Botnets are a major source of evil on the Internet, from spam, phishing attacks, virus propagation and denial-of-service attacks to the stealing of financial information and other illegal activity. Does disbanding them raise legal and ethical implications?
It's now fifteen years since that movie sequel appeared. In 2006, the most primitive Skynet botnets are already quite powerful, even if theyve got a long ways to go before becoming self-aware. Today they're also one of the greatest sources of evil on the Internet. Theyre strong and growing, although their growth is often proportional to the announcement of new major vulnerabilities and viruses that exploit them. Theyre nowhere near as powerful or intelligent as Skynet yet, but give it time. Botnets barely existed just three or four years ago, but they have grown dramatically and are highly flexible in the number of criminal and evil things they can do. In another fifteen years, they might be ready.
What is a botnet? Today it's an illegal collection of hundreds, thousands, tens of thousands or even hundreds of thousands of compromised computers all being controlled with a common infrastructure. There's even one case where a real botnet was found with about 1.5 million machines under one person's control. Incredible. According to Symantec's latest Internet Threat Report, 26% of all bot-infected computers are also located in the United States - making it the number one source of bots. These are most often home computers with viruses or web servers with buggy software that are compromised and then linked together for evil purposes. Theyre usually controlled from a central location as well, providing a single point of failure, but as peer-to-peer botnets are developed the ability to fight this evil will certainly change.
I started writing this column on a topic near and dear to everyones heart: spam. Three years ago spam was a real nuisance to everyone, but it wasnt really a security issue - except for email-borne viruses that were starting to use social engineering to convince people to click on them. How things have changed in a few short years.
I first thought about some security issues with email:
- viruses and Trojans still use spam-like social engineering
- phishing emails for online banking information are now common and do fool people
- stock promotion scams do impact the markets
- PayPal and eBay email scams also do fool people and steal real information
- other social engineering scams, from promises of nude celebrity pictures to the latest World Cup results, often do contain a virus or lead to a website that will give you a virus.
- "click here to unsubscribe" scams will indeed give you more spam, viruses and phishing scams
- spoofed From: addresses use legitimate domain names, making filtering more difficult.
I started to realize that one big source of the problem is actually the botnets now being used to send out spam. They're the transport (and sometimes hosting) mechanism. Since any computer on the Internet is allowed to send mail (1), a botnet is an ideal vehicle for spammers to avoid getting shut down. (1 - Many ISPs now block port 25, which is an excellent trend.) You can even rent botnets by the hour for this very purpose. We have to address the botnet issue if were ever going to combat spam, phishing scams, and other email-related security issues. Filtering and SPF just isn't going to cut it.
Botnets are a major source of Internet evil
Botnets also do much more harm than just send out spam and phishing scams, however. In aggregate they are often used for denial-of-service attacks and extortion against legitimate companies, Google and Yahoo advertising click fraud, and more - such as hosting phishing sites. When the same botnet sends out phishing emails and hosts the phishing site, youve got one-stop shopping. The computer hosting the next Citibank or credit union fraud might be tracked down to your Uncle Bob, who just got a new computer for Christmas but he didn't apply all the security patches fast enough.
Botnets received some good coverage in an excellent article in the Washington Post recently (including accidental disclosure of the botnet owner's tiny home town) because their operators can earn significant money when they install sleazy spyware on all the bots under their control. The bot software (usually, a type of Trojan with keylogger capabilities too) often plays a dual role, stealing the unaware users passwords, banking information, and credit card numbers. While we think of the danger botnets pose to the Internet as a whole, we must also remember these computers are being used in peoples homes. Therefore we can assume that the software is stealing the users private data as well - in addition to his computers bandwidth and resources.
Theres no legitimate purpose for a botnet. And they are now an amplifier for much of the evil on the Internet. A few of them have been shut down by law enforcement (including the one that was first thought to have a population of 100,000, but actually controlled 1.5 million machines!), but most remain. Some have tens or hundreds of thousands of machines under a single person's control. A few of them are being hunted by well-meaning people, but most are unabated. Most people secure their own borders and leave the wild west quite alone. Most people say, "Its not my problem." Well, it is.
Legal and ethical issues
If you found some Trojan bot software on your parent's computer, stealing their credit card information and distributing viruses, would you just wipe the computer, reinstall, and leave it at that? Has it become your problem yet? Would you analyze the botnet, log in yourself as a bot and see if you can disable its command and control center? Is there any point in helping thousands of people along the way?