The Future of BOTS

[thehorse13]

This is an excellent read and I agree with most of the content. For those of you who are in the trenches each day, you'll probably already know everything that is discussed but for others who are not in tune, this will be quite an eye opener.

Enjoy.

http://www.trendmicro.com.au/global/...ers/BotsWP.pdf

[HTRegz]

Hey Hey,


It's definately interesting... I was reading about the RSS Feeds yesterday in the FD posting, which linked to that WP...... There's also a news article that was posted @ http://news.yahoo.com/s/zd/20051129/tc_zd/166349

I'm not sure what to think of RSS Hijacking... Does anyone here know any "lay people" that use RSS?? They tend to be the ones that fall victim to this sort of stuff... Then again, if it looks like a trusted source.... This could be a way to fool even the staunchiest of geeks.

Peace,
HT

[thehorse13]

The scary thing is that you already have a trust relationship with the RSS feed. If that gets nailed, you're not going to know it until its too late.

I've had suspicions about this vector from the beginning but again, my fears are closing in on reality. I've already spoken to some friends on the inside and they're telling me that certain AV vendors have a decent foothold on developing scan engines to deal with this. Time will tell how well the design works.

--TH13

[MrBabis]

file size can limite that kind of protection i think (bots)

[rapier57]

I played with the RSS early on, but just never got the hang of it. The polymorphic capabilities of the bots is the larger concern, I think. One infection can multiply and change so quickly inside your network that it will be very difficult to get on top of.

We recently had a client college get hit with what looked like the new Zotob worm. They were playing whack-a-mole for two weeks. Not fun!

[thehorse13]

played with the RSS early on, but just never got the hang of it. The polymorphic capabilities of the bots is the larger concern, I think. One infection can multiply and change so quickly inside your network that it will be very difficult to get on top of.

True. However, there is a manual technique for achieving the same goal today. When a malware writer sees that a signature is out for his code, he simply repacks it with another PE app such as Yoda, Morphine, FSG, etc. Now this isn't as dangerous as polymorphics because of speed and seeding but when 90% of the internet population rely on signature based solutions, this quickly becomes something to be familiar with.