Slashdot Mirror
Hackers Offer Subscription, Support for Malware
Stony Stevenson writes "Organised gangs are taking a page out of security vendors' books and setting up their own websites that offer support and subscriptions for malware and spyware. From the article: 'For subscriptions starting as low as $20 per month, enterprises can sell fully managed exploit engines that spyware distributors and spammers can use to infiltrate systems worldwide, said Gunter Ollmann, director of security strategies at IBM's ISS X-Force team. Many exploit providers simply wait for Microsoft's monthly patches, which they then reverse engineer to develop new exploit code against the disclosed vulnerabilities, Ollmann said. "Then all you've got to do is just subscribe to them on a monthly basis.'"
When I first read the title, I thought it meant that hackers were now selling "protection" from malware in much the same way organized gangs have sold "protection" in the past. Perhaps a better title would be "Hackers organize, sell exploits as business"
Couldn't they make more money by offering a 'Patch Wednesday' kind of service which updated Microsoft products and protected against the next round of vulnerabilities? Seeing as no one else is able to do this there's a very obvious gap in the market here for someone who knows a bit about exploiting MS products!
...then kill them.
If Colombian cartels run public support of whole villages, why not to go a similar way for sleazy hackers?
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
Not only a troll, you're lazy. I have lazy trolls for breakfast. Better run.
Erm, if you're daft enough to sign up and give them your credit card details directly, doesn't that mean they no longer need bother writing the malware?
When I saw the summary, I was half-certain it had to be a delayed April 1 submission. Then I looked at the article. And thought about it.
It actually fits a pattern we've seen with viruses, trojans, spyware, other malware, cracking, even spam. They've gone from small shops, often one programmer trying to make a name for himself, to full-on organized crime using businesslike structures and tactics.
What these thigns do in a crossover office environment. can they still work on IE in crossover office or does it need the underlying holes in windows?
also they do not mention, is firefox vulnerable to this stuff?
Do not look at laser with remaining good eye.
How long before we see a defection and find out that N.Korea or some other evil empire's government is sponsoring this type of activity. All that malware out there isn't just annoying you with spam, a lot of it is trying industrial espionage.
Support NYCountryLawyer RIAA vs People
$20? What a rip off. I get the latest malware and spyware for free every day courtesy of my coworkers.
...cause that worked out so well in Transporter 2...
How long will these hackers be trusted by their colleagues? Eventually; the groups selling the subscription will be booted from the underground / aka no longer be trusted. Keep in mind: how do you know what they are selling is going to be accurate?
.02 cents worth.
Just my
Unless the line is stolen from some other pop culture of course.
The next step is obviously to protect their IP, so look for patents such as:
:)
"a method of injecting code into a web-browser to steal credit card details.... on the internet"
"a method of using many remote controlled computer's, without the owners express consent* to send unwanted advertising material, to many, many people... on the internet"
After that expect to see Exploit Genuine Advantage programs to ensure that the stolen data you are using is from genuinely advantageous exploits, and not from some half baked knock off malware or virus, duplicated by a disreputable individual.
Obviously the last step will be the mergers, (after all the above should ensure a profitable market is created and grows). Symantec will merge with EvilCode PLC, to produce Evil-Symantec, McAfee will merge with McNasty, to produce McNastfee. These new entities will be able to leverage both the illegal exploit market and provide protection services simultaneously, probably all in one product... , Finally Microsoft will change its OS so that it no longer "works" with all these wondrous exploits and... hell will freeze over
erm, ok, maybe not. Anybody whose job it is to track such things who thinks this is news, well, they're not doing their homework.
The exploit ecosystem has evolved an organism that appears to be self-aware.
If only there were an environment that was safe from such evil organisms, where they could not thrive...
Help stamp out iliturcy.
The site they're writing about, found by searching with Google for phrases in the article, isn't quite what the article says it is.
It's really yet another slimy "affiliate" program. "We give our code to your and you need to setup it to your websites. We pay for installs and for trusted webmasters for traffic if they want that." They're not selling malware with support. They're buying traffic to install their malware via drive-by installs. That's not exactly new. CometCursor, BonzaiBuddy, and Zango come to mind.
From the original article, someone else may be selling "fully managed exploit engines", but it's not these guys.
I know I will likely be flamed for this, but I think its great that the hackers have offered this type of service. This will force microsoft to come up with real security instead of some pop up windows that try and give some simalance of being secure. I hate adware as much as the next guy but if this is allowed to continue, Microsoft might be forced to re-think the base of their OS. Of course this could all be the next small step in Apples bid for world domination! Apple-hired mercenaries working under the guise of business minded hackers...brilliant!
Could you please provide evidence that a common base Linux install (of a popular distribution like RHEL, Fedora, Ubuntu, etc) is less secure than a base install of anything else? Can you then provide evidence that once it is up-to-date it will continue to be less secure? Please compare to Windows XP, Windows Vista, current Solaris, and current AIX.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
ie isn't a virus development tool. It's just an installer.
Help stamp out iliturcy.
People like you.
Seriously, what does running as a restricted user do to prevent this? Restricted users can still install software anyplace they can write to.
Don't thank God, thank a doctor!
You bet. In fact, right now there's hordes of undocumented alien, exploit writers hammering away at new malware from their nondescript building in Dallas overlooking a grassy knoll.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
How about this link: http://www.omninerd.com/2007/03/26/articles/74
To Hell with the Queen of England!
The final step in this process is clearly that Microsoft will buy one of the tiny little malware vendors, or maybe two of them, and work for a couple years to integrate the service directly into the next version of Windows, taking the revenue stream from McNastafee and Evil-Symantec.
If you mod me down, I shall become more powerful than you could possibly imagine.
How about a study that hasn't been thoroughly debunked? The Linux vulns count includes applications that provide functionality that Windows doesn't provide, and the Windows vulnerabilities are on average open longer and more likely to be a remote root hole.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Someone should sell a monthly malware research subscription that identifies attack sources for an enterprise or ISP for a month and submits case files to the appropriate government to put the offenders in jail. In countries with no functional government, hire privateers instead.
Isn't this similar to L0pht Heavy Industries' business model, just without the scum and villainy that's associated with malware?
Dedicated Cthulhu Cultist since 4523 BC.
It's called meatspace. Of course, if the singularity actually happens, be prepared for v1@g4@ hawking bots in real life, too.
I downloaded some malware from the internet that was offered for free, and now they want to charge me for maintaining it?
That's it for me. From now on I'm using only open-source malware.
This is outrageous! It's extortion, that's what it is! It's downright criminal... Oh!
-- I have monkeys in my pants.
Comet Cursor!!! Yay! The exploit that Microsoft ignored for years! Affected Win98, WinXP, and Vista! Remember Microsoft said this problem was 'isolated' ha ha.
Firstly, Microsoft makes most of its money off support. Maybe they benefit from secure software, but definitely not "good" software. They want their software to be "just good enough" so that support is necessary and paid upgrades are necessary.
Secondly, there are so many different versions, alternatives, and forks of open source software that it's harder to target a large audience. It's the monoculture that requires Microsoft to be more secure.
Buckle your ROFL belt, we're in for some LOLs.
There, fixed it for you.
I know this seems very paranoid, but I thought it was interesting to see the advertising effort for malware protection on the same page as the article. It got me thinking about the size of the industry to prevent spyware as opposed to the size of the hacker community. The amount of money that has been made protecting from hackers is in the billions. Just an observation that opens up all kinds of conspiracy theories.
Flexible bare-metal recovery for Linux/UNIX
The Tao of math: The numbers you can count are not the real numbers.
Wow, yeah I find this news quite amazing. When I think of a hacker a nerdy 20 something year old comes to mind typing away on a computer with a box of pizza and 2 liter of mountain dew at hand. This is something different though. By actually selling these illegal products to anyone who can afford them, these hackers are gaining respect as well as funding, which is crucial to the advancement of their nefarious deeds. It sounds like the attacks are all browser based, coming through yet to be patched versions of Internet Explorer. I think, in the short term at least, victims of these attacks will begin switching to alternate browser solutions (such as Opera or Firefox) to avoid the problems associated with IE. However, as more people switch, the attackers will simply direct their attacks at the alternate browsers, bringing everyone back to square one. From there perhaps the open source community supporting Firefox will direct their energies toward combating the hackers' exploits, or the victims may go so far as to switch operating systems to Mac or Linux instead of Windows. All of this, however, is based on Microsoft losing their patch fight against the hackers and the hackers continuing to sell their code and grow their business through ever greater levels of dominance. What would be interesting is if the hacker companies grow powerful enough so that standard anti virus software can no longer compete with them. At that point we may see malicious software from competing companies specifically designed to target and destroy their competitors' code. A digital war if you will. In any case the future will hold some interesting outcomes.
Wow, wouldn't it be wonderful if Microsoft finally got it and made Windows really secure?
No, it wouldn't It wouldn't sell, nobody would use it and it would be a complete flop.
Windows is designed to be usable by people without one little bit of computer knowledge. It therefore does things "for you" in the background that can be good and helpful. If they are subverted, they are bad and insecure. Take all of this away and leave just the command line and Windows would be much more secure, but it would be unusable by most people.
If it is programmable and the programming can be added to or modified in the field, it needs controls on who can modify that programming. If the inexperienced user can, it isn't secure. Period. When users run programs to install games they purchased they are using the same resources as when the click on an email attachment to install some bit of malware. They have no way of knowing the difference and it would seem no amount of education is going to fix that problem.
What most people need is a locked-down appliance that cannot be modified in the field without extraordinary effort. And certainly cannot be modified over the Internet. This could be user friendly and secure, but you wouldn't install software on it, ever.
Windows is trying to be user friendly and general-purpose. This has no choice but to fail to be very secure. The user cannot tell the difference between a program that is from Microsoft that is something they want and a program from microSoft that isn't something they want at all. Or from MircoSoft. Or really, anyone else at all. Sure, you can try to give them a chance to tell the difference - and Vista does try - but it isn't going to work. People gave up reading messages from computers and just click OK beginning in 1979 with CP/M and they aren't about to change now.
I contend that there is no material difference between the security present on a Macintosh or Linux and Windows in the hands of a user that doesn't understand how the system works. If they get an email that says to run some program, they are going to run it if they want what the email says they are going to get. If this requires using sudo to get root authority, they will do so if they have the ability to do it.
So how do you have security in that environment? You don't. You can't ever be secure against the naive user in charge of their own computer.
Even better, don't give them write permission. Or read permission. Hell, don't give them a computer.
Removing execute permission from a directory does not do what you think it does. As far as I can tell, it effectively removes read permission. Maybe it does something different on Windows?
.xinitrc, etc). So, just create a file called '.spyware.sh', and add a line 'bash ~/.spyware.sh' (or 'perl ~/.spyware.pl') to your .bashrc.
I am sure you mean removing execute permissions from the file itself. In that case, you would have to mount their entire home directory (has to be a home partition now) 'noexec', which would probably break some things, and still wouldn't work -- scripts do not need execute permissions, and they still have things like login scripts (.bashrc,
You could just remove interpreters, or hide them from your users -- thus making your system more and more unusable to them. I suppose you could hack all the interpreters to only work when a file has execute permissions, but as far as I know (haven't tried), noexec-mounted partitions simply don't let you execute things, they don't actually change the apparent permissions of those files. Meaning you now break any script that doesn't have a shebang (#!) at the beginning...
Anyway, while technically possible, it's really a lot more effort than "not running as local admin". The real solution would be to have a secure web browser in the first place.
Don't thank God, thank a doctor!
That's why we can't have nice things.
Any y'all who were on Usenet back in the day know exactly what I mean.
--
Don't like it? Respond with words, not karma.
20$ ??? When I can get a delayed version for free by reading the descriptions of this website
Don't you know it is now both immoral and criminal to think beyond the next quarterly report?
Linux has a monoculture too.
How many spreadsheets are in the basic Ubuntu repository? (not universe, non-free, multiverse, or whatever)
Ok, now how many are in the base repositories of the other major distros? I bet you'll find a few common faces...
And how many people use spreadsheets that aren't in the repositories?
What about compilers? What's that? not even intel's free compiler is in the repositories?
The repository system is like a two party political system: It enhances the front-runners and penalizes the trailers. If we're not careful, we'll end up with an even worse problem than Microsoft.
Can you be Even More Awesome?!
If you use phishtank.com to verify phishes others submitted, you see clear patterns such as page filename, the exploit used and so on. There must be some "phishing kits" in use. If you see c.html in 6 different hacked servers in complete different locations, there is nothing but a software kit there.
Somehow, I'm scared to even visit that site with lynx.
Yeesh.
They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
lindon@dmtelecom.net
Got that, spambots?