Slashdot Mirror
FBI Releases Results of Operation Bot Roast
coondoggie writes to tell us that the FBI has released the findings of their recent botnet study and have identified over 1 million botnet crime victims. "The FBI is working with industry partners, including the Computer Emergency Response Team Coordination Center at Carnegie Mellon University, to notify the victim owners of the computers. Microsoft and the Botnet Task Force have also helped out the FBI. Through this process the FBI may uncover additional incidents in which botnets have been used to facilitate other criminal activity, the FBI said in a statement.Bots are widely recognized as one of the top scourges of the industry. Gartner predicts that by year-end 75% of enterprises 'will be infected with undetected, financially motivated, targeted malware that evaded traditional perimeter and host defenses.'"
and go straight to the source
http://www.fbi.gov/pressrel/pressrel07/botnet0613
There would be an RFC for getting an email address for an ip address and it wouldn't take an expert to figure out how to contact the right person when you see a machine doing something it shouldn't.
How we know is more important than what we know.
I would have thought that a nice call from the FBI to the CxOs of the main appropriate ISPs and a selection of those users on the fastest connections (ie with the most capacity to be damaging) would have a salutary effect.
And then a follow up with negligence-related charges for those who refused to give a f**k maybe?
Rgds
Damon
http://m.earth.org.uk/
how many computer users dont patch/update their computers or use a very old version? how many of those wouldnt know if they were infected or have an infected computer as it is?
Sigs are too short to say anything truly profound so read the above post instead.
Warn the kids and wake the neighbors. Be suspicious of any e-mail posing as the FBI and wanting a response by clicking an URL, fbi.gov or otherwise.
Anyone else think this will start a new wave of phishing where botnet controllers send e-mail messages out forged as coming from FBI.gov to people telling them their machines are infected with bots (linking to the URL in parent) and that they need to install the program attached to the e-mail that is claimed to remove the offending software but in fact turns your machine into another zombie?
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
Dear Computer Owner,
Your computer has been determined to be infected by a malicious program that gives control to another person. Please double-click on the link to find out how to get your computer disinfected.
FBI
No. Really.
I aim to misbehave.
Every IP address belongs to a block that has been assigned to some ISP.
Simply find the block containing that IP address and then find the ISP controlling that block.
Now, whether the ISP is going to spend any time (time == money) on dealing with the problem is the next issue.
Raise of hands for who read that as Operation Pot Roast?? /raises hand
Is the victim the person whose computer is serving spam, or the person whose computer is receiving spam?
Who is the real victim here?
Since the FBI can identify the machines to the ISP, it should be simple for the ISP and FBI to work together to track traffic to/from those machines.
First off, put them on their own network. Sure, this might clue the Zombie Master that something's happening, but maybe not.
Then, monitor the inbound/outbound traffic. If they're doing things like sending spam, block it. A DDoS attack? Block it.
Then work backwards to find the sites controlling the zombies.
It would probably be a LOT cheaper to do it that way than to try to get a MILLION people to clean their machines AND maintain them in the future.
A botnet is a collection of compromised computers under the remote command and control of a criminal "botherder." Most owners of the compromised computers are unknowing and unwitting victims. They have unintentionally allowed unauthorized access and use of their computers as a vehicle to facilitate other crimes, such as identity theft, denial of service attacks, phishing, click fraud, and the mass distribution of spam and spyware.
Hmm... I didn't realize that the FBI was investigating the RIAA and their anti-P2P tactics!
mmm... yeah... You see, we're putting the cover sheets on all TPS reports now before they go out...
IPs resolve by WHOIS if they have been properly SWIPed.
Wrong, wrong, and wrong. Get your blind hatred out of the way for a second, and you might realize that there are more than just windows boxes hooked up to the tubes.
All the windows boxes dissapear, so the bot-lovers would start targeting linux and OSX.
Don't think that just because there isn't a very active threat against those platforms doesn't mean that one isn't possible.
Living With a Nerd
I have said it before here, and i will say it again. People really need to be held accountable for what damage is caused by their ignorance. If my car comes flying through your bedroom window at 30 miles an hour because I parked it at the top of a hill in neutral, should General Motors be responsible? No.
Likewise, if i leave a completely unprotected winbox up on the internet and it gets rooted, should Microsoft be held responsible (which seems to be what some of you think)?
In both cases harm has been caused by my negligence, and i should be held accountable for both.
NewslilySocial News. No lolcats allowed.
...that OS/2 would be the dominant operating system by, IIRC, 1993 or thereabouts.
I just did some Googling on things like "bad Gartner predictions" and "missed Gartner predictions" or '"Gartner predictions" scorecard' hoping that someone had tried to keep tabs on them, but found to my disappointment virtually no relevant hits. Everyone discusses them in the months after they're released, nobody seems to check back even as recently as a year.
Of course, with predictions like these for 2002... "During 2002, leading-edge businesses will exploit application integration to generate business innovation...." how the heck would anyone ever figure out whether or not it was fulfilled?
I can't believe people pay Gartner for this stuff.
"How to Do Nothing," kids activities, back in print!
Windows was ubiquitous long before botnets became a problem.
Botnets became a problem as full-time internet access by unsophisticated home users became more ubiquitous, and Windows was the primary target because it was the main OS used by the targeted users. If there had been a Mac OS or Linux monoculture instead, people would have been tricked into install malicious software on those platforms instead.
It's amazing people still write headlines and article summaries without mentioning the enabling technology in question.
When the monopoly is finally busted, I guess it will no longer be implicit that "We're talking about Windows, of course."
you had me at #!
Step 1: MS makes a flawed product, even after all patches and security advisories are followed.
Step 2: We (et all) are unable to make the product better, due to closed source.
MS has the only means and thus sole responsibility to improve their product.
Therefore, the user cannot be held liable for MS flaws.
Step 3: Sue the big red M for negligence, damages, and force them to release the source.. (not cracked yet?)
Step 4: Profit. No, really. They will settle.
That they are looking into the problem is a good start. Gmen reading are advised to consult with the Honeynet Project and regard vector vendor "help" with suspicion. It would also be nice to see them call a spade a spade and abandon the false OS neutrality that keeps them for doing so. This is a Windows problem and the relative risks should be published. Otherwise they are lying to us and keeping information we can all use locked away. Most importantly, though, they need to clean their own house.
Friends don't help friends install M$ junk.
Yeah, and botnets were never a problem until the internet became ubiquitous, too.
Let's blame the internet!
And
There isn't any way to shut down all of the zombies. But our government CAN act to shut down the zombies here.
First off, there is NOTHING stopping our FBI from contacting law enforcement agencies in Russia or China. They may not help, but then again, they may help.
Then, you track the traffic back from that machine. And from the next machine. And from the next machine.
Simple. The commands have to come from somewhere. You can monitor all inbound and outbound connections. That will tell you what machines that machine is communicating with. You just keep checking each of those to see whether the trail continues or ends.
A lot. So?
Do we stop arresting criminals just because other criminals will perform the same crimes?
Not really. There's no reason why it would take more than a week. If the zombies are not receiving commands, then they're not sending spam or doing DDoS attacks. In which case, the problem is already solved.
If they are receiving commands, then you've just gotten another link. Maybe more than one link.
In the meantime, the ISP's are limiting the damage caused by those zombies.
The advice given to home users (and this) is clearly Windows specific, even though Windows is not mentioned. They go through the usual laundry list of things which are failing corporate users, firewalls, "patches", anti-virus and so on and so forth. Way down in the glossary is a mention of "Linux" linked to the "webopedia".
As I said before, these are important first steps. The information presented may be useful to novice computer users, but it's incomplete because it does not include some of the most effective options. We can only hope they follow up on this start.
Friends don't help friends install M$ junk.
Not only possible, but some nifty new avenues, too. What a coup to slip a bit of malicious code into the code base of some important open-source project that accepts contributions (which is one of the big wins of open-sourced software). Obfuscating holes is so much easier than trying to get a buffer overrun to do more than crash the program (even if you have the source).
Wrong, wrong, and wrong. Get your blind hatred out of the way for a second, and you might realize that there are more than just windows boxes hooked up to the tubes.
All the windows boxes dissapear, so the bot-lovers would start targeting linux and OSX.
Don't think that just because there isn't a very active threat against those platforms doesn't mean that one isn't possible.
I think you are wrong, well at least in part. Windows is a big bot problem. The main reason is because everyone and their dog runs Windows as administrator. It is much harder to root a Linux/Mac machine because those users don't use their PCs as root/administrators.
If Windows or OS X had 90% of the desktop market, the same users that currently click "Okay" or "Yes" on everything would be entering in their root/admin password for those OSes. It's about social engineering at that point, not necessarily the technical merits of the OS itself.
While I am fond of the users I support, I find it takes a lot of education to get them to stop falling for the most common scams: funny email attachments, phishing, and phone calls asking for their credit card numbers. They're not stupid people. They're just a little clueless and disconnected from a world that, quite frankly, bores and intimidates them.
I would like to suggest that, whatever operating system we put on the desktop for the average person, there be some initiative to educate them in best practices computing, even if only for the 4-10 common tasks (email, websurfing, games, mp3s, pr0n, quicken, word processing) they will use. I volunteer to design and write the curriculum if there's some rational initiative to get it out there to the human herd.
technical writing / development
A. Everyone "knows" that the NSA is doing its utmost to listen to all internet traffic.
B. It would do the NSA no good to listen to everything without filtering out the 99.999% which is irrelevant. Ergo, they must have pattern filters.
C. Botnets must be a big part of the filtered traffic.
D. NSA must be aware of botnets, their patterns, their control channels, their zombie elements.
E. Yet botnets continue.
F. The NSA must want them to continue unmolested.
The NSA knows how botnets work, and could hijack them at any time. The only reason to do so is to keep them in reserve for their own use.
I suggest the NSA would hijack botnets for counterattack if the US nets were attacked by another country.
That's my conspiracy theory, I hope you like it.
Infuriate left and right
Sorry I meant "Linux or OS X" not "Windows or OS X", though if you take it to mean "Regardless of whether Windows or OS X have 90%..." then it kind of works ;)
Harder doesn't mean impossible.
Not to mention it presents a situation where people shift from one OS to another.
The OS they use doesn't matter. PEBKAC still applies, and will ALWAYS apply because people are generally fucking stupid.
Living With a Nerd
Then a few months back I get word from my credit card company that someone had hacked into my account online (using my username and password), changed my billing address to someplace in NJ, then proceeded to try to charge a bunch of stuff on the account (luckily the CC company caught on to them and locked it down). I couldn't figure out how they did it.
Then a few months after that, I started to notice my computer acting strange. My router would be showing HEAVY activity even when I wasn't doing anything and Windows wasn't downloading updates. Eventually, I realized that someone must had botted my computer (still don't know exactly what they were up to, but I'm sure it involved sending out letters from an innocent Nigerian official just wanting people to help him transfer some money). That's how they got my account info for my credit card.
Anyway. I wiped the whole system clean (even tried out Linux for a while, but didn't care for it) and now the problem is gone. But it still makes me nervous as Hell. What drives me crazy is that I can't figure out how they did it. But, as a hacker friend once said: If it's on a network, it can be hacked--period.
SJW: Someone who has run out of real oppression, and has to fake it.
So what tools are available to check for bot activity on your network? From what I've read, it seems to be to monitor port 6667 (IRC) for non-human readable text.
Due to its ubiquity, MS is attacked much more than other systems, but the assumption that other systems are by default more secure is a statement of belief, not fact. How is your system configured? It makes a big difference. MS systems can be configured for many different security environments. The locked down deployments are very secure (their intended usage is Department of Defense deployments, etc). Wide open rich functionality client deployments are more functional, but less secure. The same tradeoffs exist in the Linix and BSD worlds. The current CERT and related vulnerability databases do not show that the *nix world has a clear superority over current comparable Windows products.
Web 2.0 is all but identical to cross-site scripting as a feature. The vulnerabilities here are so pervasive that users have virtually no way of protecting themselves if they want to have the rich web-based functionality. This is not MS specific.
That would be just fine. You see, the main reason Windows is not secure against these worms is because it is not profitable for MS to make Windows that way. Why would they bother? A worm makes your machine unusable. You throw the whole thing in the bin and go look for a new one. Everything in all the stores you look comes bundled with Windows. You buy an Acer with Windows and hope it is better than the last one, because as an average user, you assume the free market is operating and if there were better options, they'd be in the stores. MS's failure has made them money, not lost them money. Why would they want to change that?
When bot lovers start targeting Linux and OS X they'll find slightly harder targets for the most part, but not enough to make a huge difference. The real difference is what happens next. Instead of sitting on their hands Linux and OS X developers start making real improvements and soon that 99% of the low hanging fruit is gone and botnets are back to being a minor annoyance and fighting a constant battle against OS providers instead of being ignored by them. Why you ask? Because since Apple doesn't have a monopoly and Linux is a project that can never wield monopoly influence more or less by design. Both of them will need to offer security to compete with one another.
The insecurity in the desktop OS market is not directly because of Windows, it is because the market is monopolized, thus innovation in that market is no longer motivated by normal, free market economics. It's like a socialist run industry. Basically it sucks and innovation is not motivated by making customers happy in exchange for money, but by figuring out how to gouge them for more yet and take over a different market. End the monopoly and botnets will go away.
Is the FBI allowed to do this? Did they get special dispensation from the RIAA and MPAA to work on a project that appears to be completely unrelated to copyright infringement?
Stop-Prism.org: Opt Out of Surveillance
Gartner predicts that by year-end 75% of enterprises 'will be infected with undetected, financially motivated, targeted malware that evaded traditional perimeter and host defenses.'"
I think they are full of it, I am willing to bet with a linux box jacked into a mirrored port in the core that I can find bots and malware on more like 95% or better of windows based enterprises. There is not a network I have looked
at in the last two years that is not owned, botted etc in some fashion.
Got Code?
As far as you know ... none of my Windows machines are in a botnet ;-)
Competition Good, Monopoly Bad.
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
If bots are the new viruses, why not let the established tools treat them as such? Can't the FBI just turn the entire codebase over to Symantec, McAffee, etc, etc, etc? Seems like this would help a lot of people in the short term...
Or, if this is already being done and the users aren't using any kind of AV software, I would think they have chosen this route, have they not?
Would the study then be saying that 75% of companies aren't using up-to-date virus software? Or even 95% as a poster above suggests? I'd think the reverse is more likely, that AV is being run, but isn't effective at detecting the botware.
If enough different authorities get forged, maybe the gullible will believe them less often...
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Finding out that my PC has been Zombified, Or the FBi informing me they found my PC zombified.
OSGGFG - Open Source Gamers Guide to Free Games
Of course, busting the operators also means there'll be some thousands of zombies out there who are waiting for Master to tell them what to do next, and some of them may get exploited by other people. But it's still a good start.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Unix and Linux machines may not be as plentiful, they are how ever high net worth targets, granted CS students run Linux on a home made boxin their bedroom, however large institutions run Unix and Linux on their servers and store data of real value on them, the reason windows boxes are targeted is that they are the low hanging fruit, relatively easy pickings
"Linux is for noobs"-The new MS fud strategy
Irritating Windoze defender, Macthorpe, pretends there's a GNU/Linux botnet problem:
Have you ever heard of Q8bot or kaiten? Probably not, but they're Unix/Linux flavoured bots. So much for your 'all botnets are Windoze' FUD.
Well, no, I had not heard of such things. Ever helpful Macthorpe even offered a link to tell me why I don't hear about such things. They are listed under this heading:
In the description, they note they have yet to find the mechanism of spread. A reasonable person will conclude that Botnets are a Windoze created problem and not something to worry about. After all, study after study shows the average time it takes to break a Windoze box is on the order of minutes, but a GNU/Linux box will last for months out of the box. A paranoid person will wonder if M$ has not honeynetted honeynet themselves with bogus infected GNU/Linux machines.
Friends don't help friends install M$ junk.
You seem to know a lot about my setup. Perhaps you'd like my IP address to see what you'll find between my boxes and the interwebs? You might be surprised. And as long as we're all having fun proving negatives and questioning each other's network and security expertise, how about you show me proof that your Linux boxes are not rooted?
We've been through this before. No one is contesting that the vast majority of machines in botnets run Windows (oh, "Windoze", HAHAHA!). But the implication that all botnets are completely made up of nothing but Windows machines is a lie that is easily debunked. In fact it has, but you conveniently choose to ignore that.
Wow, we're in full-fledged FUD mode now!
If free software is populated by pathological liars, psychotic haters and FUDsters like you, I'd rather they just stay with "M$ Windoze". Freedom at the expense of sanity is no freedom at all.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Once you are a member of a botnet, you have been compromised and could be sharing your music files and never even know it..
.. Millions.
Hear that RIAA? Millions of people
---- Booth was a patriot ----
Does Microsoft pay you to discredit free software and open source?
It's right here.
That's a good start. If you're going to insist on using Windows, wiping and reinstalling on a regular basis is a must. I recommend at least annually. More often if you use Yahoo search, flash games or shareware. If you use AOL or MSN and chat or IRC, you may as well boot from the Windows install CD each day.
Getting it set up the way you like it, and creating an "image" file of that setup with Symantec Ghost or something like it makes the process a lot less painful.
Or you could try actually solving the problem, but I note from your post you don't care for that answer for some non-specified reason.
If you do ecommerce from a platform you know to be insecure, don't expect everyone here to lobby for legal solutions to your technical problem.
Help stamp out iliturcy.
But they don't run RPC services listening to the world running with administrator privileges on OSX/Linux, unless you configure it that way. The problem is that with Windows, the hurdles are exceptionally low. With Linux/OSX, they're higher. Not insurmountable, but more than trivially annoying, which will severely limit the impact and expansion of a botnet. And if you don't have enough bots, you don't have much of a net, so the whole thing just falls apart.
I understand that Linux and OSX don't offer perfect security. But it's still a hell of a lot harder to get around it than it is on Windows.
My blog. Good stuff (when I remember to update it). Read it.
Despite the proliferation of computers these days, you still need some specialized knowledge to make them run properly. There isn't a sure fire, bullet proof by default OS out there, although OSX comes pretty damn close. I can pretty much guarantee that if OSX had 90% market share, there would be more exploits for it. People would be breaking iChat wide open, and looking for vulnerabilities in Safari. Before the flames start, I'm not saying that obscurity is the only security that OSX. It has a well designed security model. But no security model is bullet proof. There will always be some coder out there who thinks outside of the box and ponders, "I wonder what will happen if I ask the computer to execute this.."
D. NSA must be aware of botnets, their patterns, their control channels, their zombie elements.
E. Yet botnets continue.
The NSA has neither the jurisdiction nor capability to stop domestic botnets. And they're not going to be helping the overseas folks fer nuthin'.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
what would the FBI recommend to disinfect the machines? AdAware? Windows Defender? Norton?
You can't disinfect a Windows machine with any reliability. Zero the drive, re-install, update offline, and reinstall all your apps and data. Repeat as necessary.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
...and the basic version is FREE (as in beer) too. It's pretty damned good at stopping malwares from sending network packets from your Winblows PC to the outside world.
You're blaming the wrong party here. Those who install malicious code on the computers of unsuspecting users are the problem. Of course microsoft should do everything they can to prevent such abuses, but the ultimate blame is on the abuser. - Noga Rosenthal
I have discovered a fantastic, accurate way to predict future trends in information technology. The basic principle is to find a Gartner quote on the subject matter in question and then take the opposite viewpoint. You will find that you are correct on average 98.724% of the time, which in such a fast-moving industry is a pretty good score.
On the flip side, you have to (grudgingly) admire them for making a successful enterprise funded exclusively by PHBs.
Burns: We're building a casino!
McAllister: Arrr. Give me 5 minutes.
Having scanned through the entries in this topic, I see it has moved on from the tired old "bash Microsoft" and "extol Linux" rot. Then there are a few suggestions about how to track botnets and shut them down. The FBI 1 million infections number has been quoted as a US-centric benchmark.
A few months back a botnet herder in Europe went down for running ONE 1.5 million seated botnet. The global botnet infection numbers are therefore in the tens to hundreds of millions of infected machines. Forget about what platform they run on. Obviously the numerical majority of infections will always be on the OS that has the most prevalence. And it will never be the same percentage for higher use as lower use OS. That's because higher use attracts a much higher level of interest by the infection writers. So let's climb down off the hackneyed hobby-horses.
Now to come to the point - shutting down botnets.
Does anyone imagine for one moment that none of the millions of infected machines are sitting under the watchful eyes of law enforcement, botnet tracking operations, and university labs? Who do you think first knows (after the perpetrator) when a spam-bot turns into a DDOS bot? Who thinks that nobody is watching and tracking the CC&C IRC commands coming down to the watched bots?
Catch up with reality. The FBI is working on very specific intelligence from some very intelligent researchers.
Slashdot | FBI Releases Results of Operation Bot Roast - Microsoft Internet Explorer
Good analysis.
I can see the M$/FBI exchange now.
/looks angrily at FBI,
FBI - wait what's this,
Microsoft - Just ignore that one,
FBI - but it keeps sending information about the users computer without the users permission,
Microsoft - It's nothing just ignore it,
FBI - wait, it seems to have a name, w.. g.. a..
Microsoft -
FBI - OK, OK ignoring it, moving on.
Calling someone a "hater" only means you can not rationally rebut their argument.
Durn Winder's boxes, sucking up the tubes. I say write a really nasty doomsday type virus that wipes out their internet connectivity. Get it propagated using the bot-net's own systems and any other venue that seems convenient and take em all down so that the virus writers can aim at Unix/Linux/BSD for a while and get us toughened up too. I'm tired of Windows getting all the exercise and leaving Nix fat and lazy.
</humor>B) Eliminate all the stupid users. This is frowned upon by society.
I worked on a machine the other day that had trojan.banker on it. Nasty little bugger. Interesting thing is they had a working Norton Anti-virus using IE7 and were up to date on patches from the almighty MS. I ran 2 different rootkit programs on it but the thing still kept cropping up (it became a mission to find out what/where/how). Finaly I booted from Helix Boot CD http://www.e-fense.com/helix/ and running ClamAV discovered the Windows pagefile.sys was infected. Each time the machine rebooted anything cleaned in a non-boot sweep (ususal practice is to remove the drive and AV/Anti-Spy from a clean machine) would be reinfected, 24 AT jobs would be created to hourly check to see if it was installed, it would see if it was connected and get the software. Average people cannot deal with this; they had no clue other than the computer was slow and thought they might need a new one.... ahem.
A computer once beat me at chess, but it was no match for me at kick boxing. Emo Philips
In all fairness, it would be harder to create a nationwide botnet if there really was a Linux monoculture. I don't believe Linux makes you invincible -- beyond the inevitable buffer overflows, etc., in programs, there's the social engineering angle, which is really the main attack vector in Windows too. There's just no patch for human stupidity.
The thing about Unix-like OSes isn't that they protect you from malicious programs so much as that they limit the damage that can be done by them without user input (though if your account has cron privileges or other means of auto-running programs and you get taken over you personally are screwed anyway). Barring a privilege-escalation exploit, the worst most things can do is turn your personal account into a radioactive wasteland, or possibly a black hole.
I see the botnet problem as one more of ignorance and social engineering than of poor programming. The latter affects what happens when a computer is compromised, but the former is what causes most infections in the first place.
~Eien no Inori wo Sasagete~ Searching for my Hatsumi...
If all the internet was disconnected , the problems would disappear.
The bot-lovers may start targeting Mac and Linux but they may not be successful, I've seen many many reports explaining, in great technical, verifiable detail explaining why linux is in general safer in every way and harder to infect. And while I don't use a Mac I'm sure it has a lot more in common with Linux than with Windows
Is it me, or is it strange, that both this article, and the BBC version fail to mention what operating system these botnets are running on. I have my suspicions they all run on OS from the same company :-)
Many users are commenting that there are botnets that require user intervention to actually infect the machine. For example, the user will be sent a password-protected zip file with instructions to enter the password.
If *nix were the dominant OS, you'd see botnet emails that say things like, "Enter your root password". Granted, there would be less drive-by-downloads; but *nix isn't going to magically protect people from social engineering.
No, I will not work for your startup