Black Cloud Computing: botnets dwarf legitimate cloud processing providers

Paul Raven @ 25-03-2010

Via SlashDot, another reminder of the sheer scale and clout of botnets, all just sitting out there waiting to be rented, no questions asked:

the biggest legitimate cloud provider is Google, based on Joffe’s information, made up of 500,000 systems, 1 million CPUs and 1,500 gigabits per second (Gbps) of bandwdith. Amazon comes in second with 160,000 systems, 320,000 CPUs and 400 Gbps of bandwidth, while Rackspace offers 65,000 systems, 130,000 CPUs and 300 Gbps.

[…]

… their capacity pales to that of the biggest cloud on the planet, the network of computers controlled by the Conficker computer worm. Conficker controls 6.4 million computer systems in 230 countries at 230 top level domains globally, more than 18 million CPUs and 28 terabits per second of bandwidth…

Who says cloud computing will never scale, eh? Added bonus: some forms of hacking may be illegal, but that won’t necessarily stop the US Secret Service from payrolling you to the tune of $75k a year for your work. Guess I should have spent more time programming my Vic20 than reading novels…


Ideological cyberwarfare and the marketing of intangible threats

Paul Raven @ 12-02-2010

Ars Technica points us to a BBC report that claims botnets are increasingly being deployed by ideological and political activist groups as well as the more traditional spammers ‘n’ scammers. There’s undoubtedly a kernel of truth here, but given that the data that informs this conclusion comes from Prolexic, a company whose profits depend on selling computer security solutions to businesses and governments, I find myself wanting to poke holes in the story. It’s easily done, too.

First of all, Anonymous are described as an “anti-Scientology group”, which is a massive oversimplification. If they can be said to be anything at all, Anonymous is an amorphous and capricious cloud of nihilistic pranksters, but framing them as a single-interest group makes them more understandable to the corporate mind-set, as well as portraying them as “something that could happen to you“.

Next item – look at this excerpt:

In one attack both large and small perfume firms were hit in an apparent attempt, said Mr Sop, by green activists to express their disquiet with the way the companies made and tested their products.

[…]

These techniques are far removed from those favoured by organised criminals. Some targeted databases behind a website in a bid to swamp that with bogus login attempts or lengthy search requests that would knock out the server and take out the website too.

Note the use of “apparent”, and the lack of any defined enemy. They have no idea who did it, in other words; the “green activists” thing is likely a guess, one that plays into current fears about ideological activism by companies whose business practices might put them in line for such. Isn’t it at least equally likely that the botnet was hired by another perfume business in order to throw some caltrops in the path of its competitors? Is it so implausible that “organised criminals” could have upped their technological game in recent months? It’s not an area in which I have great experience (or, indeed, any experience at all), but I’d imagine that staying on top in the world of international gangsterism involves making sure you’re using the best tools available… because if you’re not, your competition surely will be.

Furthermore, how many “green” activist groups with a special interest in perfumery have the spare money to waste on this sort of warfare? A big part of activist psychology is the desire to be seen to be doing something; this sort of clandestine skulduggery doesn’t sound like the work of placard-waving protesters to me, and I doubt they’d have the money or contacts to call down the botnet fist-of-god on their enemies. There’s nothing to say it couldn’t be, of course, but I’d want better proof – especially from a source who stands to benefit from setting up straw-man opponents which it can then offer protection from.

A few more bits from the bottom:

Mr Sop said Prolexic suspected that some of the attacks it had seen in recent months were being mounted by governments or their proxies in the hacking community as a way to demonstrate their cyber capabilities.

*cough* *wink* China *nudge* *cough* The Red Peril! The Other! The monsters under Western capitalism’s bed! They’re coming for you!

The resources being put into the attacks, some of which targeted very expensive pieces of net hardware, ruled out the involvement of organised crime, he said.

Really? Why would organised criminal syndicates not be interested in attacking “expensive net hardware” when political or ideological activists would be? And this hardware – what is so different about it that makes it expensive by comparison to “not-so-expensive” net hardware, exactly? Are the victim servers plated with gold, perhaps?

OK, so I’m going a bit overboard here, but everything about the report from these Prolexic people stinks of under-the-radar button-pushing infomercial. Ideologically-targetted botnets are certainly a real issue, and probably more so than they were a year ago… but I suspect this shift in PR focus by security firms to be born of the realisation that defined threats enable sales better than amorphous ones. Which is the more tangible risk, as perceived by a CEO – “scammers might hijack your server because it’s essentially a box that can do anything if instructed properly” or “people who object to your ideology or business practices could treat your network infrastructure as a weak point”? The former is a statistical long-shot; the latter plays on the fear of competition that is key to any successful business.

Getting back to the core point, though, the rise of ideological deployments of botnets is hardly surprising. The people who run botnets are mercenaries of the old school, renting out their services by the day (or maybe even by the hour) to anyone who can meet the price… and for those groups who can’t meet the price (or don’t like dealing with middle-men), it’s depressingly easy to build one yourself, if you’ve the time and motivation. But that’s the key – time and motivation, and the afore-mentioned visibility. Single-issue activist groups want their protests to be seen and attributed to them, because otherwise they’re wasting their time; the stealthy anonymous attacks are logically far more likely to originate from corporations (legitimate or criminal) and nation-states.

So, yes, ideological cyberwarfare is a real and rising threat… but I’m not convinced it’s as grass-roots a threat as it’s being portrayed. After all, if you want to sell your product to corporations and governments, you can’t go demonising your potential customers in your ad copy.


Brain-food: white hats, anti-hackers and post-modern political loyalty

Paul Raven @ 12-11-2009

By way of an experiment, I thought I’d round up a handful of links which made for interesting reading, but about which I felt no particular urge to editorialise (or waffle tangentially, if there’s any measurable difference between the two in my case). If you like the format, let me know in the comments and I’ll do more of them in future. Now, let’s see what we’ve got here…

  • Have you ever wondered why it is that the good guys always wear white? If so, MetaFilter has a comprehensive round-up of pieces about the psychological and/or neuroscientific roots of our association of blackness and whiteness with badness and goodness.
  • If you’ve ever wanted an insight to the world of the computer security professional, SlashDot points to an account by the FireEye Malware Intelligence Lab about their recent beheading of the Ozdok botnet. Simultaneously fascinating in the manner of occult literature (e.g. full of bizarre words and phrases for which most of us have no context whatsoever) and mundane in the manner of a corporate progress report (it’s mainly lists of domain names and IP addresses), it’s an insight into the language and attitudes of a profession we largely ignore, and the sphere in which they work. Great research material for anyone writing a story featuring hackers and counter-hackers.
  • And if you’ve wondered about my curious and relentless obsession with charting the withering of the nation-state as the uppermost level of global political structure, the two minutes it will take you to read this post by John Robb will explain it more thoroughly and concisely than I’ve ever been able to do, despite coming to a similar (though much less elegantly formed) conclusion some number of years ago. Here’s the first half:

    Globalization is in the process of eviscerating traditional loyalties. In the 20th Century, loyalty to the nation-state (nationalism, often interwoven with ideology), was supreme. In today’s environment, a global marketplace is now the supreme power over the land. It has drained the power of nation-states to control their finances, borders, people, etc. Traditional ideologies and political solutions are in disarray as the fluctuating and often conflicting needs of the global marketplace override all other concerns. As a result, nation-states are finding it increasingly impossible to govern and the political goods they can deliver are being depleted.

So, there’s some brain-food for your Thursday – tuck in! Do let me know if you’d like to see more of these bite-sized morsels on Futurismic.