Fight fire with fire: the ultimate active defence. (11th July 2016)

• Record Type: Journal Article
• Authors: Miraglia, Armando; Casenove, Matteo
• Is Part Of: Information and computer security. Volume 24:Number 3(2016)
• Page Start: 288
• Page End: 296
• Publication Date: 2016-07-11
• Subjects: Active defence -- Botnets -- Emerging threats -- Malware; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-01-2015-0004
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: This paper proposes an approach to deal with malware and botnets, which in recent years have become one of the major threats in the cyber world. These malicious pieces of software can cause harm not only to the infected victims but also to actors at a much larger scale. For this reason, defenders, namely, security researchers and analysts, and law enforcement have fought back and contained the spreading infections. However, the fight is fundamentally asymmetric. Design/methodology/approach: In this paper, the authors argue the need to equip defenders with more powerful active defence tools such as malware and botnets, called antidotes, which must be used as last resort to mitigate malware epidemics. Additionally, the authors argue the validity of this approach by considering the ethical and legal concerns of leveraging sane and compromised hosts to mitigate malware epidemics. Finally, the authors further provide evidence of the possible success of these practices by applying their approach to Hlux, Sality and Zeus malware families. Findings: Although attackers have neither ethical nor legal constraints, defenders are required to follow much stricter rules and develop significantly more intricate tools. Additionally, attackers have been improving their malware to make them more resilient to takeovers. Originality/value: By combining existing research, the authors provide an analysis and possible implication of a more intrusive yet effective solution for fighting the spreading of malware.