Re: The Criminal Underground: A Walk on the Dark Side

[Jim Murray <jim () digitaldaemons co uk>]

Valdis.Kletnieks () vt edu wrote:

> You want a *real* headache, contemplate the fun we'll have if the bad guys
> ever release something that takes advantage of the emergent-systems properties
> of self-assembling networks (basically, imagine a Storm worm, except it's able
> to re-find other copies of itself dynamically if the C&C gets nuked.
>
> http://www.trnmag.com/Stories/2003/032603/Network_builds_itself_from_scratch_032603.html
>
> http://www.washingtonpost.com/wp-srv/style/longterm/books/chap1/emergence.htm
>
> Now imagine trying to get something like *that* out of your Internet. ;)

I fear something like this either already exists or is well into it's
development cycle. The hard part is the initial discovery protocol - ie.
how a node finds it's first 'neighbour'. Getting that right is the most
critical part to the overall success of the scheme. It needs to be
something that's not going to be easy to filter since it will,
inevitably, be picked apart byte by byte within days.

Model it on a peer to peer network with no centralised control
(gnutella?) and all you really need to bolt on is the discovery
protocol. The larger the network grows the harder it will become to
break it, the number of alternate 'paths' increases much faster then the
host count.

Even better, if the data is all encrypted (with constant noise to thwart
pattern analysis) there's no way to identify a bot-herder at network
level, he simply joins the network as a regular client and sends his
commands over the bot network. All you will see is the same type of
encrypted traffic that's passing between all the other bots so even if,
by some fluke, you identify the 'control' machine there's no way to
*prove* it's a control machine.

A fully self-healing peer to peer botnet just too juicy a goal for the
criminals not to be working towards it.

Jim.

-- 
      DigitalDaemons IT Services.
---------------------------------------
   E-Mail : jim () digitaldaemons co uk
       PGP Key ID : 0xB7066495
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.