427 Botnet fm qxd

www.syngress.com
206
Chapter 5 • Botnet Detection: Tools and Techniques
427_Botnet_05.qxd 1/9/07 9:59 AM Page 206

---

Figure 5.8
Botnet Payload Hidden Directory
T
IP
Some forensic resources:
Dave Dagon presentation on botnet detection and response:
www.caida.org/workshops/dns-oarc/200507/slides/oarc0507-Dagon.pdf
Encase (Guidance Software): www.guidancesoftware.com/prod-
ucts/ef_index.asp
Filesig Manager, Simple Carver: www.filesig.co.uk
Forensic Toolkit: www.accessdata.com
High Technology Crime Investigation Association: www.htcia.org
ProDiscover for Windows: www.techpathways.com
PStools:
www.microsoft.com/technet/sysinternals/utilities/pstools.mspx
The Coroner’s Toolkit: www.porcupine.org/forensics/tct.html
WinHex: www.x-ways.com
www.syngress.com
Botnet Detection: Tools and Techniques • Chapter 5
207
427_Botnet_05.qxd 1/9/07 9:59 AM Page 207

---

Summary
Bot technology is a complex and fast-moving area. Botherders have an intense
interest in keeping the systems they control below the system owner’s radar
and have developed sophisticated mechanisms for doing so. A site adminis-
trator is likely to have, or at least has considered having, some or all of the
tools we’ve discussed in this chapter. Is there any site of any significant size
nowadays that doesn’t have antivirus software or a firewall? The trick, though,
is to make the best use of these tools for proactive and reactive detection as a
basis for an optimized security posture and sound incident handling.
What lessons can we draw from the previous sections? First, take advan-
tage of external notifications. Even if a proportion of them are sent to you in
error by an inexperienced administrator or poorly configured automatic alert
system, there could be a lesson that you, or the remote site, can learn.
Similarly, monitoring network traffic is not just a matter of ensuring a healthy
flow, but it requires having an early warning security system that supplements
your firewall and IDS measures. No single measure guarantees detection of
bot activity, but good monitoring of multilayered defenses will contribute
immensely to keeping the botherder from your door.