syssec_red_book

11. The Botnet that Would not Dietive mixing in P2P botnets and its consequences for network resilience andrecovery [409].To establish an idea of the threats we may expect from future P2P botnets,several researchers have designed their own theoretical highly resilient P2Pbotnets [213, 295, 360, 403, 404]. We are currently not aware of any existing P2Pbotnets based on ideas from these academic proposals.11.6 Research GapsWe envision Research in the area along the following dimensions:11.6.1 Prudent Counter-attacksAssuming the old ways no longer work in taking down botnets, what are thenew ways? Can we alert users that they may be infected without becomingtoo intrusive? Are there safe ways to penetrate other people’s computers andremove infections? This direction of research is not very popular today, as itrepresents what are known as offensive techniques. Most research departmentseschew such research. We believe that we need a better understanding of whatthe options are.11.6.2 LegislationCurrently, most countries lack a legal framework for dealing with these newadvanced botnets. We have no guidelines as to how and when we can takemore invasive measures against resilient malicious infrastructures. Nor is thereclarity as to who should do it. And there is even less clarity when it comes tostriking back at machines that are located in other countries (assuming youcan even tell). We need research into the desirability of such measures, theboundaries for such measures, etc.11.7 Example ProblemsTangible example problems might include:Legal boundaries for hacking back. Can we provide clear and intelligiblelegislation that clarifies under what circumstances the government isallowed to strike back at botnets? Which computers is it allowed toattack—just the ones in its own country or may borders be crossed ifneed be (and if so, under what circumstances)?Poisoned fruit. Rather than taking the P2P botnets down, can we disrupt theirefficiency sufficiently to make them less interesting for attackers? Forinstance, can we inject an overwhelming amount of fake data, so that itbecomes hard for the bot masters to extract the useful information?86