Slashdot Mirror
Anti-Scammers Become Storm Botnet Victims
capnkr writes "It looks like the efforts of the anti-scammers at sites like 419eater, Scamwarners, Artists Against 419, and possibly others have become the target of the Storm botnet.
Spamnation has a post about it, and as of this writing none of the above listed sites are responding. Spamnation reports that CastleCops and other anti-spam forums are being DDoSed as well. Sounds like a massive, concerted effort against the folks who are fighting the good fight.
Although I hate it for the owners and admins of the above sites, I think it shows without a doubt that their efforts to 'get back' at the scammers are working."
Posting the info and having people slashdot the mentioned sites is not going to help them either :)
Such that no one wants to say any...
Sigs are dangerous coy things
I screwed with a craigslist scammer this week. It was sorta fun.
m l
:)
http://digitalsushi.com/goraku/fakecheck/story.ht
Getting him to mail a check made out to "Pownd Uholot" was entertaining.
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
Aside from the legalities, perhaps Grey Hats round the world need to start developing "neuter-viri" (self replicating auto-patchers). These zombified machines have got to be defanged somehow, and fast.
Life is not for the lazy.
Good to know that these sites have been effective; I had always been skeptical of them having any measurable effect. What's the next salvo?
The counter solution to this is for a big company like Google, Yahoo, Microsoft (yes, Microsoft) should offer either their servers, hosting, bandwidth etc. To these sites that are quite evidently being successful against the scammers. Or at the least they could give the sites some cash injections to buy more capable servers, fatter lines etc.
Week 5: Mommy, now i've just started to develop a brain and only now does conciousness have a probability greater than zero of occurring. Mommy, how the fuck was i having that internal monologue during the first few days of my life? Oh wait i wasn't as i was just non-sentient sack of chemicals.
Hopefully these guys don't get assassinated.
flooding the PC market with ms-windows PCs that never get updated or virus checked to clueless consumers...
as long as msft & oem pc manufacturers are more interested is making a quick buck and the problems that go along with it are ignored this sort of thing is never going to stop...
-if you mod this comment down it just buries your head deeper in the sand-
Politics is Treachery, Religion is Brainwashing
The submitter has helpfully provided the links to these sites so Slashdotters can finish the job.
Is there a scanner and fix available? It does require executing an email attachment, right?
It really shouldn't be called a worm unless it can worm its way in without social engineering...
Galileo: "The Earth revolves around the Sun!"
Score: -1 100% Flamebait
if only someone had taken the time to teach Skynet love.
I can hear that doctor again.
Really. What with? No hearing system at that stage. Barely present nervous system and certainly nothing large enough to call a brain at the other end capable of interpreting the signals.
Learn some basic science, creationism-boy.
Because we all know we're all to lazy to look for the links ourselves.
Hmm. I'm not actually sure if that's true, sarcastic, funny, or what...
The Mothership
Doesn't that seem like a poor allocation of resources on behalf of the bot net controllers? I mean, how long could a DDOS attack possibly be carried on? A few hours? Maybe a day at most? I can see that, for a retailer, that sort of thing would seriously impact business but if these sites go down for a day, does that really matter?
In addition, implementing a DDOS probably entails some sort of risk. This could be either in terms of having individual machines identified and temporarily disabled or in terms of the risk of getting caught increasing with every illegal act that is committed (although, the risk is probably very small, it's still there).
I recall reading a quite interesting article on this topic a while ago while doing research for a university seminar I had to hold.
The big crux is that the "worm" needs to show negative behaviour, i.e. exploit it's host bandwith and CPU cycles, at least for a while, to gain sufficient impact to "infect & patch" vulnerable machines. It would turn into a battle of the worms, where "grey" worms attempt to infect as many machines as possible, plug the security holes, seek new machines to "infect and patch" and then, after a while, self-delete themselves - while the "black" worms, attempt almost the same, only that they do not self-delete but instead continue to exploit their host. Most machines that become victims of rootkits or worms are actually patched up once infected, to avoid losing the machine to competing malware.
+++ MELON MELON MELON +++ Out of Cheese Error +++ redo from start +++
my password really is 'stinkypants'
I told my oldest son about this botnet yesterday, mentioning that with between 2 million and 20 million CPU's working at any one time, and even that larger figure likely representing only a fraction of the botnet's total capacity, it collectively represented the most powerful supercomputer ever built... and it was effectively under the control of a small group of people with criminal intent - the author, or authors, of the worm. My son responded to me with a great deal of scepticism, first saying that none of these security experts which have made this analysis have any way to estimate what sort of computing power military organizations might have, so saying that it represented the most powerful supercomputer ever was actually a completely meaningless claim, and also, he proclaimed that the story was most probably just hype and over exaggerated. He said that the claim of the most powerful supercomputer ever being controlled by criminals was simply too much to be believable, like the headlines one might see on the front page of the Weekly World News tabloid. He also said that it was ludicrous to see how sending people "penis extension ads" (which is about all he figures a botnet can do) can actually seriously harm anything or anyone.
So this got me to wondering... how much of this actually _is_ something that is of any real concern, and if it really is, how could it be explained to people in such a way that it's not going to sound like some claim from a conspiracy theorist?
File under 'M' for 'Manic ranting'
Although I hate it for the owners and admins of the above sites, I think it shows without a doubt that their efforts to 'get back' at the scammers are working.
By that logic, does all the hate mail Fred Phelps get mean that he's on the right track?
Does it mean that all those protesting Bush's speeches validate his argument?
Odd way for the author to phrase it. I don't think there's a cause and effect here. They might be publicly opposed to the spamming and phishing scams, but they fact that they're getting attacked doesn't necessarily mean they're making more than a dent in it.
Assuming you run a DDOS attack with 100'000 clients and 100kbit/s upstream per client you end up with ~9700mbit/s. _Most_ sites don't have so much bandwidth and if they do, it costs a lot of cash. The botnet is most likely even bigger and can assign more clients to the attack. So NO, getting a bigger pipe is not gonna work for them... One way to solve this problem is making the ISP disconnect the infected clients or block them at the edge of the originating network.
Actually, the entire virus / worm / trojan definition is pretty muddled.
AFAIK, Worm meant it propagated by the Internet. Trojan horse was something that was an undesirable feature in a software package and did not propagate on it's own. Virus attacked itself to different software packages by itself, unlike a trojan horse, and it relied on piracy to spread. And since the sneaker net was way more prevelent than the Internet, making the virus the most common in early computing, virus came to refer to all 3.
Self-emailing malware share more features with worms than trojans, so they're more often classified as worms, although there is a move to reclassify them as trojans.
All anti-virus programs detect and fix it, and there are also stand alone fixes avalible. Clicky The problem is all the unpatched boxes.
~~~
Click here, you know you wanna!
TheScamBaiter.com has been under attack for several days too, but has stayed up so far.
Maybe BlueSecurity will resurrect Bluefrog now that its been shown that the spammers will go after you regardless. It is good to know the anti-spam crowd is having an effect though, once the botnet is patched into obscurity, we can get back to normality.
Right a piece of code that detects if the storm bot virii are present, then have it format the hard drive. If their computer is putting other computers with real work to do in danger they should be deleted until the administrator learns to use it. Seems harsh but trying to fix a computer thats already infected is almost impossible to do, as they keep changing the virii, so carpet bomb it.
Didn't some internet provider at one time threaten or attempt to disconnect customers whose computer were suspected to have spyware or a virus infection? I think more internet provider (errr.. high speed internet providers) should take charge and disconnect computers that are (or might be) part of a large botnet. This brings me to the point that like most people don't have a clue how a car functions under the hood, most people also don't know how a computer functions inside its case. So ignorance should not be an excuse for having a computer that's infected with every virus or malware under the sun which is connected to the internet. If a person had a car that kept causing problems on the road than it would eventually find itself towed away or shoved off the road (much like a computer might be forcefully disconnected from it's internet provider).
Much like the local police or the local transportation dept. might maintain roads and highways, so should the super information highway be maintained by internet providers and various security experts. Ignorance cannot be an excuse! It certainly doesn't work when you're being arrested for vehicular manslaughter. "But officer, I didn't see that old lady crossing the road..."
* A worm infects without user intervention (e.g. SQL Slammer, which *was* a worm).
* A trojan is a hidden "feature" of some otherwise legitimate software.
* A virus is a program that attaches itself to other files.
* A backdoor gives someone remote control of the machine.
* A botnet is an advanced backdoor where one can control many machines at once, e.g. from an IRC channel. PCs infected by completely different malware can all join the same person's botnet. Conversely, PCs infected by customized versions of the same malware can join different botnets.
The problem is that the media doesn't understand ANY of this and that the categories aren't all mutually exclusive. This is a trojan & backdoor that spreads via dumb users executing attachments they shouldn't.
>>>> REPOST THIS IF U HATE ABORTION
I do, usually. But in your case the post-natal variety seems fitting.
I mean, don't they have better things to do with these resources? Seems like the choice of targets tells us a lot about the opportunities - or perhaps lack of opportunities - that this resource (i.e., the Storm botnet) can be put to.
I mean, why not use it to make money? Attacking these sites ain't gonna directly generate any revenue. And one must consider such a resource as having a time value; what is the half life of a bot net anyhow? Is this one, given it's size, likely to be significantly different?
Sure, these scams are easier to pull off it people are uninformed. But how many of the people who are likely to get involved in such scams, upon receipt of these emails, will google first?
A message from our sponsor
Some of the site's are using DNS records to point back to 127.0.0.1 and lowering their TTL so the botnet machines attack themselves. Easy way to defend (in some way) a DDoS. Don't count on the site(s) being up until the owners are sure more bandwidth / CPU cycles won't be wasted.
It might be a test or demonstration of the botnet. Like any weapon it needs to be test fired before actual use. The persons controlling this might be trying to kill two birds with one stone - test the botnet, and knock those who taunt you off the air.
We all know what to do, but we don't know how to get re-elected once we have done it
Is the size of the the Storm network large enough to hold a really big player hostage? Could they eg DDoS Microsoft's update portal? Or Google's homepage? either for ransom or without?
Could they cripple other internet backbone infrastructure stuff, and thereby hold the nation's entire computer infrastructure hostage?
As TFA mentions, a DDoS attack is more expensive for the customer of the botnetters, as is easier to detect and stop at the ISP level, so I wonder if those attacks are really feasible, or if it'd just mean that everyone that's infected loses internet access until they get cleaned up. Which might not be such a bad thing.
But, in short, is the Storm Botnet an actual national security threat? Could a foreign power commission it to do the US computing infrastructure grievous harm; but could it be stopped if the DHS etc took protective action at the ISP level?
--
$tar -xvf
Sorry guys, we know your suffering a DDoS attack right now, but we just thought we'd publish links to your sites on Slashdot to compound the issue. Think of it as an experiment to see what effect a massive storm of legitimate traffic will have on an ongoing DDoS attack.
;^)
What? Your data center is a molten slag?! Eureka! We'll stop by with marshmallows and weenies.
This is one case where publishing the hyperlinks might have been a bad idea. I wonder how many people are hitting their refresh buttons right now.
--
Toro
The defang you are looking for has been provided by the free software community. Unlike the worms themselves, user and vendor action are required for this to work and it's completely legal. Vendor support is growing every day because everyone now realizes the root cause is a costly software monoculture. IBM, HP and Dell now all sell gnu/linux to desktop users. With a little bit of advertising the problem will go away soon.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
"I think it shows without a doubt that their efforts to 'get back' at the scammers are working."
I'd like to agree with you, but it makes about as much sense as saying that increased violence in Iraq is proof that the US has terrorists on the run.
The scam-baiters may be doing a lot of good, but DDoS attacks against them aren't proof of it.
-Rich
is there a way to test or check that people who might be part of the bot net how to see if they have it?
rather than gong on about what it is doing, how about we spread the word on how to stop it one computer at a time.
This article is a good place to start.
You could also introduce him to the theory behind Bittorrent, which is a good demonstration of how many computers each doing a small task, given modest bandwidth, can add up to massive distribution and publication power in short order.
Now, what if some distributed network decided to siphon a gig of illegal or embarrassing materials onto a compromised target machine. Perhaps a politician that is voting the wrong way?
Then ask him, not if the entire banking industry is safe, but if an individual's information (SHA hash collision or private key, but that's not "average Joe" speak) could be subject to a distributed brute force attack.
With the growing power of computers making tiny pieces of malware harder and harder to notice (that 1% of processor time is more and more powerful), and malware being able to literally hide files from the user until such time that it chooses to reveal them, it seems like it's only a matter of time before someone with a large enough botnet, and enough imagination, could start attacking individuals and/or siphoning off their money. How you do this is not something I care to discuss, but the black hats (both the actual criminals and the security experts, as an exercise) already have ideas and are working on it. That's why you'll see them periodically calling for stronger encryption (more bits in the keys). If there was no possible threat, they wouldn't be creating and suggesting longer keys. Rootkits would not be a concern, if files hidden from the user were always benign (most are).
But all it takes is the wrong person to have the right idea, a breakthrough that changes the assumptions, especially in cryptography. Show him the movie "Sneakers" if you want to fuel some imagination regarding that. It's crap, but it's also fun and sizes the problem for the average Joe. Assuming that only ethical people work in cryptography is somewhat naive. Assuming that unethical people are not watching the progress of ethical individuals in the field is stupid.
There's nothing to say such solutions and attacks haven't occurred already, but it seems, as your son suggests, unlikely. You can bet if a criminal has figured it out, a little bit of money siphoned off here and there would be almost impossible to detect, especially in an environment where people are unwilling to believe it's even possible. Believe me, if the idea has hit Hollywood, it's old hat. That's exactly how such a criminal would proceed if they had found a way to leverage such distributed computing applications. They would target a distributed network of accounts, one by one, in a way that looked like banking errors (which are numerous and automatically corrected by the bank) and slowly siphon money from the banking industry itself, through compromised individual accounts. No individual would suffer, because of correction processes in the banks, the world's capital reserves would.
Then ask what that money could buy in terms of influence, weapons, elections?
Any compromised machine is a liability to its user. Botnets are a menace to society, and we're lucky all they're (hopefully) being used for is "penis enlargement" ads and DDoS attacks. That's barely scraping the surface of their potential.
If he wants to go on believing that his safety and security are a given, without any effort on his own part, there's little you can do, but anyone with any imagination, who is not in flat out denial, can demonstrate that distributed computing applications have a great deal of power, and that basic security is everyone's concern. It is definitely not good that these ne
Would it not be somewhat of an improvement then if services like these would also be massively distributed? Instead of a massive scammer network having a 'force to counter' in the form of a massive anti-scammer network. Surely a p2p/torrent like thing could make this possible?
If Fred Phelps's goal is to piss people off, he's on the right track. If Bush's goal is to anger people, he's doing a heckuva job. The anti-spammers in question have clearly pissed someone off, and it appears to be the same someone who sends a lot of spam. That the anti-spammers have done enough to be noticed seems like the most likely explanation, but of course, there might be others; I just can't think of any.
Laws do not persuade just because they threaten. --Seneca
Step 1: Monitor traffic, locate physical location of botnet controller
Assuming botnet controller is not in country with working legal system:
Step 2: Apply rubber hose cryptanalysis to botnet controller to obtain control of botnet
Step 3: Force all machines on botnet to take themselves down permanently
Step 4: Dispose of botnet controller in appropriate pirhana tank.
Because they'll send a botnet at you?
We've got a professor at the university where I work that consults for DHS, one of our student workers is in his class. The misinformation this guy hands out is... legendary. For example, did you know that twisted pair only has a bandwidth of 250kHz and a maximum speed of 4Mbps? Really, it must be true, Dr. DHS said so! Never you mind things like Belden 7852A that is rated up in the 400-600MHz range, what do they know? Smarmy cable manufacturer, Dr. DHS says that's just not true!
Well if you've got people like that advising you, I'm going to guess the technical conclusions you come to are probably not going to be the correct ones.
"Look, these sites are being DDosed, let's post them on slashdot". Doesn't exactly seem like the best idea ever.
-1 disagree is not a modifier for a reason. -1 troll, flaimbait, redundant, overrated are NOT acceptable substitutes.
It's time for the community to do something about botnets. Forget ethics, we use whatever means necessary. Government and law enforcement agencies appear unwilling or even technically unable to do anything about it (this is a very important point). What better people to sort out this mess than the community who thought up the IRC protocol and whatnot in the first place? It's time to find these machines, break into them and stop this madness. Will govt only do something when their sites get attacked? Can you say weakening Western-Russian relations?
Microsoft "Malicious software removal" to the rescue!!
Maybe.
I mean, this is precisely the sort of thing it's designed for, right?
No sig today...
I don't come into your church with a loudspeaker yelling "MICROSOFT IS AN UNFAIR MONOPOLY!" Even though I think it is an important message. I'm sure you would object if I did so, so maybe you should follow the golden rule and not visit technical forums to spread your taliban infested "message".
I'm not by any means experienced at modern ASM and low-level stuff; The only instruction set I recognize is 8085. But why wouldn't it be possible to run Windows98 inside something like Bochs, and then just halt the VM and take the keys out of it's memory and order the botnet to self-destruct? Will the worm check for subtle processor state aspects that Bochs misses and not run? That this hasn't been done already implies that I'm missing something...
I remember when this happened against Blue Frog. They were forced to shut their service down due to the DoS attack against them. As soon as the spammers feel threatened by any anti-spam organization they just launch these kind of attacks and shut them down. They seem to easily get away with it. Kind of sad really, there needs to be a fight against spammers on a larger level with Governments and IT corporations getting involved.
"Those who cannot remember the past are condemned to repeat it."
To put it in other words, why am I not surprised that this happened, after watching Blue Security being obliterated by... guess what, a botnet!
Uh, can somebody please explain why the parent is modded "Flamebait"?
Ignorance is curable, stupid is forever.
Probably because claims to the effect of "all blank are filthy scammers and spammers" are generally considered to be flamebait? Add to that the whole notion of "our cyberspace" and a completely unrealistic proposal (just how do you prevent an entire country from connecting to the internet, anyway?). Yeah, it's flamebait.
When the Storm Worm writers are caught, they should be publicly beaten to death immediately, as a warning to all who would follow in their footsteps.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Malware means "bad software" so naturally all trojans, viruses, backdoors and worms are included in the term malware, but you can also add to that spyware, adware and unremovable software which may or may not contain trojan, virus or backdoor features.
Obviously, if you had adware that injected ads into unrelated programs, it'd be an adware virus, etc. But you can have something that's merely adware without it being a trojan or anything else.
I think I forgot to mention rootkits, a source of recent controversy. They're an advanced type of backdoor which cloak their presence on the system and thus have anti-removal features. This caused some confusion because a recent game had anti-removal features common to rootkits, but lacked the backdoor part. Further, a Sony USB stick had the cloaking features, but no known backdoor, although some, like F-Secure, called that a rootkit as well, which could be misleading because all traditional rootkits DO include a backdoor... otherwise they wouldn't give you root, and wouldn't that just make them a "kit" or something instead of a rootkit?
Naturally, you can call any unwanted instance of malware an 'infection', although some people are dense enough to knowingly install it on their machines, which could muddy the issue. Some people also might disagree with me for calling _all_ adware "malware" because legitimate programs can be ad-supported in that way. However, I maintain that I will NOT use adware not merely because I hate ads, but because many high profile ad networks have been hacked and made to serve up exploit code which has infected many PCs.
Frankly, I really wish that the media would get these things straight and just describe the bad features things have. E.G. they should issue reports like "infections of the FooBar malware are on the rise, it spreads via e-mail attachments that claim to be greeting cards, then uses a backdoor to connect your computer to the FooBar botnet."
Except that these sites are annoying enough that the fairly trivial effort to set up a DDOS in retribution feels worthwhile.
Scam baiting is great, and I'm delighted that it's causing some annoyance but thinking of it as anything other than a fun way to wind up someone who deserves it, is just deluding yourself.
As big as a botnet is, it has only 2 main weapons - spam and DoS. To help fix the first problem, why can't ISPs analyse outgoing mail and if spam-like behaviour appears (which shouldn't be hard to detect), do the following: 1. Completely block customer's traffic, except to allow the following: 2. Direct customer to the ISP's download page of links to virus scanning software & updates. 3. Allow customer to tick a box saying "yes I've done a scan, all ok now" and service resumes. 4. If spam behaviour continues, return to step 1. Customer can resume service immediately if they want, but will get pissed off enough with the interruptions to eventually install/scan and/or learn not to run EXEs. DoS attacks could easily be twarted by building an alert network for all ISPs. If a site is attacked, they alert the network and any ISPs seeing traffic going to that site does the same to the customer as above. Block them until they clear the infection. By badgering the end users until they learn, we might see PCs around the world quickly cleaned up. The government could help by providing free antivirus & firewall software too, or at least make them tax exempt.
What would happen if we organized a "good" botnet that would DDOS the machines on the Storm botnet, rendering them incapable? Obviously participation in the good net would be voluntary.
Taking a country off-line actually been done before (the internet was smaller / less connected then).
This is a fight that the IT profession should take on. This is not just about botnet computers or some hired gun to take down websites. This is a FIGHT for the internet. The fight for GOOD or EVIL. If we allow these thugs or criminals to take down websites or hold companies hostage for ransom, then civilization as we know it is at risk. The internet will become the new weapon of terror if it not already being use to that extent. Those who advocate criminal activities on the internet should be sought out and reported to law enforcement. There is glorification or satisfaction that is to be gain. All scams fighting sites are under attacks. These sites are the fight line of defense against cybercrime whether you agreed or disagreed with their methods. We at http://scamfraudalert.com/ remain resolute to this FIGHT.
would be to use 100% of the CPU/Memory/HDD. When the infection is that obvious, it will be found and deleted, removing the infection of the original (black) worm too. If the machine remains open after, then the grey worm will reinfect and manage 100% CPU/Memory/HDD again.
After a while the user will operate their machine safely to avoid it.
The Black worms/botnets will only remain as long as they infect lots of machines so that the DDoS is effective without saturating any one machine and thereby bringing notice to itself.
And so it seems, aa419.org is up again, albeit only with a few pages so far. I still cannot get their Muguito to run, since it needs to log in somewhere first. Their forums are also down. Anyway, as several have said here, the determination of the scammers only proves that we are doing a good job annoying them. Neat!