Botnet Stalkers Share Takedown Tactics at RSA (
Page 1 of 2 )
Security researchers who specialize in the infiltration and pursuit of botnet operators lay out their methods for finding, monitoring and shutting down individuals who control networks of infected computers.SAN FRANCISCO—A pair of security researchers speaking here at the ongoing RSA Conference Feb. 7 demonstrated their techniques for catching botnet operators who use secret legions of infected computers to distribute malware programs and violent political propaganda.
The botnet experts, both of whom are employed by anti-malware software maker FaceTime Communications, based in Foster City, Calif., detailed how they identified and pursued individuals believed to be responsible for running a pair of sophisticated botnet schemes, which have been subsequently shut down or significantly scaled back.
Addressing a packed room of conference attendees, Chris Boyd, director of malware research at FaceTime Security Labs, and Wayne Porter, director of special research for the company, detailed their efforts to infiltrate the botnet community and find the people responsible for running underground networks believed to have harbored as many as 150,000 compromised computers.
This eVideo shows how to defend against botnet infestations. Watch it here.
One of the botnets uncovered by the researchers was based in the United States and was used to deliver malware code including spyware that stole credit card data from e-commerce systems for the purpose of committing fraud. The other crimeware distribution campaign appears to have been used by radical Middle Eastern ideologists to espouse violent messages of world domination and steal money to buy satellites, radios and computer equipment.
Porter and Boyd offered a rare inside glimpse into the world of botnet herders, which the researchers entered by hanging out on the shady online bulletin boards and chat relays where the schemers meet to share the tricks of the trade and their malware programs. By luring the prolific fraudsters to offer details about their work, and spying on the criminals, the researchers claim to have pieced together the identities of several of the unsavory individuals and helped take down their networks of subverted machines.
In the case of the U.S.-based botnet, which was actually made up of two zombie networks, the operators secretly distributed a commercially available remote computer management application made by Famatech to unsuspecting end users via instant messaging systems and hid the program on their devices. Once the software was installed, the devious parties used it to load malware onto the machines, including a Perl script dubbed "Carder," which takes advantage of holes in several e-commerce shopping cart applications to steal peoples usernames, passwords, credit card numbers and PayPal account information.
Starting with a tip from another malware researcher identified only by the screen name "Rince" about the people believed to be responsible for running the zombie network, FaceTimes Boyd—who is often identified by his own online alter-identity, "Paper Ghost"—said the sophisticated con game began to unravel.
Is the botnet battle already lost? eWEEK goes to one companys research facility to study live botnets in action. Click here to see what they found.
After laying out so-called honey pots in hopes of finding the signature work of two of the suspected botnet purveyors, known by the comic booklike villain monikers MC-Zero and Ink, Boyd said the researchers found their quarry and began examining posts the individuals made to shadowy sites in which they bragged about elements of their attacks.
"You have to be careful that people arent just yanking your chain, but we tried to use social engineering to get as much information as possible about these botnets," Boyd said. "You have to get information from nontraditional channels, and working with Rince we were soon looking at live feeds of their IRC chats."
By taking the information the scammers unknowingly handed over to the researchers—which included pictures of their homes and cars—and determining where the individuals lived and carried out their work, the security experts were able to partner with ISPs to get the criminals respective botnets shut down.
Next Page: Tracking down the other zombie net.
Network Security & Hardware 
