Slashdot Mirror
Deconstructing a Pump-and-Dump Spam Botnet
Behind the Front writes "eWeek has teamed up with Joe Stewart, a senior security researcher at SecureWorks in Atlanta, to show the inner working of a massive botnet that is responsible for the recent surge of 'pump and dump' spam. It's a detailed picture of how these sleazy operations work and why they're so hard to shut down. Sobering numbers: 70,000 infected machines capable of pumping out a billion messages a day, virtually all of them for penis enlargement and stock scams. Excellent graphics, too, including one chart that shows that Windows XP Service Pack 2 is hosting nearly half the attacked machines."
i guess many of those from "unknown" are actually german since germanys largest ISP cannot get its head out of his arse and finally change hostnames to something.DE.. instead it is .net all the time for most germans. This also always causes great disconcert when you have to explain logs to a customer and the damn script does not base location on IP but on host..
If I were running an ISP, I'd have common ports such as IM, file-transfer/ftp/torrent, ssh, 80/443, irc, and many others allowed and all other ports blocked or restricted to certain destinations by default.
I'd have a web-page for my customers so they can click things such as:
Outgoing Email:
[x] web based [turn on port 80/443]
[x] through remote-login [turn on remote-login ports]
[x] through us [turn on mail ports, restrict to our servers]
[ ] through another server: ______ (specify list of outgoing mail servers)
[ ] through any server
+-- [x] check here to turn this off after 7 days (recommended)
x's show defaults.
Checking the last two would bring up the relevant sections of the AUP/TOS as a reminder of the strict "no spamming" and "we will suspend outgoing mail and charge you cleanup fees if your machine is taken over" clauses.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
But when, if ever, will anyone shut down the MS machine? Never is when. MS is far to invested into large corporations and government institutions to ever have anyone, never mind MS, say, all windows products must be updated or dumped. Its just not going to happen. If you owe the bank $1000 dollars, you are in trouble if you're late on the payments, if you owe the bank $10,000,000,000 dollars and you're late, the bank is in trouble.
Right now, the later is more the case. If MS had to upgrade or recall all XP products, it would cause a large harm to the economy, not just MS's bottom line. Think of what would have to be spent on the upgrades or change outs?
Too many people have invested in MS products to just shut it down, and just like England won't wake up one morning and start driving on the right side of the road, MS products will remain in service. (I'm not trying to imply that the left side is the incorrect one, just illustrating the size of the problem)
Reports like this do seem to show MS in a very bad light, but how it gets fixed will be even more interesting. When government types want to show they are doing something about spam, will they do anything to make MS responsible, or make MS fix it? Probably not, so the real answer to spam, or answers, is to implement measures that do not rely on the end user, or the end user's OS to fix it.
IMO, This means that ISP's are going to have to sandbox segments of their networks to throttle spam, and that cost will be passed on to consumers, or possibly will be borne by the ISP for bragging rights about having less spam than any other ISP, in much the same way that the Bell companies used to do advertising about what they are spending to improve services for consumers.
This also leaves me with a suspicion about the marketing team for Vista? How better to fix XP SP2 than to upgrade to Vista?
Support NYCountryLawyer RIAA vs People
I wonder tho how they ... know which os the bots are running?
... wine ...
... it would stop many script-kiddies from trying to automatic crack your machines, if they can't find which OS you're running ...
... in their OS detection ... on Windows and *Nix systems?
i mean i use nmap, and other portscanners myself but the OS detection
is just a sane guess and far from perfect
I also wonder what the 0.05 % of other OS'es are because i do think
this malware is written on the win32 api, so i rather guess these were inconclusive
OS fingerprinting and/or *Nix systems running a virtual machine or
if this is possible (i'm not trying to troll here)
And if this is possible i do want to know what kind of measures the users of these non conclusive
Os fingerprinting scans used because
Anyone has some tips about this in particular
How do i fool commonly used portscanners etc
You should, and you can. Just remember that this is all about false positivies and false negatives. Let's say I ran an ISP and I cut-off everyone who sent 10,000 messages or more a day. How many legitimate users would that cut-off? 1%? .01%? .001%? If someone has a legitimate need to send 10k emails then they can give their ISP a call, declare that they have legit reason, and get their service re-enabled. I hate such systems, but if it eliminated 70,000 pwned computers and forced 70 legitimate users to make a phone call, that is a fair trade-off.
getting. A few weeks back I read an article that stated that some crackers had managed to get into the accounts of some of TD Waterhouse's investment clients. Since most of these accounts were retirement accounts liquidating them and stealing all the assets would have been difficult, required a lot of paperwork, and ran a much higher risk of getting caught. So instead what the attackers did was liquidate all the assets of the victims and then used those assets to buy a bunch of pump and dump stocks(high demand low supply=much higher prices). Pumped the value of the stock up significantly then as the name suggests, dumped it.
As much as I think they are scum for doing so, you have to admit that was pretty creative....
Monstar L
There are plenty of idiots out there with access to both internet and credit cards. Really.
And a lot of them also think that if someone has your email, they must know you from somewhere.
When I worked at a brokerage firm, people used to call me and ask for advice (which I couldn't give, not being licensed) on how much to invest in whatever stock they got emailed that day.
This network of some 73,000 machines has to rank as one of, if not the, leading supercomputer in the world. Why aren't they ranked in the Top500 list?
Thad
I love Mondays. On a Monday, anything is possible.
I recently helped an elderly neighbor secure her computer (I was paid for this service, and I make sure I do get paid every time I get called over for help) by installing some good firewall and anti-virus programs (as well as setting up Firefox and Thunderbird for their primary browsers. When I ran a virus scan on her computer (I installed AVG, as her McAfee subscription had expired), I found several viruses and malware programs on there, all of which I removed, which came with games she downloaded (stuff like mahjong and solitaire). I regret not writing down what viruses she had gotten infected with, so I could find out what she did.
I did the same thing on my grandmother's computer as well (when she was alive), and odds are there are a lot of seniors who are online and engage in a lot of bad habits that we know are bad - including running IE with minimal protections, opening strange attachments, and so forth. This is not a new problem, and, frankly, a problem that only education (or getting 75% of seniors to switch to Mac OS or Linux) can fix.Zagreus sits inside your head, Zagreus lives among the dead, Zagreus sees you in your bed and eats you in your sleep.
Except greylisting+dnsblocking, for which there is no defense.
If everyone greylisted, spamming operations would slow down to a crawl. If the go full speed, then the only sites which will accept their spam (or better, to escape detection, temporarily reject it after DATA) are spamtraps, which means the rest of the world becomes instantly unavailable because of dnsblocking.
If they have to slow down.. well, we win.
It's just beautiful.
That won't work, for one of two reasons that I can think of off the top of my head. Either you'll get malware that will only spam 9000 messages per day, or you'll get customers that are cut off regularly, get pissed, and change ISPs. If you're unlucky, you'll also get some lawsuits about it, justified or not.
You're better off trying to force rate limit outgoing email, keep state on your clients, and trying to cut off outgoing SMTP for abusive hosts. However, you would then be monitoring traffic, and that might not work out so well, either.
Well, greylisting is suprisingly more effective than most anti-spam measures if you combine it with a decent rbl. The basic premise is that when a message comes in, the server looks at the sender, recipient, and sending host/server. If this is the first time that the greylisting server has encountered this triplet, it tells the sending server to wait X minutes (where X is most likely 5). There are 3 likely outcomes at this point. First outcome, this is a legitimate message from a legitimate server and the waiting period will be honored, then the message will be delivered appropriately and the greylisting server will mark the triplet as legitimate. The second outcome is that the message is coming from a zombie and it will not honor the waiting period because it isn't a fully implemented SMTP server, thus the message will be dropped. Lastly, it is a well-written spam attempt, but within the five minute waiting period, the sending machine will be blacklisted by the rbl to which you subscribe.
Although you may be right that the bad guys will eventually beat it, in the meantime, there are significant waiting periods involved which will likely slowdown the penetration of the spam. This penetration rate is what makes spam profitable. It basically forces servers to build up trust between each other similar to how people build trust with each other... i.e. "I've worked with this person before on this project, so I can believe in him/her" or "I've never worked with this person on this project, so I'll treat them with suspicion until he/she has proven her/himself"
But you know what? It doesn't matter. There still is so much malware for Windows. It's a worldwide epidemic. It affects me rather badly (all this botnet-sent spam in my mailbox) even though I don't use Windows at all.
With that popularity and market share comes some responsibility. Get down off your high horse and fix your damn problem, you Windows users. You may be sick of my "I am invulnerable because of the OS I run" attitude, but I'm just as sick of your "it's not our fault, it's the hackers' fault" excuses. Windows has become a true plague upon the internet, because of the botnets it supports.
Luck? Did you see www.spamstocktracker.com?
For an ISP of any size mail filtering is a significant problem. You don't just add something onto the mail server farm without taking a pretty severe performance hit. I do not believe there is anything free that can handle a substantial load.
Another factor is that most of the very cautious folks I deal with have a real simple solution - no attachments, period. ISP's cannot implement something like that. They can block executable attachments, but that isn't really effective any longer. From what I understand most of this doesn't really fall into the "virus" or "worm" category but is instead human-installed. Dumb person clicked on the link or attachment. Blocking all instances of this would be pretty tough without having major impact.
Why would the SEC care? There is no fraud here. Nobody is getting hurt, except those people buying stock and expecting to make a quick profit. They don't make their quick profit and maybe lose money. If you play with the stock market like that you are going to lose money. Period. It isn't the government's job to keep you from doing stupid things with your money.
I see... so if somebody came out with the solution to pollution problems would be to eliminate all vehicles and replace them with bikes, would you change?
(hint) (x) Huge existing investment in cars
You don't even need to cut off customers based on volume; just make sure that the headers on any email being sent from your network are accurate and well-formed, so that they get tracked back to the right customer -- who can then be LARTed into a wipe and reinstall, this time with virus and spyware protection.
My ISP has a web-based configuration utility that allows me to set a server-side firewall to one of several default values. One of their options blocks several commonly-exploitable ports on Windows. I don't use those ports for anything, and I have my own firewall so those ports shouldn't reach my Windows boxes in any way whatsoever, but I set it to block them anyway. (This was the default setting, actually.)
Something similar would work fine. Block port 25 to SMTP by default and have a web config utility to change it. If you really wanted, you could set it up to email the user if they tried accessing port 25 when it was blocked ("You might be trying to get past this firewall. Or, you might have a virus. Here's how you can find out, and here's how you can disable it if you need . . . ")
Breaking Into the Industry - A development log about starting a game studio.
Securities manipulation is a very serious crime, and these scammers will spend a long time in jail if they get caught.
Those guys shouldn't be that hard to find with enough law enforcement effort. Get a credit card from a cooperating bank. Put a trace on it. Buy some Viagra from a spam. Watch where the money goes, which is probably some bank in a high-crime country. Visit the bank and talk to them. Threaten to have their abilty to process credit cards cut off. Pry the actual payee out of them. Discover that it's another intermediary and start over.
This is what we pay the FBI for. This is why the FBI has field offices outside the US. This is why the Financial Crimes Information Network exists.
The FBI's Internet-related criminal enforcement unit has gotten soft. They sit up in Baltimore and send out child pornography, then go after the people they've entrapped. The process is even mostly automated now. That's an easy way to get their stats up, and fits the Bush administration's "regulate sex, not business" mindset, but doesn't solve crimes that have victims. Something to push on after Jan. 20, when the Democrats take Congress and can start asking hard questions of the executive branch.
The problem isn't "Windows is insecure", the problem is that people are given a general-purpose computing instrument and they want a web & email appliance.
Sort of. People want a little more than the web and e-mail. They want word processing, games, and maybe a few other applications. But OS's are not designed to meet the needs of the common user, and they should be set up with defaults that make sense.
Most of this stuff is not installed because of security exposures in that allow stealh installations because of exposures in email readers and web browsers. It is installed the same way the user would install any other "desired" program.
Actually, the majority of infections are the result of worms that have no user interaction, but this particular threat is a trojan. Trojan's can be mitigated but it requires more finely grained security, a better UI, and better defaults. For the average user, no program not pre-instaled should have access to send mail or access your e-mail address book without the user specifically enabling that behavior.
They user just doesn't know they don't want it.
The user does want it. People want to run untrusted executables. They want to open random, untrusted data. The problem is that Windows does not properly tell them what is data and does not let them easily run untrusted programs in a restricted sandbox. Ask the average user if double clicking on "nekkidladies.jpg" lets something send thousands of e-mails from their computer. Most think it can't. Most think nekkidladies.jpg.exe should be shown as a program instead of data. Most think even if it is a program it should not be able to send e-mail without the OS telling them that is what it is doing and giving them the option to stop it. This is the failure of the Windows. It should restrict these behaviors by default for unsigned/verified applications downloaded from the internet.
Solution? Give people appliances not general-purpose computers.
It won't work. People want to run random programs and games and whatnot. The solution is not to remove functionality, but to restrict functionality by default and present options to the user with real information and a well made GUI. People should have a choice of e-mail clients, but at the same time they should be given a choice whenever a program they install wants to start sending e-mail. "Program 'Verious 2.7' wants to access your e-mail address book and send e-mail messages (stop it from accessing my addresses and sending mail)(let it access his data and send mail once)(Let it access my addresses and send mail always)(Advanced options)."
The average user can understand that and make reasonable choices. OS's need to be coded to give them that info and that granularity of choices with a good UI.
Are you writing a new email protocol? It IS a hard problem and, unless you are personally doing something about it, it's unfair to call someone else a wimp.
"The main problem is that you would need to get everyone to get on board with it all at once."
I think the opposite is true. If people have the option of trying the New, Improved, Secure Email without abandoning their current routine, a gradual transition might have a fighting chance. Lots of people with traditional phones also have SIP and VoIP and such. Heck, with a bit of finesse, new protocol plugins could be integrated into existing mail clients.
Digital signatures could come in dual-varieties: Authority-issued and self-issued. Clients would only download headers & sigs, then decide what bodies to download via sig policy. By default, a client would accept mail signed with an authority-issued sig automatically, but would accept self-issued ones only if the recipient whitelists the sender. Outbound message bodies from unknown sources (self-issued & not whitelisted) would have to sit on the originating outbound server and wait, pending certificate acceptance. Unknown sources would have low connection quotas; upon a flood of sig packets or a large distribution from an unknown source, intermediate servers would refuse connections from that source pending a positive sig disposition.
Pi Ran Out