The act of taking down a quarter of a botnet like Symantec did will not only anger the owners of a very successful illegal business. It will also be more difficult to take this botnet 100 percent down due to new updates being pushed through the infected zombies. A more covert approach would have been more successful, said security expert Tommy Chin.
ZeroAccess, one of the largest-known botnets in existence today with more than 1.9 million computers in the network , is becoming a keen problem for security teams. The botnet relies on peer-to-peer (P2P) and command-and-control (C&C) communications architecture to give it a high degree of availability and redundancy.
Symantec just took it down.
Given its construction and behavior, Symantec reports that ZeroAccess appears to be primarily designed to deliver payloads to infected computers. In a ZeroAccess botnet, the productive activity — from an attacker’s point of view — is performed by the payloads downloaded to compromised computers, which boil down to two basic types, both aimed at revenue generating activities.
“One type of payload we’ve seen is the click fraud Trojan,” Symantec wrote in a blog post. “The Trojan downloads online advertisements onto the computer and then generates artificial clicks on the ads as if they were generated by legitimate users. These false clicks count for pay-outs in pay-per-click (PPC) affiliate schemes.”
Proactive and Realistic
Ken Pickering, director of engineering at CORE Security, said that botnets are fairly common and can be largely financially successful for their owners — and that’s part of the reason criminals continue to innovate around their C&C elements and the malware used to grow them.
“The real interesting part of the botnet is how it distributes tasks to the slave machines it controls. The malware itself is usually fairly straightforward, but it’s the obfuscation techniques used to conceal the control servers and the actions the botnet owners take to avoid being shutdown that’s the real trick,” Pickering said.
“I think Symantec’s attack was proactive and a realistic response to this fairly large cybercrime industry. There’s not a whole lot of other ways to combat these guys. But, realistically, disabling the botnet only puts a temporary financial speed bump for these guys. Unless we actively pursue them, they’ll change their tactics and adapt to scenarios like this,” he added.
Bold and Daring
When Symantec is messing with an unknown group of talented criminals, the company may be asking for retaliation, Tommy Chin, technical support engineer at CORE Security, told us. As he sees it, Symantec may need to think about who they are dealing with first, and study the target to an in-depth level before acting.
“The act of taking down a quarter of a botnet will not only anger the owners of a very successful illegal business. It will also create much more difficulty in regards to taking this botnet 100 percent down due to new updates being pushed through the infected zombies. I believe a more covert approach would have been more successful in probability,” Chin said.
“The decentralized P2P based botnet is already pushing a new update that will make the botnet’s communications much more secure and complex. The owners don’t plan to lose their network. They lost a quarter of their earnings, they are mad, and they plan to come back strong bigger than ever. Regardless, Symantec’s attempts were bold and daring.”
An Extreme Approach
Professional security analysts typically approach any system as though it were already compromised, and then work from there, limiting what that environment is allowed to store, modify, or access, according to Kevin O’Brien, enterprise solution architect, CloudLock.
While this approach may be extreme for home users, he told us one can imagine a world in which end-user devices — most likely tablets or mobile platforms that are always connected and that can be remotely managed, similar to how an iPhone OS upgrade can be deployed from Cupertino with minimal-to-no end-user involvement — are collectively monitored and managed as a service.
“This merely shifts the locus of security to the vendor,” he said. “But in doing so the protection of the end-user’s data and assets is transferred to a team that is presumably more experienced and capable than the users are, and who are able to control for this type of exploit on a massive scale and far more quickly than any group of individual users can.”