Slashdot Mirror
The 'Malware Economy' Evolves
superglaze writes "ZDNet UK has a feature on how the malware economy is turning into a recognizable traditional IT economy. Leasing botnets? Malware support? Welcome to the new age of computing. As the piece suggests, it's all gone Darwinian. 'One indication of the maturity of the black economy, according to Telafici, was the recent case of a hacker who wrote a packer [software used to bypass antivirus protection], "threw in the towel recently as it wasn't profitable enough -- there's too much competition. They opened the source code and walked away."'"
There whining is covered, please continue with OT discussion...
Really, we've been talking about the Economic basis of spam for some time. I've commented and journaled on how the economics of spam make most current solutions meaningless in the greater fight.
So now when we see yet another article discussing the money that is made in malware, particularly the botnets that drive spammers, there's no reason why anyone should find this surprising.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
That's a FUD goldmine, or a FUDmine, if you will. Damn, OSS enemies will be crowing about this: "open source leads to VIRUSES and MALWARE! Open source hackers create programs to take over your computer, how can you trust them?"
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
(registration needed, fake credentials accepted) There are dozens more sources of the same info.
This is only logical. A criminal will work for the quick buck. BnE is great when lots of people are leaving their windows open and you are the only burglar, but once every one is on the BnE bandwagonit's time to switch to mugging or extortion.
We are the Borg...
...the predators will flourish.
Read my Very Short "Stories"
I keep getting spam traffic from her that is reassigned from a myriad of outlook express ex-emailers. I have told her that she will have to get her OS reinstalled but she just won't listen. I am afraid that the windows OS and the Microsoft way of computing has done little more than create a shit load of computer using zombies and little old ladies (like my aunt) who in blissful ignorance just keep up the status quo. The result of this blissful ignorance is that bot nets have become almost impossible to kill.
This message was not sent from an iPhone because Peter Sellers really was a deviated prevert without a dime for the call
malware is great!
such as Alibaba.com, a chinese company, well known for the malware 3721, can even make IPO for more than 1.3 billon dollars.
that's why it is called "Historic IPO"
I don't get it. One of the most popular uses for a botnet, according to the article, is for spam mailings. But how can spammers afford to pay any significant amount of money for the service? I understand that they're mailing out to millions of people and count on a high level of rejection, but how many people are stupid enough to open something that says, "5PL1t H3R 1n HALF WYTH YORE HUGE ORGAN"? Let's face it, half the population is female, and probably not interested (unless they're buying for their boyfriend, and wouldn't THAT be a kick-ass Christmas present); a majority of the male half of the population are probably reasonably satisfied with their equipment; and even a vast majority of those poor, pathetic guys who actually have "AY tiney Pinnus That You GIrflrend Lauff at" probably have an IQ in at least the high double digits (I mean, they figured out how to turn on a computer and collect their e-mail, at least). So they probably wouldn't open that message either.
And then there's the spam filters, which are getting pretty good these days.
So that leaves what percentage of the population stupid enough to open one of these things and infect their computers with something vile? And if they're that stupid, how likely is it that they have a bank account worth looting? Or that they haven't been hit before so often they just sign their paycheque over to the spammers automatically and save everybody a lot of trouble?
Help. Somebody please explain it all to me.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Not only will we love robots, they will be our slaves, too. Usable, abusable, ownable, perfectly legal. And no, the robots won't rise up and take over (for at least a few hundred years) even though they will be much, much smarter than us, because they will be made to appear to like their roles, be loyal, and understand that they are expendable and disposable, and they will legally remain property to do with as we will. Though they will be human-like, they will be easily and visibly distinguishable from humans by some indelible, obvious markings, such as bluish skin. Even so, there will be incidents, crimes and regrettable accidents, where humans will be mistaken for robots and abused or killed. This is not a fiction I'm spinning, but a prediction.
Mike from www.myallo.com/blog
This has to do with SPAM and not botnets...
It's been said before, probably better than I can: The "mark" in the spam economy is NOT the person receiving the email. The "mark" is the person foolish enough to buy the Spam-in-a-box kit thinking they will be able to get a single person to buy their w0tches or v1agra. The money in spam is made not from the person foolish enough to buy the w0tches. The money is made in selling the service to spam millions of people.
I would have to say that explosives are the most abused technology in all of history.
No kidding :-) I said in a public forum about 4 years ago that botnets are the first and only successful example of commercial utility computing, where a vendor tries to rent out time on large compute clusters.
This works much better for botnet vendors than for Amazon EC2 or HP Utility Data Center, because the really valuable resource the botnets are renting is a routable IP address that hasn't been shut down yet. Computers are nearly free, but IP addresses that work are not.
These days there's enough division of labor that the hackers who develop malware aren't the people who run most of it. Sometimes the hackers are individual shops, and sometimes they're working for mafiya guys, and there's enough volume out there that hand-crafted malware isn't as necessary. For instance, if you want to take somebody's system offline, you don't have to crack into it anymore, either as a hacker or script kiddie running cracking tools - you can just DDOS it using the bandwidth of a bunch of zombies, and instead of doing it for fun, you can be in the commercial extortion business.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
There's copyright protection on an product designed for illegal use? Isn't that like complaining that someone stole your cocaine?
The whole termonology is silly anyway.
If you want news from today, you have to come back tomorrow.
Hopefully this means the malware industry will begin hemorrhaging money by hiring consultants.
Business in general tend to be rational. If the profit is not there, the product will not be used.
you won't need a driver's licence but you will be needing a programmer's licence
in the form of a registered PGP signature
and you will be liable/responsible for your code
and for those without a registered and approved signature:
NO SIGNATURE? NO EXECUTE.
this hasn't been adopted as SOP yet but with the amount of hacking going on and Ms Windows continued promiscuity it is a rather likely direction
Here's the actual paper from which came most of the material in the article: "The Commercial Malware Industry", from the University of Auckland. More technical details.
New threats of interest:
The design of stealth software like the "packer" is the same as copy-protection and "DRM" media encryption software, they both depend on obfuscation to hide the payload from an attacker while giving him both the key and the cyphertext. If you open-source it, you're telling the attacker (the antivirus researcher, or the deCSS author) where the key or the malware is hiding.
I'm sure all the AV guys have already grabbed a copy of that packer and are totally on top of it.
nope it's the way to go
we need detection and response
detection is a technical point and we will need to change the rules to require you PGP signature for every piece of code published with the guide:
NO SIGNATURE? NO EXECUTE.
once we know who you are we can hold you responsible for your program and this is the RESPONSE aspect of security
don't think it won't happen and don't think it's silly. the current flood of maleware mandates improved security. detection and response are critical elements of security. as well as prevention. we like prevention best, but failing that we need to put any bad guys out of business
your post contains unacceptable language
...wake up with a Trojan horse head in their bed.
Use your head, can't you, use your head,
You're on earth, there's no cure for that - S. Beckett
Please look at the definition of hack and how it's different from cracking
For those who hate reading: A hack is pretty much a clever trick. A crack is something that does all that security breaking stuff.
DATABASE WOW WOW
"They opened the source code.."
Another win for FOSS!
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
One thing that all spam messages must have, by definition: A website to sell their V14gra on. If you set up a botnet with 10,000 computers on it, you have the capacity to send 10 million messages a day for almost nothing. At the rate of .001%, that would be 100 orders a day.
Since 95% of all spam is blocked by filters, we have a way of making spam a lot more expensive. Simply set the filters to respond to the website on the blocked spam with opt-out messages. All of a sudden, the spammers website is slashdotted by opt-out messages from all of their blocked email. Imagine 100 orders and 9,499,900 opt-out requests a day. Kind-of changes the economic equation of spamming a bit.
"Be grateful for what you have. You may never know when you may lose it."
I'd rather you use the big old evil word, "evolution," rather than Darwinist or Darwinian.
Reason: conservative moonbats attack science by making it personal. For example, Rush Limbaugh attacks global climate change by saying that Al Gore is everywhere and listening to Al Gore makes him want to put a gun in his mouth (I am not making this up, we live in La La Land.)
Another reason is that the recent spate of articles catching on to calorie restriction as a method of life extension avoid the word "evolution" when discussing the reason that it works. The reason that fasting prolongs life is that evolution changes the aging governor in people who are experiencing famine to save them for reproduction later. No one, not Slate or NYT or Scientific American includes the word "evolution" when talking about this effect.
So let's drop the personification of theories. After all, evolution is a lot more than Darwin knew about, the theory has tremendous explanatory value and shouldn't be pegged to centuries ago.
JBS Haldane, 1940:
If you need text styles to communicate then you don't have a message.
Looking at your comment, its clear you didn't actually read the journal entries. But we'll continue on...
Spam is caused by bad registrars, you say!
No, I said that bad registrars allow spam to happen by being complacent. Those are two very different statements. Your statement carries an implication that you feel I'm aiming to say that registrars are themselves sending the spam. This conclusion is patently false. I am saying that there are complacent registrars that are making money from spam and hence are not willing to do their part to stop spam.
But thanks for playing, anyways. When we finally get registrars to pull spam sites
We'd have a good start. Except I suspect you're not actually reading my comments accurately and its not even clear that you understand the different between a registrar, a webhosting company, and an ISP. But we'll continue on...
they'd just use IP addresses -- or should we make using an IP address illegal, too
First, I didn't propose making anything illegal. ICANN has no legal authority over anything, anywhere. How you read anything that I wrote and took it to mean 'illegal' is beyond me.
But nonetheless, you are missing the point. Spammers use domain names because they're convenient. If you look up a spamming domain, you'll find that the spammers own a lot more than just the spamvertised domains. In particular, the domains that provide DNS for resolving the spamvertised domains are themselves owned by spammers.
This mutli-level scheme that the spammers run allows them to very rapidly change the mapping for their domains so that even if one ISP shuts them down or disconnects them, they can re-map to another IP, and the spamvertised domain still goes where they want it to. Or do I need to explain DNS to you as well?
but it sounds like you just need to calm down
Thats a curious statement coming from someone who opened their comment by calling me "a raving idiot".
and change email addresses to a subdomain
OK, I could start by pointing out that you didn't really write a sentence there, but I'll leave your grammar alone and critique instead your lack of logic. Of all my email addresses, the one I have that gets the most spam is in a subdomain - username@aaa.bbb.edu. It pulls in at least 40 spam emails daily. Just because it works for you, doesn't mean it will work for everyone. Besides, the spammers will eventually come up with a way to probe those, as well, and then you'll be right back where you started.
But I'll just let you think that you solved the problem with your interesting solution instead.
And of course, your "solution" does nothing for all the people who use the likes of hotmail/yahoo/gmail for their email. You can say what you want about them, but thats a lot of people who couldn't use your answer if they wanted to.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
So far, the one legislative action that has done anything significant to spam was the law barring credit cards from processing payments to online casinos. It's not that much of a leap to similarly ban any payments to v1gra pushers as well as the many 'canadian pharmacies'. After all, the product is either quackery or an illegal sale of a prescription drug, so the enterprise is illegal even without spamming. Even a fair percentage of the id10ts that fall for the spam will balk at sending cash through the mail.
If the law also called for reversal of existing transactions to a merchant found to be pushing illegal pharmaceuticals or quack remedies (after all, unlike the herbal suppliment industry, the spams DO promise effectiveness for a particular condition) then the whole 'enterprise' becomes significantly riskier.
Likewise, pump and dump is illegal already and carries significnt penelties. In addition to clogging inboxes and defrauding naieve investors, they also do great economic harm to the penny stock companies that are targeted since their stock tends to end up worse off after the dump than before the pump. If the SEC actually pursued and prosecuted these fraudsters, they would stop.
That takes care of most of the spam. If we use "for the children" for good rather than evil for a change, we can also get rid of the sex toy and porn spam. Considering that spam is splattered everywhere, including wild guesses at potentially valid addresses, they are certainly not taking care to avoid soliciting children. why is it that the same prosecutors and detectives who would relentlessly pursue any XXX store owner who ever failed to throw a minor out of the store won't pursue spammers who actively invite children to buy their products and even preview for free?
Finally, the botnets themselves are built by committing felony tampering on a massive scale. Why is it that some kid hacks his way into one computer gets the book thrown at him, but a real criminal who hacks into MILLIONS of computers isn't pursued because "it's too hard"? Surely, anyone who commits millions of felonies is worth orders of magnitude more effort than some kid with a war dialer!
The FBI DID recently catch up with a few botnet operators. That's a good start, they should keep it up. The SEC and FDA should join them.
The repl|cas are about the only thing that might slip through the cracks, but even those may be violations of trademark law depending on how closely thay resemble the real thing. If they don't bear close resemblance, then they are mail fraud.
The short summary, the bulk of spam is connected with criminal enterprises. The process of zombifying a PC is a felony. There is no need to add new laws, just enforce the existing ones for a change. There is significant legwork involved, but on the other hand, if law enforcement just spends $30 or so a month on an ISP account, the spammers will effectively report their own crimes.