ISP Telenor cripples zombie PC network
Internet Relay Chat communications were used to trace the illicit network
IDG News Service - Authorities in Singapore shut down a large network of around 10,000 robot, or "zombie," computers this week, after technicians at Norwegian Internet service provider Telenor ASA stumbled on the illicit network by tracing Internet Relay Chat (IRC) communications from compromised customer PCs on its system.
On Tuesday, officials at the Infocomm Development Authority of Singapore worked with a local service provider to shut down a server controlling the army of IRC robot PCs, or "botnet," after being alerted to the existence of the server by The SANS Institute's Internet Storm Center (ISC) in Bethesda, Md. Although the controlling server has been shut down, malicious hackers may have already resurrected it by pointing compromised hosts to a server at a new Internet address, according to Johannes Ullrich, chief technology officer at the ISC.
Botnets are networks of computers that act like robots, communicating with one another and with a central server, often using IRC. Such networks are created by installing remote access and communication software on the remote systems, often after they are compromised by a computer virus, worm or targeted hacking.
Botnets act in unison through text commands issued via IRC from the central server by the hacker or hackers controlling the network. For example, malicious hackers can instruct the network to flood a particular server or Internet domain with traffic in a denial-of-service (DoS) attack.
"In some sense, botnets are a more dangerous problem than worms and viruses," Ullrich said. "They're an easy way to control 10,000 systems, and you can do absolutely anything with them -- instruct [the compromised machines] to pick up a program and install it, or go to a particular URL or scan for other vulnerable hosts."
Often, the compromised hosts are programmed to look for a particular IRC host name, such as botserver.irc.net. Authorities can cripple such networks by banning that particular host name, he said.
In the case of the network discovered this week, Telenor staff were unable to determine the IRC host name that the machines were seeking. That means the individuals controlling the network may already have relaunched it by assigning to a different server the host name for the robot systems, Ullrich said.
The systems on Telenor's network have been cleaned of the remote-control software used by the botnet, but other systems on the network are likely still infected and can be used in future actions, he said. Even when the host name is known, malicious hackers often maintain a number of different, geographically dispersed servers that all use the



- Excel 2010 Cheat Sheet
- Register for this Computerworld Insider Cheat Sheet and gain access to hundreds of premium content articles, guides, product reviews and more.
- Streamline Compliance and Increase ROI
- Streamline, simplify, and automate compliance related activities; especially those that impact multiple business units. This white paper from NetIQ, outlines solutions that will...
- Protecting Point of Sale Systems from Targeted Attack
- If you are responsible for protecting retail systems, download this case study to learn how this retailer eliminated the threat of malware on...
- From the Frontline - Preventing APT
- Is your company's network secure? Are your endpoints and servers secured? Before you answer, read this case study on a US Military Command...
- Stop Hackers Before They Attack
- Hacktivism, Identify Theft, Financial Gain, Cyber War - regardless of motivation, stopping today's hackers requires a new proactive approach to protecting endpoints. Learn...
- The four rules of complete web protection
- As an IT manager you've always known the web is a dangerous place. But with infections growing and the demands on your time... All Cybercrime and Hacking White Papers
- WikiLeaks: How am I Affected?
- The latest WikiLeaks episode has raised questions about how organizations and governments protect their sensitive information. While this incident was isolated, it has...
- Optimizing Networks for the Cloud
- Join guest speaker, Rohit Mehra, IDC Director of Enterprise Communications Infrastructure, to explore current trends, discuss best practices for optimizing Data Center and...
- Apps QuickStart Series Part 2: Designing and Deploying SQL Server on VMware vSphere
- Download this webcast to learn about the design considerations for virtualizing SQL workloads, performance and scalability information and high-availability options, as well as...
- Apps QuickStart Series Part 1: Designing and Deploying Exchange 2010 on VMware vSphere
- Download this webcast to learn the virtual hardware design considerations for Exchange 2010, deployment using the building block approach, options for high-availability and...
- Customer Spotlight: How IPC The Hospitalist Company Implemented Oracle on VMware
- Have you been looking to hear about customer's experiences with the new VMware vCenter Site Recovery Manager product? View this webcast to learn... All Cybercrime and Hacking Webcasts