Authorities in Singapore shut down a large network of
around 10,000 robot, or "zombie", computers this week, after
technicians at Norwegian internet service provider Telenor stumbled
on the illicit network by tracing Internet Relay Chat (IRC)
communications from compromised customer PCs on its
system.
Officials with the Singaporean Infocomm Development Authority
worked with a local internet service provider to shut down a server
that was controlling the army of IRC robot PCs, or "botnet", after
being alerted to the existence of the server by The SANS
Institute's Internet Storm Center (ISC).
However, while the controlling server has been shut down,
malicious hackers may have already resurrected it by pointing
compromised hosts to a server at a new internet address, according
to Johannes Ullrich, chief technology officer at the ISC.
Botnets are networks of computers which act like robots, or
"'bots", communicating with each other and with a central server,
often using IRC. Such networks are created by installing remote
access and communication software on the remote systems, often
after they are compromised by a computer virus, worm or targeted
hacking.
Botnets act in unison through text commands issued via IRC from
the central server by the hacker or hackers controlling the
network. For example, malicious hackers can instruct the network to
flood a particular server or internet domain with traffic in what
is known as a denial-of-service (DoS) attack.
"In some sense, botnets are a more dangerous problem than worms
and viruses," Ullrich said. "They're an easy way to control 10,000
systems and you can do absolutely anything with them - instruct
[the compromised machines] to pick up a program and install it, or
go to a particular URL [uniform resource locator] or scan for other
vulnerable hosts."
Often the compromised hosts are programmed to look for a
particular IRC host name, such as botserver.irc.net. Authorities
can cripple such networks by banning that particular host name, he
said.
In the case of the network discovered this week, however,
Telenor staff were unable to determine the IRC host name that the
machines in the botnet were looking for.
So, while authorities shut down the controlling server, the
individuals controlling the network may already have relaunched the
network by assigning a different server the host name the robot
systems were looking for, Ullrich said.
While the systems on Telenor's network have been cleaned of the
remote control software used by the botnet, other systems on the
network are likely still infected and can be used in future
actions. Even when the host name is known, malicious hackers often
maintain a number of different, geographically dispersed servers
that all use the same host name, each capable of controlling the
network, he said.
While authorities and ISPs are always happy to shut down a
botnet, they are also engaged in a little-publicised game of cat
and mouse, with malicious hackers. Botnets with between 10 and 100
compromised hosts are identified and shut down several times a day.
Crackdowns on large networks with 10,000 or more hosts are more
rare, but still happen weekly, Ullrich said.
Many of the systems used in botnets are owned by individuals
rather than companies and connected to the internet using broadband
internet connections. It can be difficult for ISPs to spot and
clean such infected systems unless they do something unusual, such
as taking part in a DoS attack, he said.
And, with students returning to universities following summer
break, the botnet problem will likely get worse, Ullrich said.
Paul Roberts writes for IDG News Service