Slashdot Mirror
Infected PCs for Rent
prostoalex writes "UK authorities are raising concerns about entire networks of infected and compromised PCs (BotNets) being available for sale or rent to the highest bidder. The Register quotes a detective from Hi-Tech Crime Unit saying 'The trade of BotNets of compromised machines is becoming an industry in itself. Organised crime is making use of this industry.'"
With the number of known vulnerabilities in Microsoft operating systems, (not to mention the ones we don't even know about) it is really not hard to imagine these botnets being frighteningly large. I read one article that estimated the current number at something like 100,000! I'm doubt it's enough to bring down the entire Internet, but this could still be capable of providing some crushing DoS attacks, a la SCO.
Gives some merit to distributed hosting companies like akamai, etc.
We need to start beating the living crap out of people who mess with our stuff. Spammers, malware writers, black hats, you wouldn't put up with the neighborhood kid stealing your bike would you? No. You'd go kick his ass and take back your back. It's time to start kicking ass and taking back our Internet.
A guy I know runs his unpatched Windows XP computer 24/7, and never does virus scans. The other day he got 1000+ (around 400mb) executable files in his C home directory. I asked him what he plans to do about it, and surprisingly enough he didn't want to apply critical updates. He said he doesn't care what people do to his computer, because he does nothing important on it. It amazes how many people must think like him.
Is there anything that Organised Crime isn't making use of these days?
I just wrote a (bad) paper on a networking structure for games systems. I give it three weeks from when I hand it in until Organised Crime get their hooks into it. Apparently film piracy is also part of Organised Crime, and not my mate Donn, as I have previously thought.
Call me a cynic - but it seems to me that anyone who wants to get the media in on their thing cites Organised Crime as a benefactor and watches the links roll in.
OK - I'm done.
"If being a geek means being passionate about something, then I pity those who aren't geeks." - Pike65
I strongly believe that the most effective way to end this would be to scan for compromised nodes, identify them, and KNOCK THEM OUT. Then the user can call the local home-computer fixit guy to come fix their computer. He'll see it's infected with malware and fix it. User gets his computer fixed, fixit guy makes a buck, and one less node is spewing out sh*t.
Yes, I know this approach would be illegal. A felony computer crime in fact. I want legislation to make it legal and justified. I see it as self defense. Compromised nodes are clogging the internet with crap and the best defense is to knock them off-line. If I were standing in the middle of the freeway, clogging traffic and causing accidents the police would come remove me, by force if necessary. I see zombie nodes on the internet the same way.
-=-=-=-=- osjedi uses Debian GNU/Linux. -=-=-=-=-
Really, I do find this fascinating, albeit in an underhanded way.
Regards,
John
Falling You - beautiful
Presumably the exploitation of these victim-lists will proliferate with all the automated efficiency that is the spammer's hallmark. At its logical extreme, there'll soon be multiple spammers descending simultaneously en masse onto each listed victim, which one way or another results in the victim being shut down (presumably).
So, might the predators eat themselves out of existence?
(I know. I've been watching too much sci-fi.)
Seeing bad movies only encourages them. Watch responsibly
No, its more like blaming the dumb shit who leaves his doors unlocked and his windows open (pun not intended, but apt!), and then leaves the car sitting in a questionable neighborhood.
Installing anti-virus & firewall software are basic computer security measures, like closing the windows & locking your doors. Neither are foolproof, but both are simply a matter of training the user. Unfortunately, its been my experience that installing anti-virus & firewall software tends to be a much more painful process.
And of course - downloading updates would be analogous to putting fuel in the car: it is basic maintenance that needs to be done relatively frequently.
Tracing controllers of a botnet is next to impossible ... and everyone says that the people running the trojans are innocent victims. Well, this is going to carry on until the 'victims' are punished for their BLATANT NEGLIGENCE. They CHOOSE to run M$ software, and Outlook ... therefore they CHOOSE to run the risk of viruses. I say we start cutting them off their ISPs, maybe even prosecuting a few to make an example of them ... windoze lusers will start paying attention to their security *then*, and botnets will die.
unfortunately, this would be illegal. however, that won't stop anyone; what's stopping people from doing this is that to someone who could do it it's a waste of resources. if you have all those machines out there you can get your hands on, why not use them for your own nefarious purposes, since the people who own them neither have the common sense nor the ability to control their own machines.
We have a bot network problem like everyone else... these things riding in on the coat-tails of the M$ft vulnerabilities has given us the 'ol one-two punch.
We estimate anywhere between 400 and 1500 of the ~10,000 on campus (student resedential) machines have some sort of back door installed.
We have blocked any incoming traffic to any dorm machine (regrefully) so they can't be controlled from outside because we mostly are tired of getting blacklisted for DoSing people or for spamming.
The saving grace has been TippingPoint, a network traffic analysis tool that sits behind the backbone routers and adds a latency-free checkpoint dropping traffic related to the M$ft security exploits. And when they get Blaster, Bagle, Nachi, etc etc etc they get automatically disabled by the routers and we (IT Services Support on campus) either fix their issues for them or they have to fix them themselves. When fixed they are automatically re-enabled.
I haven't posted in so long, my sig is out of date.
Blaming the user is the least productive approach.
For the sake of arguement, let's say currently a full 90% of users are totally clueless, and it is somehow possible to wave a magic wand and make 90% clueful, leaving only 10% of them blameworthy.
What happens?
DDoS type attacks can't find nearly as many machines to work from. So the writers use a trojan, and have to increase the delay between propagation and activation. Because infection is typically a non-linear process, often approaching a square or logarythmic function for some parts of the process, the delay has to be increased from, say, a week to two weeks. Meanwhile, the patch for the trojan takes its usual month to develop, and the social structures that be are reluctant to tell even the clueful about a threat that is still unpatched as yet.
So long as the Trojan writer has abundant extra time to maneuver within, 'he' isn't strongly affected by the improvement in user cluefulness. Yes, it creates some extra stumbling blocks, such as a better chance of the Trojan being detected earlier in the process, but professional Trojan writers have shown serious ability to work around these obstacles.
In addition, although its an unrelated point to yours, these particular attacks are also supposed to be related to blackmail. Successful blackmail doesn't require a real threat, but merely one the victim believes is real.
Who is John Cabal?
Exactly, withing minutes of finishing my first install of XP pro (SP1) (finishing NOT starting), I connect to net intent on A) making shure it's connecting properly and all settings are correct. And B) donwloading the necessary patches, never made it to the windows update page as winxp's firewall isn't on by default and blaster had my system nearly unusable on the net by the time I'd logged in and verified I could get e-mail.(this with a connection that rarely reaches 28.8)
Fourtunately getting the firewall on slowed it down enough to get the patch and clean the system.
This was the third virus I've gotten, the other I got at the same time off of a 5.25" floppy (that long ago, MSdos was still on the 3.x version.)
As far as I'm concerned that is a recall level problem, if a car or tv was that faulty out of the box a recall would almost be certain.
How is it we tolerate this out of 'comercial' software? And accept we'll have to patch most out of the box to get them to work. It's one thing if something doesn't work perfectly with some obscure hardware (though the o.s. and drivers are what's broken in this case). But to be almost unuseable is not acceptable.
Would you buy a car that if the radio was turned on at the wrong point during some songs it blew a fuse and caused the controll module to think it was pumping to much gas to the injectors?
Would you buy a tv that couldn't get the odd numbered channels after watching a channel above 9 unless you powered it off then on with the remote only?
And before anyone starts in on how computers are so much more complex than the above, or how impossible it is to test against everything, etc. I would like to point out that cars and tv's and so on have gotten VERY complex (just look into some of what the ecm module in a new car does)
And simply making shure your code can handle, in a gracefull way, any inputs,exceptions, or other out of bounds conditions it may have to deal with, and that is possible. Some languages make it hard not to and still 'comercial' programs written in these languages still crap out for things they should have been able to deal with, or at least recover from.
Mycroft
https://signup.leagueoflegends.com/?ref=4c3ed6600b6ea
Mom? Bro? MacOS thank you. OSX means I can fix mom's machine from 3000 miles away.
So yeah, my boxes that serve and relay mail (80% spam) can just block SMTP connections with Windows fingerprints. Perhaps just bump it up to port 26 and a listener with much more rigourous anti-spam.
Nah, just segregate the dangerous windows folks off. Like to AOL or CompuServe. I'll never get back the happy days when you had to be tall enough to be on the Internet.
And yeah, 2 people on IPv6. Heard about the same thing in 1990 about the Internet. Just a couple geeks. Nobody over here. You guys just stay on your boxes and keep your CompuServe accounts and stay on IPv4.
RE: terrorism
When important services are brought down by DDOS and viruses (east coast blackouts anyone?), it's terrorism. The U.S.A.P.A.T.R.I.O.T. act notwithstanding, being able to buy and run hundreds of thousands of compromised Windows machines (and cable/DSL providers and MS stand by with no action) means that we ain't seen the least of it.
I hate to say it, but the only solution for Windows users is Paladium. Yes, Paladium prevents users from running the software of their choice and effectively puts their machine under the control of Microsoft. But their stupid choices are the problem! Besides, if they really wanted choice, they wouldn't be running Windows.
Paladium doesn't fix the system security holes, but it does fix the biggest security hole on most Windows machines - the user. It could be good for the net - provided that responsible users aren't forced to use it. At present, the test is easy. Windows users need Paladium. Others don't. (Yes, I know there are competent Windows users out there - but I've never met one.)
So how long before companies/gov't are taken "hostage" by rented DOS machines?
That kind of thing already happens. A friend of mine does administration for a couple small and medium size ecommerce sites. The calling card is typically a 30 minute DDoS attack followed by an email and/or phone call saying "we can make this problem go away if you pay us".
If you don't pay them they DDoS you a few more times. If you pay them, they DDoS you a few more times and demand more money. Only option is to go to the Feds with it and hope they use attacks your upstream provider can help filter.
Freedom is merely privilege extended unless enjoyed by one and all.
Rumor has it, in fact, that some banks have paid blackmail money to gangs in Russia only to discover that blackmail gangs in Russia share lists of suckers.
The banks would get a message like "we've found $HUMILIATING_SECURITY_BREACH but for $25,000 we won't tell the press". Then they'd pay, and in a week would get a bunch more messages from other places making the same threat and demand.
Different kind of threat, but the same underlying problem.
Only if the machines were hijacked illegally. I wonder how the court would rule if the distributed service running on the machine was a spyware program that technically told the user what it was doing (because none reads software licence agreements) and which the user agreed to install.
Now if these machines were being used to do something illegal then the buyers of the service could be held accountable, and the money trail makes it trivial to track down.
"Where grid starts taking off is in corporate (or educational) environments where you have tons of hardware on desktops all over the place that spend 99% of the time doing nothing."
University computers: queues for PCs at any hour of the day or night, and 80% CPU when they're being used because they're 500MHz pentiums running Windows.
Normal corporate computers: okay, these aren't being used at night, but remember they're being maintained by petty little people whose ideal day at work involves imposing a coffee-machine policy: don't be surprised if they're all powered-down at night to save electricity.
Corporate development machines: Rather better specified (racks of dual 3GHz machines), but again being used day and night, almost continously compiling, running, or testing something, and at night (when the developers leave at midnight), they're either left compiling something that takes all night, or left downloading ISOs that would take too much bandwidth in daytime.
Grannys' home computers: turned on when needed. Arguably it's mostly idle, but the owner will complain like buggery if it's ever slow to respond, plus it's internet connection is a 56K phone line once every 3 days.
Slashdotters' home computers: Constantly on, and constantly in use. How many people are going to put up with Tribes running slowly because their "idle" computer is being used to fold proteins? And how many people want their pr0n to download slower because they're DDoSing some public target?
So where are all these PCs running at 1% CPU continuously?