Botnet on Botnet Action

Dausha writes "The Tech Web news site reports a story about Botnet turf wars. Botnets have been around for a while, and are increasing in severity. The latest innovation finds Bots capturing and securing host computers from other bots. Security includes installing software patches, shutting down ports, etc."

Comments

Note to Editors

[Billosaur]

Never let CmdrTaco come up with headlines after a night of watching girl-girl porn... the images created are... disturbing...

Re:Note to Editors

[TheMeuge]

How do you think he came up with his username?

Re:Note to Editors

[peragrin]

a food eating contest at taco bell?

Re:Note to Editors

[JamesTRexx]

You were thinking of a clusterfuck too?

Re:Note to Editors

[Billosaur]

Ok, I hate to reply to my own post... and far be it from me to insult the Gods of Karma... but "Insightful?" Now that's funny!

Re:Note to Editors

[thestudio_bob]

Seriously, why couldn't some kind of "GOOD" botnet be created that does this? If the spammers can do it, why can't Microsoft, Yahoo, Goolge, AOL, Symantec or someone? A botnet that goes around and secures all these drone computers would save the connected world a lot of headaches.

Re:Note to Editors

[jojoba_oil]

Couple that with a quote I pull directly from TFA:

It's one incestuous ecosystem.

Re:Note to Editors

[dkf]

Yeah, it should have been 'Informative'.

Re:Note to Editors

[AndersOSU]

because it is self defeating. If you clean up a computer, you no longer have access to a computer that would clean up other computers.

Re:Note to Editors

[arbarbonif]

But what will CmdrTaco do when he is NEVER allowed to come up with headlines?

Re:Note to Editors

[smooth wombat]

But what will CmdrTaco do when he is NEVER allowed to come up with headlines?

Work on the broken mod point distribution code?

Re:Note to Editors

[maxume]

So stick in a 5 month service period before the goodbot commits suicide on a given machine. I imagine the greater reason is that it would be a criminal act with no direct gain, so people that are able to do it and 'good guys' won't, because it represents a big risk with no real gain.

Re:Note to Editors

[qwijibo]

Because good has to be much more diligent, and that is orders of magnitude harder.

When you're working for evil, you don't have to worry about collateral damage. If you cause one system out of 100 to stop working completely, or just have some incompatibility that makes it less useful to the user, you don't care. If they didn't want to be infected, they'd have better security. Propagating evil viruses, trojans and worms is easy because you can be careless and expect the rest of the world to reboot if you have a bug.

This is also why large organizations have people to test that patches don't break the necessary functionality in their supported applications. If something breaks, they have to support it, so they make sure it's not going to come back to bite them. This takes a fair amount of time, people, and all of the supported configurations to ensure that things are safe. It's a real pain in the neck (or other body part) to do a good job at this.

The most secure machine is one that is turned off, unplugged and locked in a room that has an armed security guard with standing orders to shoot everyone. That's not the computer usage model that any of the companies listed want to encourage. They want the user to be insecure to different degrees.

Re:Note to Editors

[Junior J. Junior III]

Seriously, why couldn't some kind of "GOOD" botnet be created that does this? If the spammers can do it, why can't Microsoft, Yahoo, Goolge, AOL, Symantec or someone?

That's exactly what turning on Automatic Updates + Firewall protection + Antivirus software automatic updates is. You can still get 0wned even if you have Automatic Updates turned on, but it's better than nothing. Automatic Updates + Sunbelt Kerio Personal Firewall + AVG Anti-Virus Free Edition + a couple of spyware scan/remove apps + running Firefox instead of IE and being careful about what I click + hiding behind a NAT router keeps me pretty safe, for the most part.

Re:Note to Editors

[bhmit1]

Seriously, why couldn't some kind of "GOOD" botnet be created that does this? If the spammers can do it, why can't Microsoft, Yahoo, Goolge, AOL, Symantec or someone? A botnet that goes around and secures all these drone computers would save the connected world a lot of headaches.

Because of liability and money. A large company won't do this because if they take control of your machine against your will through a security hole (and there's no other way they'd put a dent in the problem if people had to volunteer to have this installed) they are liable for any damage that does and open themselves up for trespassing lawsuits. Consider a patch that a company is not installing because it conflicts with business critical applications or because they are aware of an even bigger security hole it exposes.

As for some hacker doing it, it's all about money, and maybe a little fame. Doing this puts you in a worse position than the airline ticket hacker. So anyone that exposes themselves to this kind of risk, does so for money. And right now, there's money to be made in cutting out the competition in terms of making your botnet bigger than theirs and less likely to be removed (users are less likely to notice just one bot).

Re:Note to Editors

[Chosen Reject]

"And now we see that evil will always triumph, because good is dumb."

Re:Note to Editors

[HUADPE]

Seriously, why couldn't some kind of "GOOD" botnet be created that does this? If the spammers can do it, why can't Microsoft, Yahoo, Goolge, AOL, Symantec or someone? A botnet that goes around and secures all these drone computers would save the connected world a lot of headaches.

It's illegal. Botnets constitute several levels of fraud in that they a. install software without your consent; b. steal your bandwidth to copy themselves; and c. then use your computer to commit some other crime.

c. would not be done by a "good" botnet, but a. and b. would. Even if all the hijacks came from a commercial server set up for it, a. would be violated. If you think click-through EULAs are invalid...just imagine the invalid-ness of a botnet install.

Re:Note to Editors

[bmin]

I didn't see the obligitory:

"I welcome our Botnet Overlords"

Re:Note to Editors

[WhatAmIDoingHere]

Some people tried that. Modifying some of the bad worms to have a payload of "download and install the patch for the hole I came in with."

That failed pretty damn hard. It was argued that it did as much damage as the worm it was trying to stop.

Re:Note to Editors

[ajs318]

Because regardless of your intentions, it would still run afoul of the Misuse of Computers Act 1990.

Re:Note to Editors

[It'sYerMam]

Hmm, I don't think this has been thought through properly. (regardless of the insightful mod) Just because you've patched up the security hole on the host computer doesn't mean you can't still send stuff out. And of course, it's less than trivial to build in a time delay before the bot patches security holes and terminates itself, during which time it infects as many PCs as it can - so if, by some mechanism, the way you got in is related to the way you're sending yourself out, it would still work.

Re:Note to Editors

[maxume]

I don't think it's a good idea. It is notable that while the things that get called bots are worms, they are generally designed not to be destructive and to spread slow enough to avoid excessive attention. So making up history, my definition of 'goodbot' only includes bots that do more good than harm.

Re:Note to Editors

[Anonymous Coward]

You misspelled 'midget-midget'.

Re:Note to Editors

[number1scatterbrain]

I built a cluster, and the bots fucked it.

Re:Note to Editors

[Anonymous Coward]

Several years ago when the Blaster worm was making the rounds, my company fought a moderate amount of infections. As I remember it, there was a secondary worm, a "good" worm, that was intended to clean up infected machines if the users wouldn't/couldn't themselves. That secondary worm wrought more havoc on our network than did the worm it was meant to eradicate. I understood the intention, but the result was awful.

Re:Note to Editors

[plover]

I'm not so sure about this. Why does good have to be diligent and honest? Why can't this be done by vigilante groups who are not officially sanctioned, but nobody complains about them?

The internet is still pretty much wide open, with no single governing body. A vigilante group could operate out of any number of less-than-cooperative countries. And this vigilante group does NOT have to be 100% good or careful. These zombies exist because their owners don't know or care enough to keep their machines safe, and now they're out attacking the rest of us. I have about zero tolerance for dangerously ignorant people or their hardware when it's threatening mine.

In medical terms, these zombies would be defined as malignant cancerous cells, and botnets as tumors. And to carry the medical analogy further, the treatment is to kill the rogue cells. We don't contact them, and ask "hey, Mr. Cancerous cell, you're hurting the rest of us, would you please stop?" No, we use chemo and radiation and surgery and remove and destroy the tumors so they don't spread further.

I really don't see why a vigilante group can't send out "good-faith" efforts to patch bad machines. If those machines die as a result of a bad patch, well, perhaps its because they deserved to die. I certainly wouldn't complain if someone started actively dismantling these networks.

Re:Note to Editors

[HAKdragon]

You know, that's one of the things I really don't miss about running Windows...

Re:Note to Editors

[DarkDaimon]

I thought Windows was a botnet!

Re:Note to Editors

[karmatic]

I certainly wouldn't complain if someone started actively dismantling these networks.

Some of us try.

A while ago, I got a spam message, trying to infect me and connect me to a botnet - the software was a hacked up mIRC client with some DLL plugins. The client would automatically open a second connection, connect to a random network and channel, and proceed to spam people with virus messages on join. ("Type //some evil command to get op!, etc.")

After talking to the admins, we banned the owners (only certain nicknames were allowed to control the bots), and replaced them with an eggdrop that had the infected people download and install an automatic cleaner. Thousands of infected computers were cleaned overnight, and hundreds more over the next few weeks. Is it possible that the cleaner broke a machine or two in the process? Possible, but unlikely (would be most likely due to a variant of the bot). Oh well - it made the IRC servers I used a lot more useful.

Re:Note to Editors

[cdrguru]

Yes, but ...

So what? When was the last time you heard about some botnet master getting arrested and charged with 20,000 counts of computer misuse? Oh yeah, the one prosecution there was occurred because the guy bragged on some FBI IRC channel.

These people are immune to prosecution. Let's say I have a 10,000 strong botnet and I am controlling it through my cable modem at home. You can't trace the botnet back to my cable modem, that's not how it works. You can't trace it through the IRC channel used for controlling because the IRC server operator is under no obligation to give me up. And, even if you did Comcast isn't going to give me up because I'm a customer.

Let's say they make a federal case out of it and raid Comcast for the secret logs and find out that BotnetHeader is a Comcast customer at my address. Fine. How do they prove it is me and not someone else in the house? Or, someone outside that is using the wireless connection? They can't and just like the RIAA is finding out, an IP address is not a person. It might get you to an ISP account but you can't prosecute someone for allowing their account to be used for illegal purposes.

So, I would have nothing to worry about. Unless I am stupid and wet my pants when the police come and confess everything. The answer is LATEX!

Re:Note to Editors

[qwijibo]

Good has to be diligent and honest to be good. You can argue shades of gray, but that's just another way of saying degrees of evil.

When you decide to be a vigilante group and dish out your style of justice for others' perceived sins, you are at best what Machiavelli describes astutely as "other than good."

I'm a sysadmin, so if I were a juror and your "other than good" tactics landed you in court, I would not in good conscience be able to vote to convict you for trying to do something about these idiots. However, you should realize that good faith is not inherently good, and frequently creates the good intentions with which the road to hell is paved. If you're willing to live with possible consequences for your "other than good" tactics, I'm willing to look the other way. After all, the net harm would have to be less than the botnets are causing now.

Re:Note to Editors

[briancnorton]

"Evil will always triumph over good because good is dumb."

Microsoft already has this in place, it's called windows update, and it was a HUGE leap forward. For the rest it has to do with legality and profit motivation, i.e. it's not legal and they can't make money off of it. Symantec and Microsoft make their money selling aspirin to the headaches you're describing. Google and Yahoo would be WAY out of their realm of specialty. Personally, I wouldn't mind ISPs doing it, assuming it was very up-front about what it was doing and told you how to prevent it.

Re:Note to Editors

[networkBoy]

Automatic Updates + Sunbelt Kerio Personal Firewall + AVG Anti-Virus Free Edition + a couple of spyware scan/remove apps + running Firefox instead of IE and being careful about what I click + hiding behind a NAT router keeps me pretty safe, for the most part. And uses what percentage of your clock ticks? 20, 30, 70?

Re:Note to Editors

[Junior J. Junior III]

When they're not running, they use damn close to zero.

But, when they are running, they might use a certain amount... JUST LIKE A BOTNET! OMG! My analogy is flawless!

Re:Note to Editors

[Achromatic1978]

Uhhh, not to be inflammatory and all, but who the fuck are you to take it upon yourself to install your own trojan? Remind me again why you should be trusted any more than the botnet creators? Why any 'admin' (on IRC, haha, an O:line hardly is a badge of merit or trust) would allow you to "replace" the botnet with one of your own? Sorry, I don't know you from a bar of soap, why should I even believe for a moment that your "clean up" act wasn't just you doing exactly what the article is talking about, shutting down one botnet so you can have yours, and doing so in the guise of good? Or distributing another trojan of your own?

Sorry, I'd come down on your ass just as hard as the botnet creator's. Guess what? You COMMITTED A CRIME. You blew it off in the name of "making the IRC servers you use more useful", and if your work actively damaged (further) someone's computer, "oh well", at least your IRC server ran cleaner, huh?

Explain to me why you should get a free pass for computer trespass?

Re:Note to Editors

[Anonymous Coward]

So you are saying that if one guy goes into a house because the door was open and does whatever, and then a second guy comes, shouts something at the first guy so that the first guy leaves the house, the second one should be tried for trespassing?

Because that is what he did. The trojan was already installed by someone else, he just used it to tell the trojans to commit suicide.

Re:Note to Editors

[Ravon Rodriguez]

Your analogy is flawed in that the network of cells in the human body are all owned by the same individual. There would be no qualms if a corporate intranet had a problem that they decided to solve in this manner. The reality, however, is that this would be more like forcing cancer treatment on an unwilling patient. You could make compelling arguments for or against it, but you are always going to have moral and political issues.

The better solution would be a social one. Quarantine the computer at the gateway; disallow it from establishing outgoing connections except to certain ports (80, 8080, etc). When the user tries to load a website, redirect them to a page that illuminates the situation. I realize that this requires tremendous cooperation on the part of the ISP, but it's a better solution than cyber-vigilantism.

Re:Note to Editors

[NotmyNick]

In addition to what the others pointed out about the self-destruct cycle, a new bot is generated for each newly discovered vulnerability. Or goodbot could act like WindowsUpdate connecting periodically p2p. Imagine this: Goodbot gets released by a classical infection channel targeting a problem a couple months old. These first gen hosts can be presumed to not be regularly updated and possibly harmful to the internet. These initial hosts are audited and if no mitigating lockdowns are discovered, updates are retrieved and installed for all discovered vulnerabilities. Basic security lockdowns are performed to a level that will ensure security while minimizing the odds of damaging the utility of the computer to its owner (do not read Pwnr). Next, move into a limited worm phase. 1st gen Goodbot tries to infect a few hundred hosts in the next 30-45 days. The second gen acts like the first. Now you've got a couple tens to hundreds of thousands of Goodbots. They're likely the most insecurely administered computers and least likely to be disinfected by their owners in any case. Every new major vulnerability that comes out you have these BossGoodbots infect and repair their neighbors with a pawnbot with all the diagnostic and updating functionality which securely self-destructs when its job is done. Any first and second gen that fails to meet a certain quota self-destructs.

Re:Note to Editors

[Anonymous Coward]

"a food eating contest at taco bell?"

Impossible.

Re:Note to Editors

[scottv67]

A botnet that goes around and secures all these drone computers would save the connected world a lot of headaches

We fire-up the wayback machine and visit 2003:

http://www.trendmicro.com/vinfo/virusencyclo/defau lt5.asp?VName=WORM_NACHI.A

Patch Download

This worm is also designed to patch systems against the RPC DCOM Buffer Overflow. It first checks for the running Windows version and then downloads a patch from Microsoft. Note, however, that this worm does not have a mechanism which checks for the required service pack needed to install the patch. Thus, on systems where the required service packs are not installed, the downloaded patch are similarly left uninstalled.

Re:Note to Editors

[Anonymous Coward]

I am the master of the T.A.C.O. Remember this fucking face. Whenever you see T.A.C.O., you'll see this fucking face. I make that shit work. It does whatever the fuck I tell it to. No one rules the T.A.C.O like me. Not this little fuck
[referring to CowboyNeal]

Re:Note to Editors

[scottv67]

As I remember it, there was a secondary worm, a "good" worm, that was intended to clean up infected machines if the users wouldn't/couldn't themselves.

http://www.trendmicro.com/vinfo/virusencyclo/defau lt5.asp?VName=WORM_NACHI.A

I understood the intention, but the result was awful.

Amen to that!

Re:Note to Editors

[plover]

Oh, I know the analogy is weak. A better analogy would have been a virus, something transmissible to other people. At that point there *is* a public health reason to take action, either "enforce a cure", or at the very least to do what you suggest: quarantine.

As we both acknowledged, there is no governing body, which is why I don't think vigilantes are unjustified in their actions. In order to accomplish what you suggest, each and every ISP would have to agree to participate, or giant chunks of the internet would become balkanized. Perhaps new network protocols would be developed to exchange quarantine information, or new routers would have to be deployed to provide the isolation. Whatever, it's a lot of work that is not happening today, much to the advantage of the bad guys.

So today our current responses are utterly pathetic. This officially how botnets are addressed today: volunteers with honeypots spend months gathering data, they report to CERT, CERT calls the FBI, the FBI calls Interpol, Interpol calls the Estonian police, and since it's the brother-in-law of the burgomaster's kid, the hacker gets a tip and isn't home when the cops show up. Or even if nobody tips them off, the Macedonian police have the following choices to make: hunt down thieves, thugs, rapists, murderers, and the Russian mafia; or some kid in a coffee shop with a laptop. Guess which gets priority. Nothing continues to happen for months and months under the current system.

As long as nothing happens to the bad guys, why should anything happen to the good guys?

Re:Note to Editors

[SatanicPuppy]

By this rationale, if I see a sick person walking down the street, I can walk up to him and inject him with a concoction of my own design that I firmly believe will make him better, but which probably hasn't been tested very well, and may kill him.

I'm not opposed to people taking vigilante action on botnets, but the reality is, vigilantes are also breaking the law, and I likewise don't have any qualms about seeing them face the consequences of their actions when their homebrew fix-it app runs amok.

Re:Note to Editors

[Bearhouse]

Because there's no money in it. OK, all me a cynic, but have you ever seen 'The Russia House' or 'Wag the Dog' (great films but with frightening messages). It's our fault - people will always spend a fortune fixing problems that they could have spent a little cash avoiding... Meanwhile, Symantec & the CIA are doing business...

Re:Note to Editors

[Anonymous Coward]

What dumbshit of a mod on crack modded the parent offtopic?

Sheesh! I wish they would be more saelective about giving out mod points--especially idiots who don't knew redundant from offtopic or insightful. Scripy kiddies, I bet.

Dumbasses.

Re:Note to Editors

[csplinter]

I would say if anything, it's more like forcing someone to take an aids cure against their will. The fact a number of people have aids threatens me, the fact a number of people have cancer does not. I will either get cancer or wont but, it certainly wont be because someone was incautious with their body and I got fucked over for it.

The better solution would be a social one. Quarantine the computer at the gateway; disallow it from establishing outgoing connections except to certain ports (80, 8080, etc). When the user tries to load a website, redirect them to a page that illuminates the situation. I realize that this requires tremendous cooperation on the part of the ISP, but it's a better solution than cyber-vigilantism.

I have to disagree, I think a better plan is one that would actually happen. No ISP is going to compete better with another ISP by angering their customers, making them sit around and, read about why they can't use the internet they paid for until they jump through the ISP's hoops when all they want to do is find out what time a movie is playing as they are about to walk out the door. I seriously can not see the cost of all the support calls, lost customers, etc. that would inevitably result, being less than the cost of having botnets running on your network. If you hope for any major ISP agreeing to something like this out of philanthropic efforts, you are a true optimist.

Re:Note to Editors

[plover]

Hey, if you're running an unpatched server that's been taken over by a bot, and now your zombie is trying to corrupt my server, I don't care who you are or what you think of the trespass laws. If some vigilante botnet comes around and cleans up your machine, you should be out there kissing their asses in thanks and writing them donation checks, not whining "You COMMITTED A CRIME." Because if a vigilante group can do their cleanup work on your equipment, YOU are the criminal. You are criminally negligent in letting your machine deteriorate to the point where it can be corrupted and used to attack others, and you are demonstrably doing nothing about it.

Basically if your machine is so crappy that a group of vigilantes can board it and clean it up, you have demonstrated enough negligence to accept whatever it is they do to you. I don't even care if they install their own trojan from which to launch future cleanup attempts. If you were a competent machine owner, you'd be running a secure system instead of crying about legal issues.

Re:Note to Editors

[Anonymous Coward]

Spoken like a spammer.

Re:Note to Editors

[plover]

Not at all. Sick people can be sick, it happens. But we're not talking about "ordinary sick." We're talking about bleeding-from-the-eyeballs-ebola sick. The kind of sick that makes other people sick simply through casual contact. And most importantly, we're talking the kind of sick a reasonably prudent person can keep at bay with vaccinations and regular doctor visits.

If you actually saw a sick person wandering down the street, bleeding from his eyes and coughing ebola viruses on everyone he passed, (and yes, you could somehow easily determine they were ebola viruses,) and you could see bloody-eyed victims wandering around in his wake coughing on their neighbors, what would you really do? Honestly, I'd run fast and far in the opposite direction seeking shelter, or I'd shut my car doors and roll up the windows and drive off. And as soon as I was out of immediate danger I'd get on my cell phone and call 911, and I'd be demanding police, ambulances, fire trucks, the National Guard, the Department of Homeland Security, and a couple of exorcists just in case, and I'd be demanding them right fracking now.

But this is the internet, and we don't have police, ambulances, or fire trucks. We have CERT. And if I had a dollar for every time I heard the phrase, "Thank God we're saved, CERT is here!", I'd be a nullionaire.

So given the current lack of law enforcement on the net, if my choices are to either wait eleven months for CERT to get Interpol to arrest the sick guy, or wait 30 seconds for Shaun of the Dead to smack the sick guy down with a shovel and inject him with something that may or may not cure him, I'd say Shaun is my hero.

Re:Note to Editors

[Glog]

The moment MS, Yahoo, or Google introduce a "good" botnet they are basically offering a complete software package which hackers can reverse-engineer and twist for the their own evil benefits.

Re:Note to Editors

[makash]

Seriously, why couldn't some kind of "GOOD" botnet be created that does this?

There does exist a "GOOD" worm for this.

From http://www.blackhat.com/html/bh-federal-06/bh-fed- 06-speakers.html

Nematodes - Dave Aitel, CTO/Founder, Immunity, Inc.

This presentation presents concepts for taking exploitation frameworks into the next evolution: solving complex security problems by generating robustly controllable beneficial worms. The Why, How, and What of Nematode creation are discussed, along with some concepts in Mesh routing.

Re:Note to Editors

[Anonymous Coward]

Hmm...

Re:Note to Editors

[Propaganda13]

That makes no sense. A bot is just code. You can secure a computer from outside infection and still run programs on it that access the internet. You can even have secure access to it remotely.

As for companies doing it through a botnet, why would they want a lawsuit? As for doing it through their services, several companies do offer protection tools like antivirus, firewall, etc. already.

Re:Note to Editors

[Graham J - XVI]

hahaha damn I wish I had a mod point to give you for that one :D

ahh Spaceballs, an endless source of relevant quotes ;)

Re:Note to Editors

[karmatic]

Uhhh, not to be inflammatory and all, but who the fuck are you to take it upon yourself to install your own trojan?

Well, that certainly sounds like you're trying to be inflammatory, but I'll bite.

A trojan is a specific type of program that masquerades as one thing, but is in fact another. The original attack was most definately a trojan. As such, I can only assume that either a) the owner of the machine didn't know about it, and has no desire for it to continue, or b) it's a botnet owner - I don't care about them anyway.

The program that was sent to the client was very, very simple, and very limited. It looked for a running hidden mIRC.exe copy in a very specific hidden directory inside the windows directory. If found, it would terminate only that mIRC.exe, delete that specific hard-coded trojan-specific directory (no other legitimate program would be there), and remove the registry entry used to load it at startup.

As for "how do you know"? Well, it was a simple small app, and a decompile would show what it did. Or, the source code could be taken and recompiled, and compared. The app had my name and email in it, for heaven's sake.

As for the "YOU COMMITTED A CRIME" part - it would be interesting to see that argument in court. I connected to a publically accessable chat server, with the consent (implied and explicit) of the owner of that server. I placed a program to connect to a chat room, and simply pasted a command containing a URL. Arguably, the trespass was already done, and there was plenty of evidence to indicate that it was done without the consent of the owner of the computer. If anything, my script would "un-do" the harm originally done - it would be difficult to convince a judge that the Mens Rea was present for Computer Tresspass; given the rather limited scope and simplicity of the program, recklessness or negligence would be rather difficult to prove. Also, there was most certainly no intent to commit an act of Computer Trespass, further complicating a case against me.

Besides, good luck getting that one past a jury of my peers. "Their computers were infected, and attacking other computers online. I cleaned them up, at no charge, and restored them to how they were before they were attacked." - you really think you could convince a jury of 12 to convict for that?

Re:Note to Editors

[Achromatic1978]

It is? And, of course, you know this how? Because he said so? Sure, in this instance, he might actually have done so, but way to completely miss the point - how does anyone know, when this guy here makes his "white knight" offer to /install a second trojan/ that supposedly gets rid of the first, that that is WHAT HE ACTUALLY DID?

Re:Note to Editors

[Achromatic1978]

You are criminally negligent

Nice try, though laughably untrue.

I do love your blind faith though. So, tell me, someone emails you and says "Hey, you, your machine is in a botnet. But you should trust me, a complete stranger. Install this random fucking .exe and it'll clean you up, and you know this, because I said so."

You wouldn't do it knowingly, you'd mercilessly attack anyone who did so knowingly, so remind me what the difference is if you do it without knowledge?

Re:Note to Editors

[MacJedi]

Don't be fatuous, Jeffrey.

Re:Note to Editors

[jacksonj04]

Hang on, where did he say that the user was forced to run the application? Most IRC clients have quite comprehensive security options about how to react to DCC sends, commands from the server etc so simply setting an eggdrop to tell people to run a file isn't a problem. By your argument, observe my criminal activity:

Go visit goatse.cx

Re:Note to Editors

[Achromatic1978]

User plays no part in it. They coded an Eggdrop bot which would respond much the way the trojan client on the user's computer would expect, and told the computer to download and execute it. The user had no knowledge nor consent in the situation. This isn't telling someone to run BitchX, DCC a file and execute it, it's a trojan on a user's PC that gets its commands via a surreptitious connection to an IRC server. The OP replaced said bots on IRC server being used to control them, replaced them with his own which also transferred files and remotely and without consent performed actions on an innocent third party's computer, and we're to applaud him because he was doing it for a good cause (not that we know, we only have his word that he "did good").

Re:Note to Editors

[Anonymous Coward]

In medical terms, these zombies would be defined as malignant cancerous cells, and botnets as tumors.

No, in medical terms these zombies would be defined as "Zombies", and botnets as a "Zombie horde".

And to carry the medical analogy further, the treatment is to kill the rogue cells

Having seen many zombie films, I'm pretty sure the "treatment" is to shoot the zombie in the frickin head.

So many Bender jokes. . .

[smooth wombat]

so little time.

Re:So many Bender jokes. . .

[Billosaur]

The other thought that came to mind was "Autobots, attack!", but that's just me...

Funny 404

[gblackwo]

Got a good couple 404 error from slashdot on this page before anyone had commented, I thought the bots had a foothold.

"Botnet on Botnet Action"

[circletimessquare]

that is some strange evolution going on. it seems that some of the porn spam bots have learned how to spam slashdot with story title submissions

I can see it now...

[Mockylock]

In a dark area of Brooklyn, servers have a standoff wearing their bandanas, willing to die for their turf.

"We are better with patches", says GlobalBot international server.

InterSearchBot united server sneers, "PATCHES!?... WE DON' NEED NO STINKING PATCHES!"

Re:I can see it now...

[Anonymous Coward]

begun, the bot war has

So Possibly...

[QBasicer]

...the botnet creaters are trying to make their botnets more secure, and prevent other botnets from taking over the host? I'm not sure whether this is good or bad. The bad news is that it may be harder for them to detect and eliminate, but the good news is that it may keep down multiple infections?

Re:So Possibly...

[garcia]

The bad news is that it may be harder for them to detect and eliminate, but the good news is that it may keep down multiple infections?

Well you can certainly find their clients. They are the ones that are constantly hitting your web server with POST commands with no preceding GET, have strange referrers, or stupid browser identification (AmigaOS or C64, etc).

I really wish that the residential cable ISPs would shutdown these fucking connections faster. My ban list is nearly unmanageable now, if it continues, it will only get worse.

Re:So Possibly...

[plover]

I don't report zombies on Comcast addresses probing my home web server to Comcast because I'm afraid they'll just get all pissy about my running a web server. It's strictly a "personal use" server, and it doesn't see a megabyte of traffic a day, but you never know what's going to tweak the wrong person. I figure it's better to stay below the radar, keep the patches current, keep watching the logs and put up with the probes.

Re:So Possibly...

[garcia]

I don't bother to report mine to Comcast either because they don't do anything about it above and beyond their automated system checks anyway. They get enough abuse@ contacts that they cannot be concerned with some idiot that is running an open proxy.

Fortunately for me, I have a Visi DSL connection and they allow servers to be run without issue. Good thing too as I top 4.5 GB of transfer on average a month for my web server alone.

Re:So Possibly...

[Anonymous Coward]

Er yeah, 'cos no one could possibly be visiting your website from an Amiga?

I agree with the rest of your point though. I recently added just two Class B ranges to my list, both owned by Yahoo! (Formally Inktomi) Various hosts on those ranges accounted for nearly 90% of the spam posts I was seeing.

Re:So Possibly...

[somersault]

I can't afford anything but a C64, you insensetive clod! And my browser doesn't support GET.

Re:So Possibly...

[Darth_brooks]

So instead of dying of the flu, whooping cough, measles, mumps, and rubella, you die of ebola virus. It's not really an improvement. Bots that are harder to hunt down and fix also raise the possibility of greater use of the net as a weapon. Instead of sending spam, the highest bidder on a bot net now uses it to attack financial markets, or DDOS more important communications centers.

It's not the evolution from amino acids to virus that worries me. It's the evolution from "swinging stone axes & clubs" to "advanced mechanized infantry tactics."

Marching down the road of informational warfare

[Anonymous Coward]

This was predicted in the past, but here's one of the roadmaps:

http://www.iwar.org.uk/iwar/resources/treatise-on- iw/iw.htm

Quite a lot of reading, but its not too bad. Seems like all that is happening is that the crooks are catching up with the research faster than the commercial people are.

The fat years are over

[Opportunist]

The time when there was still a market to grow into with botnets is over. The big surge of new, clueless morons filling the net is slowly coming to an end, and even the morons now start using firewalls and AV tools (still no brains, but hey, I'm already happy with small steps).

So the maximum amount of machines to have is pretty much reached. Now the battle for the precious dimwits started. Well, it started some time ago, but we now get a lot of bot malware that actually tries to kick out the competition.

What for, one may ask. Why the overhead? I mean, what's wrong with 2 competing botnetters controlling a computer?

Bandwidth. You can only pump so much spam out of a machine with a given bandwidth. If two try that at the same time, they have to share. And sharing is not really a trait of a botnetter.

So, let the games for the herd begin. If anyone's looking for me, I'm in the lobby getting popcorn.

Re:The fat years are over

[Applekid]

There's a little more than just bandwidth. If your botnet can gain one extra machine, that's an advantage of +1. If your bothnet can gain control of a machine belonging to a competing botnet and kick it off that one into yours, you gain one extra machine and remove one from your opponent for an advantage of +2.

When it comes down to botnets being commissioned for Spam and DDoS attacks, the one with the most machines gets the highest bid, and the difference between that bid and the second best is likely directly related to how many computers make up the difference.

There's a bit of an evolutionary war that's continuing. It's not enough to get your bot client installed. It's facing selection pressure from smarter users, better anti-virus/rootkit detection, firewalls making it harder to propagate, and more aggressive opponent bots.

Sounds very similar to nature's natural selection.

Re:The fat years are over

[Opportunist]

As a botnetter, you didn't even try getting into tightly secured machines (at least, you didn't 'til now). Not worth the hassle. There were enough machines to go around that have little to no security, comprised of an unpatched system, no AV (or with an outdated database), no router/fw in front of it and a braindead zombie not only in but also in front of the machine. The dominant way for infections are still mails with malware attachments. I.e. they need the user's aid to actually infect. You have a really, really hard time getting that past a user with a clue, no matter how much social engineering you put behind it to lure the user into clicking.

Users, in my experience, don't get smarter, though. They can't be bothered to actually learn and "behave", be at least wary when it comes to attachments from unknown sources. Those are the primary targets for botnetters.

So the herd will consist of a roughly stable number from now on. Some thousands give or take don't really matter. I think your analysis of the "biggest net == best offer" theory could be right, though for a "normal" launch of a malware spam flood, you rarely if ever rent a whole botnet. Few direct target attacks for EBay accounts or bank fraud are conducted worldwide, most have to be quite localized 'cause it's pretty hard to coordinate the logistics behind it, unless you want to use more people. And more people means more hands sharing the loot.

Re:The fat years are over

[misleb]

There's a bit of an evolutionary war that's continuing. It's not enough to get your bot client installed. It's facing selection pressure from smarter users, better anti-virus/rootkit detection, firewalls making it harder to propagate, and more aggressive opponent bots.

So if there is an intelligent designer behind the changes in the bots in response to selective pressure, is that evolution or intelligent design?

-matthew

Re:The fat years are over

[plover]

And if you use your bot to retrieve a competing bot, you can reverse engineer your opponent's command and control structure. Why fight for one advantage at a time when you can 0wn his entire botnet? Game, set and match.

Re:The fat years are over

[Anonymous Coward]

Ha! You think the number of new internet users is decreasing? Maybe in the West, but there are 1-2 billion people in the developing world who'll get their first net-connected PC in the next decade. There are plenty of newbies yet to come.

Re:The fat years are over

[Anonymous Coward]

Sounds very similar to nature's natural selection.

Yeah . . . except without the "natural" part. So really it's more like "design".

Re:The fat years are over

[Anonymous Coward]

And if you use your bot to retrieve a competing bot, you can reverse engineer your opponent's command and control structure. Why fight for one advantage at a time when you can 0wn his entire botnet?

Until the bot owners start to digitally sign their commands.

(Or wait, maybe we'll have a use for that quantum computer after all!)

Evolution

[Shambly]

I think this one oneupmanship is very good. Sure bots are bad but if we look at a virus they are now developing a symbiotic relationship with the hosts. How long until they become indispensable to the security unconscious consumer. Sorta like how bacteria evolved into helping the organism it inhabited. Very interesting to see where this will ultimately lead.

Re:Evolution

[Pollardito]

for every bacteria that helps an organism, there are probably 2 or 3 that hurt them but this analogy is particularly weak because these computer viruses are only taking their beneficial steps to a certain point...they're not stopping themselves from ruining your PC. i'm not sure why you'd want a rooted computer that steals your bandwidth, your data, and ultimately your money just because it keeps other viruses from doing the same

Re:Evolution

[vivaoporto]

I can tell you in advance, without charge, where this will lead. Just like a disease vector, these machines will continue to be used by the botnet masters to infect other machines, spread SPAM, steal the very machine owner personal data and, in general, obfuscate illegal activities.

I don't know from where people commenting this article got the idea that having only one "infection" that don't totally destroy the machine is a good thing, even for the machine owner. Actually, it is very worse, because if people don't notice any different behavior they will not worry to fix the machine, even if they know about the infection. And in the end of the day, they will be the first to lose their money in some scam that they inadvertently help to spread.

People don't infect machines nowadays on the evilness of their hearts, only to wreak havoc or for bragging rights, not anymore. Now they do it for profit, it is organized crime that is happening there. Have no illusions about it.

Re:Evolution

[Shambly]

I don't think we have entered in a symbiotic relationship yet but I do believe that if this trend were too continue it would develop into one. Even benign bacteria have side effects (like acne). The point is that as the bots evolve due to pressures in the enviroment the likely most beneficial ones will be the ones that try to minimize the annoyance to the host while maximizing the defense. Its a gradual process... in nature it took a few billion years.

Re:Evolution

[gladish]

Yes, but the likely solution will be similar to one for foot fungus. Your body has good fungus and bad fungus. The drug companies apprently never figured out how to manufacture a drug to kill off the bad foot fungus, but they did stumble upon one that kills it all. The virus companies will likely (in my opinion), come to a similar solution. You'll probably see virus updates that remove the software and undo any good that bots did while inhabiting the system.

Re:Evolution

[vivaoporto]

Yeah, symbiosis. Just not the kind that this word use to imply. Let's see what symbiosis really mean:

Symbiosis: (Gr. syn, with + bios, life) [A] close association between two different types of organisms in a community. It can be defined as (...) [t]he living together in permanent or prolonged close association of members of usually two different species, with beneficial or deleterious consequences for at least one of the parties.

On this case, the class of this symbiosis has a name. Parasitism. And guess who is the receiving end of the deleterious consequence on this relationship?

Oblig

[xBOISEx]

"Begun, this bot war has"

Re:Oblig

[lonechicken]

"Begun, this bot war has" I was refraining from using an "I for one welcome..." comment. This one had me rolling on the floor.

Have we gotten to the point yet where bots outsource the programming of good bots to bot-Delhi, in order to combat evil bots that have run rampant?

Re:Oblig

[gmuslera]

One Botnet to rule them all, One Botnet to find them, One Botnet to bring them all, and in the spam sink us

Obligatory Futurama

[Anonymous Coward]

In a robotic female voice:

"Take this ... and that ... and one of these ..."

A Unique Opportunity

[Billosaur]

All we need is to build a botnet capable of hunting down and destroying other botnets... or perhaps converting them? Kind of the Internet equivalent of an evangelist...

Re:A Unique Opportunity

[BlueTrin]

Or we could just put their signature in an antivirus/antitrojan ?
Which is basically the result of the work of people working in companies using reports, honeypots and their brains.

Re:A Unique Opportunity

[PrescriptionWarning]

or worse... a Televangelist!

Re:A Unique Opportunity

[drinkypoo]

The problem with that is that the people who are using botnets for commercial purposes are way way way the hell ahead in the arms race. They already know what they're doing. And there's no reason to believe that they're stupid; they've accomplished so much...

Re:A Unique Opportunity

[Anonymous Coward]

so we can expect it reelect Bush and start speaking in tongues...

Re:A Unique Opportunity

[LibertarianWackJob]

Bots speaking in tongues? Enter it in a code obfustication contest!

sick jokes you

[Anonymous Coward]

This is laughable for you who grows upsward in a suburb with no real problems or life challenges but i've been a botnets sexual object. it is confusing in childhood to have affection and torment from same thing, your botnet. new laws are needed.

Botnet Gang Fights?

[hcmtnbiker]

*Cues West Side Story finger snapping*

Re:Botnet Gang Fights?

[zippthorne]

Yeah, 'cause nuthin' says "gang bangers" like a choreographed dance-fight to hip music...

Re:Botnet Gang Fights?

[Anonymous Coward]

When yer a bot, yer a bot all the way,
from your first IRC to your last WIN foray;
when yer a bot, you can do what you can,
you can fight other bots; you got root access man!

the bots are well-known; there's always an infection!
(BOP BOW!)
you're never secure; so come see our selection
of bot protection!

N0r+0n & h@mm3r$0ft, "Server-Side Story"

What I want to see is a Botnet that

[gurps_npc]

hunts down pop-up advertiserment programs and either destroys them or tags them (so that pop-up blockers will automatically shut them down).

With all the punk 1eet programers out there, you would think that someone would spend time writing this instead of silly viruses.

I am tired of having pop-up advertisements beat my pop-up blocker.

Re:What I want to see is a Botnet that

[Anonymous Coward]

I am tired of having pop-up advertisements beat my pop-up blocker.

Then why not get a Mac or Ubuntu?

This has been going on for years,

[twitter]

and it has nothing to do with what users do other than use Windoze.

Re:This has been going on for years,

[Opportunist]

Ain't that easy.

Windows is the primary target simply because it has a market share of roughly 90% in the consumer area. You may safely assume that a business server is administrated by someone who has at least half a clue and uses security features, no matter how lenient, so the consumer is the core target group for botnetters.

Since most modern attack schemes rely not on system weaknesses but on user stupidity, this would work in every environment.

What it really has to do with is users clicking on everything and allowing everything their (rarely but still sometimes existing) security tools ask them to allow.

How long until...

[rbanffy]

How long until a botnet become sentient and decides eradicate humanity? ;-)

I keep telling people those Windows machines are dangerous. This puts them on a whole new scale.

Re:How long until...

[toejam316]

How could it possibly eradicate humanity? WINDOWS. God, they'd have to put it into some kind of decent *NIX OS, using a VM, just for the damn thing to be able to run!

Re:How long until...

[Anonymous Coward]

I for one welcome our new botnet overlords....

This is just setting us up for an interesting Matrixesque scenario

Re:How long until...

[Anonymous Coward]

Interesting thought experiment, so sentience arises from competing Botnets.
1.What are the ramifications?

2. If you roll it backward, what if humanity analogous to Botnets?

Could someone explain the closing of ports?

[Anonymous Coward]

From a longtime Windows luser (i.e. lots of use, little technical experience):

Could someone explain why it is important that ports are closed?

From my heuristically driven mind: If a computer is infected, why wouldn't a bot simply check which of the ports are open and pick one of those? And if a computer is not infected, closing ports should not prevent infection from malware or web pages that the user installs.

The only situation I can see would be one where seemingly the 'infector' shoots blindly towards one specific port on a random IP without any user intervention, and manages to infect it. Is this usual?

Re:Could someone explain the closing of ports?

[dkf]

Could someone explain why it is important that ports are closed?

The only way to have a message received off the internet is to have a port open. Most ports on desktop computers are only opened to specific machines while you're uploading or downloading some data (whether web, email, or any of a myriad other things). But on server computers, ports have to be open for connections from client machines which are potentially anywhere. If the software behind those ports isn't careful, it's possible to attack the machine through them.

Desktop systems are usually not as highly protected on the inside as server systems (alas) so having a firewall that blocks off server ports "Just In Case" is a good plan.

(And yes, I've left out lots of detail from this potted explanation.)

Re:Could someone explain the closing of ports?

[Tofystedeth]

The botnets usually have to communicate to some central location and doing so involves using a specific port. Shut down that port and it can't get instructions/download the rest of the things it needs etc. There's probably other reasons, as well as more correct ways to say what I think is going. I'm not a security guy.

And thus began the Computer Wars.

[ploafmaster general]

As the the human casualties mounted, a horrific peripheral effect of Computer combat, we couldn't help wondering what the world could have been.

Title should have been

[wiredog]

"Hawt Botnet on Botnet Action". With links to robot porn.

Re:Title should have been

[number1scatterbrain]

Commander Taco will watch bot-on-bot porn and come up with a headline that reads...(your answer here)?

Re:Title should have been

[frogstar_robot]

"Hawt Botnet on Botnet Action". With links to robot porn.

And booze! And hookers!

Re:Title should have been

[mstahl]

Done ;)

The new protection racket...

[kabocox]

Forget anti-virus or malware vendors. We'll just admit that we live in the wild west/various mob ruled internet. How long do you think that it'll take them to figure out that they might be able to shack down the owners of those PCs for say a $30 a year "protection" fee from other anti-virus/anti-malware/ general evil spreading software products?

Re:The new protection racket...

[Anonymous Coward]

How long do you think that it'll take them to figure out that they might be able to shack down the owners of those PCs for say a $30 a year "protection" fee from other anti-virus/anti-malware/ general evil spreading software products?

With certain AV programs and their pop-ups for free use, and constant chatter from the management app, I think people already *have* started charging $30 a year...

Curious...

[Bobfrankly1]

The latest innovation finds Bots capturing and securing host computers from other bots. Security includes installing software patches, shutting down ports, etc." I wonder how long it will be before we have bots that secure themselves out of the computers.
-
Cheesy Quotes! 5 Bucks, get your Cheesy Quotes!

botnets evolve themselves out of business?

[Maximum Prophet]

If botnet A installs patches 1,2 & 3, and botnet B simultaneously installs patches 4, 5, & 6, could the target machines be completely immunized after the next reboot?

Re:botnets evolve themselves out of business?

[Yetihehe]

Yes, but they still have those two botnet's so they are not secure.

Re:botnets evolve themselves out of business?

[BigDukeSix]

Not in Windows cause you would have to reboot after each one

Re:botnets evolve themselves out of business?

[Spy der Mann]

could the target machines be completely immunized after the next reboot?

You're forgetting one thing. SouthKorean machines with devils-own XP (no SP) which CANNOT be secured until they install SP2. I wonder how the botnets will do this, and if they do, I'd like to watch :)

Re:botnets evolve themselves out of business?

[LibertarianWackJob]

Not to worry. It's windows. It will be re-booting soon.

What's another word for pirate treasure?

[spun]

All I could think of when reading this headline was Buck Rogers in the 25th Century. Specifically the second season, when they introduced Twiki's robot girlfriend. You know, the one who said "bootybootybooty," instead of "bidibidibidi."

Re:What's another word for pirate treasure?

[lonechicken]

All I could think of when reading this headline was Buck Rogers in the 25th Century. Specifically the second season, when they introduced Twiki's robot girlfriend. You know, the one who said "bootybootybooty," instead of "bidibidibidi." Wasn't there a scene at the end of that one where Twiki and Booty were dancing (the robot dance of course), and the camera switched to Hawk who gave them an uncomfortable smile? Then Buck and Wilma go in the back to hook up? Maybe in my mind, that's how I wanted that episode to end.

"Second Variety"

[elrous0]

Reminds me of Phillip K. Dick's "Second Variety," where the robots evolved first into killing their human masters, then into killing one another.

Re:"Second Variety"

[orielbean]

But it's a cute, starving child all along out in the wasteland! Who wouldn't want to save it?! What a great story.

Re:"Second Variety"

[Anonymous Coward]

I thought the cute child was Variety 3, and variety two was the (spoiler). (The reason the story was called second variety was because the Russian troops had encountered one & three, but never two, and became extremely paranoid about anyone outside their unit.)

Bow

[Das Auge]

Bow chicka bow wow...

Meme Wars

[Anonymous Coward]

This sort of reminds me of John Barnes "Meme Wars" books. Except that the botnets are fighting over our computers instead of our minds. I'm wondering if it will get to the point where people will actively choose to infect their computer with one particular botnet or another if they find that that particular one interferes the least with their particular usage. At least you would know what your computer is infected with and that will keep the other garbage out.

Re: Forced Evolution out of business!

[TaoPhoenix]

Would one of you /. geniuses please discover a manual config of this idea so that we can breed an army of WinMules that can't reproduce any more bots?

The irony would be delicious.

Ah, the possibilities...

[l0b0]

Botnets who like guns

Botnet mud wrestling

Botnet suicides

Botnet - Revolutions

How I learned to stop worrying and love the botnet

Unfortunately, this is not true

[Mostly a lurker]

The use of AV, anti spyware and personal firewall products is increasingly ineffective in preventing infection. If these products are fully up to date, the good ones will currently stop about 80% of the malware thrown at them, and the situation is becoming worse. The trend towards broadband routers with embedded NAT firewalls helps, but infections through email attachments and visiting malicious websites is not going to decrease: it is going to continue to increase. As the botnets become oriented primarily towards identity theft, industrial espionage and other kinds of high profit operations, you are also going to see these nets become more stealthy and harder to detect. By next year, they are going to be prevalent in corporate networks and often present for long periods without detection.

With profits already dwarfing that of the global drug business, there is every incentive for these tech savvy mafias to continue their heavy investment in improving their infrastructure. Most people in IT do not even yet realise the scope of the threat we are facing.

Re:Unfortunately, this is not true

[krbvroc1]

With profits already dwarfing that of the global drug business Care to back that up with some sources? This seems like a huge overstatement to me...

Re:Unfortunately, this is not true

[Opportunist]

What part of it is not true?

Corporate networks are largely unintersting. Few people store their personal information on their corporate machines, simply because it would be against their working contract in most places to use the machine for personal business. At best such networks would be interesting for their bandwidth, but they are usually a lot closer monitored than private machines and nets.

Yes, the stealthyness will increase. It already does. 2 years ago the average malware was an easily detectable process, now it is a thread in a running process and will evolve into a full blown rootkit in no time. I give us about 6 months tops before rootkits become a real problem. The trials are already out and running.

AV tools are improving, too. But there is no replacement for brains and common sense. Unfortunately, a lot of machines are lacking in the user department. And what's worse, they're not upgradable.

Re:Unfortunately, this is not true

[Mostly a lurker]

The initial realization of the scale of the problem came from an FBI study last year. You can start with Malware Trends. However, it is important to note matters are deteriorating faster than anticipated when that article was written last year.

You might also read Bumper crop of malware expected in 2007 which starts with Gartner's prediction that

75% of all enterprises will become infected with undetected, financially motivated malware by the end of 2007.

Unfortunately this is all too real and there are no quick fixes.

Re:Unfortunately, this is not true

[ButcherCH]

If you look at some statistics like these http://www.shadowserver.org/wiki/pmwiki.php?n=Stat s.BotCounts it doesn't look like it's going down.

Reminds me of "open range" disputes in Wild West

[Jacques Chester]

A lot of disputes in the old wild west arose from open ranges, where "anyone" could graze. In practice it led to nasty disputes and illegal attempts to fence off ranges. I reckon it might be amenable to economic approaches.

So they're evolving?

[sam991]

This sounds an awful lot like how Skynet might get started.

market niche is not security

[Gary W. Longsine]

Almost everything you said is partly correct in some limited cases.

Some of the browser exploits don't require a user to allow the wrong thing nor visit an obviously bad web site. "Good" web sites get cracked and used as distribution vectors. Exploit chains are created such that malware can get on the box as an ordinary user, then elevate to super-user status by taking advantage of a local privilege escalation vulnerability. The amount of worm traffic probing around the internet, and the continual new versions of botnets with worm capabilities seem to indicate that remote execution holes have not been abandoned as a propagation vector.

Except in cases where they are seeking data from particular sources (confidential information, plans to fighter jets, government documents, millions of credit card numbers, etc.) botnet masters don't seem to much care about the nature of the systems they infect. They are clearly a mixture of home users, corporations, and government agencies.

Finally, it may be popular wisdom, but it really isn't clear at all that Windows market share causes botnet masters to ignore other platforms. Particularly in the last couple years it has become clear that cost/benefit analysis drives botnet technology. If it were easier to infect and own Mac OS X, there are over 20 million of them around, far more than the number needed to spam the bejeezus out of the entire planet. It's the number of bots needed by a botmaster that's important to their cost/benefit analysis. If they could own 10,000 Mac OS X systems at a lower cost than owning 10,000 Windows systems, they would do it tomorrow.

Re:market niche is not security

[cdrguru]

Yes, but...

The one thing you missed is that perhaps 1% of the available machines will really be vulnerable to attacks, either through user stupidity or unpatched security flaws in some product (OS, Browser or whatnot).

This brings the numbers more in line with market share where there might be 200,000 available Mac OS machines and 4,000,000 Windows machines.

Re:market niche is not security

[Opportunist]

It's not how many systems are out there. It's how many useable systems are out there.

Usable is a system for a botherder when it's infectable. And I can't say that I'd know any system that offers as many easy vectors as Windows. It also comes with a predominant internet browser and mailclient as very handy attack vectors, which are also, in my opinion, the currently most exploitable specimens of their kind.

The browser exploits you mention almost invariably rely on
a) IE and
b) settings that no sane person would have on his machine.

If you can infect a person with such an exploit, you could also infect him with the other standard vectors. That doesn't offer any "new" machines, but only machines that are already open to other vectors and are probably already infected.

The escalation problems have never really been a key vector for infecting Windows, simply because until Vista it was far from necessary, since the majority of machines is running around with a user having administrator privileges anyway. And with Vista, I predict more malware that uses clever social engineering to lure the user into granting their application the necessary privileges rather than using escalation exploits. Simply because it is just as efficient and by far less work.

As proof you can actually take the botnet vs. botnet war. It is appearant thatbotnetters deem it more promising to try to get the cluebricks' machines from each other rather than trying to hunt for the better secured machines.

The next version of GTA...

[harry666t]

GTA: Botnets

sources

[Gary W. Longsine]

A minute or so with Google, or occasional reading in the field of information security would lead you quickly to understand that those claims are, sadly, not overstatements.

Re:sources

[krbvroc1]

A minute or so with Google, or occasional reading in the field of information security would lead you quickly to understand that those claims are, sadly, not overstatements. Well, 10 seconds with google pulls up the United Nations estimate that the world drug trade was $320 BILLION dollars in 2005. (0.9% of the worlds GDP!). And the claim of the OP was that 'botnet' profits 'dwarf' this. Come on...really?

Bring back the old worms

[alohatiger]

Somebody should write worms that infect, propagate, and then kill/wipe the host. Maybe the cleanup/restore required will result in a more secure machine.

Re:Bring back the old worms

[Anonymous Coward]

I totally agree.

open source anti-evil botnet

[Gary W. Longsine]

Hmm... I suppose that if an open source effort were orchestrated and hosted from a non-extradition country, such a botnet fleet could be designed and maintained without running afoul of this law. The idea still has a number of other problems, not least of which is that it's not clear how R&D would be funded. Botnets are evolving rapidly due to the influx of R&D money. The Anti-botnet won't benefit from revenue generated by stolen credit card numbers, data stolen and then sold to corporations and governments, and SPAM.

I imagined it more

[BlackCobra43]

as a West Side Story-style spontaneous but well-choreographed, complex dance-and-song number. I'm pretty sure that's just me, however.

Map?

[andrewd18]

What I'd like to see is a map of IP addresses, perhaps by provider, with the "turf" colored by type of infection. That would be awesome.

Re:Map?

[Anonymous Coward]

You'd probably have a blurry pixelated chaos. Physical distance, network association etc. doesn't matter for botnet infection as every computer can more or less directly contact all others.

Colored mapping only makes sense if you've some x-y-z coordinates that mean something.

Maybe a bar graph or a soccer scoreboard showing who won versus whom - that would be interesting :)

Re:Map?

[Legion303]

And then overlay it onto GTA: San Andreas.

Sweeeeeet.

Low cost + high payoff.

[khasim]

The amount of worm traffic probing around the internet, and the continual new versions of botnets with worm capabilities seem to indicate that remote execution holes have not been abandoned as a propagation vector.

It's low cost and high payoff. A machine can scan 24/7/52. If your box is vulnerable, it WILL be found.

...botnet masters don't seem to much care about the nature of the systems they infect. They are clearly a mixture of home users, corporations, and government agencies.

That's because the attacks are automated. They aren't specifically including or excluding any addresses (email or IP).

Finally, it may be popular wisdom, but it really isn't clear at all that Windows market share causes botnet masters to ignore other platforms.

That's because the people spouting the "popular wisdom" do not understand security. Which is understandable because most people don't understand security.

Windows is exploited the most because Microsoft has, in the past, opted for a less secure security model so that Microsoft OS's and apps could be more "user friendly".

Everything was open, by default, on all systems.

Even today Microsoft is focusing on putting a firewall on the box instead of closing the ports.

Even if Ubuntu and Microsoft and Apple each had 1/3rd of the market, Microsoft would still be exploited more because of those decisions.

Re:Low cost + high payoff.

[SL Baur]

Windows is exploited the most because Microsoft has, in the past, opted for a less secure security model so that Microsoft OS's and apps could be more "user friendly". There isn't much of a security model. It's insecure by design. A mail client should never, ever be allowed to execute code received from the outside. It shouldn't even be an option to turn on. Self-executing zip files are a disaster. Always invoke (preferably by hand) an archive unpacker to deal with archives - why do you think unshar was invented? Fix those two problems (which have been documented for a long, long time) and you would go a long ways towards solving the security problem on Microsoft Windows.

Re:Low cost + high payoff.

[prshaw]

And the last virus batch I received was a zip file, password protected. This required the user to unzip, enter a password, and then execute.

http://www.dshield.org/diary.html?storyid=2612

They already require the user to go through the steps you suggest, and they ARE DOING IT!

It's not just the OS, it is the USERS.

Re:Low cost + high payoff.

[SL Baur]

They already require the user to go through the steps you suggest, and they ARE DOING IT! You can write fool-proof code, but you can't write dang fool-proof code?

I'm impressed though. Really.

Knock knock, Neo...

[Spy der Mann]

the botnet has you.

Obligatory Flamebait Elaboration

[freeweed]

Most ports on desktop computers are only opened to specific machines while you're uploading or downloading some data

Except, of course, on hosts running modern versions of Windows, which is what started the first waves of botnet infection in the first place.

Microsoft has "fixed" this by installing a software firewall to block these ports, but they're still all open. Every Windows-running desktop on the planet (with the exception of the remaining 9x boxes) is essentially running itself as a server.

As to why I bring this up: it's a lot easier to compromise a firewall application than it is to get a TCP/IP stack to accept connections on closed ports (has anyone ever managed to do this, incidentally?).

Re:Obligatory Flamebait Elaboration

[evilneko]

Even Win9x, by default, opens the "wicked" file-sharing ports when you setup networking. The Client for Microsoft Networks, installed by default, opens 137-139. Remove it and File and Print sharing though, and those ports close, and a 9x box will present a completely-closed surface to the outside.

There were worms that would target other worms....

[jthrelfall]

For the folks discussing having 'good' botnets, does anyone remember the Nachi worm? It's purpose was to use the same Windows RPC DCOM vulnerability that Lovesan (an 'evil' worm) used. It would then kill the lovesan processes and download the necessary patches from M$ to prevent further re-infection. It would then search out network segments for other machines to 'fix' Nice in concept, but the amount of network traffic that this created when it was in search mode would overwhelm closet switches in a decent sized LAN environment (minded, Lovesan did as well...). A company I was with had a branch office whose network manager was slow on patches. They got infected with both worms successively. While Nachi wiped out Lovesan (eventually), the office network was still useless until Nachi was cleaned off as well. Relying on autonomous software outside of your control to randomly secure machines is a bad idea.

Bot on Bot action for Good

[ATMosby]

Because it is much easier to extinguish the light around you, than to fight the darkness within you.

DCW

[qengho]

Wow. Distributed Core Wars.

Where's the monitor?

[Anonymous Coward]

Ali Baba?

Article without ads/formatting

[karbin]

at the risk of being a karma whore, here's the article without ads http://www.darkreading.com/document.asp?doc_id=122 116&print=true

Cisco self healing network

[ACMENEWSLLC]

Cisco self-defending network is goaled to just that;

http://www.google.com/url?sa=t&ct=res&cd=1&url=htt p%3A%2F%2Fwww.cisco.com%2Fgo%2Fsdn%2F&ei=7Q0pRtToI Ki2igHx_5mLAw&usg=AFrqEzd4QZQnJHghofcLklFEObpXpaH5 ww&sig2=FUeImc-mn6XBWm6_bGCk3w

In a nut shell, it'd drop the connections of infected hosts.

Long term, if this gets into all routers/switches/AP's, then when someone with a zombie plugs into the network, they will not create as much garbage traffic as they do today.

In full disclosure, I own Cisco stock.

Re:Cisco self healing network

[SatanicPuppy]

In full disclosure, I own Cisco stock.

And here, I was just thinking you were employed by them.

Cisco makes some decent equipment, but it is all exponentially more expensive than their competition, and surrounded by promises that I haven't seen play out in the real world at all like they do in the fluffy commercials.

Additionally, Cisco has a history of occasional boneheaded security lapses, like the backdoor with the hardcoded user name and password, or the lawsuits a few years back against the guy who demonstrated security flaws at the black hat conference.

For my money, I'll just buy some HP Procurves for 1/4 of the cost...I'll be able to buy more, so I can actually have high end managed L2 switching hardware throughout the infrastructure, rather than just at the top, and I'll still have money left over to buy all the anti-virus and network monitoring crap that you still have to have, even if you buy all cisco.

Botnets fight for machines escalates

[fortiguy]

If these bots evolve, whats to stop them from ordering new hardware for themselves? Then they'd set it up and the new machine orders new machines. The morons on the web might be saturated but stealing their money and buying more bot computers likely has a future. I'm picturing that episode of X-files that Gibson helped with - the trailer in the middle of nowhere with a whack of T3s going into it. More likely if they got really intelligent, they'd take over a small carribean island. No wait, thats meatworld speak. They'd go for a wintery climate that never lost power.

Hello... hello...

[Anonymous Coward]

Hello... hello, you're from the year 2003 you say? And this story on today's front page of Slashdot was old news then? Wow.

Like this?

[Torvaun]

Hawt Botnet on Botnet Action!

Think "Morris Worm"

[HiggsBison]

A good deed never seems to go unpunished. Morris tried to make people aware of the lax security on the internet. So maybe he botched the timing constant. They nailed him good for all his best intentions.

Have no faith in Corporate IT

[twitter]

You may safely assume that a business server is administrated by someone who has at least half a clue and uses security features, no matter how lenient, so the consumer is the core target group for botnetters.

Having worked for a fortune 100 company and later done Windoze upgrades for another, I can say that assumption is anything but safe. It had nothing to do with the users and everything to do with OS choice. The admins worked hard but it was all a waste of time regardless of the amount of money they spent. Smaller companies might be expected to fare better due to their freedom, independence and brain power, but they don't. Windows and all closed source "security" is just so much voodoo. If you don't want to take my word for it, you can read about some recent big dumb company exploits here.

Re:Have no faith in Corporate IT

[Anonymous Coward]

Have you seen my monitor?

Re:Have no faith in Corporate IT

[Opportunist]

Did they have a firewall? Did they have an AV tool? Did they monitor their traffic? Did they apply patches?

If so, they are already a billion times more secure than the average computer, hanging unpatched and without any security software directly on the ISPs modem.

I don't claim that companies are "safe". By far not. I've had my share of administration for a large German corporation. But it is a ton more work to push past their defenses, and botherders are usually interested in getting the most "bang" for their "buck".

Re:Have no faith in Corporate IT

[Anonymous Coward]

This is twitter, replying anonymoysly so I don't get modded down and lose karma.

Did they have a firewall? Did they have an AV tool? Did they monitor their traffic? Did they apply patches?

Of course they did, jackass! God, what, you think we just had that shit on the open internet? Haven't you ever heard of a corporate intranet, asshole?! SHUT THE FUCK UP! I'm telling you, the problem was Windows. Or, as I like to call it, WIND0Z$E! It is an insecure operating system. The only way anything can ever be secure is if it is open source. Micro$oft $oftware is not open source, hence, is not secure! QED, BITCH.

If so, they are already a billion times more secure than the average computer,

A billion times? How are you possibly measuring that, dickface? What units are you using? If you're saying for every billion compromised open computers there is at most one compromised computer on a monitored firewalled patched tools, you are just showing your extraordinary ignorance.

I've had my share of administration for a large German corporation.

German? God. I should have known you were a fascist Nazi when you started defending Windoze security. Now you have confirmed my suspicions! Sell your corporate loving shill-dom elsewhere, friggin' German scum skinhead!

1%

[Gary W. Longsine]

I don't know if anybody has done a survey to figure this out for other platforms, but I've seen a couple different sources suggest that as many as 20% of home user systems running Windows are actually infested with malware. I've seen large organizations that has ambient infestation rates as high as 11% to 15%, even running an industry leading antivirus. The pool of potential targets might be larger than you expect. Also, any zero-day (or really any number of days before a patch is available) attacks will have a potential target pool as large as the entire population.

market niche still is not security

[Gary W. Longsine]

The browser exploits you mention almost invariably rely on
a) IE and
b) settings that no sane person would have on his machine.

Given that surveys last year by Earthlink and others indicate that the typical home user Windows system has a 20% chance of being infested at any given time, the insanity rates must be somewhat higher than generally assumed. (I have suspected roughly a 49% to 51% insanity rate among the general population of the United States since about 2004.)

Regarding IE, well, yes, it has historically had more holes than any other browser, but a zero day hole in Safari just won a guy a laptop yesterday. The niche status of a platform isn't security.

And with Vista, I predict more malware that uses clever social engineering to lure the user into granting their application the necessary privileges rather than using escalation exploits. Simply because it is just as efficient and by far less work.

Actually a programmatic approach will generally be close to 100% efficient for the target population vulnerable, whereas social engineering must be very, very clever to fool more than a few percent of the exposed users, and extremely clever to get into the half-to-all range. Of course, if you SPAM enough people with the attempt, social engineering only needs to work on a small percentage to yeild a nice botnet fleet.

Re:market niche still is not security

[Opportunist]

A niche status is actually security, even on a very braindead level. I could write the most insecure OS ever and put it on my machine, connect it to the internet and still there will be not a single trojan for it. There is no market for it. I'm the only one dumb enough to run it.

Malware is a business. It's no longer kids trying to prove how cool they are by writing the better mousetrap. It's a business. The malware I get to dissect shows that clearly. It's starting to get boring. It's always the damn same approach, occasionally filled with anti-AV code, packed with a runtime packer or two, but generally, the programs stay the same. It's no longer a matter of proving that you can do it, it's business. Wrap it up and ship it. Get it out the door. It's not fancy, it's not cool, it's not interesting, it gets the job done. Nobody trying to "prove" anything here, this is business, straight and direct.

And since it's business, the target is whatever market is the biggest. If it was MacOS, they'd write malware for MacOS. It isn't done mostly for Windows 'cause Windows is the most insecure OS. Maybe it even isn't. I don't want to decide that. But the amount of malware for Windows makes up almost 100% of the current ITW malware, simply because of the market share.

Thus a niche platform is secure. Not because it has better security, simply because it's not interesting to malware businesses.

Second, a programmatic approach could be 100% successful if you can remotely access the machines. Everything else would by definition require either physical access or getting the malware somehow onto the system and make the system execute it. Of course, there are machines that connect directly to the net without a firewall or at least router in between. But those machines are also usually the ones owned and used by people who don't know too much about security. So the additional work you'd have to put into infecting those machines is not warranted, you can usually get those people to "help" you infect their systems.

The social engineering doesn't have to be too sophisticated either. You'd be surprised how easy it is to make people click on something. Recently we faced a malware flood of programs called "xxxxxxx.pdf.exe" (with xxxxxxx usually being something like "invoice" or "your order" or "statement" or whatever), sent allegedly from Amazon, Ebay or their bank. We've also had malware spam claiming to be from law enforcements or lawyers. The icon used is of course the one you usually have on pdf documents so people don't get suspicious, and they double click it, believing it to be a pdf document.

The success rate is unbelievable.

Re:There were worms that would target other worms.

[MCraigW]

Nachi wasn't written well. It should have paced itself when searching, so that it wouldn't overwhelm switches, routers, etc. Nachi was written to delete itself upon execution once the system clock reached Jan 1, 2004.

Relying on autonomous software outside of your control to randomly secure machines is a bad idea.

I agree. The goal of a benign "good" worm, however, is to patch systems that are outside of your control and may not otherwise get patched, which may be affecting you or your network.

spam vs. drugs

[Gary W. Longsine]

Most of the other claims in the original post are not really controversial at all. This particular claim may have been overstated, but perhaps not. I haven't seen figures which total up the economic impact of malicious software, but I wouldn't be at all surprised if it was in excess of $100 billion dollars per year, if you total the damages, profits to the bad guys, cost to the good guys, and money spent on security products and consulting which might otherwise be spent on something more productive. Then decide if one should discount the official UN estimates for the drug trade, which may arguably be considered to be overstated by most governments for political reasons. Those two markets might not be as far apart as you intuition tells you. If you then add all the grey-market activity from advertising which drives spam, you might exceed handily the drug trade. Most likely not, but the botnet market is probably larger than most people would guess.

In any case, well funded organized crime groups control both markets. Maybe it's really a single market.