Slashdot Mirror
Anti-Scammers Become Storm Botnet Victims
capnkr writes "It looks like the efforts of the anti-scammers at sites like 419eater, Scamwarners, Artists Against 419, and possibly others have become the target of the Storm botnet.
Spamnation has a post about it, and as of this writing none of the above listed sites are responding. Spamnation reports that CastleCops and other anti-spam forums are being DDoSed as well. Sounds like a massive, concerted effort against the folks who are fighting the good fight.
Although I hate it for the owners and admins of the above sites, I think it shows without a doubt that their efforts to 'get back' at the scammers are working."
Posting the info and having people slashdot the mentioned sites is not going to help them either :)
I screwed with a craigslist scammer this week. It was sorta fun.
m l
:)
http://digitalsushi.com/goraku/fakecheck/story.ht
Getting him to mail a check made out to "Pownd Uholot" was entertaining.
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
Aside from the legalities, perhaps Grey Hats round the world need to start developing "neuter-viri" (self replicating auto-patchers). These zombified machines have got to be defanged somehow, and fast.
Life is not for the lazy.
The counter solution to this is for a big company like Google, Yahoo, Microsoft (yes, Microsoft) should offer either their servers, hosting, bandwidth etc. To these sites that are quite evidently being successful against the scammers. Or at the least they could give the sites some cash injections to buy more capable servers, fatter lines etc.
Storm actually does install updates and checks for viruses on its victims. It just excludes anything that would make life harder on itself.
"I think an etch-a-sketch with an ethernet port would beat IE7 in web standards compliance."
Is there a scanner and fix available? It does require executing an email attachment, right?
It really shouldn't be called a worm unless it can worm its way in without social engineering...
Galileo: "The Earth revolves around the Sun!"
Score: -1 100% Flamebait
I recall reading a quite interesting article on this topic a while ago while doing research for a university seminar I had to hold.
The big crux is that the "worm" needs to show negative behaviour, i.e. exploit it's host bandwith and CPU cycles, at least for a while, to gain sufficient impact to "infect & patch" vulnerable machines. It would turn into a battle of the worms, where "grey" worms attempt to infect as many machines as possible, plug the security holes, seek new machines to "infect and patch" and then, after a while, self-delete themselves - while the "black" worms, attempt almost the same, only that they do not self-delete but instead continue to exploit their host. Most machines that become victims of rootkits or worms are actually patched up once infected, to avoid losing the machine to competing malware.
+++ MELON MELON MELON +++ Out of Cheese Error +++ redo from start +++
my password really is 'stinkypants'
I told my oldest son about this botnet yesterday, mentioning that with between 2 million and 20 million CPU's working at any one time, and even that larger figure likely representing only a fraction of the botnet's total capacity, it collectively represented the most powerful supercomputer ever built... and it was effectively under the control of a small group of people with criminal intent - the author, or authors, of the worm. My son responded to me with a great deal of scepticism, first saying that none of these security experts which have made this analysis have any way to estimate what sort of computing power military organizations might have, so saying that it represented the most powerful supercomputer ever was actually a completely meaningless claim, and also, he proclaimed that the story was most probably just hype and over exaggerated. He said that the claim of the most powerful supercomputer ever being controlled by criminals was simply too much to be believable, like the headlines one might see on the front page of the Weekly World News tabloid. He also said that it was ludicrous to see how sending people "penis extension ads" (which is about all he figures a botnet can do) can actually seriously harm anything or anyone.
So this got me to wondering... how much of this actually _is_ something that is of any real concern, and if it really is, how could it be explained to people in such a way that it's not going to sound like some claim from a conspiracy theorist?
File under 'M' for 'Manic ranting'
Didn't some internet provider at one time threaten or attempt to disconnect customers whose computer were suspected to have spyware or a virus infection? I think more internet provider (errr.. high speed internet providers) should take charge and disconnect computers that are (or might be) part of a large botnet. This brings me to the point that like most people don't have a clue how a car functions under the hood, most people also don't know how a computer functions inside its case. So ignorance should not be an excuse for having a computer that's infected with every virus or malware under the sun which is connected to the internet. If a person had a car that kept causing problems on the road than it would eventually find itself towed away or shoved off the road (much like a computer might be forcefully disconnected from it's internet provider).
Much like the local police or the local transportation dept. might maintain roads and highways, so should the super information highway be maintained by internet providers and various security experts. Ignorance cannot be an excuse! It certainly doesn't work when you're being arrested for vehicular manslaughter. "But officer, I didn't see that old lady crossing the road..."
* A worm infects without user intervention (e.g. SQL Slammer, which *was* a worm).
* A trojan is a hidden "feature" of some otherwise legitimate software.
* A virus is a program that attaches itself to other files.
* A backdoor gives someone remote control of the machine.
* A botnet is an advanced backdoor where one can control many machines at once, e.g. from an IRC channel. PCs infected by completely different malware can all join the same person's botnet. Conversely, PCs infected by customized versions of the same malware can join different botnets.
The problem is that the media doesn't understand ANY of this and that the categories aren't all mutually exclusive. This is a trojan & backdoor that spreads via dumb users executing attachments they shouldn't.
>>>> REPOST THIS IF U HATE ABORTION
I do, usually. But in your case the post-natal variety seems fitting.
Some of the site's are using DNS records to point back to 127.0.0.1 and lowering their TTL so the botnet machines attack themselves. Easy way to defend (in some way) a DDoS. Don't count on the site(s) being up until the owners are sure more bandwidth / CPU cycles won't be wasted.
It might be a test or demonstration of the botnet. Like any weapon it needs to be test fired before actual use. The persons controlling this might be trying to kill two birds with one stone - test the botnet, and knock those who taunt you off the air.
We all know what to do, but we don't know how to get re-elected once we have done it
"I think it shows without a doubt that their efforts to 'get back' at the scammers are working."
I'd like to agree with you, but it makes about as much sense as saying that increased violence in Iraq is proof that the US has terrorists on the run.
The scam-baiters may be doing a lot of good, but DDoS attacks against them aren't proof of it.
-Rich
Oh please god.... no....
Think of what you're saying! The same group of people who color-code our paranoia, who decide that waterbottles are dangerous, and who advise us to purchase duct tape... you want to turn to them for help securing the Internet? Do you have any idea how painful that would be?
No -- the responsibility here lies with the users and (to some extent) the carriers. If the user's machines are infected, disconnect them. If the carriers detect a large, coordinated traffic pattern, investigate -- and if it's a DDOS attack, block it at the firewall level (before the traffic leaves your network segments.)
The real litigious bastards...
This article is a good place to start.
You could also introduce him to the theory behind Bittorrent, which is a good demonstration of how many computers each doing a small task, given modest bandwidth, can add up to massive distribution and publication power in short order.
Now, what if some distributed network decided to siphon a gig of illegal or embarrassing materials onto a compromised target machine. Perhaps a politician that is voting the wrong way?
Then ask him, not if the entire banking industry is safe, but if an individual's information (SHA hash collision or private key, but that's not "average Joe" speak) could be subject to a distributed brute force attack.
With the growing power of computers making tiny pieces of malware harder and harder to notice (that 1% of processor time is more and more powerful), and malware being able to literally hide files from the user until such time that it chooses to reveal them, it seems like it's only a matter of time before someone with a large enough botnet, and enough imagination, could start attacking individuals and/or siphoning off their money. How you do this is not something I care to discuss, but the black hats (both the actual criminals and the security experts, as an exercise) already have ideas and are working on it. That's why you'll see them periodically calling for stronger encryption (more bits in the keys). If there was no possible threat, they wouldn't be creating and suggesting longer keys. Rootkits would not be a concern, if files hidden from the user were always benign (most are).
But all it takes is the wrong person to have the right idea, a breakthrough that changes the assumptions, especially in cryptography. Show him the movie "Sneakers" if you want to fuel some imagination regarding that. It's crap, but it's also fun and sizes the problem for the average Joe. Assuming that only ethical people work in cryptography is somewhat naive. Assuming that unethical people are not watching the progress of ethical individuals in the field is stupid.
There's nothing to say such solutions and attacks haven't occurred already, but it seems, as your son suggests, unlikely. You can bet if a criminal has figured it out, a little bit of money siphoned off here and there would be almost impossible to detect, especially in an environment where people are unwilling to believe it's even possible. Believe me, if the idea has hit Hollywood, it's old hat. That's exactly how such a criminal would proceed if they had found a way to leverage such distributed computing applications. They would target a distributed network of accounts, one by one, in a way that looked like banking errors (which are numerous and automatically corrected by the bank) and slowly siphon money from the banking industry itself, through compromised individual accounts. No individual would suffer, because of correction processes in the banks, the world's capital reserves would.
Then ask what that money could buy in terms of influence, weapons, elections?
Any compromised machine is a liability to its user. Botnets are a menace to society, and we're lucky all they're (hopefully) being used for is "penis enlargement" ads and DDoS attacks. That's barely scraping the surface of their potential.
If he wants to go on believing that his safety and security are a given, without any effort on his own part, there's little you can do, but anyone with any imagination, who is not in flat out denial, can demonstrate that distributed computing applications have a great deal of power, and that basic security is everyone's concern. It is definitely not good that these ne
We've got a professor at the university where I work that consults for DHS, one of our student workers is in his class. The misinformation this guy hands out is... legendary. For example, did you know that twisted pair only has a bandwidth of 250kHz and a maximum speed of 4Mbps? Really, it must be true, Dr. DHS said so! Never you mind things like Belden 7852A that is rated up in the 400-600MHz range, what do they know? Smarmy cable manufacturer, Dr. DHS says that's just not true!
Well if you've got people like that advising you, I'm going to guess the technical conclusions you come to are probably not going to be the correct ones.
I remember when this happened against Blue Frog. They were forced to shut their service down due to the DoS attack against them. As soon as the spammers feel threatened by any anti-spam organization they just launch these kind of attacks and shut them down. They seem to easily get away with it. Kind of sad really, there needs to be a fight against spammers on a larger level with Governments and IT corporations getting involved.
The GP's comment was saying that the storm worm will install windows updates to make it harder for OTHER viruses/worms to get into the system. I've even heard that it installs a pirated AV program to help 'protect' the zombified machine.
As for your second point, don't be a troll. All software has bugs, microsoft is no different. If you bothered reading about this at all, you'd realize that most anti-virus products will detect and remove this worm. The people who are running windows without an anti-virus program are the same people who don't install windows updates (and the ones who ran 'game1.exe' from a random email). If Microsoft could create an 'ultimate patch' that would make Windows completely secure (stop laughing, there's a point to this), do you really think everyone would install it? There would still be worms and viruses, they'd just target the unpatched systems and prey on people who don't know enough about computer security.
Probably because claims to the effect of "all blank are filthy scammers and spammers" are generally considered to be flamebait? Add to that the whole notion of "our cyberspace" and a completely unrealistic proposal (just how do you prevent an entire country from connecting to the internet, anyway?). Yeah, it's flamebait.