Slashdot Mirror
The World's Biggest Botnets
ancientribe writes "There's a new peer-to-peer based botnet emerging that could blow the notorious Storm away in size and sophistication, according to researchers, and it's a direct result of how Storm has changed the botnet game, with more powerful and wily botnets on the horizon. This article provides a peek at the 'new Storm' and reveals the three biggest botnets in the world (including Storm) — and what makes them tick and what they are after."
Imagine if somebody did this but donated cpu time to distributed computing projects like that one on cancer research. Force philanthropy would be rather strange and still illegal, but at least slightly more noble in a Robin Hood sort of way.
This article provides a peek at the 'new Storm' and reveals the three biggest botnets in the world (including Storm) -- and what makes them tick and what they are after.
From the look of things, it appears that their sole purpose is to send me myspace friend requests from lonely, hot girls that have Tom as their only friend, and have selected me as the lucky person who gets to share in viewing their private, personal website, which has many photos of their naked breasts and vagina. Seriously.
The theory of relativity doesn't work right in Arkansas.
It's interesting that these articles don't even mention that Microsoft's insistence on running executable content from the browser is at the heart of all these problems.
Well thankfully I run Windows, which is inherently more secure than your "open source" systems. These botnet creators can look right inside your operating systems and see the vulnerabilities, whereas with Windows...
All of these articles on botnets such as Storm always mention home system vulnerability...
Well, let me point out for a second how while dangerous for a single home system to be infected, it is a world worse when a business system becomes infected.
Within hours, typically that botnet has replicated to all of the machines on the internal network. Worse, now that botnet has access to your critical database information, consisting of customer records. Often times, the brains behind these botnets can better datamine than your business can, finding interconnections with your customers to better flood them with spam, or worse.
At my job, one of our machines was hit with the Storm. We isolated it within minutes, but even then it still wa a close call. If I hadn't been doing a routine portscan at just the right moment, we'd have never spotted it.
After that, the boss authorized me to begin a slow migration to Linux.
Karma Whoring for Fun and Profit.
I installed Storm on my computer and I've never been happier. Downloads are quicker, my mortgage has been refinanced, I made a fortune in the stock market, and my cock is 2 inches longer.
excellent botnet-er, would bot again++++!++!
So the world's largest networked super computer runs Windows. It is sad really, all these hundreds of millions of computers on the planet - half of them sending spam for the other half to filter out. One would think that there should be something slightly more useful for them to do.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
I'd feel a lot safer if you could get selinux to work on Windows...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Yes, the router was still emailing me every log of all network traffic -- my traffic and the malware traffic also. Seems the malware author does not think my ability to log their traffic was significant.
Netgear was very helpful. Tier1 tech support said securing the router was my responsibility. Asshats!
Every mans' island needs an ocean; choose your ocean carefully.
I'd feel a lot better if I could get SELinux to work on Linux..
It's a well-known fact that SELinux was developed to confound hackers. It is a less-known fact that the trick is to try to get them to install it.
I see your informative link, and raise you a pithy comment.
No, smart people who know plenty about security punish all of us and use the clueless as their weapons. Your statement is like blaming the bullet for a murder instead of the killer. Without a functioning mind building these botnets, it wouldn't matter to us how stupid the rest of humanity is.
I see your informative link, and raise you a pithy comment.
Not really. There is a very simple reason why botnets are dominated (to pretty much 100%) by MS systems. Numbers. Most machines in home user hands simply are running on some kind of MS OS.
Yes, Linux and MacOS are more secure. It's harder to slip something into the system, at best you can run with user privileges, yes, yes.
Unless you trick the user. And that's pretty much the main infection vector today. About 95% of malware comes in the form of infected spam mails, only 5% of infections rely on system insecurities, buffer overflows or other system related security holes.
And when you can trick the user into executing something, it's trivial to trick him also into giving the malware elevated privileges, provided you promise him something. Send someone a "tool" that promises 20% more speed or ram, but since it has to hook deeply into the system, it will require root privileges.
Yes, you won't fall for it. But the average clueless user? After all, this thingamajig is gonna do something with your system to make it run faster, so it's kinda logic that it will need system privs.
No system is secure from malware. Security is by definition the minimum of a system's security capabilities and its adminstrator's security capability. BOTH need to be secure to create a secure system.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Keep up the smack talk and I'll rent part of the botnet to DDoS you, just for kicks. Hey, it's not like renting a few 1000 boxes for a few days was expensive!
That's how it affects you. Well, unless you can be blackmailed along the lines of "pay me X bucks or you go offline for Y days, let's see if your biz survives", it probably won't affect you, directly at least.
How about your employer? What would happen if his internet presence, his mailserver, his means to communicate online were rendered useless for a month? Would the company survive?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You see this is exactly why Windows is winning. Linux is still yet to provide a credible botnet to face off against the Windows botnet. There's just no comparison, Windows wins every time!
This is my footer. There are many like it, but this one is mine.
If you think you can do better than Fortune 100 support teams, you are sorely mistaken. They have all the time, money and employees they want to throw at this problem and still get their ass kicked. People trying to tweak non free software are working in the dark and will always be surprised. No matter how much they spend, they can never fix the problem.
The reason that the corporate world has issues with bots, has far more to do with the corporate environment than it does with the security of the platforms involved. After all any sufficiently secure platform can be made insecure by allowing the wrong morons to use it.On my home network, I can do things like block every single incoming port and disable pretty much all of the outgoing ones as well. I can install firewall software on each computer to scan the remaining ones. I can create my own install media to remove nearly any part of windows which isn't related to the bare essentials, then install the bets antispyware software and demand that anybody that uses the computers not click on links in email.
I'm sure there's more, but I would be surprised if I were allowed to do even that much if I were responsible for securing a corporate network.
Botnets and I cannot lie... :)
The sophistication of this Storm "application" is much more indicative of a mature elder programmer, who probably has read the complete cypherpunks archives. We talked about stuff like this long ago. Compare to things like the Morris worm, the two Manila children, etc. Those were intense, but brief due to coding errors and the like.
Bah. No, these people are not children and they do know what they're doing.
"internet licenses" have been discussed ad nauseum, and fact always arises that any such implementation would simply be elitist and exclusionary.
Basically, an internet license is a bunch of computer guys telling the rest of the world that the internet is an infrastructure made for the geeks, by the geeks, and of the geeks. If you really want to join the club you can take a test so we can determine if you're suitable, but otherwise, you're unfit to participate.
Look, you're not going to kill anyone being a bumbling participant on the internet, they way you might in a car or with a gun. Yes, it is possible that you unwittingly might cause some economic impact to someone, but is that a flaw of the user or the system? I submit a banking system that lets an ignorant user leak his personal information which can then be used to ruin their credit is broken. I further submit that a system that lets a zombie computer join thousands of other computers in a criminal enterprise is broken.
The problem doesn't just exist between the keyboard and chair, but also in the policies, protocols, and systems that allow a new or ignorant user to fail so spectacularly.
We should be striving to increase internet penetration to the young, the old, and the impoverished, not locking out those who can't understand our poorly built toys.