Slashdot Mirror
Storm Worm Botnet Partitions May Be Up For Sale
Bowling for cents writes "There is evidence that the massive Storm Worm botnet is being broken up into smaller networks, and a ZDNet post thinks that's a surefire sign that the CPU power is up for sale to spammers and denial-of-service attackers. The latest variants of Storm are now using a 40-byte key to encrypt their Overnet/eDonkey peer-to-peer traffic, meaning that each node will only be able to communicate with nodes that use the same key. This effectively allows the Storm author to segment the Storm botnet into smaller networks. This could be a precursor to selling Storm to other spammers, as an end-to-end spam botnet system, complete with fast-flux DNS and hosting capabilities."
Being the n00b that I am, I don't know what fast flux DNS is. I know what DNS is, and I know the meaning of fast... but flux to me is something you put on a pipe before you weld it. What does it mean in this context?
Follow the money.
I'm not sure whether to be impressed, depressed, or both.
These things are getting so insidious and vast in scope, I'm honestly wondering if I can safely believe that any Windows machine I come across with problems ISN'T on Storm or one of the other botnets. At what point does having a multi-use computing device become more of a problem than the benefits it provides? If 90% of what you get for connecting to the Internet is problems, what's the point? Bile spewing bloggers, bought-and-paid news reports and total advertising awareness?
This slashvertising has reached a new low. ;)
http://twitter.com/onion2k
How long before Storm is better than the Internet?
It seems to be peer-2-peer, can host files, must be reliable (DNS and all that), encrypted traffic.
If you assume Internet is past its sell by date, what would the next generation network look like?
:-)
(OK, maybe it wouldn't be owned by the mafia (insert USA joke here))
Open source, flash charts
Windows has downloaded a new security update. Do you wish to install?
GetOuttaMySpace - The Anti-Social Network
Can I buy a partition of zombie PC's and use their processing power to crack the 40 bit key?
"Would you, could you, with a goat?" Dr Seuss
... can the partitions be formated with ext2/3 or do have we stick to NTFS?
I remember when we proposed an anonymous P2P system for the anti-spam system "Okopipi" (successor of Blue Frog). We were criticized by saying spammers would use that system to make P2P networks for DNS attacks.
One year later, spammers are ALREADY using a P2P system for such thing, while nobody has the means to counter them.
The lesson: They got ahead of us. It's time we invest in countermeasures of our own, or succumb to the enemy. Because, we're losing.
...and if there aren't, then why are reputable DNS servers allowing these super-fast changes to DNS records anyway? Certainly such trends can be easily detected and stopped dead in its tracks?
http://www.schneier.com/crypto-gram-0710.html#1
A good essay on the Storm Worm and how it works and how it can be prevented (or rather why it CAN'T be prevented in many cases).
I've not been actively following the Storm Worm Botnet stories, but I've picked up a few details which, on the surface, are downright frightening: Storm infects between 1 and 50 million PCs; it's more powerful than the world's supercomputers; dynamically evolves to avoid counteractions by security companies; and only uses 20% of its potential computing power at the moment.
These blurbs, if they're true, paint a bleak picture. Should the hackers leverage the network's full power, couldn't they shut down just about any server on earth? And imagine the bandwidth costs of this thing operating at full force.
So for those in the know, is Storm just a way to propagate spam and annoy people? Or is it something even more dangerous?
It's about time we start calling it Skynet
With Great Power Comes No Love Life! - Samit Basu
Sure there are legitimate reasons to do this - one of them is cheap datacenter fail-over. If I have web servers colocated in two different datacenters with two different ISPs, and one of them goes down, I can change the TTL on my DNS records to, say 30 seconds, and point all the addresses to the other location. The short short TTL will cause global DNS to be updated much more quickly than normal, and my web site's traffic won't dead-end.
On the other hand, I defintiely see ISPs that don't respect DNS TTLs anyway.
Causation can cause correlation
Step 1: Rent botnet.
Step 2: Have each 'rented' computer run update, anti-virus, anti-malware...
Step 3: Profit! Ok, no profit, but maybe you get to enjoy reduced amounts of spam.
Repeat until bored.
People are hijacking PCs and servers all over the globe and selling access to them to spammers and other shady characters. This is an organized crime of GLOBAL scale. Why the hell isn't Interpol or some large law enforcement body prepared to follow the money to the sources and burn them with it?
And if we don't have the REAL people to work on this, perhaps we should hire Hollywood to get the job done because it seems like the only real law enforcement that happens these days is in the movies or on TV.
First things first, IANAE (I am not a expert)
I've recently read some stories about this botnet. From what I've gathered it's powerfull enough to do some serious damage in a society. Cyber attacks can disrupt our lives in multiple ways after all.
Imo we're just lucky so far that it hasnt been used for some serious attack on money/bank agencies, public transport, etc etc, stuff close to us and vital for average day life. (or am I just being to paranoid now?)
The hosts that are infected will most likely be bad maintained boxes, unattended, never updated. Wouldn't it be possible to write a counterworm/trojan that would delete the bot software and close the holes?
I realise the ethical issues involved here. A Trojan like this would basicly be just as "bad" as the botnet itself, on the other hand it would be for the greater good.
Has anyone ever attempted this? If not, what if someone did? Would you be pissed off if one of your forgotten and infected boxes would be cleaned this way?
Just being curious..
Life starts at the end of your comfort zone.
The partition you just purchased is on your own hard drive.
Say hello to my little sig.
It really only makes a difference if your domain's TTL is short before you need to make the change.
The real "Libtards" are the Libertarians!
The updates are part of the Slashdot tenth anniversary auction. In addition to the @slashdot.org address and low user id, CmdrTaco has also gotten the operators of the Storm Worm Botnet to auction its use off as part of the charity action.
Some potential uses for the winning bidder:
Simple answer, complex solution.
First your firewall, useless (against storm). One of the attack paths of storm is to get YOU the user to visit an infected site, often by sending you an email. Unless your firewall somehow knows ALL infected sites and blocks them all (unlikely) the email will arrive, and the site will be visited and the trojan loaded. You could setup a firewall that protects against this, but you don't have one, because if you did, you wouldn't have to ask, you would know. Firewalls only help against worm attacks, were an outside computer probes your network for weaknesses. IF you configure your firewall extremely rigidly and only allow known traffic through it, then malware on your network could be blinded, unable to connect to any command parts of the storm network. It is possible to use for instance iptables (linux) to inspect all packages going through it and simply drop unwanted traffic. Since storm now apparently uses encrypted p2p(edonkey) traffic this shouldn't even be too hard. This would however result in a less userfriendly network. The only experience I got was in a setup that ONLY wanted regular HTTP traffic, and this meant a LOT of stuff failed, even web traffic because not all web application create proper headers. (I wonder what the recent MS stealth update means for windows, did this traffic pass unseen through software firewalls?)
Then your AV software. Forget about it, storm mutates itself. Since AV software mostly works with signatures, it can never be uptodate enough. I read a report that it changes every half hour. How the hell are you going to keep your signature data that uptodate?
Windows patches. They ain't uptodate thanks to MS dreaded patch tuesday. THis means that a security hole can EASILY be unpatched for weeks. COnsidering this is MS we are talking about, practice is far longer. You will be the target of exploits MS does not know about yet, won't develop a patch for for months, that they will delay for weeks to deploy and for which the AV companies do not have signature.
Anyway the most recent big security hole involves PDF's, that is Adobe, nothing to do with MS. You have to be uptodate on EVERYTHING. That includes EVERY codec, every handler EVERY single piece of code on your computer. Have an image browser installed? Are you sure that not a single on of the image codecs it uses has a flaw? If you update one image browser are you sure that not one single program on your computer still uses an old library that is still vulnerable? Remember, if a storm attack only infects a fraction of a percentage of computers, they still got hundreds of thousands of machines.
START TO GET THE PICTURE?
Basically you are like a good soldier, who keeps his gun clean, doesn't screw with hookers and stays awake on guard asking how well he standsup to a full out nuclear war. YOU ARE TOAST PRIVATE!
But there is hope, the most common form of infection is still through user interaction. YOU have to open the PDF, you have to execute the exe/scr/sh/dmg/whatever, you have to visit the link. The most powerfull attack is social engineering, get that soldier in his invincible armour to pickup a grenade and eat it.
The really odd thing is that you do not even have to be paranoid to avoid it. Just don't click on things. IF somebody sends you a story headline, visit the BBC site yourselve. If somebody wants to send you pictures of some celeb flashing her aging bits, don't. There is plenty of fresh porn with nice looking girls out there (cheggit.net).
So what do you need to stay safe?
Mostly, your brain. Disable every bit of automation in software and instead let your brain do the thinking. NEVER just use automatic install (spyware) and never allow for instance outlook to preload crap or preview stuff. Email is for text, not webpages. But mostly ask yourselve WHO is sending me this, and WHY. One of the most amazing attacks I seen was by sending a "joke" attachment to people in your address book. Here is a hint, I am dutch. My brother I
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Actually you'll have to change the TTL prior to failing over. So if you use it for active fail-over and not for scheduled maintenance, the other nameservers will be using your 'old' TTL. A common mistake by cheap webhosters.
The other issue is that TTL is a suggested time for keeping your records alive. The other (caching) nameserver can choose to ignore it (to circumvent stuff like this botnet or just to keep it's own load down) or if it can't reach your nameservers after that TTL you specified it will just wait until the next cycle (2*TTL) or until your Maximum TTL (there is another record for that) has been exceeded which means it will not give any results anymore if it can't contact the nameservers. There are also caching nameservers that set up a minimum TTL which overrides your recommended TTL and maximum TTL.
Custom electronics and digital signage for your business: www.evcircuits.com
There's only one way that there'll be enough public outcry to cause solutions to be generated. The spammers will have to overplay their hands hugely. (Think Al Qaeda in Iraq - things are turning around over there at the grassroots level, mainly because AQI was chopping off people's heads and serving roasted children on platters to parents, and the public outcry has been enormous.)
Everyone hates spam, but spam filtering techniques have progressed to the point where we're at an uneasy stalemate with spammers. Everyone hates DDoS attacks, but in truth, how many people have really been the victim of one, and how many companies with muscle are really vulnerable to a normal-sized one? What will have to happen is that some overambitious crook gets it in their head to attack a Google or a Level3 or an Amazon or a national military, and puts the muscle behind it to make it work. It'll take players of that sort of weight to induce ISPs to do what they should have been doing all this time - proactively detecting botnet traffic and suspending the account of any user, individual or corporation, participating in such botnets.
I suppose we could also black hole enough of the world that the botnet controllers are forced into the reach of countries with tough computer anticrime resources, where they can be put behind bars and well out of the reach of any keyboard. I'm just not quite sure the Russians will stand for that....
I'm sorry, I'm probably sounding completely lame to those more firm in cryptography, but I have to ask:
:-)
:-)
What would it take to attack the 40 byte key? Imagine a coordinated effort by the biggest 500 gouverment computing setups around the world. All the blue genes and whatnot pitching in. The Japanese sure have the one or other state-of-the-art mainframe supercomputer, and CERN, ESA, Nasa and few German weather services have a few aswell. There is tons of horsepower laying around idle at agencies, bureaus and the occasional school or corporation. If they all pitch in in a coordinated brute force attack *and* have Seti@Home do a few hours too it should be possible, no? Especially if one takes into account that at least the NSA has mathmatical functions that do some of the dirty work and speed up the process a little. They wouldn't even have to publish them.
Wait, let's just check:
255 to the power of 40 is rougly 1.8 times 10 to the power of 96 (Gulp!). Thats nearly Gogol. (10^100, what Google initially was supposed to be called, the guy registering the domain mixed up the letters...)
Whatever.
On it goes: For the sake of ease I'll roughly estimate that after the overhead has been dealt with, half of the top 500 (or a simular setup) will be doing optimized attacks on an average of 50 billion tries per second. An average state-of-the-art mid-range server has aprox. 20 GigaFLOPS, so I think that's fairly realistic for a large mainframe doing a multi-step operation.
250 * 50 000 000 000 = 1.25*10^13 tries per second.
*60*60*24 makes 1.08*10^18 per day. [Sidenote: This may be way off wack allready and total bollocks but it's fun actually]
*7*52*5 makes 1.96*10^21. Oh, gee. This doesn't look to good. Where at it for 5 years and have only covered less than the fourth root of our total amount of keys. Even if we had 10 times the power it would make up only 1 percent of the keypace. Sheesh. We'll probably be cheaper off in handing out Linux PCs to everyone on the planet.
It's no use. I gotta start working on my next project: Finding an explicit function for prime numbers. Hehehe. I could use the Million from the Fields Medal too.
Bottom line: My question/assumption was lame. But at least I found out myself.
We suffer more in our imagination than in reality. - Seneca
When a machine gets infected, the virus usually patches the system so that it own it without the intervention of other malware. These guys, unfortunately, aren't stupid; sadly, an infected computer is probably more patched than most (not yet) infected boxes. After you steal something, you tend to defend it so that it remains in your possession.
If I mod you up, it doesn't necessarily mean I agree with what you've said, sorry.
This is the planet's largest ever privately controlled computer grid system. It is larger than google in terms of machines, and by the nature of its design it is about unkillable. It was most likely started by one *really* smart guy, as in uber scary smart, sitting in front of one machine at a console prompt. Think about that in your condescending leetness. And "just big"? This is the world's first Lex Luthor scale hack, because it is controllable, and has several practical (to them) attributes. It's a plan that suceeded, not just random vandalism like some other big ones like slammer. This is something the combined forces of all the other security gurus haven't been able to stop, or even get much of a handle on. It looks like to get rid of it, you would have to both identify and then simultaneously wipe/reformat every single infected machine *simultaneously*, and you say it isn't even all that inventive? Say what?