Largest Hacking Scam in Canadian History

vieux schnock writes "Police raided several homes across Quebec on Wednesday and arrested 16 people in their investigation, which they say uncovered the largest hacking scam in Canadian history. (...) The hackers collaborated online to attack and take control of as many as one million computers around the world that were not equipped with anti-virus software or firewalls."

Comments

Really?

[ImprovGuy]

Are there that many computers without anti-virus software or firewalls on the Internet?

Re:Really?

[Brian Gordon]

Are you serious? There are hundreds of millions of PCs in the world (billions?), and the vast majority of them aren't properly secured. Also the vast majority of them have 10 smiley toolbars and take 45 minutes to boot.

Re:Really?

[PrescriptionWarning]

Yes, there are that many Windows machines on the internet.

Re:Really?

[TheRealMindChild]

It doesn't even really matter at this point. Let's be honest... the average computer user doesn't know the difference between U2-Somesong.mp3 and U2-SomeSong.exe. It doesn't take much to write an application that would be able to run in a restricted user account... just connect outbound on port 80 for coordination, and for payload delivery. The code would be simple enough that you could change the binary significantly enough that the fingerprinting that virus scanners use are practically worthless.

That doesn't even address the vector of replacing the setup.exe (or equivalent) on, say, an Office 2003 cd posted on thepiratebay. Obviously, the install has to run as admin, so you pretty much know, you are a shoe in for a compromised machine for anyone who tries to install it. And again, it would be such a trivial, simple application, that you could change the attacking binary pretty much at will.

Re:Really?

[GreatBunzinni]

It doesn't even really matter at this point. Let's be honest... the average computer user doesn't know the difference between U2-Somesong.mp3 and U2-SomeSong.exe.

To make matters worse, some attacks may even occur if you are dealing with safe file types, like a PNG or even PDF. Some security problems exist due to the user's ignorance or idiocy but "some" isn't exactly the same thing as "all".

Re:Really?

[CarpetShark]

That doesn't even address the vector of replacing the setup.exe (or equivalent) on, say, an Office 2003 cd posted on thepiratebay.

Why stop there? Most of the Windows OS torrents are slipstreamed. There's no reason to assume they didn't slipstream a few viruses, bots, and backdoors in there too.

Re:Really?

[Anne Thwacks]

the average computer user doesn't know the difference between U2-Somesong.mp3 and U2-SomeSong.exe.

The average user cannot tell there is a difference - because the Windows default is to hide the extension!

It may be criminally insane, but its the default.

Re:Really?

[Anonymous Coward]

There's a web of trust on the piratebay with trusted uploaders. Installing an OS or running a keygen from a newbie uploader is virtually guaranteeing you to get a trojan downloader. I've been playing around with a few of the torrents from the piratebay and installing them on a separate vlan at home. It's very enlightening watching all the network traffic when the compromised OS calls home. I am pretty sure this is one of the primary "seeding" vectors for the nu-war storm network. I weekly find new morphed storm clients using these trojan downloaders and I always submit them to virustotal.com.

Moral of the story: Only trrrrust the pirates with the green skull. Arrrr.

Re:Really?

[ultranova]

To make matters worse, some attacks may even occur if you are dealing with safe file types, like a PNG or even PDF.

There are no safe file types. All files can be viewed as programs meant to run in a specialized virtual machine (the program which is used to open them). For example, a PNG file is a program which, when run, will compute an array of bytes (the image pixels). The same goes to PDF. In this view, since all files are programs, it is in principle possible that any of them could contain code which can result in unexpected behavior of the virtual machine executing them.

Of course some file types are easier to compromize than others, either due to sheer complexity or ambiguity of the specification or because they are Turing complete. However, it is impossible to guarantee that every viewer for any file type is free of defects. Anyone still remember ANSI codes for DOS, which could be embedded to text to change color but also to set macros to keyboard keys when the file was viewed ? And of course SQL injection attacks are based on formatting a text string so it will cause unexpected results, not to mention causing a buffer overflow with an overlong string.

I repeat: there are no safe file types. They all have a potential to contain malicious code, because there is no such thing as data which is not also a program. From a certain point of view, GIMP is simply a very specialized compiler...

Re:Really?

[digitalaudiorock]

The average user cannot tell there is a difference - because the Windows default is to hide the extension!

It may be criminally insane, but its the default. That's one that's driven me crazy for years. I'm sure it goes back to early days of Windows and their attempt to look more like Mac OS 9 (which got the file type info from the resource fork). Any time I do something for anyone on their Windows machine and the extensions are hidden I just change the setting...I don't even ask if that's what they want.

Who else here has ever been trying to walk someone though a software install over the phone and said "Now double click 'Setup'"...and they respond "which one"...because of course there's setup.exe, setup.ini, etc etc...just awful.

Re:Really?

[ultranova]

Is a text file containing a single line of text followed by a carriage return a program?

It can be. For example:

'; ROLLBACK; UPDATE users SET admin = true WHERE username = 'ultranova'; '

If the virtual machine which handles the username field of Slashdot login form naively passed this string to the database layer without specifically quoting it, this text string would make my account an admin account; well, actually, since I haven't studied Slashdcode, it propably wouldn't, but the point still stands: even text is not an inherently safe data format in all circumstances.

How about the standard input device? When I type at the console keyboard, is that a program feeding into a "virtual machine" created by the console driver?

The virtual machine in this case would be whatever program receives the input. And yes, the text you type is indeed a program being executed by that machine; each time it receives a keypress from you, that keypress instructs it to do something, right ? Even if that something is merely to output the letter (altought a text editor would also store the input internally, of course). And that is what a program is: a list of instructions.

If not, why is a disk device different from another device?

It isn't.

Re:Really?

[Bronster]

Our mx servers have a list of over a million machines which are blocked from talking SMTP to us for three days thanks to past bad behaviour. In a single hour nearly 200,000 of them tried multiple SMTP connection attempts.

Yes, I'd believe those numbers.

Re:Really?

[nopainogain]

and the repair of these poorly maintained PCs paid for my tuition and beer in college.
Long live idiots, for without them, being smart means nothing, and pays less.

Spot the key words

[Silver Sloth]

The hackers collaborated online to attack and take control of as many as one million computers around the world that were not equipped with anti-virus software or firewalls

Police won't reveal what the information was used for but investigators estimate that the network profited by as much as $45 million. Hmm... as many as, as much as, or maybe they're inflating the figures to show what macho investigators they are.

Re:Spot the key words

[powerlord]

Nah, nothing so covert. Its simply that, "as many as", sounds a lot better than, "three computers we know about, but we really have no clue" or "we found 5 million deposited in their bank accounts in the last month, but the accounts have been open for nine months, so who knows how much money they could have collected previously".

Alternatively they probably have a pretty good idea of the ranges involved, but hey, high numbers make a better press release.

Re:Spot the key words

[tlhIngan]

1 million machines in a network talking to each other would probably consume more bandwidth in network overhead than useful work. Even instructing 1 million independent machines to do the same thing would take a considerable amount of time/bandwidth (eg. send a spam email to each one plus a list of targets so they can begin spamming... that's a million emails you've got to send - might as well send the spam yourself).

Except that a good botnet doesn't have to have machines talking to each other. Each compromised machine just needs to find a few others to get its orders from, who gets its orders from someone higher in the chain, etc.

There doesn't have to be communications back to the server.

For spamming, each machine gets a list of a bunch of usernames from a peer who shares its list, and gets other addresses from other peers. That's why you can end up with multiple copies of the same spam in your inbox - the spammers don't care if you get 1000 copies of the same email. And the spambots don't bother marking off an email as sent to a specific address and tell everyone, they just run through their own lists.

This way, the only real communication happens top down, fire-and-forget method. If someone buys 1,000,000 emails, spammer can send out more just to ensure that 1,000,000 people got it. But since they're scammers, it doesn't matter if it went to 10,000 people 100 times.

Obligatory:

[powerlord]

Blame Canada! ... eh?

Re:Um, this is Slashdot...

[techpawn]

that were not equipped with anti-virus software or firewalls.

Hardware or software firewalls? After XP SP1 the windows "firewall" would count for most users.
Still recommend to install more than the paper tiger at the gate if you get that chance, but, anything is better than nothing for most users yes? If they mean hardware firewalls, I know very few home users that have one...

From TFA:

[Jurily]

[...] and face charges related to the unauthorized use of computers.

Surely they must mean unauthorized use of other people's computers?

Re:From TFA:

[Anonymous Coward]

I'd assume you're always authorized to use your own computer.

Then again, in today's climate, maybe not...

Re:From TFA:

[morgan_greywolf]

I'd assume you're always authorized to use your own computer. Nope. There are times when I'm not authorized to use my own computer. Just ask my wife! ;)

Re:So which is it?

[Anonymous Coward]

It's 16 Canadian people, or 14 Americans... it's just the exchange rate.

Hardly the first time Canada has caused problems

[elrous0]

Let us not forget Bryan Adams.

Re:So which is it?

[Iphtashu Fitz]

Both.

16 people were arrested.

14 of those 16 were arrested on Wednesday.

Sounds like advertising.

[TwoToeWilly]

This is one way for the anti-virus companies to stay in business.

Eh?

[lbmouse]

I moved here from Canada and they think I'm slow, but I'm really an über-hacker, Eh?

That summary needs fixing.

[Shados]

The hackers collaborated online to attack and take control of as many as one million computers around the world that were not up to date with patches and didn't have users with common sense.

There, thats better.

Re:That summary needs fixing.

[zakeria]

slight correction: The hackers collaborated online to attack and take control of as many as one million MS Windows computers around the world that were not up to date with patches and didn't have users with common sense.

Re:That summary needs fixing.

[VorpalEdge]

Common sense? Really? Most people, when they buy their first computer, expect it to "just work." They expect everything to be fine as it is, and for the patches (if they've ever heard of them) to be nice, but unnecessary.

After all, what they were sold is good enough, right? They didn't exactly buy the "turn your computer into a botnet zombie" feature (bad jokes featuring MS aside). They still expect companies to have integrity, and to make products that actually work, and that don't explode when you turn around. Common sense in this situation would be "companies can't ship products with security holes, they'd get sued!"

And yeah, I am aware that the parent is probably joking, but someone modded it insightful. :(

Re:That summary needs fixing.

[Shados]

We're in 2008. Even non-software products now get recalled, blow up, fall apart, are defective by design, are made in china (lol), all over the place. Go to Bestbuy and buy a headset at random (close your eyes and pick one), go up, and try it. 9 to 1 that thing will break within 2 weeks, sound will be crap, and it will be barely usuable.

All but the fanciest grocery stores will have expired stuff on the shelves if you look well enough. You have to be selective in what food you pick, make sure to read the expiration date, cook your meat to 160-170 degrees, etc.

Nothing works out of the box anymore. The only difference is that software doesnt always have to be recalled, it can be patched. But if you don't say informed, the ground beef you have in your fridge that got recalled...you'll never know it was. Thats "common sense" in this day and age.

Haha

[ViralInfection]

From the ages of 17-26.

Wouldn't you say the RCMP is just hunting down script kiddies?

Re:Haha

[necro2607]

You're joking, right? Younger people not only have more free time to pursue the motivation to hack & crack, but also tend to have more drive to do so, and less ethical reservations about doing so. You know how a lot of techie guys say "yeah, I used to be into that, but i grew out of it", well, that's generally the case with the vast majority of "hacker types" with malicious intent, except that a fair number of them actually pursue those motivations to a much further extent than others.

I used to hang out in chat rooms with guys who were developing their own exploits in C on netBSD machines they set up on their own, etc. etc.. (mid to late 90s).. They were all in their late teens, average of around 17 or 18 years old, no joke. There were a couple guys in college who were 20 or 21 or so, but really, the teens and early 20s is pretty much the prime time to delve into 'questionable' types of endeavours in the high-tech realm.

Oh, by the way, for a little personal anecdote, I cracked/hacked/obtained/whatever the admin password for our Mac lab in my elementary school when I was 9 years old, in grade 3 or 4 (and got banned from the lab for a while of course). Then again, I used utils I found on the net (a keylogger IIRC), but I still think that required a lot more knowledge and investigation than most 9 year olds are willing to pursue. Actually, I created a custom HyperCard stack that let me execute any program I had on a floppy disk - it just had to match the same type/creator code as any of the programs that were available in At Ease. That's pure hack-mindedness at work, and no outside help was consulted. ;)

The Unwritten Story...

[Panaqqa]

These arrests were in Quebec. What they are not telling us is that the arrests were REALLY for not hacking into the boxes using both official languages.

Re:Profitable

[calebt3]

they will probably server a couple years Someone needs more coffee.

Re:Hardly the first time Canada has caused problem

[i_ate_god]

As with a lot of our other trash, we simply shipped Celine Dion to America. Now she's your problem, enjoy.

Canadian Prisons

[Detritus]

Does Canada have any strict regime prisons? It certainly has the geography for it. Why not ship the script kiddies off to a work camp in the middle of nowhere for a few years.

Not enough coffee again.

[ColdWetDog]

Murderers barely serve jail time up here. Don't hold your breath.

I read it as Moderators ...

For one brief second, I thought there was real justice Up There.

Time to crank the espresso machine up again.

Prison...really?

[ALimoges]

It's funny because now it's all over the news here in Québec, and pseudo-experts are trying to explain *how* to secure one's computer. Don't you guys understand that Windows *is* insecure!

The people who got hacked are facing a maximum of 10 years in prison but with Québec's system, they really do 1/6 of this time so it's not that bad..

Re:So which is it?

[elrous0]

Well, I certainly didn't mean to insult the French Canadian race.

The "$45 million" profit claim is highly unlikely

[Master of Transhuman]

This sounds like the usual inflation of profit that law enforcement agencies love to do.

Most of the large-scale botnet scams I've heard of don't yield anywhere near that kind of money. The botnet operators maybe pull down $3-10,000 a month renting out the botnets. Even large-scale identify theft rings are reaching for anything like $45 million.

Unless these guys were targeting rich people, I don't see it. And since most of the alleged compromised computers were in South America, I doubt they hit a lot of rich people.