Anonymizing Proxy Server

4 million strong Alureon P2P botnet "practically indestructible"

To make this hiding more effective, the rootkit infects the system's master boot record (MBR), part of a hard disk that contains critical code used to boot the operating system. Infecting the MBR means that the rootkit code is loaded even before the operating system (let alone anti-virus software) can run; it's another move to make the rootkit harder to detect and remove. The software also encrypts all network traffic to prevent eavesdropping or hijacking by other botnet owners.

The most significant feature, however, is the inclusion of peer-to-peer technology in the latest version of the botnet's code. The rootkit uses the Kad peer-to-peer network, used by filesharing software eMule, to communicate between nodes. Using Kad, the botnet creates its own network of infected computers, allowing the machines to communicate with each other without relying on a central server.

This has one purpose: to make it much harder to take down the network. Previous successful botnet takedowns have depended on law enforcement agencies taking over or making inaccessible the centralized command-and-control servers used to disseminate instructions for the network. These servers tell the botnet which spam to send, which sites to target with a denial-of-service attack, and so on. Generally they are relatively few in number—a dozen or two—and so represent a major weakness in the botnet infrastructure. Though TDL-4 uses more command and control servers than is typical—around sixty so far this year—it's the peer-to-peer network that really makes it tough to fight off. With this network, the botnet's owner can retain control of the network even if the infected machines can't reach the servers.

Rootkits have used peer-to-peer networks before, but the use of such a large, public network is highly unusual. It makes gives the botnet an extremely robust communications system that will be nigh impossible to disrupt or overpower, and the same techniques that have been so powerful against other botnets may be impotent against TDL-4.

The malware itself is spread primarily through file-sharing and pornography websites. Earlier this month another distribution method was found; the malware creates a DHCP server that in turn makes machines use a malicious DNS server. This DNS server will redirect network users to webpages containing the malware.

In addition to the common spamming and denial of service tasks that botnets are routinely used for, the botnet's operators include an interesting proxy server component. For about $100 a month, you can use a PC in the botnet as a proxy for your Internet traffic, thereby anonymizing your Internet traffic. They even have a Firefox plugin to make it easy to use the proxy system.

Proxy Server Types Explained - VPN Reviews

Proxy Server Types Explained

Proxy servers have the capability of allowing you to surf anonymously online, but not all of them actually provide this service. Technically speaking, a proxy is simply a server that represents you online. It makes a request to a webpage or to a different resource in place of you making that request directly with your own computer. How this request is made determines whether the proxy is transparent or anonymous.

An example of a transparent proxy would be a server that simply forwards your request to the resource that you want without concealing any of your information. This may be used in the workplace, where the IP address of the request is revealed to the server being requested from but where the proxy provides access to the resource for a multitude of computers within the network. Transparent proxies are generally not what people are looking for when they go shopping for proxy server access online.

Anonymous proxy servers conceal your information. When you go to request something from the webpage, the webpage gets the IP address of the proxy server that you’re using instead of your own. The server has no way of accessing your IP address and communication between you and the proxy server is encrypted, in cases where the greatest deal of security is desired.

One other variation on these servers are highly anonymous proxy servers. These servers not only conceal your IP address, they also conceal the fact that you are using a proxy server to access the resource. In cases where this is not used, your IP address may be concealed but the resource that you are accessing will be aware that you are accessing it from a proxy server and that it is not sending it to your real address. In situations where the highest levels of security are needed, highly anonymous proxy servers are generally preferred.

SOCKS 4 and 5 are protocols used to communicate over the Internet or other networks by computers. SOCKS 4 is an older protocol, and it doesn’t have the same features as does SOCKS 5. SOCKS 5, for instance, can be used for DNS lookup services, for UDP communication and is generally more flexible than the earlier SOCKS 4. Some proxy server providers will offer both SOCKS protocols to their clients. There is generally no pricing difference for using one or the other.

Big Book of Windows Hacks

Steal this file sharing book, what they won't tell you about file sharing

Handbook of information security

Mac Security Bible

Traffic Monitoring and Analysis, Third International Workshop, TMA 2011, Vienna, Austria, April 27, 2011, Proceedings