Slashdot Mirror
20,000 Zombie PCs -- $3000
Saint Aardvark writes "From F-Secure blog comes these links to two USA Today articles on spamming. The first gives an example of how a grandmother ended up becoming a security expert after Comcast cut her connection for spamming. The second quotes spammers advertising networks of Zombie PCs for sale. The price? $3000 for 20,000 machines."
Telenor takes down 'massive' botnet (From the story, they didn't really take down the botnet, just rendered it headless for a little while.)
One line blog. I hear that they're called Twitters now.
Very few people realise that deploying a cheap effective reverse firewall will save them from being unwitting spam zombies (kinda sounds like sex slaves don't it? It sure is as demeaning!).
Granny had the right ideas.
Home users, please note - a. You need a firewall
b. You need a reverse firewall
c. You need to dump IE and use Firefox
d. You need to try dumping windoze and move on - that puppy is probably crapping all over your machine.
--
See that long UID - that's what you get for lurking too long
Actually, the problem is far worse than this.
With the ability to register unicode domain names, you may indeed see www.citibank.com and have no idea that the "a" is from the russian alphabet and therefore points to a different server and IP, even though visually, right down to the pixel, they are identical.
All browsers should show warnings for any domain containing characters from multiple languages, or not permit them at all. I can think of no legitimate use for them.
We get Linux boxes in labs we don't manage hacked all the time. They usually aren't used for SPAM, they are instead used for warez, eggdrops or shells, but they get hacked all the same. Reason is the same too: someone fails to patch their system, and it gets exploited.
Linux needs patching as well because OSS is not immune to security holes. SSH, BIND and even PNG are three off the top of my head that have had security problems in the past. If you run a Linux box that has an SSH server, and you don't patch it when an SSH venurability comes out, someone WILL hack it.
But unless they're running with root privileges (which most distributions don't do by default) you can't overwrite system binaries or executables, or run daemons on priviledged ports (like open smtp relays on port 25), etc. I know that the attacker could do things like use nonstandard ports or privilege escalation hacks like buffer overflows, but it's extra work the attacker needs to do, making it a less attractive target (and thus, more secure by default).
Stupid? Well, people look at their home computers like their TV or their toaster. Is there any other consumer product that requires so much awareness to run?
Probably only the the automobile. We make people take written and practical tests before they're allowed to drive unsupervised, and then in most places they are expected to get insurance to cover any damage their operation of the car may cause.
Is that where you want to go?
Using a computer on the Internet will never be as simple and relatively safe as using a TV, but it could be moved down the scale of complexity in that direction, by better engineering of Internet software and making ISP managed reverse firewalls part of the standard broadband service.
Granny should be able to just turn on her computer to order to sell her crocheting on ebay or get email with pictures of her grandkids without having to research computer administration. And, when she's done, I think she should be able to flick a massive off switch (like on the old PC/XTs) and watch the CRT raster turn into a little dot, without having to worry that somebody is using her computer when she thinks it is idle. I for one would think that was cool.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
That is so true... thought I had security pretty tight on my Cobalt Qube running Linux... then my ISP called me up telling me I'd already used 30G upload and download for the month after two weeks... I normally have like 400MB for a month on my little family server. The spammers were using the Squid vulnerability to make my box a zombie remailer. Had to slap on greatly increased security onto my firewall! They never logged in to my box at all - simply routed their filthy spam through my open port. From all the hits I got googling my issue, I'd say this is way to common... this is one case where Linux is easier to abuse than windows!
Do you have any links to examples or javascript that can actually do this?
Firefox spoof demonstration. No padlock spoof, though, I believe.
JP