 
|
|
In partnership with:
March/April 2006 issue Zero Day of the DeadThe data load that has accompanied the globalization of trade would
make even Atlas stagger. And that’s without the added burden
of counter-terrorisAs you read this, zombie programs Once upon a time script kiddies were happy simply to infect computers
with a virus and unleash an unexpected cascade of tumbling letters.
But filthy lucre has corrupted the intellectual curiosity that drove
those exploits; now there’s big money in delivering insidious
programs that hide, waiting silently for instructions from distant
masters. IT analyst firm Gartner says: “Although botnets are not new, they were previously referred to as zombie networks, their use as a vehicle for DDoS (Distributed Denial of Service) attacks has been the biggest concern. However, organizations are now realizing their impact in other forms of attack, for example in spam relays and as hosts for phishing web sites.” Gartner estimates that bots generate more than 70% of spam, and that through 2007, half of internet-active firms that do not implement prevention technologies will suffer service or financial losses due to botnet attacks. Waspish attractions Legitimate origins So far so good, but users need help or even chastisement (for using profanity, for example) and bots help fill the need. A bot automatically responds to events while appearing to be a normal user on the channel. The bot may protect the channel from abuse, allow privileged users access to special features, log events, provide information, or host games. A quiz program is a typical example. Source code for bots is freely available (for example, www.energymech.net or www.eggheads.org). While there are many legitimate uses, bots and botnets add an extra dimension to malware security. Richard Ford, research professor at Computer Sciences’ Florida Institute of Technology, says botnets are “a great illustration of the maxim ‘your insecurity makes my system insecure’.” You can be damaged by botnets without being infected, he says, and yet defensive strategies currently concentrate on endpoints—preventing individual infections—not on the botnet itself, and not on the fact we contribute to each others’ security.
Ford likes an insect metaphor: you can squash one ant but it makes no difference. It is only when you destroy the queen you know you are safe. “If we don’t kill the centre of the ‘colony’ we’re simply engaged in a war of attrition with an enemy who always has the upper hand,” he says. Yet he cannot say for certain how a botnet might be destroyed, “Killing the colony might require attacking machines you don’t own, this opens a whole bunch of difficult legal questions.” But if you can’t shut them down, making sure your neighbour’s machines are not used to launch an attack is also difficult. Their security arrangements may be, legitimately, less bullet-proof than your own. The internet will always be a hotchpotch of machines with different vulnerabilities, and there is no way of forcing a ‘duty of care’ on the whole world, says Jon Fell, partner at IT law firm Pinsent Masons. But according to Fell, the US doctrine of ‘attractive nuisance’, may apply to IT users that fail to keep their systems secure and thus unwittingly participate in acts that damage others. “The example usually given,” says Fell, “is that of a child who sees a swimming pool in a garden, enters the pool and subsequently drowns. A homeowner could be liable for the death if he had failed to take sufficient precautions to prevent such an event, for example, by installing fencing around the pool. “There is certainly a risk that an party who fails to take sufficient steps to keep hackers from entering their systems could be found negligent if the hackers disrupt others via his system,” he says.
But the risk is small, he says. “To date there have not been any cases decided on this point. Even a business whose lax security allows a hacker to launch attacks via its systems may escape liability.” And recent analysis of the doctrine suggests that by itself it will not be enough to launch a successful case for damages. “The person who suffers loss is in the wrong category,” says Fell. “They haven’t been attracted to the computer in the first place.” That leaves legal recourse difficult to pursue, undermining reasons to invest in protection. None the less, modifying a system without a user’s express permission remains punishable by up to five years under section three of the UK’s Computer Misuse Act (CMA) 1990. Detective Inspector Chris Simpson is with the Economic and Specialist Crime Directorate of the Metropolitan Police Computer Crime Unit (CCU). Speaking at (ISC)2 Secure London event, he said: “If an individual is concerned in any one of the following: authoring the malicious code behind the botnet; managing the botnet itself or being responsible for funding or initiating its creation, that person could potentially be convicted as part of a conspiracy to commit offences under the Computer Misuse Act.” Which appears to leave the owner of an infected system in the clear. Simpson stressed the importance of traditional approaches to information security. “People should consider how to prevent or manage infections and DDoS attacks, and also how to raise awareness of IT security within the business environment. Many of the cases investigated by the CCU were infinitely preventable, if only policy was in place and supported by procedure and appropriate management systems,” he said.
Ford thinks the botnet phenomenon will worsen. With commercial
reasons to create zombies growing stronger (see sidebar), the value
of exploits that install bots is rising. “If a botnet owner
wishes to expand his network, and that network makes money, it stands
to reason that a zero-day attack has value to him. The goal of a
botnet is to spread under the radar, so using an unknown exploit
and keeping that exploit out of sight makes sense.” “There is extremely good co-operation between international law enforcement and industry. Results in the UK, US, Canada, Holland and Eastern Europe are evidence of this.” (See sidebar.) But it is the immensity of scale that makes a zero-day exploit so valuable. As Simpson points out: “In the physical world the number of crimes an individual can commit is limited by their physical capacity. In contrast, across the internet, a criminal without any significant assets can target over a billion potential victims.” This rich field of potential victims and the value of infection makes it inevitable botmasters will try to grow their legions of zombies. A zero-day attack is perfect for their diabolical plans: use your head; make them lose theirs. •
|
|
