Is the Botnet Battle Already Lost?

Its dress-down Friday at Sunbelt Softwares Clearwater, Fla., headquarters. In a bland cubicle on the 12th floor, Eric Sites stares at the screen of a "dirty box," a Microsoft Windows machine infected with the self-replicating Wootbot network worm.

Within seconds, there is a significant spike in CPU usage as the infected computer starts scanning the network, looking for vulnerable hosts.

In a cubicle across the hall, Patrick Jordans unpatched test machine is hit by the worm, prompting a chuckle from the veteran spyware researcher.

Almost simultaneously, the contaminated machine connects to an IRC (Internet Relay Chat) server and joins a channel to receive commands, which resemble strings of gibberish, from an unknown attacker.

"Welcome to the world of botnets," said Sites, vice president of research and development at Sunbelt, a company that sells anti-spam and anti-spyware software.

"Basically, this machine is now owned by a criminal. Its now sitting there in the channel, saying Im here, ready to accept commands," Sites explained.

A botnet is a collection of broadband-enabled PCs, hijacked during virus and worm attacks and seeded with software that connects back to a server to receive communications from a remote attacker. And these botnets are everywhere.

According to statistics released by Symantec, an average of 57,000 active bots was observed per day over the first six months of 2006.

During that period, the anti-virus vendor discovered a whopping 4.7 million distinct computers being actively used in botnets to spit out spam, launch DoS (denial of service) attacks, install malware or log keystrokes for identity theft.

Botnets filled—and easily replenished—with compromised Windows have emerged as the key hub for well-organized crime rings around the globe, using stolen bandwidth from drone zombies to make money from nefarious Internet activity, according to security experts tracking the threat.

From adware and spyware installations to spam runs and phishing attacks, CPU cycles from botnets drive a billion-dollar underground business that thrives on lax computer security and uses "money mules" to ship physical items around the world.

Click here to read more about money mules.

Now, there is a general feeling of hopelessness among security professionals involved in finding and disabling botnets. It remains to be seen how this despair affects security products and the attitudes of the technology executives who rely on them.

"Weve known about [the threat from] botnets for a few years, but were only now figuring out how they really work, and Im afraid we might be two to three years behind in terms of response mechanisms," said Marcus Sachs, a deputy director in the Computer Science Laboratory of SRI International, in Arlington, Va.

SRI is a nonprofit research institute that provides support for the Department of Homeland Securitys Cyber Security Research and Development Center.

The battle against the bots has been manned by volunteers who pinpoint the botnet command-and-control infrastructure and work with ISPs and law enforcement authorities to disable them. Now, there is a general feeling of hopelessness as botnet hunters discover that, after years of mitigating command and controls, the effort has largely gone to waste.

"Weve managed to hold back the tide, but, for the most part, its been useless," said Gadi Evron, a security evangelist at Beyond Security, in Netanya, Israel, and a leader in the botnet-hunting community. "When we disable a command-and-control server, the botnet is immediately re-created on another host. Were not hurting them anymore," Evron said in an interview with eWEEK.

"Were fighting a war of intelligence. The botnet herders keep advancing and moving forward at a fast rate, and we just cant keep up. There are just too many obstacles in our way," Evron added.

The complex setup now includes the use of hijacked computers to host the DNS (Domain Name System) servers that provide domain resolution services for the rogue.

This allows a bot herder to dynamically change IP addresses without changing a DNS record or the hosting—and constant moving around—of phishing Web sites on bot computers.

Statistics from multiple sources justify Evrons pessimism. According to data culled from Microsofts MSRT (Malicious Software Removal Tool), back-door Trojans and bots represent a "significant and tangible threat to Windows users."

Since the first iteration of the MSRT in January 2005, the tool has removed at least one Trojan from about 3.5 million unique computers. Of the 5.7 million infected Windows machines, about 62 percent was found with a Trojan or bot.

Next Page: Cat-and-mouse game.