Slashdot Mirror
Top Botnets Control Some 1 Million Hijacked Computers
Puskas writes "Joe Stewart is the director of malware research at SecureWorks, and presented a dire view of the current botnet landscape at the RSA conference this week. He conducted a survey of the top spamming 'nets, extrapolating their size from the volume of emails that flow across the internet. By his calculations, the top 11 networks control just over a million machines, hitting inboxes with some 100 billion messages a day. 'The botnet at the top of the chart is Srizbi. According to Stewart, this botnet — which also goes by the names "Cbeplay" and "Exchanger" — has an estimated 315,000 bots and can blast out 60 billion messages a day.
While it may not have gotten the publicity that Storm has during the last year, it's built around a much more substantial collection of hijacked computers, said Stewart. In comparison, Storm's botnet counts just 85,000 machines, only 35,000 of which are set up to send spam. Storm, in fact, is No. 5 on Stewart's list.'"
Start with "microsoft" and "windows" as the technologies which bring you the largest, most profitable botnets!
you had me at #!
I'm a smart software developer, so I'm pretty sure my computer is not affected (secured hardware firewall, etc). But how can I be sure?
I don't necessarily trust that a clean-virus scan means a whole lot.
What's the best way to make this determination?
They obviously don't have a problem with tracking down and monitoring people. And they apperantly have bandwidth issue. Why don't they basically mail merge to SELECT * FROM `customers` WHERE `customers`.isinfected? Simple, cheap snail mail... nothing fancy.
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
God knows I installed on that notebook each and every Anti-Spyware, Antivirus, Anti-everything in order to get rid of it. I traveled each and every "advisory" site with my HijackThis logs, removed numerous keys from registry. Still, every now and then goddamn popup window with site "pc-on-internet.com" appears. I spent altogether perhaps 3 working days trying to remove stupid thing, there is lot of data and SW installed so I am trying to avoid re-installation. Now I am in sitting-in-the-corner-and-crying phase.
839*929
Be that as it may, "Kraken" is a superb name (as is "Damballa" itself.). "Bobic", "Oderoor" and "Bobax" sound like open-source CMSs. "Cotmonger" sounds like a word Bart Simpson would use when suddenly breaking into a unfunny Cockney accent for no reason.
What I'm listening to now on Pandora...
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
I had a botnet once... didn't catch very many bots, but I got a shitload of dolphins :(
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Please fwd me some spam selling whatever it is you're smoking.
If Windows weren't so dominant an OS then botnets would operate on other systems as well (or in its place). It's a question of ROI, nothing else.
That said, it's also not a question of an "offending operating system." It's a question of uninformed (or incompetent, or both) users. If they can't be trusted to not double-click on an xxxxx.jpg.exe file in an email, they are likely to have problems with identity theft and other non-Windows-exclusive security issues. Rather than taking away Windows, these users need to receive training in basic computer security.
Using Windows is NOT a privilege, by the way. If the user paid for it, they have a right to use it.
Cutting off internet and then asking for demonstration that... they've bought a Mac? Will this be demonstrated using ninja magic? A photo via mail?
I can't tell whether you're a Windows elitist, a Mac fanboy, or just plain mental.
I like basketball!!1!
The industry is going at this all wrong. There are only a few players left, and they're all crooks. We need a consortium of companies with spam problems to hire Kroll, Blackwater, or one of the other big international security companies to deal with the people behind the problem.
If 5% of the money spent on dealing with spam went into finding the people behind it and making them go away, the problem would go away.
Most infections actually patch and update machines they infect. Once they get in they seal the door behind them, as well as try to remove any competing infections already on the machine. That way they don't get their zombie stolen from them.
You never realize how much manually made unmanaged "linked" lists suck, till you have src.link.link.link.link...
If all ISPs and businesses would simply block egress tcp port 25 for all addresses on their network except approved mail servers, they would stop these botnets in their tracks.
Of course, the botnets would then be rewritten to try to discover the mail server the PC normally uses and try to use it instead. But is ISPs enforced SMTP authentication to send, it would make it more difficult. Even if the botnets got past all that, it would now be easier to track down exactly who has the infected computer.
Of course many ISPs won't do this because it will make them more directly responsible for preventing spam, preventing viruses, and keeping their customers computers clean.
Once you know the PC is compromised you cannot get it back to a known good state. The best you can hope for with the various utilities is to get it workable enough to offload your data, build your recovery media and record your settings. You're actually better off removing the hdd to an external enclosure and installing fresh on a new one. You could then scan the removable device before carefully recovering the data from it. The worst possible thing you could do is eliminate the visible problems and pretend that means you have a good PC on which to do work.
What is pwned cannot be unpwned. Reinstall. Somewhere in my journal may be some helpful instructions for getting the reinstall done without becoming compromised in the process. You're not the first (or the ten thosandth) person here this has happened to.
Somebody else here will have suggested you try Linux by now, or Apple. There are no Linux or Apple botnets so they don't have this problem. The do have security vulnerabilities too, but compromising one of them is a retail, rather than a wholesale, endeavor and so less fruitful for the botmasters.
Help stamp out iliturcy.
Yes, they'll have other security-related problems, so I won't dispute that users are a huge part of the problem. BUT: Windows really is a special case. Give a clueless user another OS, and they will run malware or otherwise join botnets far less often, and not because of ROI or what platforms that malware authors choose to target. Outside of Windows, most naive users do not know how to even deliberately execute an email attachment. They wouldn't just have to click on xxxx.jpg.exe; they'd have to save it and chmod +x it first, since (AFAIK) no email clients go to extra trouble to help users execute malware.
Windows and its applications have an unusual amount of "support" for running malware. (Executable-by-default is just one feature; there's also autorun, ActiveX, and fuck-knows-what-else.) These are technical (not marketshare-related) "features" of the platform, which most other OS creators have not elected to implement. Windows would be attractive to malware authors even if it had a small marketshare, because the platform is malware-friendly.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
I just block everything incoming on port 25 from IP blocks in the US, apart from a (very small) handful of whitelisted servers.
This thread was all one person.
DRM: Terminator crops for your mind!
WHO IS CLICKING ON THE LINKS IN THESE EMAILS?
Why does spam work? Who are these stupid people and why do they click? Also, if you get 80 spam a day for the same fake product, why would pick one at random and say, "der, I think I'll go buy this!"
Can someone please tell me why?
I wish some news reporter would send out a billion spam but then, instead of taking money from the people who click, contact them and do an interview. I want to know who these people are and what the hell they are thinking.
Regardless of platform, most users
1) Run as root, administrator, or some other super-trusted user account and completely disregard security
2) Open anything they receive in email. I've even had some users do a Save-As giving the file the correct extension to be runnable!
These are a result of fundamental flaws in the design of Windows, Unix, et al. Most operating systems assume that all programs should have the ability to do whatever the user can do. In other words, programs are as trusted as the user account they run under.
Given people's experiences with OS X's admin dialogs or Vista's UAC, I'm not sure changing this assumption will lead to more security either. Most users, when presented with a dialog box, will immediately press whatever button is required to dismiss the dialog without reading it.
Even if the default is cancel, the first time they hit "naked ladies.jpg.exe", get a warning, and dismiss it they'll just figure they did something wrong and open it again, choosing the other option this time.
I'm not sure what the solution is.
Natural != (nontoxic || beneficial)
There are a good chart mapping current botnets and spam at Marshall TRACE center (updated frequently afaik). That over 80% of all internet spam comes from botnets (and almost 50% of it just from srizbi) is a good sample of what is the impact of this kind of spam sources.
Bull.
I have a legitimate right to send SMTP from my machine - and I do so. I also run an SMTP server at home - have since 1993, when I got off of uucp.
I have never been an open relay, and access is passwd. I already have assholes at AT&T blacklisting me for no reason - and suffering their ridiculous petition process to get off their RBL.
This is the Internet. A collection of networks. ISPs are not cops, nor should they be. When you mandate this on common carriers, they become something else - and any slim protections we still have remaining will be long gone.
"Flyin' in just a sweet place,
Never been known to fail..."
Care about privacy? Read this!
My home ISP just started outbound blocking traffic from DSL customers to port 25 a few days ago, which has stirred up some controversy. Maybe I'm just imagining things, but I believe my connection has been faster since then. We're always suffering from bandwidth problems (the downside of being on the end of a very long cable across the Pacific) so anything that eliminates our share of 100 billion daily spams clogging the line is a good thing in my book.
On mail servers I use spamdyke to immediately drop connections from end-user IP addresses (using the reject-ip-in-cc-rdns rule and Spamhaus PBL) and it's been remarkably effective.
If everyone did this, the botnets would be useless.
"Patriotism is your conviction that this country is superior to all other countries because you were born in it." -- GBS
No but this is the whole point (I think) ...
... people running Linux are less likely to contract nastys for the simple reason they are more likely to be tech savvy in the first place !!!
... why can't I just double click it ?
... but it takes exactly the same time to lock down windows into a relatively safe platform, as it does to unlock linux into a relatively USEFUL platform.
Anyone who has enough tech savvy to manage to save something and then chmod+x something IS NOT NAIVE !!!
Just as someone who (like myself) will always save and virus scan something before opening it IS NOT NAIVE !!!
So you defeat your own argument
But try telling someone who ISN'T computer literate that sorry, "you'll have to save it first and then do x,y,z before you can use it", will reply "fuck that"
And THIS is what the Linux fanboiz will not admit - it's not the O/S, it's the users.
Now admittedly, because of the market share (whether you like it or not), more people will get Windows which is by nature open rather than closed by default
In the last two months I have seen a huge increase of spam from distributed locations around the world and I get them in bursts at irregular times. The new junk is the backscatter spam that they send to other people, existing or not, and resultant rejections if they don't existing gets bounced to us. I think that burst of spam is bots controllers telling their slaves to send out spam simultaneously thus the resulting spam burst on my system.
If someone can find the most of bot controllers and then "cleans" those slave systems so there are less of them so we can have some peace. I'm not advocating killing them like the Russian Mafia:
http://it.slashdot.org/article.pl?sid=07/10/11/2157244
but torture them until they relinquish the password to their system so we can find out where the slave systems are. I have no problem sending them to some gulag in some God forsaken former Communist country have them beaten the living daylights out of them.
There has to be some attempt at control. Obviously too much control is a bad thing, but no control is just as bad. Anarchy doesn't work as a government, why would it work on the internet?
I do not agree with blocking port 25 traffic and only allowing designated SMTP servers, but I do believe it is the ISP's and the end user's responsibility to make sure infected machines are handled in a quick and effective manor. The ISP should monitor their network for this type of activity and contact the end user so that the problem can be addressed. If the problem isn't addressed, the end user's computer doesn't need to be on the internet.
I don't want to hear that crap about "it's my computer I can do what I want" either. You're not allowed to drive on the sidewalk just because it's your car.
A friend of mine is investigating an interesting approach to spam.
From this article it quite clear that chasing the source of the spam is quite pointless.
His research is into tracking the destination.
Spams only make sense if they can make some money from it. This means the payload(content) must lead
someplace with a URL to order, a URL with adds, or a phone number for orders.
His blog is at:
http://spamdirect.blogspot.com/
I have to push him to post some of the more interesting stuff he has discussed in E-Mails with me.
One very odd note.
My domain unmailable.com get's no spam!
without any filters and addresses even posted publicly there is just no spam to it.
I think they must remove any mail reference to unmailable assuming it must not be a real domain.
I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso