Jose Nazario provides an excellent summary on the Arbor blog of a bot that spreads via USB and instant messenger. He starts with a note on anti-Sino bias often found in American security analysis.
Lest you think all of the DDoS bots we focus on come only from China, we found one that appears to be from the US.
It appears to be from the US, but it still has links to the countries where it is easier to evade law enforcement.
His servers that he has used go back to “Net-0x2a: Zharkov Mukola Mukolayovuch†in the Ukraine, and also “PIRADIUS†in Malaysia. This is someone familiar with underground hosting, it seems.
It sounds much less American now. Don’t let it slip away Jose.
Inspection of the bots we captured show a handful of user-agents (my favorite is the Cyberdog one!) and HTTP headers that appear distinctive, enabling us to detect its traffic selectively. The author appears to have imported Slowloris’ attack method without any modification.
We have also been sinkholing this botnet. Inspection shows hundreds of bots checking in from around the world, with most in the US.
Aha! I can’t overstate the importance of including the lineage in an attack analysis. But even more to the point, Cyberdog is an obviously American reference. I remember in the late 90s when Steve Jobs said he put a “bullet through the head” of Cyberdog.
And now Cyberdog is back, as a zombie! I bet Steve didn’t see that coming.
But seriously, a Chinese user-agent is unlikely to be Cyberdog. It might be ç‹—å± or maybe called Sundog, if Chinese, but I doubt Cyberdog.
Even more seriously, the speculation about nationality just forces me to wonder if the common definition of a nation is being pushed too far to fit these scenarios.
It’s relevant to law enforcement and financial take-down operations but, when it comes to explaining where a bot is “from”, are we at risk of shoving a square peg into a round hole?
Maybe I’m getting stuck on this idea of nationality linked to a product because it brings to mind how some say Budweiser is from America, instead of the Czech Republic. I mean Cheddar cheese has to be from Cheddar, England, right?