating botnets in captivity. If not for the legal issues involved with that idea...

Re:They aren't really studying the problem (1)

pinkushun (1467193) | more than 2 years ago | (#34601710)

A corroborative study would involve PC users, in captivity, with such expert tests as: flashing ads promoting free stuff, click to clean your infected PC, and chatting with horny single females in your area (now!).

The question remains (1)

Creon04 (1692936) | more than 2 years ago | (#34602520)

"It was [...] something of a challenge to convince the owner of a cluster worth around $1 million that installing malware onto it was a good idea." The question remains: is he referring to Waledac or Windows xp?

First time... right (0)

Anonymous Coward | more than 2 years ago | (#34602562)

Lawlz I say. This is the first time someone has openly bothered to declare it's the first time. Other people just did their thing and not brag about it. I mean isn't that done at hackfest every year?

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>