Botnet Herders Attack MS06-040 Worm Hole

Laljeetji writes "eweek reports that the first wave of malicious attacks against the MS06-040 vulnerability is underway, using malware that hijacks unpatched Windows machines for use in IRC-controlled botnets. The attacks, which started late Aug. 12, use a variant of a backdoor Trojan that installs itself on a system, modifies security settings, connects to a remote IRC (Internet Relay Chat) server and starts listening for commands from a remote hacker. On the MSRC blog, Microsoft is calling it a very small, targeted attack that does not (yet?) have an auto-spreading mechanism. LURHQ has a detailed analysis of the backdoor."

Comments

Re:IRC the weakpoint?

[winkydink]

How are the IRC channel and the hacker's IP address related? Just because somebody visits some random IRC channel doesn't make them the bot author. Security researchers, for example, will also be found there.

Also, most bot herdes are in eastern europe, brazil, or developing countries. Catching hackers isn't high on the list of law enforcement priorities in the countries (and, if the right amount has been paid to the right people, it's completely ignored).

A Solution...

[nmb3000]

Find a way to make the average user patch software.

As wonderful as it would be if all software was completely bug free and contained no security holes, it's simply impossible. No product, be it OSS or commercial, is free of these banes. On the other hand, problems like this would nearly go away, if only users would patch the software. Whether it's a new exploit in Windows or Apache or phpBB, if you don't patch, you're going to get screwed. Yes, it seems like Microsoft products have more patches than average, but at least they have patches. Blaster and MyDoom? They'd have never hit the news if users were patched. Automatic Updates in XP is a great step forward, but it's still opt-in.

Some people seem amazed when I say I had no direct problems with Blaster or Welchia, and they don't seem to get it that these problems essentially always appear after a patch is release which means there is no valid reason for their survival. Patch, patch, patch, patch, patch. Yes, slightly monotonous, but if users would simple do it, we'd stop seeing these equally monotonous news stories about Exploits of Doom.

Re:A Solution...

[Ph33r th3 g(O)at]

A good start would be for Microsoft to stop attaching new EULA conditions or spyware (e.g. WGA) as a prerequsite to getting patches conveniently.

Re:A Solution...

[Jerf]

This is a complicated topic, and I don't have a pat answer. But let me give you two of the counterpoints:

1. Corporate users can't do that; they need to test the patches first. Obviously, "corporate" users could then get an option to not auto-download the patches. But the corporations aren't conservative about patching because they like to drag their feet; technically it's easy to roll out a patch in a matter of hours, even minutes for small ones that don't require a reboot. The problem is that patches aren't perfect, and they will tend to break computers that used to work, and programs that used to work. Worst case scenario they can even destroy data.
   
   Corporations have trouble because they may well have thousands of configurations they need to support, so even if 1% of them fail, it's a major problem. Still, imagine if Microsoft forces a patch out, and they cause the machines that have Quicken version 6.3532 build 4 to completely destroy all financial records on their next startup. (Or even just render them unreadable, since we're assuming non-technical users.) Imagine the liability issues, which, frankly, probably terrify the executives at Microsoft already when they issue a patch. Forcing the patches on users makes those issues even worse.
2. If Microsoft has the ability to force your machine to run an update, they literally own your machine. They can make it do anything, and you can't stop them. Already the activation stuff has caused some issues, and I've basically bailed on Windows as a result and consider it a good reason for everybody else to bail, too. The computer needs to belong to you, not your corporate overlords. (The term "corporate overlord" in this case is used without sarcasm, because at least in computing terms, they really are.)

I think the problem boils down to the fact that it may not be possible to run a general-purpose computer in an incredibly hostile environment without a high degree of operator skill, and people in general, quite justifiably, do not wish to attain this high degree of skill, just so they can safely surf the web, send email, and use IM. Until a completely secure computer is built, or at least a far more secure one, I'm not sure what can be done about this.

The worst part is, none of what I've said here contradicts anything you've said. It's all in play at once? So, which side dominates, and under what circumstances? I really couldn't tell you. However, I would think the empirical evidence at the moment is in your favor. But is the only/best solution really to cede control over your computer to Microsoft (which are the people who got you into this situation in the first place)?

At least Open Source doesn't have that issue; since nobody is in charge and nobody is making money by controlling your computer (DRM, etc), the conflict of interest involved in creating a security situation where what seems to be the best solution is deeding your computer over to the same people doesn't come into play.

Internet the weakpoint?

[twitter]

Suppose the bots all used AIM or MSN Messenger servers. Would you demand that those be taken down?

The weak point is not IRC or any other communications method. The weak point is software that's so easy to exploit it has new "critical" patches every month [insert tampon jokes here].