Slashdot Mirror

← Back to Stories (view on slashdot.org)

Heise Online Reveals Trojan / Spam Connection

Posted by timothy on from the how-to-make-friends-and-influence-people dept.

yourruinreverse writes "Virus distributors have been caught red-handed selling IP addresses of trojan-infected machines by editors of the German IT magazine c't. Several individuals appear to have been arrested already after c't, revealing one of the virus writer's nationality as British, passed on the information to Scotland Yard. Check out the German article first, then its translation on Groklaw and maybe also same translation posted in the English section of the Heise website (in order of appearance)."

15 of 150 comments (clear)

  1. Re:PWN3D! by Aardpig · · Score: 5, Funny

    I hope they send them to a British pound-me-in-the-ass prison!

    In Britain, this happens in the private schools, not the prisons...

    --
    Tubal-Cain smokes the white owl.
  2. So, I suppose the next question is... by Xystance · · Score: 5, Interesting

    When will they post a website that has an engine that will allow us to submit IP addresses / MAC addresses to find out whether they are infected? I have the entire IP table of where I work... knowing what machines have been compromised through trojans would be helpful... Either way... Go Heise!

    1. Re:So, I suppose the next question is... by Bender+Unit+22 · · Score: 5, Informative

      Although not quite what you wanted dshield has a page where you can see if your machine has been reported as scanning others.
      They also has a banner you can add to your site that shows a warning if the viewers ip is in the list. But if fear that people will ignore that and mistake if for the "Warning, your machine is broadcasting an IP..." ad. that used to run.
      also check out mynetwatchman

    2. Re:So, I suppose the next question is... by 26199 · · Score: 5, Informative

      That's exactly what tools like nessus are for.

  3. A maturing industry... by erick99 · · Score: 5, Insightful
    Maybe this isn't so surprising. Virus writers are becoming, as the gangsters in movies like to say, "a business man." Capitalism will grow in any sort of soil. I'm not supporting this by any means, but, sociologically, it sure makes a point about how any "industry" or endeavor will eventually start to emulate more legitimate enterprises.

    Keep Smiling!

    Erick

    --
    http://www.busyweather.com/
  4. I new it! by megalogeek · · Score: 5, Insightful

    OK, we all knew it, but maybe this will be enough incentive for the major news outlets to pick the story up. In an ideal world people would see this story, realize that much of the spam they get can be blamed on viruses and patch their systems.

    Too bad we don't live in a perfect world.

  5. Caught red-handed? by twoslice · · Score: 5, Funny
    The phrase "red-handed," meaning, as the Oxford English Dictionary puts it, "in the very act of crime, having the evidences of guilt still upon the person," A murderer caught "red-handed" still had the blood of his victim on his hands. We have, since the 18th century, also used "red-handed" to describe any criminal caught in the act or bearing irrefutable evidence of guilt.

    So did these guys have IP addresses hanging from their necks like bling blings?

    --

    From excellent karma to terible karma with a single +5 funny post...
  6. Re:Theo article by LostCluster · · Score: 5, Insightful

    Uh. Why do you think zombie networks and selling access to them wasn't a problem earlier?

    Viruses are finally sophisticated enough to create botnets, and spammers have become more and more desperate for ways to pump their e-mail out.

  7. Excellent work by tiger99 · · Score: 5, Interesting
    It is about time that something like this happened, and I hope the courts deal with them severely.

    It would be very useful if the police forces had well-publicised points of contact for reporting computer and internet crime. At the moment, the local police station is unlikely to know anything at all, unless you are lucky to meet one of the few policemen who is really into computers, likely as a hobby. The expertise seems mainly to be in Scotland Yard, the department there could do with more funding, more staff, and more publicity, such as a simple means to contact them by email or web. My systems get beseiged by attacks from a handful of IP addresses, and if there was a central point for reporting all these easily, it would not be hard to spot the patterns and take appropriate action. For example, a warning letter from the police might be sufficient to get open mail relays closed, and cable modem users who have been trojaned might pay heed and take proper precautions. This could be largely automated, only where the parties concerned were deliberately committing criminal acts, or who failed to react to a warning, would the full powers of the Computer Misuse Act need to be applied.

    Not so long ago there was an idiot on the NTL cable network who was causing continual problems to others because his machine was running continually and had been trojaned, and was being used by hackers elsewhere. Something like that, after a few independent reports, should automatically trigger a "cease and desist" letter, together with some good advice on cleaning up the problem.

    It seems to me that it should be quite simple to gather and collate information from the public, which with the ISP's logs would enable the causes of problems to be located and dealt with. I for one don't mind my ISP's files being available automatically to a law-enforcement robot, I rather would get a warning letter or email if something was amiss.

    Of course the way to deal with the most recent round of severe problems is to simply ban Outlook. I wonder if the Convicted Monopolist could gain another conviction for deliberately producing software which facilitates contravening the Computer Misuse Act? BTW it would help if other countries enacted similar legislation instead of being misled by fascists like the RIAA into stupidly focussing on those who might want to play a DVD on their Linux computer, for example. In the UK, the CMA has real teeth, sadly it does not get exercised as often as it should, because it provides a means to outlaw certain vile practices. For example, if an installer deliberately cripples another application (we all know some that do, and most come from the Redmond area), that is a criminal offence, and rightly so, yet I have not seen any prosecutions. The wording of the Act would suggest that if installing Windoze as the second OS blows away the ability of Linux/BSD/OS-2 (or whatever) to boot, then an offence is committed. The only defence seems to be that it was done in ignorance. Can you imagine Bill standing in the dock in the Old Bailey, pathetically whining that he was not guilty, he was only ignorant? Justice would be admirably served by that admission.

  8. The factor neglected most often.. by Anonymous Coward · · Score: 5, Insightful

    The machines infected with the trojans can be used as spam relays.. sure - but at the same time theyre also a gold mine for fraud, just think about all the data stored on the hard drives available for download - financial data, all kinds of private documents.. this worries me more than spam. I think data theft will become a hotter topic in the near future.

  9. And the network operaters still do nothing by cluge · · Score: 5, Interesting

    This is no suprise for people involved in the anti-spam community. It has been discussed for some time in NANAE. What is REALLY sad is that some networks really don't seem to care, or don't have the time to police against this sort of thing. When I was Joe Jobbed by one of these spam gangs, using infected machines for webservers, I reported it to RR and comcast security. They were hosting their site all-oem.biz on several obviously compromised machines AND using my e-mail address in advertisements about their company. What did I get for my trouble? E-mail after e-mail that said - "To the best of our knowledge, the incident that was the basis of your complaint was neither posted by an individual using the Road Runner (Or Comcast) system, nor is it in any way related to the Road Runner (or Comcast) system or content maintained by Road Runner." What was funny is that if you did a dig on the domain being advertised it ALWAYS contained a road runner cable modem account.

    Lets try it again for a test shall we?
    # host www.all-oem.biz
    www.all-oem.biz is an alias for all-oem.biz.
    all-oem.biz has address 217.81.243.206
    all-oem.biz has address 24.98.35.54
    all-oem.biz has address 212.83.89.135
    all-oem.biz has address 213.33.0.67
    all-oem.biz has address 24.6.6.196

    And again, what do we have, 2 comcast cable modems working away trying to sell software that APPEARS to be pirated, and is advertised via spam with false headers.

    Lets check the DNS shall we, the dns servers for the domain are listed as follows

    Name Server:NS1.MOROZREG.BIZ
    Name Server:NS2.MOROZREG.BIZ
    Name Server:NS3.MOROZREG.BIZ
    Name Server:NS4.MOROZREG.BIZ
    Name Server:NS5.MOROZREG.BIZ

    Each of these name servers is also hosted on compromised machines, mostly broadband connections. Don't take my word for it, haul out nmap and take a look for yourself. The IP's for these name servers change pretty often. At this time no road runner accounts are showing up. I give it an hour before we get a few more.

    In short this is nothing new, and no one should be shocked. Spammers have shown themselves to be an unscrupulous lot. What IS good is that this is starting to get some press. Perhaps this will put pressure on providers to police their networks better. Otherwise more drastic action may be required to be taken by other networks to simply protect themselves.

    AngryPeopleRule

    --
    "Science is about ego as much as it is about discovery and truth " - I said it, so sue me.
    1. Re:And the network operaters still do nothing by kiolbasa · · Score: 5, Informative

      I'll bet dollars for doughnuts Comcast and Road Runner never see their own IPs when they do queries on that spammer's domain. I first learned of this trick from NANAE poster "Spamless," so you can look it up for a more thorough explanation (can't find it myself just now). The short story is that the spammer's DNS responds differently depending on the IP that makes the request. When the ISP checks those DNS records, they get something in South America, or China, or another ISP, anything other than them. The cable modem machine is just a proxy.

      It takes a little more effort to track down what is going on, and large broadband ISP's abuse desks are probably too swamped - which should be no excuse.

      --

      Beer wants to be free
  10. Re:The outlawed triangle... by datadood · · Score: 5, Insightful

    Insightful? In what way is P2P filesharing 'illegal'? It might get used for copyright infringement, but that doesn't mean the tool itself is illegal. Think crowbar.

  11. Re:Open Relays by AndroidCat · · Score: 5, Insightful
    Most spammers don't use open relays these days. They use open proxies, which are different. (No logging in the Received lines of the email, and no store/forward--it's the spammer's machine doing the real work.)

    From some of the spam I've been getting, I think that some spammers are playing with zombie relay malware. That allows them to load up a whole spam run on a zombie machine and move on to the next one. I'll bet that their relay software is designed to not look like an open relay to anyone else. Why share the box with other spammers, and why set off open relay detectors?

    --
    One line blog. I hear that they're called Twitters now.
  12. Re:The future of law enforcement? by Vlad_the_Inhaler · · Score: 5, Interesting

    I did not read the article online, but assume it is the same as was in the copy of C't which I read this morning.

    This is not really 'vigilante justice', especially in the racist sense which some ACs below saw there. It was someone who was affected (if only when cleaning up someone else's computer) and took the trouble to see what the trojan could do and where it came from. He then went to the only organisation he could think of (C't) which was technically able to understand the problem and had the legal knowledge necessary.

    Interesting was that companies like Symantec had also done the analytical work on the trojan(s) (and had posted the results) but had no interest in treating this problem at source (the ISS team). They make their money protecting computers from threats and not attacking those threats at source.

    What is going to happen to ISS now?

    --
    Mielipiteet omiani - Opinions personal, facts suspect.