Showing posts with label botnet detector. Show all posts
Showing posts with label botnet detector. Show all posts

Friday, August 26, 2011

Cyber Threats report 2009:Emerging threats for…all data-driven!(2)

2:15 AM Unknown No comments


Emerging threats for…all data-driven!

BOTNETS

Most botnet command and manage websites is also traced back to China2. But Lee cautions that this statistic could be misinterpreted since "a good deal of Chinese are usingpirated software program which doesn’t receive security updates.”

According to Lee, “That techniques numerous Chinese computers are rife with vulnerabilities, doing them a haven for botnet command and manage sites.”
Botnets en masse are considered a bot army and these malicious computing forces could be applied to conduct cyber warfare within the future.

In addition, bot payloads are becoming increasingly complex to avoid evolving security measures.
According to Lee’s research at GTISC, several recent bot variants have exhibited more than 100 distinct binary payloads used to hide the communications path and to vary the command and manage IP address. The net effect creates botnets and bot masters harder to track.

However, new technologies can pinpoint the Internet communications among botnets and bot masters and
shut down the vital links required for cyber crime and cyber warfare. Signature-based defenses like antivirus
and intrusion detection are no match to your subtle communications between bot and bot master.
But newer behavior analysis approaches can support identify bots without signatures.

Lee’s search team at GTISC is developing algorithms to analyze targeted visitors patterns from internal machines to outside machines. Strange anomalies in connection duration, time of day, or type of information uploaded/downloaded can indicate a botnet command and control attempt. Lee’s research also examines how botnets use the internet infrastructure.
For example, look-up requests to DNS servers may perhaps provide information on which domain is applied for botnet communications. In addtion, global sensor networks are now using specialized algorithms to pinpoint bot army communications.
Once the command and control links are observed and disrupted, the bot army threat can be neutralized as long as layered security is already in location
Related Articles:
Cyber Crime:Threats to VoIP and Mobile Convergence...

Read more »

Posted in: ,,,,,,,,

Cyber Threats report 2009:Emerging threats for…all data-driven!

1:59 AM Unknown No comments




Emerging threats for…all data-driven!


BOTNETS

In 2008, botnets have turn into worse—a trend expected to continue following year.
GTISC estimated in last year’s report that 10 percent of on-line computers have been component of botnets,groups of computers infected with malicious code and unknowingly controlled by a malicious master.
This year, GTISC researchers estimate that botnet-affected machines may comprise 15 percent of on-line computers.

“Compared with viruses and spam, botnets are growing at a faster rate,” mentioned Wenke Lee, an associate professor at GTISC along with a leading botnet researcher. Lee cites three unavoidable factors which are spurring botnet growth:
• Infection can occur even through legitimate Web sites
• Bot exploits/malware delivery mechanismsnare gaining sophistication and better obfuscation techniques
• Users don't need to do anything to become infected; simply rendering a Web page can launch a botnet exploit

Bots can also be delivered to a machine in a variety of ways—
via Trojans, emails, an unauthorized instant message client or an infected Internet site. Once installed, bots lie low to avoid notice by antivirus and anti-spyware technology.
Periodically, the bot communicates to a “command and control” server and waits for your response.

The communication— using the command and manage server as an intermediary—can preserve the malicious bot master’s identity hidden.
Lee issues out the distinction among botnets and malware: “What we think of as malware can be responsible for turning a machine into a bot,” mentioned Lee.
“But conventional malware is often a single-purpose attack.

A bot really remains over a machine, maintains a command and manage mechanism to enable communication with the bot master, and can update itself based on people communications. 
The updates enable new bot communication and malicious capabilities, and are often applied to avoid detection.”

Bot communications are designed to seem like normal (Web) targeted visitors using accepted ports, so even firewalls and intrusion prevention systems have a tough time isolating bot messages.
Lee agreed, “It’s incredibly tough to filter bot traffic at the network edge since it uses http and every
enterprise allows http traffic.”

Prompted to act in unison, bots turn into bot armies that harness considerable computing power to engage in a
variety of malicious activities, including:
— Information theft (social security numbers, credit card information, trade secrets, etc.)
— Denial of program attacks
— Spam delivery
— DNS server spoofing

According to a report compiled by Panda Labs, in 2Q 2008, 10 million bot computers had been applied to distribute spam and malware across the internet every day1.
Damballa continues to find that 3-5 percent of enterprise assets are compromised on average by targeted
threats for instance bots—even during the presence in the best and most up-to-date security.
Leading industry analysts predict this range to be even higher.
Read more »

Posted in: ,,,,,,,,

 
Design by Wordpress Theme | Bloggerized by Free Blogger Templates | coupon codes