Botnets: Reasons It's Getting Harder to Find and Fight Them

The perpetual proliferation of botnets is hardly surprising when one considers just how easy it is for the bad guys to hijack computers without tipping off the users.

Botnets have long used a variety of configurations, in part to disguise their control mechanisms -- see What a Botnet Looks Like. But as user-friendly but insecure applications continue to become available -- especially social networking programs used by the non-tech-savvy -- hackers have an ever growing number of security holes to choose from. They're also getting smarter about building resilient architectures, according to botnet hunters who have monitored recent activity.

[ See also: One bot-infected PC = 600,000 spam messages a day and Gang of six' controls botnet of 1.9 million computers ]

Here are four reasons the botnet fight is getting harder, and what to do about it:

1. Operating below the radar
While much of the attention lately has been on botnet activity related to the Conficker worm (see Conficker Group: Worm 4.6 Million Strong), researchers say some of the largest botnets have largely escaped media attention. And that's how the bad guys like it.

Alex Lanstein, senior security researcher at FireEye Inc., a security vendor based in the San Francisco Bay area, said this is because their overlords don't want to make news and let people know their machines are infected. Cimbot, for example, is a piece of malware that has been used to create a botnet that now accounts for about 15 percent of the world's spam, he said.

Paul Royal, principal researcher at Atlanta-based security vendor Purewire Inc., has found several other examples of botnet herders operating below the radar. In one experiment he participated in, Project ZeroPack, he found that automated obfuscation techniques allow the bad guys to engage in such activities as server-side polymorphism. With malware morphing regularly, traditional antivirus vendors have more trouble keeping up with the right AV signatures. The Waledac botnet has used this method with much success.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine