[deleted]
Botnet Controls “Twitch Installs Arch Linux”
21–30 of 32 posts
Re: Botnet Controls “Twitch Installs Arch Linux”
#22Yup, this was pretty disappointing to us.
We were keeping it running as long as we felt comfortable to do so, but due to our lack of preparation for an actual attack, we decided to cut it when it was obvious that the majority was voting too perfectly on actions that were turning malicious.
At this point, we are not sure how we are going to be continuing with this project. The time investment required to make this secure is much larger than we initially anticipated and our current setup is not optimal to do so. Along with this, we are both currently students and do not have the time to invest in such an undertaking. However, we are currently talking with a group that is attempting to reboot this idea immediately in a more secure environment. We will be exploring our options on how to best keep this project going.
All of our code is available on github at https://github.com/twitchinstallsarchlinux
Re: Botnet Controls “Twitch Installs Arch Linux”
#23Don't restart this thing until you've had a professional harden your network. You are not gonna stop the botnet, so the best you can do is limit the impact of post-exploitation.
yeah. basically, no network access, except to the arch mirrors and just enough to watch the twitch stream. should be hard to abuse.
Re: Botnet Controls “Twitch Installs Arch Linux”
#24Yup, this was pretty disappointing to us. We were keeping it running as long as we felt comfortable to do so, but due to our lack of preparation for an actual attack, we decided to cut it when it was obvious that the majority was voting too perfectly on actions that were turning malicious. At this point, we are not sure how we are going to be continuing with this project. The time investment required to make this sec…
[deleted]
Re: Botnet Controls “Twitch Installs Arch Linux”
#25Yup, this was pretty disappointing to us. We were keeping it running as long as we felt comfortable to do so, but due to our lack of preparation for an actual attack, we decided to cut it when it was obvious that the majority was voting too perfectly on actions that were turning malicious. At this point, we are not sure how we are going to be continuing with this project. The time investment required to make this sec…
Well, I'll thank you for having this experiment, short as it was.
Re: Botnet Controls “Twitch Installs Arch Linux”
#26A good twitch stress test. Hopefully this stuff gets cleaned up in the future!
Re: Botnet Controls “Twitch Installs Arch Linux”
#27Don't restart this thing until you've had a professional harden your network. You are not gonna stop the botnet, so the best you can do is limit the impact of post-exploitation.
Better yet, just run this on a t2.micro on a throwaway EC2 account. Doesn't matter if they own the box, they get literally nothing they couldn't get for free from Amazon anyways.
Re: Botnet Controls “Twitch Installs Arch Linux”
#28Don't restart this thing until you've had a professional harden your network. You are not gonna stop the botnet, so the best you can do is limit the impact of post-exploitation.
And this is hardening like a DMZ. I'd probably end up with an arch mirror VM on the same host, tell libvirt to isolate the traffic and tell the host to drop all traffic coming from these machines without looking at it after setting up the arch mirror.
And then cross my fingers that there are no KVM bugs.
Re: Botnet Controls “Twitch Installs Arch Linux”
#29Don't restart this thing until you've had a professional harden your network. You are not gonna stop the botnet, so the best you can do is limit the impact of post-exploitation.
Better yet, just run this on a t2.micro on a throwaway EC2 account. Doesn't matter if they own the box, they get literally nothing they couldn't get for free from Amazon anyways.
it also becomes quite easy to lock the machine down
Re: Botnet Controls “Twitch Installs Arch Linux”
#30Don't restart this thing until you've had a professional harden your network. You are not gonna stop the botnet, so the best you can do is limit the impact of post-exploitation.
yeah. basically, no network access, except to the arch mirrors and just enough to watch the twitch stream. should be hard to abuse.
put it in an aws vpc on a private subnet. create another subnet with a nat instance. Only allow access to the vpc over ssh or whatever from the secure control server. Lock all other incomming via security groups or network ACLs. Allow egress from this box only to route on ports 80 && 443 out through a route table to the NAT instance to the internet. Further you can allow the nat to only allow access to 80/443 outbound to whitelisted ip addresses, or if you want to get craftier, make the nat a squid box and whitelist / net nanny what it can hit possibly via an admin watching twitch plays stream and saying yea/nea