Slashdot Mirror
The NYT on the Proliferation of Botnets
ThinkComp writes "The New York Times has a up a story on the proliferation of botnets. The article cites a number of security researchers who paint a depressing picture of the state of internet security, and concludes with the suggestion that for home users, buying a new 'updated' PC may be the only real solution. Unfortunately, as most of us know, given the number of outstanding flaws in software and the ingenuity of malicious software authors, that might not even help."
Capitol Punishment on national television for owners of botnets. ,but it has to be bareass.
O.K.,O.K. maybe just corporal punishment
*Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!
Been done already. And it didn't work out so well IIRC.
When a corporation creates a product that is unsafe not just to its user, but to many thousands of others, and provides instructions for that product which, even if faithfully and fully followed by its user, are insufficient to prevent it from causing damage and suffering to thousands of others, that corporation should be liable for the damage and suffering.
If you sell me a chain saw, and I ignore the instructions and cut off my hand, it's my own damn fault. If I ignore morality and criminality and cut off my spouse's head, it's still my own damn fault. But if the chainsaw goes off on its own power, while I'm sleeping, and slices and dices the whole damn town, it's your fault for selling me such a product, especially if you manufactured it with the knowledge that it could, in certain not-uncommon circumstances, do exactly that.
"with their freedom lost all virtue lose" - Milton
So all we need is a widget on the desktop that allows you to turn on and off the internet connection, and logs all information that goes in and out, along with denying any redirection of data to other than the specific target request (if you send a request to www.google.com, only www.google.com may respond).
Any traffic that isn't specifically requested by the user is blocked. You manually open and close ports as you need them.
Oh, right, that would break most authenticity checks to combat "piracy", and totally botch most advertising on the net, and set us back to the early 90s. BTW - sign me up.
Is it just my observation, or are there way too many stupid people in the world?
Getting a new PC doesn't make any sense at all. It just gives the bot more resources to munch on.
The core of the problem is responsibility, or a lack thereof.
Vendors aren't responsible for the results of the flaws in their programs. Worse, they aren't responsible for deliberate design decisions that make it impossible to secure systems. I make an analogy to automobiles. Auto makers aren't generally liable for defects in cars, unless the source of the defect goes beyond a simple mistake or defective part, but they are responsible for repairing those defects and can be sued if they refuse to do so. And they're liable for design decisions they make. Witness the Ford Pinto. The current state of software liability is akin to Ford claiming that, because they had a valid business reason for building the gas tank on the Pinto the way they did (it was cheaper, thus let them price the car cheaper), they cannot be held liable for the fires that happened as a direct result of their decision. The courts slapped Ford around for making that claim, why are software vendors not treated the same? I can live without strict liability for software flaws, but lack of liability for design decisions that directly lead to security problems is probably the biggest reason we still have problems.
And users aren't held responsible for their use of a computer. They treat it as some sort of plug-and-play device like a television or a radio: plug it in, turn it on and stop thinking about it. A computer isn't an appliance, you can't just ignore it after initial set-up. Again, cars make a good analogy. You can't just ignore a car's maintenance after you buy it, you need to put new tires, new brakes and such on it regularly. And car owners get held liable if they don't. If you wore your brakes out so they don't work anymore and didn't get them serviced, when you rear-end someone because you don't have any brakes you will be held responsible by the courts and the insurance. If you're running on bald tires because you don't think you should have to check and change anything, you're going to get ticketed by the cops at some point for unsafe mechanical condition and the car's registration will get suspended until you fix the problem. Sure it's a hassle and expense to keep maintaining all those things about a car that need maintained, but we don't accept that as an excuse for someone not maintaining them and causing damage or injury to others as a result. So why do we let computer users off the hook when they say "But I don't know anything about computers!".
Software vendors and computer users need to grow up. They've been both acting like spoiled 5-year-olds who were running in the house after being told not to, knocked over the china cabinet and broke everything in it, and now that Mom and Dad are standing there they're whining that they shouldn't have to own up to it and take their punishment. No dice.
is safer than XP or Vista.
but still safer than Vista (;-))
You say this with what evidence?
Vista hasn't even been released to the public yet and the only versions people have seen are unfinished betas and a very few corporate users who have started playing with the new RTM Enterprise. You know you're on Slashdot when a product that isn't even out yet has already been relegated to the insecure/unsafe/junk software category.
However, I see you have that little winky smiley thing at the end of your post. Does that mean you're just kidding and it's all a joke? Or are you serious, but going under the guise of joking so if somebody calls you out on your statement you can just say "whoosh!"? Emoticons are stupid--better for people to say what they mean and stick with that.
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
There are a limited number of ways for a machine to be cracked.
#1. Worms - if you don't have any open ports, then you're pretty much immune to worms (unless they can crack basic TCP/IP operations). Ubuntu ships BY DEFAULT with no open ports. Windows ships with lots of open ports. Change that behaviour and you've solved an entire CLASS of attacks.
#2. Viruses - an infected program infects other programs, but does not otherwise change those programs. This is not very common now.
#3. Trojans - this is the biggest current threat. And there is no real way to remove it 100%, but it CAN be limited (again, look at Ubuntu). This is primarily a social engineering attack. You have to convince the user to run an app or open a message that will exploit a flaw in their email app (and so forth).
So, why aren't we seeing a focus on the biggest security issue?
Why hasn't Microsoft released a bootable CD so you can run the anti-virus/spyware/adware stuff easier? Clean up the junk AND patch the vulnerabilities in Outlook. Even if it means turning off some of the functionality.
If you cannot do it securely, then you should not do it.
Waiter Rant (some blog) covered this recently http://waiterrant.net/wordpress2/?p=400
..... .....
"Same old," Arthur says. "How's the writing thing going?"
"Harder than I expected," I say. "But thank God for computers. I can't imagine typing this all out on a typewriter."
"Computers are great," Arthur says. "Until they go wrong."
"Ain't that the truth."
"My old computer was so infested with porn I had to throw it out," Arthur says.
"No way," I reply, taking a sip from my martini.
"I'm not kidding."
"Couldn't you reformat the hard drive?"
"My ex brother-in-law tried to fix it," Arthur says, wiping down the bar with his towel. "He's a computer geek and even he couldn't do it."
"What the hell were you looking at?" I ask.
"Nothing illegal," the bartender says, suddenly defensive.
"Sure."
"I swear," Arthur says. "I'm surfing the net, minding my own business...."
"Looking at naked women."
"Perusing all the wonderful smut the internet has to offer," Arthur continues, "When a porn demon possesses my laptop."
"Porn demon?"
"Yeah," Arthur says, throwing up his hands. "A million pop-ups start exploding on the screen."
"Oh no," I mutter.
"So," Arthur says, pulling a frosted glass out of the freezer, "I had a millions pop ups. It took me forever to close them. My ex-wife saw them."
"I'm not gonna even ask what she was doing there."
Arthur just smiles. "So the computer's completely fucked," he says. "Ran slow, acted weird - the works."
"Didn't you run a virus scan?"
"This isn't a virus," Arthur cautions. "It's a porn demon. Virus scans are powerless against it."
"I don't think the church exorcises computers," I say.
"You sure?"
I chuckle to myself. Every Catholic diocese has an official exorcist. I used to know the one from mine. It's a secret, mostly ceremonial post. Despite what you see in the movies, Linda Blair scenes are few and far between. Something tells me the Church isn't gonna whip out the bell, book, and candle to save a Duo-Core processor.
"I'm sure," I say.
"That's too bad," Arthur says. "My brother-in-law gave up. I had to throw the damn thing in the trash."
"I don't know what's worse," I say. "You buying a new computer or your ex brother-in- law trying to fix it."
"I learned my lesson," Arthur says, pouring my drink into the frosted glass. "I had to spend a grand on a new computer. No more internet porn for me."
Seems drastic but it did solve the problem. - i make no comment about the tech but thats a user for you.
Buying a new computer won't help you unless you know how to secure it and maintain it.
I'm guessing the poster thought that was the advice based on the closing anecdote. In it someone ran into trouble because their current PC was a botnet client. They weren't running the security software provided by their ISP because it overwhelmed their PC, and were buying a new one that was powerful enough to run all of the anti-virus/firewall/etc. protection they need.
You don't need to be a security guru, but you can't get by thinking you can just use a computer and never have to learn anything more about it than that.
You ever see the show To Catch a Thief? A household locks all the doors and then lets a reformed burgler with a videocam attempt to break in. They show them the videotape, help them install required security, and then try and break in again at a random time to see if the family learned anything. The first time is always pitifully easy, and most of the time the burgler's able to make it in the 2nd time as well.
Now, if most people can't secure their home where all most of them have to learn is to close & lock the door when they leave, what chance to we have a mass education campaign about TCP/IP or NAT or anything else related to computer security will work?
Computer security is broken, and I don't think anyone has a workable solution. Why can trying a new screensaver wreak this much havoc?
Nope. There are still lots of ports open, it's just that Microsoft put a firewall on the system, too.
The problem still exists. But now there is a wrapper obscuring it that you have to get through. That isn't solving the problem. That's just attempting to hide it.
And exploits have been found for Microsoft's firewall. Which demonstrates the problem with not solving it at the lowest level.
I can put an Ubuntu machine with a default install onto the Internet without any firewall and still be safe from worms.
I cannot do that with WinXP (or Win2K or Win9x or WinNT). If you aren't solving the problem at the lowest level, you're not really solving it. You're just hiding it.
We have that now, it's just that we type 'sudo' rather than pushing a big red button, but it's the same effect. For you, perhaps we can wire up a red button that echoes 'sudo' to your shell?
The problem is exacerbated by the reluctance of MS and PC vendors to give out Windows CDs that can be used to wipe and reinstall systems. They should build pockets into the sides of cases for the CDs so people don't lose them, and slipstream all the drivers in, and put instructions to boot the restore disk on the CD label itself.
Heck, a 700MB USB flash drive isn't expensive now. They should build read only flash drives with windows into the box, and put an option to run a reinstall in the bios. Solder it in so no one will steal it.
It's the least they could do, considering. I mean, Windows compes preinstalled on almost every PC sold, and there are a zillion pirate copies of Windows floating around on the net, so hardly anyone needs to steal it, and anyone who wants to steal it can. But legitimate users are screwed when they have problems because they don't get CDs, because giving them CDs would encourage piracy. And, I suspect, because it's good for business if people trapped in a monopoly have to buy extra computers to solve this problem.
Being proficient with a computer is not optional if you want to own and use a computer. Learn about TCP/IP. Learn about NAT. Learn about not trusting everything. Learn about understanding how things work at least a little bit before you try to run. You don't need to be a security guru, but you can't get by thinking you can just use a computer and never have to learn anything more about it than that.
Ummm, most Mac OS X users don't have to know anything about TCP/IP or NAT, etc. Of course, they have an OS that has security built in at a very low level, not tacked on as an after thought. Windows, at least through XP, is still based on the notion that it wants to make it easy to connect to everything and everyone. As such, it's pretty open and malware takes advantage of that. OS X and the various *nix distros start at the other end of the spectrum where things are locked down unless you open them up (although OS X has more opened up than, say Ubuntu and various other linii).
As others have posted, if Windows shipped with all ports closed except those that were really needed, then the user wouldn't need to worry about all these things. They wouldn't be opening a port until they needed it for some specific application and then that application could explain the dangers, if any to having the port open. It's basically a compromise between ease of use and security. Microsoft chose to maintain it's ease of use model from the pre-internet days, when everything was local and has tried to add security on top. It just doesn't work that well.
So, the real choice is, it seems, that if you want a Windows pc, then you need to learn about TCP/IP, NAT, firewalls, etc. On the otherhand, if you just want to use your computer, either buy a Mac or put a secure Linux, like Ubuntu, on your pc. (I just use Ubuntu as an example, there are others, too)
I really, really don't get it. It's not that hard to keep a Windows box safe. I do understand how grandma can screw up, but I just do not buy the rubbish that every Windows machine gets compromised in five minutes.
People talk about "open ports." To me, that's right up there with "oh no! My IP address is visible!" paranoia. It's just not how computers work! Worms don't somehow jump into your computer through magic holes called "ports:" They exploit bugs in services.
So, disable all the services you don't need. Get rid of the blasted Windows filesharing cruft. Shoot the scripting host. Turn off the remote desktop crap. Look through all the services, and just clean all that junk out. If you don't have idiot programs running that worms can fool into executing arbitrary code or otherwise misbehaving, you're ok! Then connect to the 'net and install the latest updates. In the time it takes you to do that, nobody will jump up through your NIC and give your computer gonorrea.
A firewall is a safety net, and it makes perfect sense in, say, a production IT department to have as many safety nets and backups as you can. But a properly-configured machine, without exploitable crap running, shouldn't strictly need it, and I really think that a competent personal user can easily stay safe.
As for the "security software" the article speaks of: Though an up-to-date antivirus is a decent idea, most software firewalls and other pieces of security software really just operate something like modern-day politicians, keeping users alarmed so as to justify their own existance. "Someone is trying to HACK you!" they scream, as an innocent ICMP ping request arrives at your computer. Pfft. Save your CPU cycles and just don't be a fool!
As a current Vista user I can tell you the following: Microsoft has a high priority of not being blamed for security issues. Their solution is to through the UAC (User Account Control) warn the user before he makes any action that could potentially be harmful to the system. This is just about any action. "WARNING! Operation 'use keyboard' is a high security risk. Press any key to abort." Ok, perhaps not that bad - but nearly. If you are an experienced user, you will turn UAC off after cursing at Microsoft for 15 minutes. If you are an inexperienced user you will just blindly accept the warning - otherwise you can't use your computer normally. In effect the operating system is constantly crying wolf and there is no way in hell an inexperienced user will be able to tell the difference between an irrelevant warning and a relevant one. Vista is also supposed to be much more secure under the hood. I really hope so, because their approach to user based security sucks. The only real point that I can see is avoiding getting sued.
Sorry, but the primary function of a firewall is indeed to add security. My website is protected by a firewall but it still receives millions of hits and several hundred thousand pageviews. It's safe to say its quite visible and I wish it to remain so. You're right that a firewall is an additional layer of protection and is by no means the only layer. Sometimes you are forced to run an insecure app though and in those times you thank your lucky stars you have proper firewalls and routers and VLANs and RADIUS to help protect your services.
I bet most slashdotters aren't even aware of DEP or using Run As to actually take away rights from a process in XP, so if a bunch IT geeks like /. don't know how to keep XP secure, then neither will users. XP has its share of security problems, but by and large the majority of them are caused by ignorance. The only way to really combat ignorance is to remind them "This is dangerous!" every time they do something risky. I would rather Vista err on the side of caution w/ UAC. The time lost clicking "Allow" all the time is less than the time lost having to restore a compromised machine.
As for the rest of your comment, I agree completely. Cheers.