Zombies are coming; not for your brains but for your computer. For years, cyber criminals have been exploiting weaknesses (mostly in Windows) to gain access to computers on the internet and change them into “bots” which obey remote commands. Chances are, if your PC has been converted into one of these zombies, you wouldn’t even know it – the malicious nature of the bots are hidden from their owners. Networks of bots (botnets) can be cultivated into many thousands (if not millions) of computers. They are commanded by a bot herder, the human who guides them to commit crimes: spam, rapidly accessing a single site to shut it down (denial of service attack), creating false traffic to a site to inflate its standing (click fraud), adware, spyware, and most importantly: spreading the botnet to other computers. Botnets are the evil form of distributed computing. The power of thousands (if not millions) of processors is an awesome force and bot herders are seeking new ways to use that power to gain money and clout. As computers become more powerful and more prevalent, there will be more opportunities for the zombie plague to spread. The botnet threat is likely to get worse before it gets better.
Here’s a short commercial from Symantec explaining botnets:
Botnets are so insidious because they take one of the most promising trends of technology, the exponential increases in computer performance and connectivity, and turn them into a danger. Even new computer attached to the internet is a possible bot in the making if it’s not protected. Already, computers are becoming a part of everything around us: our limbs, our factories, and soon even our brains. What need to start understanding the botnet problem now before we have to worry about a computer virus sitting in our neocortex.
Back in 2007, Vint Cerf told the World Economics Forum that up to 25% of all internet connected computers may, in fact, be bots. Verification for any sort of statistic measuring bot populations are difficult (you’ll hear everything from <1% to >35%). The consensus seems to be, however, that botnets are thriving as more people go online. Famous botnets, like Conficker, Kraken, and Srizbi, used software viruses and worms to infect millions of computers in the last few years. These networks are responsible for a good portion of the spam you receive everyday. They are also one of the ways that your identity can be stolen and your financial information pilfered.
What does a bot herder gain from creating these botnets? Money certainly, either through using their network for spam or ID theft, or by renting out the network to others for their own nefarious purposes. Many botnet creators and users have ties to the Russian mafia, who take advantage of the systems to generate credit card theft rings, to propagate fraud through spam, and to extort companies with threats of denial of service attacks. Often, those operating the largest botnets aren’t its creators, they’ve simply purchased the network and grown it. It’s scary to think that such potentially devastating power is for sale.
Bot herders can also become potent political and even military weapons. During the 2008 Russia-Georgia conflict, cyber warfare reared its ugly head. Many Georgian political and national sites were shut down or subverted by attacks originating in Russia. Google and China have been in conflict since earlier this year after the company experienced a sophisticated cyber attack aimed at stealing trade secrets. While botnets may or may not have been important parts of these attacks, bot herders have impressive expertise in hacking that may make them desirable recruits for governments interested in committing cyber warfare. Those recruits could play an increasingly important role as the military becomes roboticized. Advanced drones and automated turrets are no good if they can be hijacked.
NPR had a great interview with Joseph Menn, author of Fatal Systems Error, and Barrett Lyon, cyber security specialist, that discussed bot herders becoming national resources as well as many of the other problems with botnets and cyber attacks in general:
Of course, there are many looking to fight cyber crime. US President Obama announced the creation of a ‘cyber czar’ to head defense efforts, though the appointment process took time and had its setbacks. The US Department of Justice has a Cyber Crime division also handling intellectual property rights. India offers life in prison as a punishment for some cyber crimes. Europe has had a cyber crime treaty since 2001. Australia is working towards tightening its cyber defenses. Even China and Russia have made some motions to curb the growth of botnets in their homelands.
Yet an increase in botnets seems almost assured because of our computing habits. Pirated operating system software leaves many users unable to install patches and other fixes for known vulnerabilities. Even when they have access to these updates, many users may fail to install them. People click on e-mail attachments from senders they don’t know. Someone will send a link in Facebook, or in the comments section of a blog, that transports the clicker to a site that automatically downloads malware. We don’t spend the time to educate ourselves in how to keep our computers safe from becoming zombies.
So what’s the solution to the botnet problem? Greater minds than mine have spent years trying to find one. Users could take more personal responsibility (more careful internet browsing, keeping security software up to date, etc) but most are simply too apathetic to the problem. Operating systems (I’m looking at you Windows) could rebuild their platforms from the ground up to better close their vulnerabilities. Of course, there’s very little financial incentive for that, so it’s unlikely to happen. Governments could regulate software more and require standards that reduce the spread of botnet infection. That could damage private innovation, and may be very hard to implement.
The only real solution that seems to be left is the silver bullet –Â the innovative leap forward in software that could kill the botnet scourge. What form will that silver bullet take? No one can say for sure, but it may be software that uses narrow artificial intelligence to greatly enhance our security. AI could create security programs that learn and adapt, protecting your computer from attacks no one has seen before without the need for patches and updates. It’s just one possibility, but there’s no doubt that some solution will be needed. And soon. New botnets are forming every day and they could threaten e-commerce, or even geopolitical stability.
Distributed computing may be the next paradigm in increasing digital processing power. We’ve already seen how a network of computers running programs in the background can actually be a tool that helps find cures for diseases and save the world. To enjoy that powerful benefit of internet connectivity, we must be prepared to face its darker alternative: botnets. Computer zombies are a dangerous threat to our tech and information based society but, as with real zombies, security lies in being prepared.
[image credit: Symantec]
[media credits: Symantec, NPR]
