Slashdot Mirror
We Know Who's Behind Storm Worm
jmason reminds us of a story from a few weeks back that got little attention, adding "This doesn't seem to be just bluster; as far as I can tell, everyone who knows the RBN now agrees that this seems likely." Brian Krebs's Security Fix blog at the Washington Post carried a story about the Storm worm containing some pretty staggering allegations. "Dmitri Alperovitch [of Secure Computing] said federal law enforcement officials who need to know have already learned the identities of those responsible for running the Storm worm network, but that US authorities have thus far been prevented from bringing those responsible to justice due to a lack of cooperation from officials in St. Petersburg, Russia, where the Storm worm authors are thought to reside. In a recent investigative series on cyber crime featured on washingtonpost.com, St. Petersburg was fingered as the host city for one of the Internet's most profligate and cyber-crime enabling operation — the Russian Business Network. Alperovitch blames the government of Russian President Vladimir Putin and the political influence of operatives within the Federal Security Service (the former Soviet KGB) for the protection he says is apparently afforded to cybercrime outfits such as RBN and the Storm worm gang. 'The right people now know who the Storm worm authors are,' Alperovitch said. 'It's incredibly hard because a lot of the FSB leadership and Putin himself originate from there, where there are a great deal of people with connections in high places.'"
Corrupt Russian Government officials in collusion with shady Russian underworld types? Who'd a thunk it?
Shocking! You mean the criminal friends of powerful politicians don't get prosecuted in Russia? Good thing that never happens here!
Currently hooked on AMP
U.S. authorities have thus far been prevented from bringing those responsible to justice due to a lack of cooperation from officials in St. Petersburg, Russia...
No seriously though. This is no suprise. We can pretend that the US and Russia are the best of friends but in reality these kinds of situations will continue to happen. What is the Russian Governments incentive to take care of this issue. Like it or not it is good for their economy.
$diff terrorists hippies
$
$rm -rf *terrorists *hippies
Seriously ...could the whole point of this -from the Russian perspective at least, be that they can use or hire their local blackhats to wreak economic and/or civil damage (eg what happened to estonia) pretty much at will?
I'm not saying that's what Russia is actively doing -but what incentive would Putin have to dismantle a tool that could be used so effectively against his -and russia's- enemies?
why not blackhole the source IP blocks?
1. Provide RBN with Windows Vista
2. RBN gets slowed down repeatedly clicking "Da, continusky"
3. Battle over.
(Besides, if a minimum level of computer security was mandated, and critical machines were kept off public networks, cybercrime, worms and viruses would be reduced in quantity and effectiveness. The Government has a position open for Internet Czar - why is it not filled and why isn't it being used to push the importance of network security? Hell, I'd put in for the job if I thought I'd have a whelk's chance in a supernova of either getting it or getting heard afterwards.)
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
"Paranomocracy" is rule by criminals, as first used by Russian Ouspensky in a 1919 letter describing what he also called "kakourgocracy" the new Soviet rule by criminals.
--
make install -not war
We have high level gov. officials who are corrupt. Welcome to America^h^h^h^h^h^h^h France^h^h^h^h^h^h China^h^h^h^h^h Russia.
I prefer the "u" in honour as it seems to be missing these days.
In unrelated news, there are troubling reports of a new Storm Worm coming from mars. Random slashdot posts have appeared stating "In soviet Mars, The planet reddens YOU"
Agents are exploring a correlation. Slashdot has already modded them down as trolls.
"Teach a man to build a fire, and he's warm for a day. Set a man on fire and he's warm for the rest of his life."
You mean like this?
The problem with that thinking is that this ecosystem is entirely created by humans, and that there are no limits on population in the first place. The internet's not like an enclosed valley which can support 300 sheep no matter what. The limits on what the internet can handle are constantly expanding, and so far there's been little to no strain.
As for whether the worm is cool and impressive, well, that depends on what you think cool and impressive are. It's extremely well built, runs quite well and is hard to catch once it's entrenched. It's a lot like the mafia, and if you're like the rest of the US, that is cool. Also like the mafia, it's really only cool if you're the one running the show or you have little to no experience with it.
I had read through the Wikipedia page on Leo Kuvayev that he may be (one of the?) main guy(s) behind the storm worm botnet.
Here's the reference to Leo Kuvayev having a role with the storm botnet. Considering the massive amounts of spam that is pumped out for domains that he purchases, it wouldn't surprise me in the least.
Though according to his Crooked Registrar Partners, he apparently lives in Finland. Though I somehow doubt that he really owns an entire Finnish city, as his address would have you believe.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
What needs [my emphasis] to happen is cutting Russia completely off the net. Cut them off at every peering point they have, and if someone (China) still continues routing Russian network traffic, block the Russian network traffic where it's being passed onto the responsible part of the Internet.
Really, do you actually think about the practicality or plausibility of implementing your ideas in the real world?
This not only *won't* happen (as you acknowledge) but *can't* heppen without locking down the US's (or whoever's) part of the Internet so much that the cure will be worse than the disease. Even if you stop direct links to the US net, you won't be able to stop every peering point between Russia and elsewhere. It's going to be impossible to stop indirect traffic. Criminals will just figure a way around your idea of blocking Russian traffic that hides their true location. Since they have access to lots of compromised PCs in numerous countries that's one obvious route. The other obvious solution is to cut a deal- "legal" or "illegal" by whatever measure- with a third party in a third country that isn't blocked. Good luck figuring which connections are legitimate and which are proxies for the criminals.
And even if you block all *those* countries, they'll do it in two hops via a fourth country- so unless you have a 100% agreement between "good countries" and they have a 100% watertight block against traffic from the "bad" countries, you can't do it.
I'll tell you now that (a) You won't get such an agreement and (b) If you did, you still wouldn't be able to make sure that those countries' defences were watertight to your standards. So the only way to get what you want is to block all non-US traffic (assuming you live in the US) to an incredible degree. And this still probably won't work.
Your naivety and the flaw in your argument can be summed up by this phrase:-
the responsible part of the Internet
As if the Internet can be obviously (and easily) partitioned off into "responsible" and "irresponsible" parts! Even if it could, so long as either "part" is too big too isolate completely from the other, you can't stop traffic flowing. Therefore, there's only *ONE* Internet.
And it's not like that; the whole thing is just shades of grey; the US part might be more "responsible" by your measure, but it's still far from perfect.
There just has to be a better way of protecting the network from bad actors who are hellbent on destroying it.
Yes, and your easier-to-come-up-with-on-Slashdot-than-it-is-to-actually-implement-it idea isn't one of them.
the next alternative is diplomatic isolation. They don't do something to curb the fastest growing criminal activity in the world, well, gee, Vladimir, you don't get to sit on the Security Council
Yeah, it's that simple when you're a tough-talking behind-the-keyboard would-be-diplomat/politician.
Bottom line, I'm not justifying what Russia is doing, or how they're behaving, but your solutions are naive and clumsy in the extreme. The West isn't going to isolate Russia further (which Putin would probably be quite happy with) and risk escalation of political and military tensions simply to stop some crime which- although admittedly serious and large-scale- still doesn't warrant anything like that risk.
ballrooms in Geneva and you can most certainly kiss that EU membership you so want goodbye forever. And don't even think of vacationing on those nice ski resorts on the Alps Russians are so fond of. Visa denied.
Oh noes!!!!!11111
And that's why you're neither a diplomat or a politician. You think that such petty retribution would work and Putin would say "You're right! I'll do exactly what you say". Not a bloody chance. This is just the Slashdot equivalent of some guy down the pub/bar saying how he'd put the world to rights.
Putin would set his face against the West further (wh
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
Apparently the Storm worm is the world's fastest supercomputer. And even if it weren't, funneling whatever attacks the FSB might be likely to do through the Storm botnet would provide excellent plausible deniability.
Give me Classic Slashdot or give me death!
Putin and the like will be quite happy to see ordinary Russians cut off from external sources of information; they've already tried to shut down as many dissenting voices as possible, but the Internet is harder to deal with. They'll also be able to paint it as Western aggression and mistreatment when they don't get things their way. Double whammy for them!
So even if you think that inconveniencing ordinary people in this way will indirectly pressure the Russian government, it won't. Quite the opposite. At what point do we stop accepting their harboring of their criminals? There's gotta be a line somewhere. As I said, you assume criticism of your solution == non-acknowledgement of problem. This is not the case.
My post was a criticism of a transparently bad idea, and I had the gut reaction that it would be taken (by you or someone else) as a rejection of the problem itself.
Simply going with a bad and workable "solution" simply for the sake of doing something in the absence of a better idea is A Very Bad Thing. As I already pointed out, your solution would be *worse* than the problem anyway.
I suspect that people have already come up with better ideas than yours, which they (having greater insight into the issues) nevertheless concluded were flawed.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).