ISP Telenor cripples zombie PC network

Authorities in Singapore shut down a large network of around 10,000 robot, or “zombie,” computers this week, after technicians at Norwegian Internet service provider Telenor stumbled on the illicit network by tracing Internet Relay Chat communications from compromised customer PCs on its system.

On Tuesday, officials with the Singaporean Infocomm Development Authority worked with a local Internet service provider to shut down a server that was controlling the army of IRC robot PCs, or “botnet,” after being alerted to the existence of the server by The SANS Institute’s Internet Storm Center (ISC), based in Bethesda, Md. However, while the controlling server has been shut down, malicious hackers may have already resurrected it by pointing compromised hosts to a server at a new Internet address, according to Johannes Ullrich, chief technology officer at the ISC.

Botnets are networks of computers that act like robots, or “‘bots,” communicating with each other and with a central server, often using IRC. Such networks are created by installing remote access and communication software on the remote systems, often after they are compromised by a computer virus, worm or targeted hacking.

Botnets act in unison through text commands issued via IRC from the central server by the hacker or hackers controlling the network. For example, malicious hackers can instruct the network to flood a particular server or Internet domain with traffic in what is known as a denial-of-service (DoS) attack.

“In some sense, botnets are a more dangerous problem than worms and viruses,” Ullrich said. “They’re an easy way to control 10,000 systems, and you can do absolutely anything with them – instruct (the compromised machines) to pick up a program and install it, or go to a particular URL or scan for other vulnerable hosts.”

Often the compromised hosts are programmed to look for a particular IRC host name, such as botserver.irc.net. Authorities can cripple such networks by banning that particular host name, he said.

In the case of the network discovered this week, however, Telenor staff were unable to determine the IRC host name that the machines in the botnet were looking for. So, while authorities shut down the controlling server, the individuals controlling the network may already have relaunched the network by assigning a different server the host name the robot systems were looking for, Ullrich said.

While the systems on Telenor’s network have been cleaned of the remote control software used by the botnet, other systems on the network are likely still infected and can be used in future actions. Even when the host name is known, malicious hackers often maintain a number of different, geographically dispersed servers that all use the same host name, each capable of controlling the network, he said.

While authorities and ISPs are always happy to shut down a botnet, they are also engaged in a little-publicized game of cat and mouse, with malicious hackers. Botnets with between 10 and 100 compromised hosts are identified and shut down several times a day. Crackdowns on large networks with 10,000 or more hosts are more rare, but still happen weekly, Ullrich said.

Many of the systems used in botnets are owned by individuals rather than companies and connected to the Internet using broadband Internet connections. It can be difficult for ISPs to spot and clean such infected systems unless they do something unusual, such as taking part in a DoS attack, he said.

And, with students returning to universities following summer break, the botnet problem will likely get worse, Ullrich said.

“Student machines are a classic target,” he said.