4 ms·

but there are plenty of remotely controlled Cisco routers that can pump out more data than hundreds of thousands of bots Have any examples? I would think that

but there are plenty of remotely controlled Cisco routers that can pump out more data than hundreds of thousands of bots Have any examples? I would think that a router is less than ideal here, as most forms of traffic generation would involve the anemic CPU and control/mgmt plane.

ambiate 14y ago
I'm just speaking from experience from a few of the older IRC botnets I analyzed for a few years. Nearly 200,000 of the 750,000 (+-150,000) bots were on dial-up connections in developing countries. Now, 200,000 packets coming in at 2.8KB/s is nothing to joke about(500MB/s). Yet, 500 packets coming in at 8MB/s, well, on top of the arsenal of random connections. I sometimes forget I'm a dinosaur now when it comes to this sphere of knowledge! I'm sure these days its less one sided. It used to be dialup and windows 95/98 RPC vulnerabilities spreading in the wild using IRC as a middleman. With tor, torrents, etc, I imagine the game has drastically changed in the past 6 years. It is too bad there are not many jobs in this field, I would gladly make a lifetime out of it. I was on a team that created an anti-bot-net which would reinfect, secure, and alert of the already infected machine. We determined that it could prove to be more destructive than the original botnet, because it wastes resources, while we could actually impact the way a machine behaved for the owner. This could also lead to legacy machines failing due to windows updates or firewall rules.
- yid 14y ago
  > I was on a team that created an anti-bot-net which would reinfect, secure, and alert of the already infected machin While I'm sure your intention was benevolent, I'm pretty sure that's illegal under current laws. There's probably a reason that reputable AV vendors don't use that practice; I would hate to have unknown entities helpfully "patch" my machine.
  - ambiate 14y ago
    Exactly, which was the reason we retracted the project. It was truly the greatest learning experience of my life.
VLM 14y ago
If I were a bad guy I would enter a single config line static routing some "chunk of the internet" at the victim. That loss of production traffic would likely be rather quickly noticed... but for a little while it could be pretty impressive. Lets say you have a content provider (as opposed to an eyeball provider) and it hosts nothing in Chinese. So nearly all traffic from APNIC netblocks is botnets and spammers WRT your content so your firewall normally would dump it all. However an attacker could static route several /8 APNIC blocks to someone or something and all you'd notice is your firewall discarding less. Of course the poor guy its all static routed to (perhaps one of your own systems?) would see some weird stuff incoming. Someone who knows what they're doing could have a lot of "fun" with a BGP speaking router depending on how intelligently its peers are configured.

ambiate 14y ago

I'm just speaking from experience from a few of the older IRC botnets I analyzed for a few years. Nearly 200,000 of the 750,000 (+-150,000) bots were on dial-up connections in developing countries. Now, 200,000 packets coming in at 2.8KB/s is nothing to joke about(500MB/s). Yet, 500 packets coming in at 8MB/s, well, on top of the arsenal of random connections. I sometimes forget I'm a dinosaur now when it comes to this sphere of knowledge! I'm sure these days its less one sided. It used to be dialup and windows 95/98 RPC vulnerabilities spreading in the wild using IRC as a middleman. With tor, torrents, etc, I imagine the game has drastically changed in the past 6 years. It is too bad there are not many jobs in this field, I would gladly make a lifetime out of it. I was on a team that created an anti-bot-net which would reinfect, secure, and alert of the already infected machine. We determined that it could prove to be more destructive than the original botnet, because it wastes resources, while we could actually impact the way a machine behaved for the owner. This could also lead to legacy machines failing due to windows updates or firewall rules.

yid 14y ago
> I was on a team that created an anti-bot-net which would reinfect, secure, and alert of the already infected machin While I'm sure your intention was benevolent, I'm pretty sure that's illegal under current laws. There's probably a reason that reputable AV vendors don't use that practice; I would hate to have unknown entities helpfully "patch" my machine.
- ambiate 14y ago
  Exactly, which was the reason we retracted the project. It was truly the greatest learning experience of my life.

VLM 14y ago

If I were a bad guy I would enter a single config line static routing some "chunk of the internet" at the victim. That loss of production traffic would likely be rather quickly noticed... but for a little while it could be pretty impressive. Lets say you have a content provider (as opposed to an eyeball provider) and it hosts nothing in Chinese. So nearly all traffic from APNIC netblocks is botnets and spammers WRT your content so your firewall normally would dump it all. However an attacker could static route several /8 APNIC blocks to someone or something and all you'd notice is your firewall discarding less. Of course the poor guy its all static routed to (perhaps one of your own systems?) would see some weird stuff incoming. Someone who knows what they're doing could have a lot of "fun" with a BGP speaking router depending on how intelligently its peers are configured.