Slashdot Mirror
When Malware Authors Combine Efforts
An anonymous reader writes "Spammers, Hackers and virus writers are all teaming up according to some russian security researchers. This means that they reckon that weaknesses will be exploited in a matter of hours of being announced, rather thant the weeks and months that we're seeing now.
Scary stuff."
They couldn't get along!
So where does this place public disclosure advocates? Are people going to demand that makers of affected software have a 24/7 programming staff ready to plug leaks just so weakenesses can de disclosed immedately? In light of this even I would favor not publicly disclosing weaknesses immediately!
Get a firewall, block all inbound and outbound traffic, unplug your ethernet cable and shut off your computer. It's that easy to protect yourself.
Is it just me, or does it seem that every story that lists the source as a "Russian Security Expert" is generally a load of crap?
-Phixxr
ungggghhhh
to lock down your enterprise with a File surveillence and security tool like i:scan... know what's happening before the user does...
I know what's on your hard dr
...make deep bugs deeper. FOSS philosophy applied to viruses. Yikes.
adam b.
this wont have an effect on computer litirate people who know how to protect themselves ...and for those who dont know things wont change much ether....some people still have blaster on there box..they dont know or wanna know how to take care of there box
I don't think more people cooperating will really find new exploits, they will simply explore the ones they have already found. So, instead of an exploit coming out and than a derivative coming out a couple weeks later, we will see four or five derivates in quick succession of the original exploit.
Also, what "new" cooperation tools are malware writers using to communicate with each other? I'm fairly sure that IRC, Instant Messaging, VoIP, Bulletin Boards, and e-mail have all been standard communcation tools for these people. Maybe the groups now have more members.
-Teiresias
Isn't this the same as orginized crime. So a bunch of internet thugs orginize to advertise more stuff, because they realized it will be more effective if they worked togeth. Will this rise the cost of protection money to use the internet?
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Hacker: I'll form the head!
Scammer: I'll form the heart!
Pornographer: I'll form the right hand!
Spammer: I'll form the crotch!
All: Together, we are - ASSHOLETRON!
(catchy theme music here)
Used to be (way back in 2003 or so) AdAware was all you needed (and Norton AV or a workalike)
But now, man some of the things I've seen are really nasty!
You wipe 'em out, they come back, they hide from searches, morph into other programs, I've even seen one (I shit you not, I've been in IT for 10+ years, never seen anything like this one!) that was active even when the infected drive was placed as a slave on another machine, it started right up and infected the new PC.
This goes way beyond simple syware, these people are teaming up and it's just the beginning.
So rise up, all ye lost ones, as one, we'll claw the clouds.
"They work in groups that exchange information with other groups on forums and Web sites."
erhmm....
ianase (i am not a security expert) but wouldn't that statement apply to, hmmmm....., oh i don't know.....THE INTERNET?? seriously, a broad, vague, statement like that suggests to me that this is mostly overreaction on the part of a group who could experience significant gains IF their statements were true.
fud? imho, yes.
The only way to get rid of a temptation is to yield to it.
-Oscar Wilde
Kinda makes you think twice about publicly announcing vulnerabilities in your software before you have time to fix them, does it not?
There's a Mercedes gap too. I want one and can't afford one, but it's not government's job to do anything about it.
Once done, they have a certain population size (vulnerable hosts) that can be almost instantly assaulted.
On the white-hat side, once the malware is noticed, it may take months to patch the initial security hole and even longer to patch the entire population of vulnerable hosts.
This is why vulnerability announcements are so important, the software that survives in the future will be the one with the shortest vulnerability to patch cycle. The others will die off ... only the strong survive!
However, this article is pleading that we should *not* be publishing vulnerabilities, "because it gives hackers a tool", and I disagree with this. Publishing vulnerabilities is a way to alert the public of exploits that are present. What we need to do is make the publishing of vulnerabilities more popular than it is so that the general public is aware of problems and alerted on how to fix them.
Beat the computer, program your life.
Microsoft should use the business model that's brought them where they are today, create a "virus" department in Redmond and beat these guys at their own game.
I can see it now: Active Virus (TM)
1. Make OS.
2. Build-in holes.
3. Release patches.
4. Create virus.
5. Still profit!
"All great things are simple & expressed in a single word: freedom, justice, honor, duty, mercy, hope." --Churchill
Mistaking hacker for cracker is acceptable on the general media, where people aren't very aware of such subtleties. But on Slashdot? C'mon, I know Slashdot is crawling with Windows users, wannabes and such, but this is getting offhand!
Stupidity is an equal opportunity striker.
Fellow slashdotter Bill Dog
...And this was posted by an Anonymous Coward. Am I the only person to see the irony here?
These are the same guys who were predicting an "Internet Meltdown" a little while back -- I'd take their prognostications with a grain of salt ...
1 53 3213&tid=172&tid=95&tid=1
http://it.slashdot.org/article.pl?sid=04/08/25/
How can you trust such a non-trustable source anywany?
This circumstance does have some advantages; by tying themselves together financially they open the possibility for one to be traced from the other.
It also opens the participants to criminal conspiracy charges. Can you say RICO, motherf***er?
"This is why vulnerabilities are so important," said Kaspersky. "We are against anyone who publishes vulnerabilities because it gives hackers a tool."
This pushes security discussion underground, but doesn't stop the bad guys, just leaves the administrators vulnerable and unaware. Very easy to spread this sort of propaganda however... hopefully it doesn't lead to laws being passed.
Cwm, fjord-bank glyphs vext quiz
By the time someone with enough motivation (read funding) to write an article on a vulnerability does so, the bad guys have already written exploits. Why? For the same reason...they get paid!
The published articles allow the moderately tech savvy user to protect themself. Additionally, it forces the software makers' hand to close the vulnerability faster than if they had no pressure at all. Ultimately, this is our only way of shaming large companies into creating proper software and delaying the releases until they've created a more hardened product.
Yes, hanging out the dirty laundry of vulnerabilities makes it easy for the junior hackers to create something out of nothing, but I'd rather we all know about the problems at the same time than a few sophisticated spam hackers knowing about the problems for an indefinite amount of time.
Never go to sea with two chronometers; take one or three.
until even Firefox will be useless, because see they are gaining market share in leaps and bounds, which makes them a target for malware and exploits now. It's only a matter of time until only lynx will be safe.
Exactly. Which is one of the reasons I refuse to get rid of my old DOS box. 6.22/3.11 for Workgroups. If some 32-bit virii went around, hit everything...I've got my 486 to get the patch:)
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
1) spread fear, its good for business. ... We need to cooperate to prevent this.")
2) create some fucked up 'axis of evil' shit to help further #1. ("Virus writers are combining their efforts with hackers and spammers to launch Swiss Army knife-like malware attacks on users")
3) throw in some fuzzy math for effect. ("The company said that it was seeing 200 new viruses a day.")
4) take a random stab at preventing free speech. ( "They work in groups that exchange information with other groups on forums and Web sites
5) and finally, say something really stupid that goes against something tried and true thats trusted in the industry - in this case, the idea of Full Disclosure. ("We are against anyone who publishes vulnerabilities because it gives hackers a tool.")
and to think i actually used to respect their work. maybe they should just stick to coding and save the PSA's for when they have a smarter PR rep.
just my 2 cents.
smattawichu
In these days of 0-day exploits, I just can't take the chance that someone will find a hole in ssh and create a Warhol-worm before I can install a patch. I sleep better now...
PHEM - party like it's 1997-2003!
I know this has been stated MANY times before in various ways, but if "closed source" truly is effective in preventing malware/hacks/virii simply because the source isn't available for anyone's inspection - then why do we see all the security flaws popping up with IIS? Meanwhile Apache has comparable market-share and usage world-wide on the net as a web server, and it is considered far more secure?
By the same token, Linux and BSD have been chosen as the platform many commercial firewall/router products are based on, despite being open-source. If open-source really had a "disadvantage", security-wise, by the mere fact that it's freely available code - then wouldn't you think companies like Netgear or Cisco/Linksys would steer clear of them in security-related network appliances?
Of course "exploits are expected to come out within hours of disclosure" - but that seems like a pretty general statement to me. Far more people with malicious intent are capable of slapping together some code based on a documented flaw than figuring out a previously undiscovered flaw and exploiting it. If you disclose a Linux or BSD security flaw, I'd say it's just as likely to be exploited quickly as a Windows flaw.
Close. Actually, the two things you should do are:
1) Download and install Firefox.
2) Delete Internet Explorer (if you can).
On my computer, Internet Explorer is slightly faster for casual browsing than FireFox because Explorer is more tightly integrated into the operating system.
On my computer, I'm running Linux. IE is NOT integrated into the operating system. You can't see it, but I'm doing the Superior Dance.
If IE is integrated into your OS, there is a third thing you should do.
3) Upgrade to Linux or Mac.
I can't understand why everyone isn't more enraged by the fact that 80% of spam now comes from zombie Windows PCs. Lack of security hurts us all. As a society, we're far too complacent about PC security. We should take the attitude that a person's right to run an unpatched Windows box attached to a high speed cable ISP does not supercede the right of a million internet users not to drown in illegal V1aGr@ and warez spam.
>> My ultraviolent Linux switch video.
Ethernet socket driver for a simple ethernet card.
Trupmet winsock or similar to bind to the 0x60 DOS socket.
$20 router connected to your DSL to do the PPPoE login, as well as a bit of firewalling to any computers internally.
I would never suggest using a PPPoE utility on the computer when routers are so cheap and useful. Most DSL modems even have the router logic built-in nowadays.