Botnets 'the Swiss Army knife of attack tools'
Hacker militias can turn to botnets for instant cyberattacks
Computerworld - Hacker militias reach for the closest tool at hand -- botnets already up and running, already reaping ill-gotten gains -- when they mobilize to attack the information infrastructure of other countries, security experts say.
"They just pick up what they use every day," said Joe Stewart, director of malware analysis at SecureWorks Inc. and a noted botnet researcher. "[Militias] don't have much time to ramp up, just days, so it has to be something already in use."
Although militias may be at the bottom of the cyberwar food chain, that doesn't mean they haven't caused chaos. Researchers believe that in 2008, Russian hackers marshaled a force of previously compromised computers -- one or more botnets -- to carry out distributed denial-of-service attacks (DDoS) that knocked offline many of the Web sites in the former Soviet republic of Georgia. At the time, military forces from Georgia and Russia were fighting over disputed territory.
DDoS attacks flood sites with so many spurious requests that the sites' servers are overwhelmed and can't handle legitimate requests, are knocked offline, or are taken offline by the hosting firm or Internet provider.
According to Stewart and other researchers, one of the botnets drafted for the brief cyberskirmish was Black Energy, a Trojan horse-hijacked army of PCs thought to have been used to hit Citibank last year. Since then, Stewart has identified its successor, Black Energy 2, which he said is currently being used to launch DDoS attacks against Russian banks. Stewart speculated that the criminals behind Black Energy 2 attack the banks' Web sites to distract security teams as online accounts are pillaged, much like a criminal crew might stage a fire to distract police from a bank robbery across town.
Black Energy 2 could be the weapon Russian militias reach for next time.
"Botnets are the Swiss Army knife of attack tools," said Marc Fossi, manager of research and development for Symantec Corp.'s security response team. "Hackers use them to relay spam, for phishing and to post Web-based attacks or malcode. They're the engine that drives criminal activity on the Internet."
DDoS attacks are the "blunt end of what they can do," Fossi added.
- After Google-China dust-up, cyberwar emerges as a threat
- Targeted attacks test enterprise security controls
- Is the U.S. the nation most vulnerable to cyberattack?
- In cyberwar, who's in charge?
- Schmidt: Private sector key to stopping Google-style attacks
- Threat of cyberattacks from overseas high, federal IT execs say
- Estonia readies for the next cyberattack
- Think tank in Estonia ponders war in cyberspace
- Botnets 'the Swiss Army knife of attack tools'
- 'Cyber War' author: U.S. needs radical changes to protect against attacks
- Special report: Web giants attacked
- Top 10 Reasons to Strengthen Information Security with Desktop Virtualization Regain control and reduce risk without sacrificing business productivity and growth
- Preventing Sophisticated Attacks: Anti-Evasion & Advanced Evasion Techniques McAfee Next Generation Firewall applies sophisticated analysis techniques specifically to detect advanced evasion techniques (AET).
- The Security Industry's Dirty Little Secret The debate over advanced evasion techniques (AETs) This report summarizes the findings of a McAfee commissioned research group to determine the level of understanding IT security professionals have about AETs...
- Demand More, Get the Most from the Move to a Next-Generation Firewall Beyond the basics in a next generation firewall, to protect your investment you should demand other valuable features: intrusion prevention, contextual rules, advanced...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!