{"id":1110,"date":"2009-03-13T04:08:58","date_gmt":"2009-03-13T12:08:58","guid":{"rendered":"http:\/\/cubist.cs.washington.edu\/Security\/?p=1110"},"modified":"2009-03-13T04:10:06","modified_gmt":"2009-03-13T12:10:06","slug":"the-bbc-borrows-a-botnet","status":"publish","type":"post","link":"https:\/\/secblog.cs.washington.edu\/Security\/2009\/03\/13\/the-bbc-borrows-a-botnet\/","title":{"rendered":"The BBC Borrows a Botnet"},"content":{"rendered":"<p>In an effort to make the public aware of the threat of botnets, the BBC comes very close to violating the UK&#8217;s Computer Misuse Act.\u00a0 The BCC technology program Click acquired a botnet of about 22,000 computers and used them to send spam to BBC-owned e-mail accounts.\u00a0 They also mounted a DDoS attack on a site owned by security company PrevX (with their permission, of course).\u00a0 Click acquired the botnet after &#8220;visiting chatrooms on the internet.&#8221;\u00a0 Before giving up control of the zombie machines, Click advised owners of vulnerable machines on how to make their systems more secure.<!--more--><\/p>\n<p>Click&#8217;s ability to acquire the botnet makes clear the increasing ease with which malicious users are able to raise computer armies to do their evil bidding. While the article doesn&#8217;t directly say how the botnet was acquired, it asserts that 1,000 computers may be sold for around $400.\u00a0 Their &#8220;chatroom visit&#8221; likely mirrored a real-world back alley deal.<\/p>\n<p>Although Click&#8217;s intentions were pure, their means were questionable and only furthered the problems botnets raise.\u00a0 They encouraged botnet creators to continue their work, proving that there is an expanding market for their product.\u00a0 Even though they only sent spam to their own accounts, they still burdened the servers along the way, wasting bandwidth.\u00a0 Finally, to deliver their warning message to users, they either had to identify the users, comprimising their privacy, or make changes to their machines.<\/p>\n<p>I hope that Click&#8217;s use of a malicious service will make people aware of these attacks and inform them how to prevent subversion of their computers.\u00a0 BBC should be reprimanded by the government because their actions come close to breaking the statutes in UK&#8217;s Computer Misuse Act.<\/p>\n<p><a href=\"http:\/\/news.bbc.co.uk\/2\/hi\/programmes\/click_online\/7932816.stm\" target=\"_blank\">BBC Article<\/a><\/p>\n<p><a href=\"http:\/\/www.opsi.gov.uk\/acts\/acts1990\/UKpga_19900018_en_1.htm\" target=\"_blank\">Computer Misuse Act<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In an effort to make the public aware of the threat of botnets, the BBC comes very close to violating the UK&#8217;s Computer Misuse Act.\u00a0 The BCC technology program Click acquired a botnet of about 22,000 computers and used them &hellip; <a href=\"https:\/\/secblog.cs.washington.edu\/Security\/2009\/03\/13\/the-bbc-borrows-a-botnet\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":124,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,7],"tags":[],"class_list":["post-1110","post","type-post","status-publish","format-standard","hentry","category-current-events","category-ethics"],"_links":{"self":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/1110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/users\/124"}],"replies":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/comments?post=1110"}],"version-history":[{"count":6,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/1110\/revisions"}],"predecessor-version":[{"id":1115,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/1110\/revisions\/1115"}],"wp:attachment":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/media?parent=1110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/categories?post=1110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/tags?post=1110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}