Slashdot Mirror
Top Botnets Control Some 1 Million Hijacked Computers
Puskas writes "Joe Stewart is the director of malware research at SecureWorks, and presented a dire view of the current botnet landscape at the RSA conference this week. He conducted a survey of the top spamming 'nets, extrapolating their size from the volume of emails that flow across the internet. By his calculations, the top 11 networks control just over a million machines, hitting inboxes with some 100 billion messages a day. 'The botnet at the top of the chart is Srizbi. According to Stewart, this botnet — which also goes by the names "Cbeplay" and "Exchanger" — has an estimated 315,000 bots and can blast out 60 billion messages a day.
While it may not have gotten the publicity that Storm has during the last year, it's built around a much more substantial collection of hijacked computers, said Stewart. In comparison, Storm's botnet counts just 85,000 machines, only 35,000 of which are set up to send spam. Storm, in fact, is No. 5 on Stewart's list.'"
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Please fwd me some spam selling whatever it is you're smoking.
If Windows weren't so dominant an OS then botnets would operate on other systems as well (or in its place). It's a question of ROI, nothing else.
That said, it's also not a question of an "offending operating system." It's a question of uninformed (or incompetent, or both) users. If they can't be trusted to not double-click on an xxxxx.jpg.exe file in an email, they are likely to have problems with identity theft and other non-Windows-exclusive security issues. Rather than taking away Windows, these users need to receive training in basic computer security.
Using Windows is NOT a privilege, by the way. If the user paid for it, they have a right to use it.
Cutting off internet and then asking for demonstration that... they've bought a Mac? Will this be demonstrated using ninja magic? A photo via mail?
I can't tell whether you're a Windows elitist, a Mac fanboy, or just plain mental.
I like basketball!!1!
The industry is going at this all wrong. There are only a few players left, and they're all crooks. We need a consortium of companies with spam problems to hire Kroll, Blackwater, or one of the other big international security companies to deal with the people behind the problem.
If 5% of the money spent on dealing with spam went into finding the people behind it and making them go away, the problem would go away.
That's the same reason NIMDA went after Apache, Slammer hit LAMPs... Oh, wait, they didn't.
If all ISPs and businesses would simply block egress tcp port 25 for all addresses on their network except approved mail servers, they would stop these botnets in their tracks.
Of course, the botnets would then be rewritten to try to discover the mail server the PC normally uses and try to use it instead. But is ISPs enforced SMTP authentication to send, it would make it more difficult. Even if the botnets got past all that, it would now be easier to track down exactly who has the infected computer.
Of course many ISPs won't do this because it will make them more directly responsible for preventing spam, preventing viruses, and keeping their customers computers clean.
Once you know the PC is compromised you cannot get it back to a known good state. The best you can hope for with the various utilities is to get it workable enough to offload your data, build your recovery media and record your settings. You're actually better off removing the hdd to an external enclosure and installing fresh on a new one. You could then scan the removable device before carefully recovering the data from it. The worst possible thing you could do is eliminate the visible problems and pretend that means you have a good PC on which to do work.
What is pwned cannot be unpwned. Reinstall. Somewhere in my journal may be some helpful instructions for getting the reinstall done without becoming compromised in the process. You're not the first (or the ten thosandth) person here this has happened to.
Somebody else here will have suggested you try Linux by now, or Apple. There are no Linux or Apple botnets so they don't have this problem. The do have security vulnerabilities too, but compromising one of them is a retail, rather than a wholesale, endeavor and so less fruitful for the botmasters.
Help stamp out iliturcy.
Yes, they'll have other security-related problems, so I won't dispute that users are a huge part of the problem. BUT: Windows really is a special case. Give a clueless user another OS, and they will run malware or otherwise join botnets far less often, and not because of ROI or what platforms that malware authors choose to target. Outside of Windows, most naive users do not know how to even deliberately execute an email attachment. They wouldn't just have to click on xxxx.jpg.exe; they'd have to save it and chmod +x it first, since (AFAIK) no email clients go to extra trouble to help users execute malware.
Windows and its applications have an unusual amount of "support" for running malware. (Executable-by-default is just one feature; there's also autorun, ActiveX, and fuck-knows-what-else.) These are technical (not marketshare-related) "features" of the platform, which most other OS creators have not elected to implement. Windows would be attractive to malware authors even if it had a small marketshare, because the platform is malware-friendly.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
This thread was all one person.
DRM: Terminator crops for your mind!
Regardless of platform, most users
1) Run as root, administrator, or some other super-trusted user account and completely disregard security
2) Open anything they receive in email. I've even had some users do a Save-As giving the file the correct extension to be runnable!
These are a result of fundamental flaws in the design of Windows, Unix, et al. Most operating systems assume that all programs should have the ability to do whatever the user can do. In other words, programs are as trusted as the user account they run under.
Given people's experiences with OS X's admin dialogs or Vista's UAC, I'm not sure changing this assumption will lead to more security either. Most users, when presented with a dialog box, will immediately press whatever button is required to dismiss the dialog without reading it.
Even if the default is cancel, the first time they hit "naked ladies.jpg.exe", get a warning, and dismiss it they'll just figure they did something wrong and open it again, choosing the other option this time.
I'm not sure what the solution is.
Natural != (nontoxic || beneficial)
As it is nowadays impossible to have complete insight into all your running softwere let alone your hardware, you will never be sure. But you can have confidence
Firewalls don't help, if you navigate to a BadWare URL, and request an exploit on port 80!
"Flyin' in just a sweet place,
Never been known to fail..."
You can't.
Not even Linux boxes are safe from hacking.
An anti-virus scan is totally worthless. In fact, most systems slow your machine down so badly that they're worse than useless. Norton slows your machine down by thousands of percent!
Let's be honest here. In my lifetime, I've spent less than $100 (one hundred dollars) on my security systems. That gives me a D-Link firewall, Avast!, and Spybot. The hackers have access to the same materials. If they want to write a program that gets around my meager defences, then they can. I live only by my obscurity, enhanced by my slight tweaks to my firewall. (Dropping pings, blocking port 113, etc.) As far as a passive scan goes, I don't exist. I simply wouldn't survive a concentrated attack.
That's probably okay, though - it's like when I lock up my bike. I have a kryptonite U-lock that I put through both wheels and the frame. I also take the seat with me and remove all the shiny bits. (It also has a VHF transmitter, but that's another story.) It would take someone with a plasma torch two or three seconds to cut the bike rack and put my bike into a truck. However, that's not worth your average meth-headed bike thief's time. It's easier for him to take another bike that's not as secure. If a dedicated professional wants my bike, then he's going to get it.
The major problem with Windows is that when you take your machine home and plug it in, it can be easily compromised. The same is true with a lot of commercial-grade routers with firewalls. The default settings leave a lot to be desired. Your firewall still sort of works, but you're not getting the same level of protection that you'd get by changing some settings. Just two days ago, we had an article about the 2-wire security holes, showing that a large percentage of IDSN home users in North America are wholly unprotected against external attacks.
So why do we have what we have? It's simple. We have a lot of programs written by people who simply do not understand security issues. Windows, for example, is perfectly stable until you start to put 3rd-party software on it. Then it starts to crash because the memory is being used in two or more different ways. Take a look at some of the snippets on thedailywtf to see what sort of quality work you end up with when you have people who "can program" and can't understand basic math (if you work unpaid overtime, that's you.) writing important code for important systems.
What's required to fix it is a wholesale change in CPU architecture along with mandatory licencing and regulation for anyone who wants to program anything in any language and sell it. (If you put up a dividing wall in your house, you can get the supplies at Home Depot and DIY. If you want to sell a wall-building service to the public, you have to be licenced.)
Only once we take programming as seriously as we take bridge construction and land surveying will we start to see safer computing.
---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
Congratulations on eliminating hobbyist programming and having nothing left BUT the megacorps like Microsoft. No thanks. It's suitable for engineering firms where physical harm can be done, but it's definitely not suitable for software. This is nothing more than a legal framework for Trusted Computing.
Care about privacy? Read this!
If it costs you $500 to rent a chunk of botnet bandwidth for a few days. It blasts 1,000,000 of your spam. 25,000 of them survive all the layers of filtering (2.5%) and are viewed. 1000 of those (4%) get their link clicked on. 100 of those people (10%) actually buy the product, netting you $15 each, for a total of $1,500 in untaxable income. That's $1,000 total profit for your 30 minutes of work.
So of that 1,000,000 spam you sent, only 100 had to be actually bought for you to turn a big buck. (1-100th of 1%)
Do the math, that's why it works. Spam works due to cheap volume. Anything works if you can have cheap volume.
I work for the Department of Redundancy Department.
No but this is the whole point (I think) ...
... people running Linux are less likely to contract nastys for the simple reason they are more likely to be tech savvy in the first place !!!
... why can't I just double click it ?
... but it takes exactly the same time to lock down windows into a relatively safe platform, as it does to unlock linux into a relatively USEFUL platform.
Anyone who has enough tech savvy to manage to save something and then chmod+x something IS NOT NAIVE !!!
Just as someone who (like myself) will always save and virus scan something before opening it IS NOT NAIVE !!!
So you defeat your own argument
But try telling someone who ISN'T computer literate that sorry, "you'll have to save it first and then do x,y,z before you can use it", will reply "fuck that"
And THIS is what the Linux fanboiz will not admit - it's not the O/S, it's the users.
Now admittedly, because of the market share (whether you like it or not), more people will get Windows which is by nature open rather than closed by default
In the last two months I have seen a huge increase of spam from distributed locations around the world and I get them in bursts at irregular times. The new junk is the backscatter spam that they send to other people, existing or not, and resultant rejections if they don't existing gets bounced to us. I think that burst of spam is bots controllers telling their slaves to send out spam simultaneously thus the resulting spam burst on my system.
If someone can find the most of bot controllers and then "cleans" those slave systems so there are less of them so we can have some peace. I'm not advocating killing them like the Russian Mafia:
http://it.slashdot.org/article.pl?sid=07/10/11/2157244
but torture them until they relinquish the password to their system so we can find out where the slave systems are. I have no problem sending them to some gulag in some God forsaken former Communist country have them beaten the living daylights out of them.
You had a great post up until the end.
"What's required to fix it is a wholesale change in CPU architecture along with mandatory licencing and regulation for anyone who wants to program anything in any language and sell it. (If you put up a dividing wall in your house, you can get the supplies at Home Depot and DIY. If you want to sell a wall-building service to the public, you have to be licenced.)
Only once we take programming as seriously as we take bridge construction and land surveying will we start to see safer computing."
Such suggestions are worse than the problem. Suggesting that people should need a licence to program and comparing it to bridge builders and surveyors is like suggesting people should have to get a licence to walk, just like they need a licence to drive a car.
Except that Windows has you run as administrator so malware can do damage to the O.S. where as Mac and Linux run as a user so malware can only damage the user account. Malware rates might be the same with a similar user base but the damage done would still be vastly different.
Tired of all the isms, don't exploit people as an employer, or a government, mmmmK?
Not simply hobbyists, this would cause major issues for the entire open-source world!
There has to be some attempt at control. Obviously too much control is a bad thing, but no control is just as bad. Anarchy doesn't work as a government, why would it work on the internet?
I do not agree with blocking port 25 traffic and only allowing designated SMTP servers, but I do believe it is the ISP's and the end user's responsibility to make sure infected machines are handled in a quick and effective manor. The ISP should monitor their network for this type of activity and contact the end user so that the problem can be addressed. If the problem isn't addressed, the end user's computer doesn't need to be on the internet.
I don't want to hear that crap about "it's my computer I can do what I want" either. You're not allowed to drive on the sidewalk just because it's your car.