5 ms·

Infiltrating a Botnet - A Conversation With a Botmaster

126 points by jperras 17y ago

gnosis 17y ago
A masterful bit of deception. Who would have guessed that a botmaster would be so trusting?
- whimsy 17y ago
  What did he have to lose? The researcher had already penetrated his botnet, and if he was hidden behind an "anonymous proxy chain" then his identity wasn't at risk, non?
  - allenbrunson 17y ago
    he had a lot to lose. the "reporter" could have been collecting subtle details, and trying to match them up with known real-world suspects. in his position, i certainly wouldn't have talked. but it's probably a lonely occupation, and who else are you going to talk to.
  - gnosis 17y ago
    Everything he revealed could be used as evidence at his trial, if he was ever caught. Plus, much of what he revealed will be used to make the systems the botmaster tries to hack into more secure. At the very least, he's just making his own life harder, and possibly more dangerous, if some of what he said could be used to track him down.
  - tetha 17y ago
    He gave out a lot of information. If I was in this scene, I would certainly say: too much information. WAY too much information. The researcher now knows a forum which contains up-to-date exploits of this scene, transactions of this scene. That is a boatload of knowledge, especially if one finds currently unknown exploits in there, or starts tracking the money by the transactions made on this forum. Furthermore, the botmaster gave out a lot of information about his illegal activities, so he pretty surely was very, very confident (I'd go as far as calling this overconfident) about his security. Sorry, but coming from this, this guy does not look like a real serious botmaster to me. I mean, if you make lots of money with bots, why whould you give out information about your exploits and your trades, making it easy for the government and security firms to stop you? That's just dumb.
peregrine 17y ago
I'd be interested in seeing the code. I've always wanted to see what that side of the wall does.
falsestprophet 17y ago
Is it possible to monitor bot nets to figure out what they are doing?
- zitterbewegung 17y ago
  I remember steve gibson reverse engineered the protocol for a bot and figured out what it did.
- rabidsnail 17y ago
  I don't know how often this is still true, but it used to be that they would lurk in an irc channel and the botherder would post commands in the channel. Anybody could figure out what was going on by lurking there as well.
- hedgehog 17y ago
  Yep, but it's a lot of work. There at least a few researchers that keep track of bot activity, reverse samples, monitor via wire-compatible clients, etc. From what I gather it's getting harder, some newer worms use decentralized control channels, signed updates, etc. One way to observe worm behavior: http://www.honeynet.org/ http://www.honeynet.org/ SRI writeup on their dissection of Storm: http://www.cyber-ta.org/pubs/StormWorm/report/ http://www.cyber-ta.org/pubs/StormWorm/report/
tsally 17y ago
Solid set of info there. Anyone know or have a guess as to the forum the botmaster linked to? Email's in profile if you don't feel like posting it for the public.
- verroq 17y ago
  The name of the bot is fatalzircd according to the guy and they didnt censor that so its not all lost. After googling that name I found several forums and easily found one with a source code download.
allenbrunson 17y ago
this is a good article. it's pretty clear that, if you had the know-how to write your own botnet software, you could really clean up. you could design your own communication protocol, rather than using irc the way everybody else does, which would help evade detection. windows users are lucky that anybody capable of such a thing probably already has a much more satisfying "real" job. too bad the article devolved into an ad for cisco products at the very end. i was really digging it up to that point.
- jonny_noog 17y ago
  Seconded. I liked it save for the Cisco advertising as well.
katamole 17y ago
Interesting article, but the lack of subtlety in some parts made me cringe, e.g: "wanta be partners?".
Estragon 17y ago
the researcher suggested a TOR audio conference Audio over TOR? I thought it was too slow for that.
- wizard_2 17y ago
  Skype wouldn't work, but all you need is a 12kps stream. The problem with tor is sometimes the nodes are very slow, you could probably pick a path that showed to be faster but as far as I know it's non trivial.
  - eru 17y ago
    May work. Tor is not really that slow. It just has a lot of latency.
flashingpumpkin 17y ago
nice read there. would make sense to post this link here too: http://philosecurity.org/2009/01/12/interview-with-an-adware-author http://philosecurity.org/2009/01/12/interview-with-an-adware...
- tc 17y ago
  This is the kicker: I got to write half of it in Scheme, which probably means that I deployed more Scheme runtime than anybody else on the planet.
fishercs 17y ago
He mentioned old school and then quoted 2005, i dont know if its just me but the idea of a botnet is certainly nothing new, and definately spawned from IRC.. FWIW you could date the article 1999 and throw in mentions of wingates a couple of times and sprinkle on some SOCKS proxy information for flavor and i'd know no different.

126 points by jperras 17y ago

gnosis 17y ago

A masterful bit of deception. Who would have guessed that a botmaster would be so trusting?

whimsy 17y ago
What did he have to lose? The researcher had already penetrated his botnet, and if he was hidden behind an "anonymous proxy chain" then his identity wasn't at risk, non?
- allenbrunson 17y ago
  he had a lot to lose. the "reporter" could have been collecting subtle details, and trying to match them up with known real-world suspects. in his position, i certainly wouldn't have talked. but it's probably a lonely occupation, and who else are you going to talk to.
- gnosis 17y ago
  Everything he revealed could be used as evidence at his trial, if he was ever caught. Plus, much of what he revealed will be used to make the systems the botmaster tries to hack into more secure. At the very least, he's just making his own life harder, and possibly more dangerous, if some of what he said could be used to track him down.
- tetha 17y ago
  He gave out a lot of information. If I was in this scene, I would certainly say: too much information. WAY too much information. The researcher now knows a forum which contains up-to-date exploits of this scene, transactions of this scene. That is a boatload of knowledge, especially if one finds currently unknown exploits in there, or starts tracking the money by the transactions made on this forum. Furthermore, the botmaster gave out a lot of information about his illegal activities, so he pretty surely was very, very confident (I'd go as far as calling this overconfident) about his security. Sorry, but coming from this, this guy does not look like a real serious botmaster to me. I mean, if you make lots of money with bots, why whould you give out information about your exploits and your trades, making it easy for the government and security firms to stop you? That's just dumb.

peregrine 17y ago

I'd be interested in seeing the code. I've always wanted to see what that side of the wall does.

falsestprophet 17y ago

Is it possible to monitor bot nets to figure out what they are doing?

zitterbewegung 17y ago
I remember steve gibson reverse engineered the protocol for a bot and figured out what it did.
rabidsnail 17y ago
I don't know how often this is still true, but it used to be that they would lurk in an irc channel and the botherder would post commands in the channel. Anybody could figure out what was going on by lurking there as well.
hedgehog 17y ago
Yep, but it's a lot of work. There at least a few researchers that keep track of bot activity, reverse samples, monitor via wire-compatible clients, etc. From what I gather it's getting harder, some newer worms use decentralized control channels, signed updates, etc. One way to observe worm behavior: http://www.honeynet.org/ http://www.honeynet.org/ SRI writeup on their dissection of Storm: http://www.cyber-ta.org/pubs/StormWorm/report/ http://www.cyber-ta.org/pubs/StormWorm/report/

tsally 17y ago

Solid set of info there. Anyone know or have a guess as to the forum the botmaster linked to? Email's in profile if you don't feel like posting it for the public.

verroq 17y ago
The name of the bot is fatalzircd according to the guy and they didnt censor that so its not all lost. After googling that name I found several forums and easily found one with a source code download.

allenbrunson 17y ago

this is a good article. it's pretty clear that, if you had the know-how to write your own botnet software, you could really clean up. you could design your own communication protocol, rather than using irc the way everybody else does, which would help evade detection. windows users are lucky that anybody capable of such a thing probably already has a much more satisfying "real" job. too bad the article devolved into an ad for cisco products at the very end. i was really digging it up to that point.

jonny_noog 17y ago
Seconded. I liked it save for the Cisco advertising as well.

katamole 17y ago

Interesting article, but the lack of subtlety in some parts made me cringe, e.g: "wanta be partners?".

Estragon 17y ago

the researcher suggested a TOR audio conference Audio over TOR? I thought it was too slow for that.

wizard_2 17y ago
Skype wouldn't work, but all you need is a 12kps stream. The problem with tor is sometimes the nodes are very slow, you could probably pick a path that showed to be faster but as far as I know it's non trivial.
- eru 17y ago
  May work. Tor is not really that slow. It just has a lot of latency.

flashingpumpkin 17y ago

nice read there. would make sense to post this link here too: http://philosecurity.org/2009/01/12/interview-with-an-adware-author http://philosecurity.org/2009/01/12/interview-with-an-adware...

tc 17y ago
This is the kicker: I got to write half of it in Scheme, which probably means that I deployed more Scheme runtime than anybody else on the planet.

fishercs 17y ago

He mentioned old school and then quoted 2005, i dont know if its just me but the idea of a botnet is certainly nothing new, and definately spawned from IRC.. FWIW you could date the article 1999 and throw in mentions of wingates a couple of times and sprinkle on some SOCKS proxy information for flavor and i'd know no different.