Comments on: Zombies try to blend in with the crowd

Hackers aim to make networks of hijacked computers go unnoticed by merging their communications with common Web traffic.

[hadaso]

There are a billion honeypots out there

Every privately owned PC is a possible honeypot. The chalenge is to coordinate all these so that information can be collected from all of them.

Whan people discover that their computer has been compromised they are most likely to agree to help in counter action. The problem is to find ways to approach them and have them cooperate in using their computer to obtain info that can lead to the real person behind the virus in their PC.

Law enforcement agencies should be more active in coordinating the effort to collect this evidence. When your home is broken into, you invite them to collect evidence that might lead to the thief. The same should happen when your computer is broken into. That doesn't rule volunteers out. However, most people would be more confident in letting someone collect evidence on their premises if that someone has an official status.

A lot of spam is sent using botnets to do the delivery. Perhaps it is not the worst use of botnets, but it leaves a lot of footprints in the form of email headers leading to compromised PCs. Coordination between postmasters can help identify most of these, and then analysis of many of these infected machines might lead further back to their operators. Spam also leaves a trail of money: there are people who paid for the services, and if they paid someone to use stolen resources to send their ads, they are accoplices. If they are faced with criminal charges for the illegal factors in activity they paid for, they would happily cooperate and lead to the real criminals who operate these. Starting with spam and going back would lead to the people who operate the infrastructure that allows not just spamming. Spam is only one of their sources of income.

[Amigoid]

Its not that simple.

Its really not that simple. Most people are not sophisticated techinically to know their system has been compromised. More frequently than I would like to see, I find users without firewalls, without a good anti-spyware app like webroot spysweeper, or a good antivirus program that has up-to-date definitions. And even if they do find out their system is a zombie, they want it cleaned so they can get back to work, not set aside to be a digital double agent.

The police? Most do not have the time, skills or materials to mount a CSI-style investigation of an infected PC.

At a Federal level? I think they are busy with terror threats. Postmasters? Not really their job. They have their hands full keeping spammer blacklists up to date and just keeping mail working.

The people paying for the spam would deny knowing how the email was sent and feign shocked indignation to discover a contractor had mishandled their email. Of course that contractor would be fired, and a new one would be hired to spam... I mean distribute... their email.

[dargon19888]

You can still track them....

They can run, but they can't hide.

If the feds want to fork over some cash and if google was willing to cooperate, you can catch the bot herders.

Its not rocket science...

;-)

-G

[fred dunn]

Just start calling them Vistabots....

Because with the vulnerabilities already found and cached by the blackhats for commercial use Vista is going to be a boon to the Bot arrays.

[Sumatra-Bosch]

Another Underappreciated Aspect of the Vistapocalypse

Chilling.

[wbenton]

If ISP's keep 90-day records...

The problem would be resolved easily.

Walt

[oldsailor432]

it is problem but not a big one

For SOHO market there is no problem you can spot unwanted connections if you have even average firewall with logging capabilities. For corporation it is more complex because of amount of traffic which is going trough they firewalls - but they (at least in the theory) should have better equipment and proper staff to handle that.

[fred dunn]

90% are consumers directly connected...

to the internet without a wired router between them and their broadband connection or using an unsecured Wireless Access Point.

Most enterprises can and do detect Bot activity.

You'd be surprised how many windows machines have null shares hanging out on the internet or blank admin passwords like the default Windows XP Home Bot Edition.