Slashdot Mirror
Storm and the Future of Social Engineering
Albert writes "Storm shows several key characteristics, some new and advanced. It uses cunning social engineering techniques — such as tying spam campaigns to a current event or site of interest — as well as a blend of email and the Web to spread. It is highly coordinated, yet decentralized — and with Storm using the latest generation of P2P technology, it cannot be disabled by simply 'cutting off its head.' In addition, Storm is self-propagating — once infected, computers send out massive amounts of Storm spam to keep recruiting new nodes."
The worm's been around for the better part of a year now and these features are in it from the beginning.
Something bad is coming when people are suddenly anxious to tell the truth.
This is just a puff piece for IronPort - nothing to see here, move along
init 11 - for when you need that edge.
Social engineering is often a bit of a self created problem. Look at this (legitimate, yes, I confirmed) email I got today. I reported a very easily reproducible bug, in a internet hosting (for a client) software package. Here is there response:
Hi Eric
Please forward us the username and password that your using so we can login and test this problem
Cheers,
Bruce Renner
Betta Computer Services Pty Ltd
Unit 2 / 55 Tradelink Rd, Hillcrest, 4118
Ph: 3809 2999
Fx: 3809 3999
http://www.bettacomputers.com.au
Note: This message may contain privileged and confidential information that is the property of the intended recipient. The information herein is intended only for use of the addressee. If you are not the intended recipient, then you are requested to return e-mail to Betta Computer Services Pty Ltd and destroy any copies made. Copying or disseminating any of this message is prohibited. Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of Betta Computer Services Pty Ltd.
Oh, and the sun came up this morning.
Paging Michael Crichton?
http://en.wikipedia.org/wiki/Prey_(novel)
hai guise theirs still a thing called 'storm' and itz bad
the blurb doesn't even SAY anything beyond that, and the 'article' is a skinny summary that has a cute lil stupid graph in the middle... and a solid bracing of two columns of ads on either side.
Does any article with the word "storm" in it get published...?
That which does not kill us makes us... st
Since the article mentions "and with Storm using the latest generation of P2P technology"
I think the only reasonable solution to this is to for all of us to call our ISPs and demand that this "P2P" thing be either throttled back or somehow forced to stop, perhaps by sending out fake RST packets whenever the ISP sees "P2P traffic. Yeah, let's all do that so we can nip this Storm bot in the bud.
Karma: Excellent. 15 moderator points expire sometime.
How can we teach everyone to pay attention when their computers slow down, the disks thrash, lights on the cable modem go nuts, and strange bounces appear in their email? This isn't rocket science. We need to get the word out!
Those are my principles, and if you don't like them... well, I have others.
Not surprised.
Took it's time.
Why isn't every virus doing this?
Seriously, this has always been possible, always been a threat. It's not surprising. It's "different" but you can't even call some parts of that "new"... other people thought of these things years ago.
I wouldn't be surprised if the next step is an "evolution"... instead of a simple worm, we get a virus that changes itself programmatically to avoid detection, uses information from previous successful hacks to propogate itself (e.g. "People click on me if I claim to be from this website... I'll send out some more of me claiming to be from that and similar websites"), or authors piggy-back increasingly more complex viruses on the back of Storm, so that eventually there is just a "swarm", instead of a "Storm".
And then the "virus swarm" will be seen as a single entity and you'll be defending your computers against it and reading adverts for "Anti-SWARM" software, etc.
Because people don't care.
If you're car display lights up and flashes, people take notice but still I've seen people ignore the warning lights and just drive (sorry, but women are actually the worst culprits).
A computer is a black box to people and a few flashing lights/slowness mean nothing to them. It could be that their P2P app has just kicked in or their printer is printing or a million other things... people can't diagnose it, therefore they don't care about it.
You will *not* educate the masses, no matter what damage you do to their computers - these people are buying new computers every year because "the old one got slow", where in reality it was running at the same speed but just bogged down with viruses.
The way to do it is not to trust them to be able to spot it, or need to. That is, make a computer that takes care of such things. This is what privilege seperation do when they are implemented properly, but even on the strictest controlled networks, you'll find something users can do that wasn't designed for or intended. However, the fix is in the design and execution, not the dumb idiot who just wants to send an email to his family.
(2) Fewer than 25 percent of attacks did or did not take advantage of a known or unknown vulnerability...
No way ! It can do this ? That's unbelievable
For those who need a little reminder about what is a worm (such as the guy who wrote the article), here is the definition of a worm by Wikipedia
A computer worm is a self-replicating computer program. It uses a network to send copies of itself to other nodes (computer terminals on the network) and it may do so without any user intervention.
I know that this is what anti-virus companies do, but the way people talk about Storm and similar bot nets, makes it sound as though there is some elusive quality which allows it to do all these unexpected things. What gives? It's just a program. What's the big deal? Or IS there a big deal? I've never been infected.
-FL
Help! Help! I'm being repressed!
Of course newspapers leave headlines that leave me as a mass murder like --Storm kills 300 in the Philippines -- --Storm leaves orphans homeless-- --Storm invades your privacy-- --Storm discontinued by geo-- --Storm discontinued by Coca Cola--
Storm
My disks often show activity when the machine is "just sitting there". My DSL modem lights often blink for no apparent reason. When I do a top, I see several dozen processes, any one of which could be logging data, doing garbage collection, looking for updates, or doing any number of innocuous things. Just because a computer is active when you don't think it should be, doesn't necessarily mean that it's infected with anything.
When our name is on the back of your car, we're behind you all the way!
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
I'm tellin ya, find the guys who write a couple of these things, or that run a bot net or even a small spamming operation, charge them with crimes against humanity or some such garbage, and kill them very slowly on live TV... Then take away everything their families own... money, property, put them out on the street. SPAM would stop soon after the second or third execution and the world will be better for it.
.. I wouldn't be surprised if the next step is an "evolution"... instead of a simple worm, we get a virus that changes itself programmatically to avoid detectionSorry friend - we've had those kind of viruses for a long time now - http://en.wikipedia.org/wiki/Polymorphic_code http://en.wikipedia.org/wiki/Metamorphic_code
and with Storm using the latest generation of P2P technology, it cannot be disabled by simply 'cutting off its head.'
I suspect a few public decapitations of the people running Storm would put a pretty quick stop to it. Just gotta pick the right targets, see.
Done with slashdot, done with nerds, getting a life.
How are they supposed to know those symptoms aren't just Vista doing some kind of indexing or whatever on their computer?
If 'the people' in Amendment 2 are 'the state' then Amendments 1, 2, 4, 9, and 10 benefit the state, not you.
A little bleach in the gene pool would go a long way
It's indeed very very hard to educate the masses.
I'm not sure if the following can be called "giving up" and I don't want to start a whole X vs. Y war here either, but I've been sending all acquaintances with relatively little computer knowledge to the Apple store for about a year now.
Not because Macs are for people with no technological knowledge and all that kind of nonsensical reasoning, but just because it gives them a pretty interface while being relatively safe. It will not protect the user from every threat, but many of them know that 'iPod-thingy' and can navigate around using the dock etc. relatively quickly after switching.
So far it has saved me a lot of time and frustration while keeping the users quite happy.
According to this article it is possible to "frame" IP addresses using the bittorrent protocol, and convince the RIAA that a non-infringing IP address (for example, a networked printer) is hosting their precious music.
If worm-compromised hosts can be automatically identified (say, the originator of every piece of spam that I get), why not frame them, and then RIAA will send take-down notices to their ISPs? Either this forces the RIAA to work a little harder before harrassing people, or a bunch of worm hosts get knocked offline (or both).
Step 3: PROFIT!