Massive DDoS Attack Brewing?

Quite a number of people wrote in with the news that CNN is reporting that a Back Orifice-like program masquerading as a movie clip is infecting thousands of computers worldwide. The prediction is that it's being setup for a DDos - but the technical details, are shall we say, "sketchy".

Comments

Re:CNN ?

[Booxbaum]

The link to the advisory on www.netsec.net is here, has more technical info than the cnn article.

Killing of a subseven network...

[GoNINzo]

I recently killed around 250 nodes of a subseven network. Apparently, they thought my irc server would be a good harbor. They all used the same username, and they all used similar names. After I found the bots, I put a sniffer on the bot master, grabbed his password, and then used that to gather the ports and passwords of the bots. Then, I used the 'remove server' option of the server to remove the bots from the people's machines.

It was a huge project, took me around 8 hours to do, and was a huge pain in the ass. Subseven is a damn scary trojan, only has limited flooding abilities, but it can gather a lot of information and can redirect most anything. this would allow a cracker to gather personal information, bounce a web request off of it to use a stolen credit card, or ping flood some ip.

I hope to god they manage to catch these guys and that they don't pay much attention to the news.. heh.. i'm betting they are just using subseven to bounce off a client anyway, so their ip might be diguised. all I know is that 250 of these clients are no longer around because of me, and that makes me feel a little safer.

If anyone is involved in the clean up of these clients, please get in contact with me. I might be able to provide you with operational knowledge.

--
Gonzo Granzeau

Stop it before it spreads

[geoffeg]

To prevent this DDoS from happening I think that everyone should start turning off their computers. Anyone that works at an ISP should go to the server room's and shut everything off. Not only will this stop *this* DDoS right in its tracks, it will save power.

shutdown -h now damnit
Geoff

Re:Stop it before it spreads

[MrDelSarto]

don't worry ; i've written a small vbs file that will send everyone in your address book a message informing them they may unwittingly be part of a DDoS attack ...

Massive automobile recall

[Megasphaera Elsdenii]

Why on earth do these sources always talk about 'computers' without being more specific ? As if computer == 'a PC running DOS'. I smell a rat here (even though I'm sure CNN doesn't run their web servers under Mega$lob software, be that operating system-wise or application-wise)

Imagine the following press release:

REUTERS -- Somewhere.

A major car company has decide to issue a callback on one of their models. Under certain conditions a particular safe-critical part of the car might fail. Although the total cost of the recall is purported to be high, officials at the company were confident that it would not influence their quarterly results, due at some point.

Here's the beef

[akey]

A quick check of the Network Security Technologies website has a bit more info than the CNN article. Read their advisory here. Apparently, the Serbian Badman Trojan (as they're calling it) is using an IRC channel to report the compromised IP address, and then starts listening on a port -- this is why they think it could presumably be used for a DDoS attack.

---

tell 'em to run ZoneAlarm

[Pfhreakaz0id]

You should recommend to anyone (particularly not geeks) you hear is getting a DSL/Cable or any "always on" connection to go to www.zonelabs.com and get ZoneAlarm. It's free (beer) and it's really easy to use and it will alert you anytime any program tries to get out to the internet (in very easy to understand terms: "Program XXX is trying to contact the internet, do you want to let it?" -- along with a check box not to be bugged by that program again. Plus it does the blocking job of incoming probes too. Not and industrial strength firewall, but fine for home use. Plus, the new version has a nice "mailsafe" feature for vbscript trojans.
---

Re:WTF?

[cancerboy]

Actually MSNBC has a better story, including the reply from Network Associates that they think it's pretty much low risk.

Also names the file which goes under two names

QuickFlick.mpg.exe or MySissy.mpg.exe

Interesting quote ...

[Draoi]

Interesting quote from the NETSEC guy:

"We're all hackers, in the traditional sense of the word," Waskelis said. "If we find something like this, we want to pick it apart and see what it's doing."

They're finally getting their terminology right ...

Pete C