Zombies all over....

ISP Shuts Down Zombie PC Network

enterprisesecurity.symantec.com/content.cfm?articleid=4656&PID=20807901&EID=741
 
Reprinted
From:  Symantec
SEP 14, 2004    ARTICLE ID: 4656

by Paul Roberts
Authorities in Singapore shut down a large network of around 10,000 robot, or "zombie," computers last week, after technicians at Norwegian Internet service provider Telenor ASA stumbled on the illicit network by tracing Internet Relay Chat (IRC) communications from compromised customer PCs on its system.


On Tuesday, officials at the Infocomm Development Authority of Singapore worked with a local service provider to shut down a server controlling the army of IRC robot PCs, or "botnet," after being alerted to the existence of the server by The SANS Institute's Internet Storm Center (ISC) in Bethesda, Md. Although the controlling server has been shut down, malicious hackers may have already resurrected it by pointing compromised hosts to a server at a new Internet address, according to Johannes Ullrich, chief technology officer at the ISC.


Botnets are networks of computers that act like robots, communicating with one another and with a central server, often using IRC. Such networks are created by installing remote access and communication software on the remote systems, often after they are compromised by a computer virus, worm or targeted hacking.


Botnets act in unison through text commands issued via IRC from the central server by the hacker or hackers controlling the network. For example, malicious hackers can instruct the network to flood a particular server or Internet domain with traffic in a denial-of-service (DoS) attack.


"In some sense, botnets are a more dangerous problem than worms and viruses," Ullrich said. "They're an easy way to control 10,000 systems, and you can do absolutely anything with them -- instruct [the compromised machines] to pick up a program and install it, or go to a particular URL or scan for other vulnerable hosts."


Often, the compromised hosts are programmed to look for a particular IRC host name, such as botserver.irc.net. Authorities can cripple such networks by banning that particular host name, he said.


In the case of the network discovered last week, Telenor staff were unable to determine the IRC host name that the machines were seeking. That means the individuals controlling the network may already have relaunched it by assigning to a different server the host name for the robot systems, Ullrich said.


The systems on Telenor's network have been cleaned of the remote-control software used by the botnet, but other systems on the network are likely still infected and can be used in future actions, he said. Even when the host name is known, malicious hackers often maintain a number of different, geographically dispersed servers that all use the same host name, each capable of controlling the network, Ullrich said.


While authorities and Internet service providers are always happy to shut down a botnet, they are also engaged in a little-publicized game of cat and mouse with malicious hackers. Botnets with 10 to 100 compromised hosts are identified and shut down several times a day. Crackdowns on large networks with 10,000 or more hosts are more rare, but they still happen weekly, Ullrich said.


Many of the systems used in botnets are owned by individuals rather than companies and are connected to the Internet by broadband Internet connections. It can be difficult for Internet service providers to spot and clean such infected systems unless they do something unusual, such as taking part in a DoS attack, he said.


And, with students returning to universities following summer break, the botnet problem will likely get worse, Ullrich said.


"Student machines are a classic target," he said.