Five Lessons for Your Website from U.S., South Korean Web Attacks

With U.S. and South Korean government Web sites hit by distributed denial-of-service (DDoS) attacks this week by a botnet controlled by an unidentified attacker -- North Korea is suspected, however -- the shadowy world of botnets continues to grow unabated.

According to the ShadowServer Foundation, a group sharing information about botnet activity, the number of identified botnets, which started to take off about half a dozen years ago, has grown from about 1,500 two years ago to 3,500 today.

So far the botnet-directed attacks against the United States and South Korea, believed carried out through hidden manipulation of about 50,000 compromised computers using an updated version of an old virus, MyDoom, have done no lasting harm to the many Web sites struck, although the U.S. Federal Trade Commission and the Department of Transportation suffered outages and FTC.gov still is struggling, according to Keynote Systems, which measures and monitors Web site use. And the DDoS botnet episode is ongoing, with more hits expected on South Korean banks and a newspaper, says South Korean antivirus firm AhnLab, which analyzed malware samples associated with the attacks.

It's not just DDoS attacks that are associated with botnets. Botnets are usually specialized, designed for criminal tasks that range from spam distribution; stealing identity credentials such as passwords, bank account data or credit cards and keylogging; click fraud; and warez (stealing intellectual property or obtaining pirated software).

"There's usually a primary purpose to a botnet," says Jose Nazario, manager of security research at Arbor Networks. "There are turf wars out there as criminals are vying for the desktop. They try to kick each other off."

Although botnets come and go, the more successful ones have endured for years as large command-and-control systems operated by shadowy groups that have taken over hundreds of thousands of desktops and sometimes servers.

These botnets are bequeathed names -- usually quirky ones -- by researchers probing them, with the first to identify a new botnet typically getting to name it.

Gammima (gaming password stealer), Conficker (fake antivirus) and Zeus (information stealer), are among what are believed to be the largest, according to security firm Damballa.

But sizing botnets up in terms of actual numbers of compromised computers, under their control as bots (sometimes called "drones") is tough, many experts say.

That's because these numerical counts, typically based on detected numbers of infected machines, are often based on IP addresses where numbers are influenced up or down by network technologies such as network-address translation. And there's constant change.