Cyber Security Institute

Thursday, September 25, 2008

Shadowserver to Build ‘Sinkhole’ Server to Find Errant Bots

The Shadowserver Foundation, a volunteer organization that gathers intelligence on the Internet’s dark side, has begun building a so-called “sinkhole” server that poses as those now-defunct malicious domain servers in order to find out what they left behind.

The project, which is in the early phases, will allow Shadowserver to emulate both botnet IRC and HTTP traffic as a way to study those botnets as well as find bots that remain infected by them, says Steven Adair, a security expert with Shadowserver, who revealed the new project to attendees of the OWASP USA security conference here.

“There are still a lot of [machines] communicating with” these now-defunct servers, Shadowserver’s Adair says.

Shadowserver then could trace those infected machines and alert the organizations whose machines or Web servers are still infected by the botnets, he says.

Shadowserver’s sinkhole server will be able to accept incoming traffic from infected machines as they try to communicate with their former command and control server, for example.

One infamous HTTP-based botnet Shadowserver has been studying closely is Black Energy, which traditionally has been used for distributed denial-of-service (DDOS) attacks.

“It went from a mundane botnet to stealing [credentials] and taking when it can from the same infection.”

http://www.darkreading.com/document.asp?doc_id=164571&WT.svl=news1_2