Slashdot Mirror
Point and Click Cracking
An anonymous reader writes "Washingtonpost.com is running a story about a number of botnets and keylogger operations being controlled by Web-sites with point-and-click type front-end software interfaces. The sites mentioned in the story look like fairly slick PHP pages designed to sort through password data from keylog victims and update infected computers with new code or instructions. From the story: 'The hacking software also features automated tools that allow the fraudsters to make minute adjustments or sweeping changes to their networks of hacked PCs. With the click of a mouse or a drag on a pull-down menu, users can add or delete files on infected computers.'"
Actually, a lot of the time a browser hole isn't required at all. Users are actually still downloading applications that are just applications that function in a malicious way, with full rights actively given by the user to use the system resources for ill.
After all, once an OS is running something bound to a port, how is it supposed to know whether or not you're an idiot who just installed a keylogger or trojan, or a competent user running some sort of legitimate server software? It can only warn you so much before there's just nothing else that can patch the hole, except maybe some tape over your head.
At this point, browsers warn people, operating systems warn people, firewalls warn people and virus scanners worm people, and they still just have to run that trojan software for whatever pointless whizz-bang effect it adds to their mouse cursor or emails.
From now on, I buy only Intel.
The point is that no one should be allowed to tease the public with knowledge contained in secret tomes only the few can access. If you are going to talk to someone on a subject, then talk to them as an equal. Don't tell them that the boogyman is around the corner. If they ask, show them the actual threat. Let them decide. Don't just try and instill fear.
Would you be satisfied if a neighbor was sent to prison without a public trial? If you ask, the police could just say, "If you only knew what we know, you'd want him in prison too."
That's what the WP is doing here. They tell people to be afraid without showing the full truth. The internet is a bad place, but don't try and scare people with secret knowledge.
I'd rather you do it wrong, than for me to have to do it at all.
Oh and here is a feature breakdown from a Russian bulletin board:
In English...
For those that care.... here is the site.
If you have half a clue you will figure out where to go from there.
For those who are interested, I managed to get a couple more images of this interface here and here.
Bonus points if anybody can figure out where the shots came from and shut them down.
Send offline messages on AIM with DoorManBot