Slashdot Mirror
Deconstructing a Pump-and-Dump Spam Botnet
Behind the Front writes "eWeek has teamed up with Joe Stewart, a senior security researcher at SecureWorks in Atlanta, to show the inner working of a massive botnet that is responsible for the recent surge of 'pump and dump' spam. It's a detailed picture of how these sleazy operations work and why they're so hard to shut down. Sobering numbers: 70,000 infected machines capable of pumping out a billion messages a day, virtually all of them for penis enlargement and stock scams. Excellent graphics, too, including one chart that shows that Windows XP Service Pack 2 is hosting nearly half the attacked machines."
If more ISPs did egress filtering of email this sort of thing would be harder to do.
then they would use the massive botnets of 0wned machines for something else, that probably also wouldn't be conducive to the health and general well-being of the internet...
my password really is 'stinkypants'
The charts would be a lot more interesting if they had them compared to market share. then you've got to consider that people are more likely to target the biggest market share. i mean, how many virus writers are targeting FDOS?
I'm sorry, but the terms "Penis Enlargement" and "Excellent Graphics" were situated a bit too close together in that summary for my liking.
Is it just my observation, or are there way too many stupid people in the world?
It is time to rebuild the email protocol. It needs to be redesigned to cope with modern systems and security needs. The pain of the transition would be worth it. It is just too easy to spoof header info now.
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
Perused the article to know how to find out if my computer is infected or not but couldn't find anything. This is such an important news for Windows users, at least tell something abou thow to verify if a particular windows machine is having this problem.
And implemented greylisting on it. Cut out almost %100 of the spam I have been receiving (Was up to 50 emails a day, now I think only one has gone through since I installed postgrey on my mail server in 1.5 months!). Unfortunately, this is easy to get around, so it should only be a matter of time till that is worked around and becomes useless in the spam fight. By that time, hopefully another anti-spam method comes up...
From the graphs, it's obvious that Linux, BSD, and MacOS lumped together are only 0.05 percent of the desktop market!!
--
Given enough personal experience, all stereotypes are shallow.
Well of course Windows is going to be in the majority of affected machines... There is a dramatically higher number of people in the world using Windows than any other OS, so... wouldn't it make sense?
/.'s tendency to point out everything that appears to be wrong with Windows... but come on, isn't it a little much to explicitly point it out in this case?
As a proud user of Kubuntu, I can relate to
/* No Comment */
Which leads me to wonder about the folks who actually believe that those penis enlargement pills work.
And as far as the "pump and dump" spam goes, are there folks who beleive those spams? Or are they of the mindset of the "greater sucker"? Meaning, if I buy this stock now, after this spam circulates, there will be others who buy this shit stock and push up the price allowing me to make money.
Yeah, I know the guy who originates the "buy" recomendation is hoping for everyone to buy the stock, but what makes some of the recipients think they'll make out?
If I were running an ISP, I'd have common ports such as IM, file-transfer/ftp/torrent, ssh, 80/443, irc, and many others allowed and all other ports blocked or restricted to certain destinations by default.
I'd have a web-page for my customers so they can click things such as:
Outgoing Email:
[x] web based [turn on port 80/443]
[x] through remote-login [turn on remote-login ports]
[x] through us [turn on mail ports, restrict to our servers]
[ ] through another server: ______ (specify list of outgoing mail servers)
[ ] through any server
+-- [x] check here to turn this off after 7 days (recommended)
x's show defaults.
Checking the last two would bring up the relevant sections of the AUP/TOS as a reminder of the strict "no spamming" and "we will suspend outgoing mail and charge you cleanup fees if your machine is taken over" clauses.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
But when, if ever, will anyone shut down the MS machine? Never is when. MS is far to invested into large corporations and government institutions to ever have anyone, never mind MS, say, all windows products must be updated or dumped. Its just not going to happen. If you owe the bank $1000 dollars, you are in trouble if you're late on the payments, if you owe the bank $10,000,000,000 dollars and you're late, the bank is in trouble.
Right now, the later is more the case. If MS had to upgrade or recall all XP products, it would cause a large harm to the economy, not just MS's bottom line. Think of what would have to be spent on the upgrades or change outs?
Too many people have invested in MS products to just shut it down, and just like England won't wake up one morning and start driving on the right side of the road, MS products will remain in service. (I'm not trying to imply that the left side is the incorrect one, just illustrating the size of the problem)
Reports like this do seem to show MS in a very bad light, but how it gets fixed will be even more interesting. When government types want to show they are doing something about spam, will they do anything to make MS responsible, or make MS fix it? Probably not, so the real answer to spam, or answers, is to implement measures that do not rely on the end user, or the end user's OS to fix it.
IMO, This means that ISP's are going to have to sandbox segments of their networks to throttle spam, and that cost will be passed on to consumers, or possibly will be borne by the ISP for bragging rights about having less spam than any other ISP, in much the same way that the Bell companies used to do advertising about what they are spending to improve services for consumers.
This also leaves me with a suspicion about the marketing team for Vista? How better to fix XP SP2 than to upgrade to Vista?
Support NYCountryLawyer RIAA vs People
This is the basic problem with any single antispam measure, or really any single computer security measure.
1. Someone comes up with a defense mechanism that works well.
2. It works so well that more people use it.
3. It becomes popular enough for the bad guys to beat, so they do.
4. The defense becomes useless, forcing someone to come up with a new defense.
5. Goto 1.
Slashdot Burying Stories About Slashdot Media Owned
Fortunately, I should have significantly more money to invest shortly, as soon as I get a rather large sum from a new online friend and business associate and new friend, Mr. Emmanuel Obi from Africa, of all places.
Its like going after Boeing because someone put some tape over the port that allows outside air to get at the gauge that measures air pressure and estimates elevation on a 757.
You can point your finger all you want at the maintenance worker who didn't read the warnings in GIANT PRINT - but Boeing was still sued and paid.
Boeing was not being irresponsible. I do not think the same can be said of Microsoft because many of the security problems have been pointed out CONSTANTLY since before 1995.
I wonder tho how they ... know which os the bots are running?
... wine ...
... it would stop many script-kiddies from trying to automatic crack your machines, if they can't find which OS you're running ...
... in their OS detection ... on Windows and *Nix systems?
i mean i use nmap, and other portscanners myself but the OS detection
is just a sane guess and far from perfect
I also wonder what the 0.05 % of other OS'es are because i do think
this malware is written on the win32 api, so i rather guess these were inconclusive
OS fingerprinting and/or *Nix systems running a virtual machine or
if this is possible (i'm not trying to troll here)
And if this is possible i do want to know what kind of measures the users of these non conclusive
Os fingerprinting scans used because
Anyone has some tips about this in particular
How do i fool commonly used portscanners etc
getting. A few weeks back I read an article that stated that some crackers had managed to get into the accounts of some of TD Waterhouse's investment clients. Since most of these accounts were retirement accounts liquidating them and stealing all the assets would have been difficult, required a lot of paperwork, and ran a much higher risk of getting caught. So instead what the attackers did was liquidate all the assets of the victims and then used those assets to buy a bunch of pump and dump stocks(high demand low supply=much higher prices). Pumped the value of the stock up significantly then as the name suggests, dumped it.
As much as I think they are scum for doing so, you have to admit that was pretty creative....
Monstar L
I recently helped an elderly neighbor secure her computer (I was paid for this service, and I make sure I do get paid every time I get called over for help) by installing some good firewall and anti-virus programs (as well as setting up Firefox and Thunderbird for their primary browsers. When I ran a virus scan on her computer (I installed AVG, as her McAfee subscription had expired), I found several viruses and malware programs on there, all of which I removed, which came with games she downloaded (stuff like mahjong and solitaire). I regret not writing down what viruses she had gotten infected with, so I could find out what she did.
I did the same thing on my grandmother's computer as well (when she was alive), and odds are there are a lot of seniors who are online and engage in a lot of bad habits that we know are bad - including running IE with minimal protections, opening strange attachments, and so forth. This is not a new problem, and, frankly, a problem that only education (or getting 75% of seniors to switch to Mac OS or Linux) can fix.Zagreus sits inside your head, Zagreus lives among the dead, Zagreus sees you in your bed and eats you in your sleep.
Except greylisting+dnsblocking, for which there is no defense.
If everyone greylisted, spamming operations would slow down to a crawl. If the go full speed, then the only sites which will accept their spam (or better, to escape detection, temporarily reject it after DATA) are spamtraps, which means the rest of the world becomes instantly unavailable because of dnsblocking.
If they have to slow down.. well, we win.
It's just beautiful.
"Thats crazy... that's like going after P2P admins for users sharing illegal content. It would never fly."
It's not like that at all, but that's due to a distinction that's apparently too fine for some people.
Take a look at your favorite torrent tracker. Unless it's legaltorrents or something of its ilk, you know they set it up to capitalize on the huge demand for pirated material (and to make ad money off same), you know most of the traffic is pirated material, and you know that the admin knows this. Running a tracker with the belief that you will simply be able to tell the authorities that you're "not responsible for your users" might make perfect sense to a 14-year-old, but they're often unaware of a crucible in the legal profession known as "the laugh test." If it has the proper locomotion, vocalizations, and behavior, smart people don't need to be told that it's a duck.
Now, it might be funny and all to say that yes, Microsoft really does sell XP primarily for the purpose of running botnets and sending spam, but again, you, I, and everybody else know that it's simply not true. Again, the laugh test prevails.
Sitting in my day care, the art is decopainted.
Just to reiterate what these scum are doing:
1. Buy some really cheap stock at a really cheap price.
2. Hype it to victims.
3. Sell it to victims at inflated prices. Pocket the profit.
4. Victims are now stuck with a worthless stock that they can only sell at a large loss.
They usually work for the pump and dumper. Everybody else gets screwed. That's why it's a scam.
The companies are real, and you can look them up on NASDAQ or Pink Sheets. I've looked a few of them up, and they all show an enormous spike in trading, a big spike in price, then a rapid fall.
While there are ways to make money on declining stock value ("short selling"), you can't do it with the stocks these filth are hyping.
...laura
So a law that mandated safe computing clearly would not be out of the question, and would not be "blaming" those computer users who did nothing more than purchase a brand new PC in order to use it for its intended purposes.
Hackers and Spammers no longer support Windows 95. It's too hard to write worms, bots, and viri that are backward compatible.
There's a lot of humor potential in going to a site laced with ads and a list of 30 sponsors to read about spam.
For an ISP of any size mail filtering is a significant problem. You don't just add something onto the mail server farm without taking a pretty severe performance hit. I do not believe there is anything free that can handle a substantial load.
Another factor is that most of the very cautious folks I deal with have a real simple solution - no attachments, period. ISP's cannot implement something like that. They can block executable attachments, but that isn't really effective any longer. From what I understand most of this doesn't really fall into the "virus" or "worm" category but is instead human-installed. Dumb person clicked on the link or attachment. Blocking all instances of this would be pretty tough without having major impact.
Why would the SEC care? There is no fraud here. Nobody is getting hurt, except those people buying stock and expecting to make a quick profit. They don't make their quick profit and maybe lose money. If you play with the stock market like that you are going to lose money. Period. It isn't the government's job to keep you from doing stupid things with your money.
No broker will allow you to short a pink sheet stock, which the overwhelming majority of pump and dump spam deals with.
The truth about Scientology, Xenu, and you: Operation Clambake
Securities manipulation is a very serious crime, and these scammers will spend a long time in jail if they get caught.
Those guys shouldn't be that hard to find with enough law enforcement effort. Get a credit card from a cooperating bank. Put a trace on it. Buy some Viagra from a spam. Watch where the money goes, which is probably some bank in a high-crime country. Visit the bank and talk to them. Threaten to have their abilty to process credit cards cut off. Pry the actual payee out of them. Discover that it's another intermediary and start over.
This is what we pay the FBI for. This is why the FBI has field offices outside the US. This is why the Financial Crimes Information Network exists.
The FBI's Internet-related criminal enforcement unit has gotten soft. They sit up in Baltimore and send out child pornography, then go after the people they've entrapped. The process is even mostly automated now. That's an easy way to get their stats up, and fits the Bush administration's "regulate sex, not business" mindset, but doesn't solve crimes that have victims. Something to push on after Jan. 20, when the Democrats take Congress and can start asking hard questions of the executive branch.
The problem isn't "Windows is insecure", the problem is that people are given a general-purpose computing instrument and they want a web & email appliance.
Sort of. People want a little more than the web and e-mail. They want word processing, games, and maybe a few other applications. But OS's are not designed to meet the needs of the common user, and they should be set up with defaults that make sense.
Most of this stuff is not installed because of security exposures in that allow stealh installations because of exposures in email readers and web browsers. It is installed the same way the user would install any other "desired" program.
Actually, the majority of infections are the result of worms that have no user interaction, but this particular threat is a trojan. Trojan's can be mitigated but it requires more finely grained security, a better UI, and better defaults. For the average user, no program not pre-instaled should have access to send mail or access your e-mail address book without the user specifically enabling that behavior.
They user just doesn't know they don't want it.
The user does want it. People want to run untrusted executables. They want to open random, untrusted data. The problem is that Windows does not properly tell them what is data and does not let them easily run untrusted programs in a restricted sandbox. Ask the average user if double clicking on "nekkidladies.jpg" lets something send thousands of e-mails from their computer. Most think it can't. Most think nekkidladies.jpg.exe should be shown as a program instead of data. Most think even if it is a program it should not be able to send e-mail without the OS telling them that is what it is doing and giving them the option to stop it. This is the failure of the Windows. It should restrict these behaviors by default for unsigned/verified applications downloaded from the internet.
Solution? Give people appliances not general-purpose computers.
It won't work. People want to run random programs and games and whatnot. The solution is not to remove functionality, but to restrict functionality by default and present options to the user with real information and a well made GUI. People should have a choice of e-mail clients, but at the same time they should be given a choice whenever a program they install wants to start sending e-mail. "Program 'Verious 2.7' wants to access your e-mail address book and send e-mail messages (stop it from accessing my addresses and sending mail)(let it access his data and send mail once)(Let it access my addresses and send mail always)(Advanced options)."
The average user can understand that and make reasonable choices. OS's need to be coded to give them that info and that granularity of choices with a good UI.