DHS, Commerce looking to battle botnets

The Commerce and Homeland Security departments are considering whether a set of voluntary industry standards are needed to combat botnets, the malicious networks of compromised computers controlled by online criminals, hackers and possibly nation-states.

Steps being considered include a centralized customer support center for Internet service providers, a voluntary code of conduct for vendors and service providers along with incentives for participation, and an effort to identify best practices for preventing, identifying and mitigating infections.

“Over the past several years, botnets have increasingly put computer owners at risk,” said a request for information published last month by DHS, the National Institute of Standards and Technology, and the National Telecommunications and Information Administration.

Related stories:

FBI shares lessons of Zeus botnet ring takedown

After US crackdown on botnets, cyber criminals run to Canada

Both Commerce and the Federal Communications Commission have suggested that voluntary standards for industry could help fight these increasingly organized threats. But it is not yet clear what those standards should be, whether they would be effective, or how they should be implemented.

The departments are seeking comment on:

• The need for a voluntary code of conduct for consumer notifications on botnets.
• How private entities might help prevent and identify botnets and malware on systems and networks.
• How to mitigate and notify users about botnets on systems and networks.
• How to help promote incentives for companies to participate in voluntary notification efforts.
• How to help build related resources in the United States for ISPs or other entities to notify consumers.

Commerce and DHS officials also discussed the issue with industry leaders during an invitational meeting at the Center for Strategic and International Studies earlier this month.

Botnets have become powerful tools for distributing malware, stealing and delivering personal and financial information to black markets, conducting espionage, launching denial-of-service attacks, and providing storage and computing resources for attackers. Exploits used to compromise computers often are well-known and can be defended against or cleaned up, but the huge global pool of vulnerable computers provides a constant source of new botnet recruits.

McAfee, in its threat report for the second quarter of 2011,  reported there were about 3.5 million new botnet infections in March, up from under 3 million in February, although well under the 5.3 million reported in July 2010.

The last two years have seen some success in dealing with the organizations that control botnets through legal action and disabling their command and control networks. But because the infected computers often are owned by individuals rather than an enterprise and are distributed around the world, responding to the problem at that level is difficult and generally has been left to ISPs, which often are reluctant to accept responsibility for the cyber hygiene of their customers.

The idea of industry standards for dealing with botnets is not new, and Commerce and DHS are looking to build on earlier efforts. Australia, Germany and Japan have established or are in the midst of establishing voluntary programs for customer notification and cleanup, according to the RFI, and an FCC working group in December recommended 24 best practices for addressing botnets.

The working group invited industry to review the recommendations with an eye toward applying them, but cautioned that “best practices in general are not applicable in every situation because of multiple factors,” and that their adoption should be voluntary.

Commerce and DHS want to identify what practices have proved effective in combating botnets, how to notify customers when they show evidence of being compromised, how to prevent and remediate infections, and what incentives should be offered to companies for adopting a code of conduct.

Another idea being explored is the development of a centralized resource center to handle consumer IT security complaints across multiple service providers.

“Such a resource center could reduce the burden on corporate customer support centers by pooling resources,” according to the RFI. “The center could aid consumers by, for example, providing certain no-cost means of support, as well as information on other means for expedited support.”

It also could be used for information sharing and research. The departments are seeking comments on whether such a center should be operated by the private sector, government or a public-private partnership.

Comments should be sent by Nov. 4 to the National Institute of Standards and Technology at the U.S. Department of Commerce, 1401 Constitution Avenue, NW, Room 4822, Washington, DC 20230, or e-mailed to Consumer_Notice_RFI@nist.gov. Paper submissions should include a CD with comments in electronic format for posting online.