The New Face of Script Kiddiez

An anonymous reader writes "Washingtonpost.com's Security Fix blog has an interesting post profiling the activities of a kid named Witlog who controls a botnet of roughly 30,000 hacked Windows PCs. Even after the authorities manage to shut down the network Witlog uses to control his bots, he pops up somewhere else. From the article: 'Witlog may in fact be the product of a new generation of script kiddiez; the chief distinguishing feature of this generation being that instead of using Web site flaws to deface as many Web sites as possible, these guys are breaking into thousands of home and work PCs and taking them for a virtual joyride, often times all the way to the bank.'"

Comments

Re:New Face

[msobkow]

Exactly. While the rootkits, virus kits, worm kits, and other attack examples have been out there since the early DARPA days, most people using them were exploring for security holes to exploit. Now we've got people who just use that work to take over unpatched or obsolete machines.

They aren't hackers. They can't even claim to be crackers. They run a kit with as little thought to how it works as an Excel user thinks about the math and programming behind the interface. It's just a tool to them.

What's really annoying is their persistent attempts to break a patched/maintained environment wastes bandwidth that has better uses.

What's criminal is that their traffic interference can prevent you from using your connection to work or relax as you see fit. Legally, it should be comparable to theft of resources or vandalism preventing the use of resources. Following from that could be additional charges depending on the intended use of the victim's machines.

Re:Now here's an interesting idea.

[MyNymWasTaken]

Whitehat viruses do exist in the wild. However, they too can bring down networks in a DDoS style; even while cleansing the system.

Computer virus infects Air Canada check-in system
W32/Nachi.worm

Re:Now here's an interesting idea.

[MrNougat]

Yup. Blaster was the first, and Welchia was supposed to fix it. Problem was, Welchia located other nodes by pinging. It didn't take too long for a network full of Welchia to grind to a halt with all that traffic. I saw it happen; an office of about 200 people had to be disconnected from the WAN in order to keep it contained. (No, I was not in charge of that office or that network.)