Slashdot Mirror
Botnet Business Model Comes to Life
consumerist writes "Researchers at the German Honeynet Project have discovered that a malicious hacker earned about $430 in a single day installing spyware on computers in the latest Windows worm attack. Within 24 hours, the IRC-controlled botnet hijacked more than 7,700 machines via the Windows Server Service vulnerability (MS06-040) and hosed the infected computers with the spyware from DollarRevenue. The botnet operator made between a penny and 30 cents for every piece of spyware installed. Add that to the spam rental and DDoS extortion money and we have a booming business."
""Researchers at the German Honeynet Project have discovered that a malicious hacker earned about $430 in a single day installing spyware on computers in the latest Windows worm attack. "
Gosh, darn it! I'm in the wrong business.*
*Even E-Bay sellers can't do as well.
And for those persons affected, how much will they spend on antivirus software or tech service to remove the problems? A bunch. Think of how many people simply choose to buy a new system when their old one suddenly "wears out" (e.g. slows down due to virus/spyware infestation). Everybody's happy but the poor sap who owns the infected computer.
The people most likely to be harmed are those who are the least likely to know what to do about it. What a shame.
This seems to be rather simple to me. Make it illegal to have gains from hijacked computers. DollarRevenue is paying people to create exploits. Shut down DollarRevenue and similar places, and the financial incentive for creating botnets will dry up. The only problem is that this would have to be an international effort, and if the USA wore a t-shirt, it would be the one with "does not play well with others" written across it in large letters.
Learn to love Alaska
When doing your build follow the following procedure
1 install Autopatcher latest
2 install some sort of firewall (disable the Windows firewall)
3 install an antivirus program (freebie or paid does not matter)
4 take a machette to the startup programs list
5 install your broadband connection
6 connect the system to your router
comments
Any person using FTFY or editing my postings agrees to a US$50.00 charge
That's it for all the work? ROI ain't very favorable in this instance
Hey,
I don't know who to be angry at. My list includes in order of hatred from greatest to least:
1) The asshat hackers who spread the worm
2) The companies that pay asshat hackers to shovel their crapware
3) The stupid people who actually give money to crapware companies and keep them alive
Honorable mention:
4) People who can't stop their system from being zombified.
If this signature is witty enough, maybe somebody will like me.
Is the metamod system really down or is it just yet another part of slashdot i've been excluded from for not doing the slashdot goosestep?
While those infections could theoretically amount to that much money, did anyone actually pay the guy?
Reallllly news worthy material?? $430/day could be earnt through a legitimate high end wage(157k/year). Normally the saying "crime pays" refers to paying more then you could earn otherwise. If he'd go back to school could probably do better then that.
How much would a dope dealer earn in a year?
We don't need the government to solve this problem. We merely need people to be responsible with their computer systems. I know, it is a lot to ask, but it is by far the cheapest and most reliable method of preventing this sort of exploitation.
The first step people will need to do is dump Windows completely. Attempting to secure it just isn't enough. It is so inherently flawed with respect to security that it's best to get rid of it completely. Anti-virus software, for instance, needs to be continually updated, assuming it even works well in the first place. Firewalls are somewhat of a defense, but many people disable them because they prove to be annoying.
More people will need to use operating systems that offer a better security model. These systems include Mac OS X, Linux, *BSD, and Solaris. Those systems offer enough variety that they should be sufficient for the vast, vast majority of users.
The only way to eliminate this issue is to get rid of the root cause. And when it comes to botnets, the root cause is the insecurity of even the most modern and fully-patched Windows installations.
They're designed to stay under the radar. The longer you control the machine, the more money you make. Virii, etc... are a different story.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
what I want to know is; how the hell do I get a piece of that?
Ignore the fact that bad security in Windows is the cause of this. If you want to kill off bozo's like dollarrevenue and make a good dollar, simply create concurrent fake windows, do the infection, collect; kill it; repeat. You will drain the company or they will have to lower the rates or insist on longer infection time. Basically, this will remove the incentives from doing their dirty work.
I prefer the "u" in honour as it seems to be missing these days.
"The only problem is that this would have to be an international effort, and if the USA wore a t-shirt, it would be the one with "does not play well with others" written across it in large letters."
Step one: Post "I wanna take a shot at the US"
Step two: Moderate up.
Step three: profit!
For those of you who can't see beyound your noses, he basically implied that all the other nations would be a 60's love-in, and the US would be da man.
"Researchers at the German Honeynet Project have discovered that a malicious script-kiddie earned about $430 in a single day installing spyware on computers in the latest Windows worm attack."
I seriously doubt this guy deserves the moniker "hacker". More like thieving annoyance to all of humanity.
TLF
I do not respond to cowards. Especially anonymous ones.
We have a new business modle based on LiveCD OSes which interface to web OSes (YouOS has been covered recently). This way, only the central servers for the web OS need to be highly secured and the rest is read-only and rebootable if anything goes wrong.
The only problem here is a need for an internet connection, which is clearly taken care of if infection are a worry.
-Tim Louden
>In this case, Holz counted 998 installations in the United States, 20 installations in Canada,
>103 in the United Kingdom, 756 in China and about 5,800 in other countries.
20 PCs in the whole freaking country? I am proud to be Canadian for once.
First good thing to have is a lawyer on retainer.
I Am My Own Worst Enemy
When will we see bots that automatically patch their hosts, install anti-virus apps and lock down the browser?
After all, it's in the bot-master's best interest to maintain their bots.
They could even do some basic system improvements like hardware driver updates, defrag'ing the drives, cleaning out the browser cache and other temp files.
This is NOT a business model. This is hacking people's systems, without their knowledge, and using it for someone else's purposes. It's stealing, computing resources and the people's time that it costs to get rid of the stuff. I'd be willing to bet a lot of the people effected by this end up having to pay to have it removed (by Geek Squad or some other overpriced outfit).
/. editor's systems, or whomever posted this article, THEY wouldn't consider this a "business model".
I'm sure if this happened to the
Your math is bad: $430/day = $67K/year
Try it this way. 240 working days a year x $430/day = $103,200
If you're an independent contractor, expect something like 35% tax.
That gets you down to about $67K/year.
You could throw every comptuer on the planet at a single 128-bit AES key and not break it until the sun goes dark, never mind 256-bit crypto. Remember: If you have something that can break a given 64-bit key for a given crypto system in 1 second it would take 584,942,417,355 years to break a 128-bit key in teh same system with the same hardware.
I earn $60/infected computer (to remove spywares)
This business does not sound too profitable to me.
He likely spend much longer in preparation of the worm, and once the exploit is fixed the worm recognised by scanners and the pool of vulnerable pcs exhausted his income will dwindle until the next big exploit.
So at most he can make a couple hundreds per month.
Addidtionally he cannot sue for his payments and is totaly dependant on the good will and honesty of companies that generally don't seem to have any. And he risks being caught and prosecuted.
Why would anyone do this? If he made tens of thausands I could understand, but for 430 bucks?
All online advertisers know that spyware makes money. It also burns your distribution pipes, but that's not important when you're going bankrupt. You'll see struggling NETWORKS use more and more ads, then more and more intrusive ads before outright spyware installs. 430$ a day is ridiculously small potatoes. A small ad network has access to 12 million unique IPs a day and you make thousands legitimately on that. Spyware installs get you the hundreds of thousands up front, when you need it and want out.
Often wrong but never in doubt.
I am Jack9.
Everyone knows me.
Given the power of computers these days, wouldn't it be possible for someone to run multiple instances of an OS on the same machine, install adware on each one and count those as separate installs? You'd make a killing, and screw those adware companies pretty severely.
I was thinking of something a bit more proactive involving a deep hole, an ant colony, and plenty of honey.
Things may change but as I stroll past and see the parent modded "Interesting", It once again reminds me
that there is nothing funnier in this world today than the slashdot comment section.
For a ciminal $430/day is not very good.
I see a lot of posts saying this is not a business model and that it is not lucritive. The two sort of depend on each other to both be true or neither are true. What is a business model? Its a planned system that operates in a fashion that hopefully makes money. For those that say its not lucritive... $430 dollars a day isn't much??? Thats almost as much as my two week paycheck. Obviously I'm not being paid for my rare skills at that rate but for somebody... perhaps a teenager or guy in his early 20's to fuck around in his basement (lab) and make a few thousand a month I think I'd call that successful. Perhaps his talent is better spent and better paid elsewhere, but he has no boss, I seriously doubt he works 40 hours a week, and I doubt he has much stress other than not getting caught. So lets do the math, quoted in the article something like his fast moving exploit made him $430 a day for a week before he moved on that equals out to atleast 2k if he took the weekend off and just killed the thing. A sporadic week's worth of work paid all the bills and then some for a typical blue collar guy's lifestyle. I have trouble saying this guy lost... atleast until he ends up in federal prison which so far is pretty unlikely. No I'm not pro botnet master, I hate cheats but lets admit the best of these guys are winning big and they are rarely the loser. Hopefully the need for better security and a better overall architecture will slowly wittle the ease of compromising systems over the years. But until then this is a rampant crime we'll see go on for quite some time. P.S. yeah I'ved heard the affiliate programs like to cheat the botnet masters and either stiff them or only pay a portion of the "work" that was done. This probably goes on all the time with the 2 cheats trying to fuck each other but in the end they both have some cash in their pocket and blow it off as "it comes with the territory". So oh no, he only made $150 dollars that day. If he has a strong work ethic you can only imagine how much he can make in a month.
Right.... wink wink, nudge nudge. And the check is in the mail and I promise not to cum in your mouth. They know what is up and they just don't give a shit.
If I was gonna score a little dope I definitely wouldn't choose that location in Louisville, KY. That is home to the Metro Corrections facility. Not that hospitable of a place.
Can I bum you a
Can you please tell us on what OS you need to recompile the kernel on evey patch? I thought everything (including apps) auto-updated these days.
An 1/8th Oz. of Marijuana goes for atleast 20 dollars. And if you think there is no money to be made at the low level... you can make thousands a day on the corner selling crack, but it comes with the risk of the cops getting you, or some hard thugs robbing you. Its a high risk game where you risk death or prison for making a grand a day. Look at Snoop Dogg's story, he was pushing carts at a supermarket and found out he could make in ONE day the same money he made in 6 weeks pushing carts. He was tempted and took it, then he found himself serving 9 months in jail. The myth that drug dealers are all rich is what you see in MTV video's and DEA drug profiles. The majority are mostly broke supporting their own drug habit scraping by to make rent on their $300 shit trailer. Don't believe the hype, unless you're a drug dealer in a high risk crazy area you're not making a thousand dollars a day. And if you are you might be dead tomorrow or in prison for a very long time.
$430 in one day? So what?
That's not exactly a lot of money - and I doubt he's earning that *every* day.
I don't see what the big deal is.
Its about who has the knowledge that survives.
The obvious next step is to create voluntary nets and distribute the profits.
I'd join one, why not? This is one reason why the online advertising model will eventually fail. You never really know if a computer or a real human being is on the other end of the connection.
I'd set up a box with Xen partitions and join multiple times.
Just follow the money, and eliminate everyone you meet along the way.
When I write my ultimate badmalspyware, I'm going to blackmail the world for ONE MILLION DOLLARS. I'll be laughing at the schmo who only got $430.
nuff said ...
davecb5620@gmail.com
We have trouble keeping trojans and bots off of our site. We employ some javascript in the main page of our intranet site that checks for the most common malware; however, with so many versions of malware out there now, its nearly impossible to keep your Windows PC clean.
The javascript can be downloaded from Here.
430 bux? This kid is cheap and underbidding the market. I'm surprised they only get that much. Any real job where you command that many computers get's you at least 430 bux everyday of the year.
There's nothing fundamentally wrong with the XP SP2 firewall.
It works in doing what it can, it doesn't try to do anything that it can't, it doesn't cry bloody murder about the natural background noise of scans which it successfully blocked, and it doesn't try to be too smart and parse protocols.
Amen. I've been saying for years now that even attempting outbound filtering *based on the identity of the process sending the packets* is an excercise in pointlessness. Unless you want to have to approve every request that any application makes. But boy would that get tedious fast.
The XP SP2 firewall is as good as a software firewall needs to be. The BSD idea of having one you need to reboot to disable is interesting, but probably too fiddly in practice. Security needs to be easy, or it doesn't get used.
Lock them away! Lock them away for life!
They're not human... they're very very bad.
The POINT which you are refusing to acknowledge is that there is a MEANINGFUL DISTINCTION between COMPUTER VIRII and BIOLOGICAL VIRUSES.
And yes, you are being pedantic, and tedious about it, and Tom Christiansen's opinion is no more pertinent than yours.
As someone who works with textual data concerning BOTH KINDS of virus, I think the distinction is extremely useful, and helps out particularly with searching and datamining, and I would appreciate it if know-nothings like yourself would stop muddying the waters with blather about DEAD LANGUAGES.
What if Windows patches aren't made available in a timely fashion, or at all? Or broken patches are issued? To be fair, it's not *only* Windows. I've also had a couple of encounters with proprietary Unix vendors who denied or downplayed vulnerabilities. But it's *mostly* a Windows problem, and by a very wide margin.
I think you're correct about a cultural divide, but that's certainly not the entire story. And while 'keep your machine(s) updated' is the first line of defense, that's not the entire story, either.
There's already been a response about recompiling the kernel, so I won't go there.
What you do with a computer does not constitute the whole of computing.
http://www.mwscomp.com/movies/brian/brian-08.htm
Faster! Faster! Faster would be better!
If you can reverse engineer the way that the scumware reports that it's got another victim, you may not even need a virtual machine, if you don't mind making money defrauding scum. This is likely to be hard, though - the kinds of people who develop new techniques for installing scumware (as opposed the the script kiddies who use them) are just as likely to be willing to reverse-engineer scumware, so there are probably several sets of verification methods designed to make it hard for them.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks