ISP Telenor cripples zombie PC network

IDG News Service - Authorities in Singapore shut down a large network of around 10,000 robot, or "zombie," computers this week, after technicians at Norwegian Internet service provider Telenor ASA stumbled on the illicit network by tracing Internet Relay Chat (IRC) communications from compromised customer PCs on its system.
On Tuesday, officials at the Infocomm Development Authority of Singapore worked with a local service provider to shut down a server controlling the army of IRC robot PCs, or "botnet," after being alerted to the existence of the server by The SANS Institute's Internet Storm Center (ISC) in Bethesda, Md. Although the controlling server has been shut down, malicious hackers may have already resurrected it by pointing compromised hosts to a server at a new Internet address, according to Johannes Ullrich, chief technology officer at the ISC.
Botnets are networks of computers that act like robots, communicating with one another and with a central server, often using IRC. Such networks are created by installing remote access and communication software on the remote systems, often after they are compromised by a computer virus, worm or targeted hacking.
Botnets act in unison through text commands issued via IRC from the central server by the hacker or hackers controlling the network. For example, malicious hackers can instruct the network to flood a particular server or Internet domain with traffic in a denial-of-service (DoS) attack.
"In some sense, botnets are a more dangerous problem than worms and viruses," Ullrich said. "They're an easy way to control 10,000 systems, and you can do absolutely anything with them -- instruct [the compromised machines] to pick up a program and install it, or go to a particular URL or scan for other vulnerable hosts."
Often, the compromised hosts are programmed to look for a particular IRC host name, such as botserver.irc.net. Authorities can cripple such networks by banning that particular host name, he said.
In the case of the network discovered this week, Telenor staff were unable to determine the IRC host name that the machines were seeking. That means the individuals controlling the network may already have relaunched it by assigning to a different server the host name for the robot systems, Ullrich said.
The systems on Telenor's network have been cleaned of the remote-control software used by the botnet, but other systems on the network are likely still infected and can be used in future actions, he said. Even when the host name is known, malicious hackers often maintain a number of different, geographically dispersed servers that all use the

Reprinted with permission from

IDG.net
Story copyright 2009 International Data Group. All rights reserved.