Web 2.0 has enriched the internet with some great new capabilities but it has also brought some very unpleasant ones, namely a whole class of new security threats that can silently install when a user visits a compromised website. Web 2.0 gives the cyber criminals more "surface area" to exploit bandwidth, more communication channels (for example, IM, P2P), and more client-side executable options.
To make matters worse, many users have thrown caution to the wind when it comes to downloading insecure content. Employees who would never download an e-mail attachment from someone they did not know will now add a widget to their MySpace page or play a potentially harmful YouTube clip without knowing its source.
It is becoming difficult to distinguish malicious from non-malicious sites. Google recently published a paper from researching sites it crawls (see "The Ghost in the Browser"), and found that one in 10 websites contains a malicious payload. Most users would be hard-pressed to distinguish the malicious 10 percent from a random set of search results. Once inside the firewall, these covert applications can steal confidential data, infect other machines and launch spam.
The "new new" threat: Botnets
The most sophisticated of these new threats are botnets. These collections of software robots known as "bots" run on compromised computers called "zombies" that can be controlled by "bot herders" through a communications infrastructure named "command and control" (C&C). The value of a botnet is directly proportional to the number of machines it controls, the value of those machines, for example, .com versus .org, if data theft is the goal, and the aggregate bandwidth the botnet can command for distributed denial-of-service (DDoS) attacks.
Once a bot hijacks a PC, it starts scanning the network for other vulnerable hosts to compromise. The bot will then report back to C&C with information on how many systems are under its control. Finally, C&C will send instructions and payloads for the botnet to execute, which could include sending spam, click fraud, collecting confidential data or launching a DDoS attack.
In the early days, botnets were typically controlled by a single C&C, so chopping off its "head" would render the botnet useless. Not anymore. These days, most botnets contain multiple C&Cs, hiding on many servers, with control being turned over to a new server every few minutes. They use a tiered infrastructure, much like a military command structure, so taking out a lower-level C&C will not affect the rest of the botnet. In the spirit of organised crime, botnet owners are now collaborating, sharing pools of bots and C&C servers to increase fault tolerance, and they are making more money in the process.
Finally, bots are broadening their reach beyond their initial target base of desktop PCs and are now infecting servers, including e-mail and UNIX servers.
No one knows for sure how many bots are out there, but Mi5 Networks has discovered them in approximately 65 percent of the enterprises and 100% of the universities we have worked with this year.
What is amazing is the amount of activity one bot can generate. It is not unusual for a single bot to perform more than 1 million IP scans and hundreds of thousands of spam-related communications in a single day. In one network of more than 8,000 PCs, for example, 145 bots were found in the first month, but those bots performed more than 136 million IP scans over the time period.
Bot detection and prevention best practices
The amount of C&C traffic crossing the firewall is intentionally kept very low, allowing bots to avoid detection from traditional intrusion protection systems and other security measures. Although some ISPs and security monitoring services can tell if significant spam or DDoS traffic is coming from an IP address space within an organisation, they cannot definitively confirm whether machines within the corporate network are infected, nor which machines are generating the traffic.
What is required to pinpoint hijacked machines inside the firewall is the ability to monitor internal network traffic in addition to the data coming in and going out of the enterprise. This visibility exposes how botnets spread internally, send out spam and launch DDoS attacks. Ideally, a security system will block communication out of the network from infected machines and even automatically dispatch cleanup agents.
Like most security issues, there is not a single magic bullet to stop bots, but the first step is to implement a layered defence (desktop + gateways) that limits the number of bot infections. Beyond that, enterprises need early warning systems that can detect infected PCs inside their network and block those machines from communicating sensitive data back out.
According to recent research by Gartner, the Web perimeter remains the biggest unprotected border within most organisations' networks. Although most enterprises have URL filtering in place, fewer than 15 percent have adequate protection from Web-based malware. Gartner predicts that by the end of 2007, 75 percent of enterprises will be infected with undetected, financially motivated, targeted malware that have evaded their traditional perimeter and host defences.