Cover Story: Waiting to strike
06/09/2005

By YOSHINORI HIRAKO, The Asahi Shimbun


      Take a closer look at your computer. Seems fine, right? But inside 
that high-tech gadgetry that people rely on for work, shopping and keeping 
in touch, there could be a war just waiting to happen.

      We have entered the age of the ``bot,'' the newest strain in the vast 
number of noxious computer viruses.

      Bots, as in robots, start out as spies and with the push of a few 
buttons, mutate into virtual armies, destroying anything that stands in 
their cyber way.

      ``Bots have the potential to bring a nation's whole computer network 
to a grinding halt,'' warns Ko Ikai of the National Police Agency's Cyber 
Force Center. ``They can certainly damage a target company's computer 
network.''

      Bots slip undetected into victim PCs, wreaking havoc along the way and 
engaging in spy activities by downloading private data.

      They continue to nest quietly until receiving orders to mobilize 
through their ``general,'' or remote user. Then they attack; opening up the 
victim computer to remote access and propagating before spreading en masse 
to the next battleground.

      While conventional viruses and worms are bad enough, they are 
comparatively tame, say experts.

      Because regular viruses are usually designed to stir commotion and 
draw publicity, they can be spotted fairly easily.

      Bots, however, are hermetic. Therefore, they are capable of affecting 
thousands of networks in a single strike.

      Yuji Hoshizawa is an engineer at Tokyo-based SecureBrain Corp., which 
provides security for businesses against digital threats.

      ``It's quite easy to gain access and almost complete control of a 
personal computer using the bot virus,'' Hoshizawa says. ``And then there's 
the added worry that your computer could be taken over and used as a conduit 
for an attack on a third party.''

      Bots, he adds, can make your PC turn all sorts of tricks, like 
forwarding information specified by the remote attacker or sending off 
infected e-mail in droves.

      But bots' true ammunition lies in the fear they create.

      The NPA says it is aware of ``bot control rights'' being traded among 
overseas' criminal organizations.

      According to the NPA, operators of a gambling Web site in Britain said 
they were threatened in March 2004 with an imminent ``all-out bot attack'' 
unless they coughed up the equivalent of about 4 million yen. The incident 
was the first reported bot-related crime.

      Although no cases of ``bot blackmail'' have yet occurred in Japan, 
authorities are on constant alert.

      The Information-Technology Promotion Agency, Japan cited bots in a 
March report as the No. 1 threat to computers. The new cyber threat also 
prompted the NPA in January to release an analysis report on the bot virus.

      Meanwhile, bots are also featuring large in computer virus damage 
reports released by anti-virus software companies.

      But with so many variants, it is becoming increasingly difficult to 
devise ways of defeating the menace.

      According to Trend Micro Inc., an anti-virus software company, there 
are already more than 9,000 bot variations, including subspecies, lurking 
behind the ``on'' button.

      Those that ordinary computer users should be on the lookout for, say 
Trend Micro officials, are the Agobot, the Sdbot, the Rbot and their 
variations.

      The most effective way to prevent infection, they add, is to keep 
updating anti-virus software programs and stick to the basic rule of not 
opening e-mail messages that look even vaguely suspicious.

      And yet, there are even bigger concerns.

      One of the many bot viruses is outstripping all the rest. It has 
already developed more than 1,000 variants and subspecies-and it is still 
breeding.

      Hiroki Iwai at LAC Corp., a computer security planning company based 
in Tokyo, explains that once the source code-or the blueprint-is revealed on 
the Internet, creating a DIY bot to attack a specific corporation no longer 
requires high-tech savvy.

      In mid-April, a Tokyo-based manufacturer that operates networks of 
several thousand computers discovered it had only narrowly escaped falling 
victim to such an attack. By chance, communication data that was usually not 
in use was found to have been tampered with. A resident bot, although not a 
highly sophisticated one, was apparently trying to get in touch with the 
outside to ``call home.''

      Since then, the company has been taking additional precautions.

      The company official in charge of Internet management fears the 
company could be targeted again.

      ``It was the fourth time we have had to quarantine network computers 
that were exposed to a new bot strain. Maybe we are on a secret hit list,'' 
he said.

      Experts agree on one thing: There is little you can do once a decision 
has been made to target your computer.

      The LAC's Iwai explains: ``Since the virus is not scattered about over 
a wide range, that makes it difficult to develop a specific anti-virus 
vaccine. What you have to do is to really make the effort (to crack bot 
infiltration) by screening the network and tracking fishy transmission data 
step by step.''

      Currently, the NPA's Cyber Force Center is keeping watch on about 20 
bot families with the sole aim of preventing cases of blackmail.

      The center purposely allows the virus to infect a system, and then 
keeps vigil on any incoming commands. The NPA's Ikai said: ``Though it is 
said that anti-virus safety measures have come a long way, in reality, the 
danger is right out there. I would say, the situation is as precarious as 
ever.''(IHT/Asahi: June 9,2005)