427 Botnet fm qxd

www.syngress.com
448
Chapter 12 • Responding to Botnets
427_Botnet_12.qxd 1/9/07 3:08 PM Page 448

---

card encoding, and botnets won’t be nearly as lucrative a business
proposition for cashers.
Phishing attacks based on social engineering via fake Web pages, and
pharming attacks based on rewiring the DNS to send naïve users to
new fake Web sites, are an important part of the botnet scene.
The complexity of software and distributed systems is a hard
problem.This means it is easy for a hacker to find an exploit, and
hard for defenders to defend against all possible exploits.
Fundamental security policies are often ignored. For example,
passwords may be weak or nonexistent on highly privileged accounts.
Many attacks include password guessing as one of the threat
elements. Software that requires a user to have local admin privileges
to operate, giving out local admin accounts to anyone who wants
one, and using local admin accounts for day-to-day use increase the
odds that a computer will become a botnet.
Many attacks are old and simply rely on the existence of unpatched
(Windows) systems. Windows is not the only guilty party, though, as
other systems can go unpatched as well.
Policies that allow anyone to create Web pages without any
requirement for security, security standards compliance, or even
security review threaten both Windows- and UNIX-based systems.
Creating Web pages for all users, even if they never intend to use
them, creates piles of treasure for the new phisher.The hosting
platform of choice for phishers today is overwhelmingly UNIX-
based systems running Apache.
What Is to Be Done?
Improve local security policy authentication practices to help prevent
password-guessing attacks.This includes sane account management
practices.
Use firewalls and other containment technologies (even NAT!) to
limit the scope of attacks.
Windows systems need to be updated. All other systems need to be
updated, too. Beware turning off auto updates. Remember from