427 Botnet fm qxd

www.syngress.com
Responding to Botnets • Chapter 12
447
427_Botnet_12.qxd 1/9/07 3:08 PM Page 447

---

to help the home user. When we described the efforts that are needed in the
enterprise or institutional networks, they were wide reaching and compli-
cated. Even our power users in this environment are not considered to have
the tools and skills necessary to fight this issue alone.Yet, the home user—our
moms and dads, grandmothers, and grandfathers, and small children—are
essentially on their own in this battle. In our opinion, the ISPs serving the
home market need to acknowledge that without a mandatory response by the
ISPs, botherders will always have a new crop of easy victims.The mandatory
response can be in the form of required compliance to new industry standards
or compliance with new laws or regulations. As long as ISPs continue to
believe that their only responsibility is to act as a pipeline, they will continue
to stand idly by while our innocents are exposed to danger. Perhaps most
important is that the white-hats need to get involved and communicate.Their
management needs to encourage them to get involved.
Solutions Fast Track
Giving Up Is Not an Option
The despair over the loss of the “head of the snake” strategy was
misplaced. Just as the loss of U.S. battleships in Pearl Harbor forced
the U.S. Navy to move to a newer and in many ways better carrier-
centric Navy, so too will the loss of the old botnet strategy force us
to move to newer and better tools and techniques. Botnets may
evolve, but so will our responses to them.
?
Getting rid of a botserver C&C is a good thing, but damaged hosts
still need to be repaired.
Many botnet clients are simply due to bad local security practices
that can be easily remedied via education about good security policy
and practice.
Why Do We Have This Problem?
Money is the root of all evil, and botnets. Who is fueling the demand
for botnets? Find and eliminate the conditions that cause the
demand, and botnets will diminish. Improve the security of ATM