One of the recurring topics of discussion in advanced security circles is how far offensive (or counter-offensive, if you prefer) measures can be taken, such as hacking back into attacker networks to raid and destroy stolen intel. However, I want to remind the community that there are other kinds of active defense which are not sexy but can be effective.
The mass-takedown of 3322.org was a recent example of doing more on defense than simply blocking inbound attacks with devices or expelling infiltrators. This defense has been going on for years with takedowns of many botnets (Waledac, Rustock, Kelihos and Zeus, as per The Register article). In the 3322.org takedown, Microsoft identified a crucial piece of infrastructure for a botnet and worked within the legal system to "compromise" the botnet's command-and-control server names.
However, you don't have to be a software giant with an army of lawyers making takedowns to deprive adversaries of critical resources. Anyone can help make life harder for criminals if you have the time, motivation, and tools to do so.
Notification
When you are working an incident for your org, whenever possible, attempt to contact any compromised orgs that are unwittingly participating in the botnet infrastructure to help inform and/or remediate. It may seem like a small gain, but even dismantling a single distribution point can make an impact on a botnet by forcing the criminals to exert more of their own resources to keep up.
In a recent investigation, I discovered that a local news site's ad banners were acting as routers to crimeware kit landing pages. Ad-initiated drive-by-downloads have been a typical infection vector for years, so when I called the local company to let them know what was occurring, I expected to find that the ads they served were not under their control. Instead, I discovered that their primary ad server had been compromised through a recent vulnerability in the OpenX ad server, making all ads on the site malicious. Though local, the site is still major enough that most of my friends and family, and tens of thousands of other citizens in my city, will visit it at some point every few days. The day I discovered the compromise happened to be the day President Obama was visiting, so traffic to the news site was at a peak. Working with the staff at the news site may have saved thousands of fellow citizens from becoming part of a botnet, and it only took a few minutes of my time.
When you work with external entities, remember to encourage them to contact the local police department to file a report. The police will pass the info up the law enforcement chain. This is important even for small incidents in which damages are less than $5,000 because they may aid a currently ongoing investigation with new evidence or intel. It's also important to get law enforcement involved in case they are already aware of the compromise and have it under surveillance to help make an arrest. The last thing you want to do is let a criminal escape prosecution by accidentally interfering with an ongoing investigation.
Plugging the fire hose of malicious ad banners was good, but my investigation didn't stop with the local news site. The "kill chain" in the infections routed through yet another hacked site at a university. I took a few seconds to do a whois lookup on the domain and found a contact email. I took a few more seconds to send an email to the admin letting them know they had been compromised. Less than a day later, the admin responded that he had cleaned up the server and fixed the vulnerability, and the criminals had another piece of their infrastructure taken back.
While they will undoubtedly find a new hacked server to use as a malicious content router, hacked legit servers are still a valuable commodity to a botnet operator, and if enough low-hanging fruit is removed from the supply, it could make a real difference in the quantity of botnets. At the very least, it is forcing the opposition to expend resources on finding new hacked sites to use, which is time they cannot use to craft better exploits, develop new obfuscation techniques, recruit money mules, and sleep. Even reconfiguring a botnet to use a new site will probably take more time than it took me to send the notification email.
Remediation
Even at large sites with dedicated IT staff, it may not be simple or easy for the victim to remove the malicious code and fix the vulnerabilities. In some cases, hand-holding is necessary. In many cases, the actual vulnerability is not remediated and the site is compromised again. This can be disheartening, but even though it happens, it's still worth it to do the notification.
If a site simply can't be fixed or no one can be contacted, at least submit the site to Google Safebrowsing or another malicious URL repository.
I would wager that there are more IT security professionals than there are botnet operators on this planet. Let's prove that by raising the threshold of effort for criminals through victim notification.
