[ news_security_news ]
Losing The Botnet War
David Utter
Staff Writer
2006-10-24
 Insider Reports RSS Feed
The sophisticated SpamThru Trojan delivers a client that performs AV scans to get rid of rivals on a victim's computer and communicates through peer to peer technology. That is just one of many examples of bots that plague people from non-technical web surfers to administrators of vast enterprise networks.
Those admins would like nothing more than to feed some of these bot creators feet first into a tree chipper and get away with it. But those creators do their best to stay well-hidden, and the software they write tries to work in similar fashion.
McAfee research Alyssa Myers wrote at the security software company's Avert Blog about bots and botnetting, and wondered if we as computer users have lost the botnet war.
"Certainly things are looking fairly grim as the rise in the number of variants of IRC bots has grown by leaps and bounds over the last couple of years," Myers said. "Strictly using string-based detection against the unending tide certainly appears to be a lost cause."
Myers did cite some present examples of how bots are being fought by the tech world. Those include the use of behavior-based heuristics to detect bot activity, the broader use of firewalls and even IDS/IPS by home users, and ISP cooperation with security groups in tracking down and shutting off "command and control" channels used by bots.
That cooperation represents a key to the success of future anti-bot efforts. It isn't enough to just shut down the bot channels. ISPs and law enforcement need to cooperate sensibly (as in providing relevant information to investigators and not a massive index of all user data) to track down bot masters and serve them a heaping helping of prosecution and the justice system.
That effort has to extend outside the US. Countries that have developed a reputation for harboring bot makers will need to be encouraged firmly to put a stop to the botnetting activities happening within their borders, too.
---
Tag: Botnet
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Bookmark SecurityProNews 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
