Zombie Network Explosion

anti-globalism writes "The number of compromised zombie PCs in botnet networks has quadrupled over the last three months. Shadowserver tracks botnet activity and the number of command and control servers. It uses a variety of metrics to slice and dice its figures based in part on the entropy of botnet infections. The clear trend within these figures is upwards, with a rise in botnet numbers of 100,000 to 400,000 (if 30 day entropy is factored into equations) or from 20,000 to 60,000 (for five day entropy)."

Comments

Comment removed

[account_deleted]

Comment removed based on user account deletion

Interesting.

[scott_karana]

Interesting. Far more interesting to me, however, is speculating on how botnets quadrupled in the part three months.

Re:Interesting.

[Neil Watson]

I've seen a large increase in SPAM with virus payloads.

Re:Interesting.

[v1]

Probably safe to assume a new hole was found in something windows-ish and is making the rounds, gathering up all the vulnerable machines.

We're likely to see the number decline gradually as people patch up the hole. Trends like this have a sawtooth pattern to them. Sudden jump up, and then gradual decline over time back down to where they started, and then repeats with the next new vulnerability making the rounds.

Re:Interesting.

[Lumpy]

That's odd.

I mostly have a email box full of messages that simply state...

BRAINS!!!!

I hate Zombie explosions, leaves festering goo all over the place.

Re:Interesting.

[Amouth]

i am sure everyone here remembers the code red worm.. few remember the code green worm (the one that spread the same way the code red did but it patched the infection and prevented further infection once it made it in)

i honestly thing it would be a good idea to start doing this - to have a group write patchs that spread in the same way the viruses do

Re:Interesting.

[M1rth]

Probably safe to assume a new hole was found in something windows-ish and is making the rounds, gathering up all the vulnerable machines.

Before someone jumps on the "everyone should use Linux" bandwagon, Windows has over 90% of the market. Windows also has much more of the casual user market and much less of the enthusiast market - and the casuals don't keep a hawklike watch on their system.

Therefore, if you want to make a big botnet, compromising Windows is the way to go.

Someone found a new vulnerability, but didn't publicize it. Or they're exploiting the same old vulnerabilities (PICNIC, blank admin passwords, etc) and just stepped up their efforts again.

If your machine's admin password is blank and you're not behind a NAT, you are completely exposed. All the botnet guys have to do is get into the system through XP Pro's originally configured default drive shares and replace one commonly used file (say, a favorite new video game) with their payload. The user reinstalls the game figuring it got corrupted and it wipes out how they originally got in - but they're already in the system with a rootkit installed from the time the user tried to run your game, and it's a bot.

The unfortunate reality is that the largest vulnerability is, and will be, the human element. They want their login to be "easy" - so anyone who gets physical access to the machine gets root access with no password credentials, or they use a trivially-cracked password. They want to "simplify" their security arrangements. They trust an email sent by their friends (or sometimes even spoofed to look like it came from themselves) or "system administrator at your domain."

End result? More vulnerabilities.

Unfortunately, the "solution" involves either telling a lot of crybabies "no, you can't have it this way" or else changing human nature. And it's not in human nature to stand up to the crybabies (actually, an actual corporation never would - it's "bad customer relations.")

Re:Interesting.

[TheRaven64]

In theory, it's a good idea. In practice, what happens when there's a code orange worm, one which patches the old vulnerability and then creates a new one? What happens if you're DoS'd by a load of Code Green worms all looking for machines to disinfect?

Re:Interesting.

[0100010001010011]

So where do the gray hat ethics come into play with fixing these? I'm tired of spam. I've seen a huge spike recently, if I could figure out how to deliver a playload to these computers that would 'fix' them I'd do it in a second.

I can't imagine that there aren't more people out there with the know how that are annoyed by this.

Re:Interesting.

[Anonymous Coward]

I don't know I would make the windows assumption. I ran a small web hosting company a few years ago on a dedicated linux box. Eventually the version of red hat I was running was out of date and vulnerable. I was too lazy to update it and I got botted. In the end, its why I stopped the business. (there are lots of other reasons, but it was the straw that broke the back.) I take responsibility for not keeping the machine up to date, not blaming linux, but I just wonder how many other people out there are in a similar situation.

Re:Interesting.

[BenEnglishAtHome]

I've seen a large increase in SPAM with virus payloads.

I assume you mean SPAM as per the currently common definition, unsolicited email. I'd like to add that I've seen a big increase in virus-laden spam (in the original electronic sense) in the form of postings to usenet binary groups.

I don't like this at all.

Re:Interesting.

[bazonic]

Probably safe to assume a new hole was found in something windows-ish and is making the rounds...

Yep. It's called "users." If I had a dollar for every time a relative or friend downloaded free animated smileys or a free game that completely compromised their system, I'd be able to, well, buy an iPod Shuffle. "Why is my system running so slow?" And that's just the stuff they invited into their machines.

Re:Interesting.

[Anonymous Coward]

It's a poor idea because of liability issues, and the fact that altering the data in a computer without authorization is illegal. It also provides a defense for the bad guys (e.g. they write a "patch" with a subtle flaw in it, then claim it was with the best of intentions).

What if a "benign" patch takes a server down and it was performing a critical function, and lives are lost (e.g. an ambulance routing service) - who is liable? Arguing that the server was vulnerable anyway to some other malware won't get you very far.

Further, regardless of the legalities, if an administrator discovers their machine has been changed without their knowledge, they basically have to wipe it and start again, whether the patch was well intentioned or not (how can they be sure?), so it still causes economic damage.

Re:Interesting.

[Sopor42]

His assumption is still sound. In your case, the user allowed his PC to be compromised by not keeping it up to date. Non-"enthusiast" users are less likely to keep their software up to date. Non-"enthusiast" users are more likely to be using Windows.

Just because you happened to have been running Red Hat and would probably be considered an "enthusiast" user, doesn't mean that Windows is not the easiest OS to hack, purely based on the user element.

Re:Interesting.

[Fex303]

i am sure everyone here remembers the code red worm.. few remember the code green worm (the one that spread the same way the code red did but it patched the infection and prevented further infection once it made it in)

i honestly thing it would be a good idea to start doing this - to have a group write patchs that spread in the same way the viruses do

I'd never heard of Code Green, but I do recall Welchia.

And that was terrible. It did bizarre things to some people's computers, crushed LANs as it tried to spread, and as bonus made up a substantial amount of net's traffic for a while.

While it's a cool idea in theory, in practice it ends up very inelegant, very fast.

Re:Interesting.

[MrNaz]

Yea but if you write a virus to kill their viruses, then your virus could mutate into something malicious and then spread. Then you'd need a bigger virus to kill those, and then those. Pretty soon you'd be emailing out blocks of code the size of an operating system.

It's like in Australia. The first farmers imported beetles to kill off the local locusts, then they found that the beetles didnt die and ate crops too. So they imported cane toads, which also ended up eating all the crops. They they tried cats, which ended up just running away and eating local fauna which were much tastier than cane toads, so they brought in foxes to prey on the cats. Then the foxes became a problem so they sent all the criminals there to kill the foxes. But the criminals got bored of that pretty quickly, and that's how we got Australian rules football.

Re:Interesting.

[antifoidulus]

Pretty soon you'd be emailing out blocks of code the size of an operating system.

Dude, Ubuntu spam! Thats perfect! Just create an email virus that installs Ubuntu and the botnets will disappear!

Re:Interesting.

[Anonymous Coward]

Now if we could only figure out how to stop the spread of poor spelling and missing punctuation. Oh, what a world it would be!

Re:Interesting.

[Amouth]

yea i know it is almost a taboo thing.. everyone thinks about doing it .. but no one does.. but in reality.. if they can monitor these bot nets and the command and control servers.. why not hijack the command and control servers to distribute the patchs to the bots it controls.. use their own power to take them out.

while the idea of spreading them in the wild seems bad because of the load on nutral or non effected hosts.. if they used the botnet to patch the botnet.. then that should elminate the issue with the nutral hosts.

Re:Interesting.

[gad_zuki!]

Why would you need a hole? All you need to do is write the executable, put it on the web, and send out an email about "greeting cards" or "photos of hot chicks." When all users run as admin by default then there's really no reason to go for anything than a simple download. This is why companies take away admin access from their users and why XP is much, much worse than Vista, by default.

Re:Interesting.

[Whiteox]

And that's why we sent possums to New Zealand because their flora and fauna weren't stuffed up at all!
Makes sense doesn't it?

Re:Interesting.

[bryce4president]

If they could write something to fix the human vulnerability in this equation then I think the baseline would probably fall to a rate where it would no longer be profitable form them to be sending spam...

Re:Interesting.

[X0563511]

Seen one of them. Unrar a file, and you get some 'rar password generator' exe and an encrypted rar.

I ran strings on the exe, and found all sorts of interesting things relating to sessions, runonce, etc. Oh, also the password was listed, so I just bypassed all the fun.

Re:Interesting.

[Captain Spam]

yea i know it is almost a taboo thing.. everyone thinks about doing it .. but no one does.. but in reality.. if they can monitor these bot nets and the command and control servers.. why not hijack the command and control servers to distribute the patchs to the bots it controls.. use their own power to take them out.

A fair idea, but it's not that simple... modern botnets use encryption... the controller and bots share an encryption key... without proper encryption, the bot will ignore all orders because they know they didn't come from the original controller...

So all the controller would need to do... is patch the problem that got them in the system in the first place... that'll stop others from exploiting it to put new instructions in... then, by encrypting all their commands... they ensure... insofar as they can do so without new vulnerabilities... that they will be the only ones ordering their own bots around...

I think something similar to this has been tried before, but it didn't work out right. Maybe not on the botnet level, but effectively an anti-virus virus (or anti-worm worm, or any combination of the two) that caused more problems than it solved, partly due to hefty bandwidth use, but also due to flaws in the anti-virus virus program that didn't clean itself up properly, so it just kept looking around for the virus. It'd be a bit too big a risk.

Re:Interesting.

[whoever57]

I've seen a large increase in SPAM with virus payloads.

So have I. I have also seen a lot of "connection lost after DATA" lines in my mail server logs. Is anyone else seeing this?

Re:Interesting.

[Anonymous Coward]

They tried this with Welchia. Welchia broke into computers the same way as Blaster did, then downloaded patches and removed a few viruses and rebooted. It did fix the problem, but also generated massive amounts of traffic and made systems unstable.

Re:Interesting.

[aurispector]

You know, this actually makes M$ look good. By providing automatic updates they are forcing even the casual users to keep their machines patched. It's a shame they threw WGA into the pipe and screwed it all up. If they just kept the automatic updates channel open for patches it would build trust. Of course they blew that opportunity.

Re:Interesting.

[Amouth]

i was thinking more along the lines of ifthey can see the hosts connecting to the command and control checking for commands they know what boxes are infected and can use the same exploite the bot net used to infect them to reinfect them with the patchs..

i know it isn't the best solution.. but really we need to be more proactive in stoping these things.

Re:Interesting.

[Anonymous Coward]

If your machine's admin password is blank and you're not behind a NAT, you are completely exposed.

Not true. In windows, a blank password is the most secure because it disables remote login.

Re:Interesting.

[johndmartiniii]

What would be really hilarious is if rather than being a hole in something windows-ish it was a hole in all of our Linux-based home servers and none of us have noticed it yet. That would be a big collective egg-on-face.

Re:Interesting.

[bryce4president]

If you are running a web hosting company of any kind and you're "too lazy" to keep yourself updated you shouldn't be in business in the first place.

Good riddance.

Re:Interesting.

[deroby]

Seeing something is active is one thing, being able to control it is something else...

As for the 'green virus', the problem is that in order to be successful, the green virus needs to spread as fast as possible too in order to prevent the red one from taking over all the machines. Hence creating A LOT of traffic that might cause collateral damage to entire systems and networks (think DDOS).
In the end, the cure is just as bad as the illness... Although I probably would prefer my computer to be infected with the green one versus the red one as the latter will do all kind of nasty stuff on top of the 'trying to replicate' effect.

Re:Interesting.

[Anonymous Coward]

So, I work at a company that makes email servers. We recently setup a new alias to receive phishing reports so we could collect samples to tune our anti-phishing code. First report was from an admin at a university (one of our customers). The second, 3rd & 4th emails were viruses. Turns out the email admin had a virus on his PC and when he sent to the new address, the virus noticed, fired off it's infection vector to the new address (our phishing submission addr), and then spread it around the net, so the box was picking up spam and viruses from many sources within the hour.

Admin for a University!

Re:Interesting.

[somersault]

It did fix the problem, but also generated massive amounts of traffic and made systems unstable.

That's pretty much what all the spam and viruseseseses are doing already though. I'd be happy for a few days of slow 'net access every 6 months if it meant everyone was all patched up after that week. Would make it much more difficult for the spammers to get anything done, and most of them would hopefully give up anyway.

Reactive solutions are still not as good as actively educating computer users though. Before people are allowed to use guns and cars they generally have to get a license - well, computers can be just as damaging to people as a physical accident, if they end up being used as part of a scheme to steal someone's identity. We need more training on basics like phishing, not running random code that someone sends you, etc. Basically just making people less gullible.

Re:Interesting.

[Dekker3D]

well, if they asked for FINGERS!!! instead, they'd get odd questions.

Re:Interesting.

[Anonymous Coward]

Skynet?

Re:Interesting.

[Anonymous Coward]

Maple Leaf does not sell spam.

Re:Interesting.

[Ilgaz]

Olympics?

Serious, there is a total explosion of spam from China area involving open proxies especially in 2 weeks.

http://www.senderbase.org/ which isn't Symantec (e.g. won't alert for nothing to sell sw to end user) reports another virus outbreak right now. They also get the early alert from Spamcop.net which I just reported 6 spams coming in 1 day, a very unusual thing for that mailbox.

It is either Olympics or someone won a huge botnet auction.

Re:Interesting.

[Anonymous Coward]

This is wrong. If the password for any account, including Administrator, is blank then network access is denied.

Re:Interesting.

[billcopc]

Just because you have smart people in the same building, doesn't mean the entire staff is mentally capable. They hire people in the want-ads just like any other company.

Re:Interesting.

[mapkinase]

IMHO, there is a factor of relative harmlessness of payload on zombie computers for the user of that computers.

You left a gun on the porch, somebody took it, killed bunch of people, cleaned it and put it back on your porch. No harm done, right?

Re:Interesting.

[BrettJB]

Yeah, but where do the gorillas and Chinese needle snakes figure in to all this?

Re:Interesting.

[Anonymous Coward]

In XP, a blank Administrator password is actually more secure than a poor one, as accounts with blank passwords are completely inaccessible from the network without changing a whole pile of default group policy settings.

And since XP SP2, the Windows Firewall is on by default and blocks the inbound ports that Windows would otherwise listen on, so even being online without a NAT router and having a poor password doesn't leave you screwed. It's not 2001 anymore - remote exploits against Windows in its default configuration aren't easy to pull off.

If anything, the rise in botnet activity is due to increasingly more effective social engineering in the form of shady codec packages and antimalware suites that have been pervading the web lately. Even Firefox won't help you here - you have to think for yourself to keep your computer from getting owned, and for so many Windows users, that's *hard*.

Re:Interesting.

[Intron]

Interesting. Far more interesting to me, however, is speculating on how botnets quadrupled in the part three months.

If you just click on the link to one of these top CNN stories, you can find out how:
1. Madonna to wed Alex Rodriguez in December
2. Child molester goes scot-free in NY
3. Angelina Jolie shock pregnancy discovery
4. Paris Hilton in new naked pictures romp
5. Nicole Richie in sexy lingerie shoot
6. Barack Obama the long lost nephew of Robert Mugabe
7. Elton John shot dead in London

Note: these were actual links in spam emails that I've received over the last few weeks.
Following any of them takes you to a malware installer.

Re:Interesting.

[Fulcrum of Evil]

depends on who's actually running the botnets - piss off the russian mafia and you could wake up dead.

Re:Interesting.

[Intron]

Now that I think about it "Zombie Network Explosion" would make a great headline, too.

Re:Interesting.

[AnyoneEB]

The unfortunate reality is that the largest vulnerability is, and will be, the human element. They want their login to be "easy" - so anyone who gets physical access to the machine gets root access with no password credentials, or they use a trivially-cracked password. They want to "simplify" their security arrangements. They trust an email sent by their friends (or sometimes even spoofed to look like it came from themselves) or "system administrator at your domain."

End result? More vulnerabilities.

Unfortunately, the "solution" involves either telling a lot of crybabies "no, you can't have it this way" or else changing human nature. And it's not in human nature to stand up to the crybabies (actually, an actual corporation never would - it's "bad customer relations.")

No, the solution is to make systems secure by default and ensure that the easy ways to do things are also the secure ways. Note that although I use Linux for specific examples of some good security practices, it is not necessarily secure for the casual user.

• Why is remote login allowed by default? The Linux distros I have dealt with do not even have SSH servers in the default install. Most users are not going to use remote access at all. They should have to do something extra to enable it. Or maybe just something extra to get it to work with routable IPs because most people may want file/printer sharing on their 192.168.x.x local LAN.
• Why are blank passwords allowed by default? No password for local login to a non-admin account on a single-user or family machine does not seem like a big deal. On the other hand, blank passwords should not be allowed for remote access (SSH has an option for this; other replies point out that Windows XP prevents remote blank password login as well). Simple passwords are a different problem, but a simple solution may be biometric login via a fingerprint scanner like Thinkpads support. Fast and easy without the trouble of remembering a password.
• The e-mail problem is probably the most serious problem and the hardest one to fix. It does not really depend significantly on operating system other than the fact that it is easier to implement with a monoculture. If the exploit is offered via a link from the e-mail then it could just show the page/download appropriate for your OS like mozilla.com does.

  Some solutions include better spam blocking. If those messages get blocked as spam, then the user never has a chance to react insecurely to them. This is likely incomplete and difficult to implement for all users, as spam blocker quality seems to vary widely and spam is continually improving. Some sort of trivial signature system could help. I believe there are services that will give you an S/MIME certificate for free based on proving that you can receive e-mail at a specific address. An e-mail client could probably automatically request such a certificate. Also, webmail providers could sign S/MIME certificates for their users automatically. That combined with throwing out unsigned e-mails from a sender whose public ke you know (as it was used in a previous e-mail) could make forging e-mail from addresses a bit more difficult.

  A more direct solution may involve limiting the rights of software so if a user gets tricked into installing a program, it cannot do much damage. AppArmor and SELinux are extensions to Linux allowing for rights limiting of applications in addition to the more traditional chroot'ing and running as a limited user. Only software from the trusted repositories could get full rights -- preventing the user from getting tricked into adding a repository to the trusted list while making installs of 3rd party software feasible poses a further difficulty.

I do not offer solutions, only partial ideas. The general direction is that blaming users for using software insecurely will not get you anywhere. The software has to be designed so it is either secure or broken -- which was the idea behind the new Firefox 3 display for expi

Re:Interesting.

[Sir_Lewk]

Interesting. I've seen a large increase in Vista adoption.

Re:Interesting.

[ChrisA90278]

I don't buy the argument that Windows is targeted because it has 90% market share.

Do termites "target" wood frame building and avoid concrete structures because 90% of buildings are wood? Termite don't bother to each bricks because there are not so many bricks?

Same here. virues "eat" Windows and not any of the other OSes because Windows _can_ be eaten and the others can't. Windows is a soft target it was designed with the idea that it would run on an isolated desktop with no networking. Most all the other OSes are UNIX based. Unix was designed, back in the late 60's when computers were shared by many users. Unix was designed from the start to keep users isolated and unable to efect each other.

Yes Windows could improve but if it were to loose it's backwards compatabilty Microsoft would loose it's monopoly

Re:Interesting.

[fedxone-v86]

You write... like Kirk speaks... with all those... ellipses...

Fascinating.

Re:Interesting.

[definate]

Not sure if this is related or not, however a friend and I have both recently been done by trojans packed inside of legitimate warez. (Seperate rips)

This was odd for us since we looked at the comments, looked at the ratings, and looked at the seeds/peers, none of which suggested it was ilegitimate.

However, when we then went to install it, about 10 different "A virus has been detected" messages came up (I use mod32, he uses Kaspersky), however 1 always got through, and then you'd see a ridiculous amount of dos boxes running commands pop up.

From here I checked my firewall and noticed that I was now making connections to ports around the 688x mark and higher, while also sending heaps of icmp's and similar.

I think I might have been seeding the torrent which infected me, and this is why it looked quite legit.

Additionally since the installer/release looked legit, and launched a pile of trojans most of which were blocked but a few that got through. So my guess is they've developed a pack which no matter what 1 will get through.

My friend and I both found ourselves irreparibly infected. He even found that he was infected after a format (due to drives that were connected having auto run with viruses on them).

So we both had to reformat (I was due for it anyway) to fix these problems.

Additionally at work we've seen a huge increase of UPS spam with trojans attached and similar. We block most of them, however we had one employee who somehow got one (probably her private mail), and then proceded to try and infect the rest of the company.

Re:Interesting.

[Anonymous Coward]

Termite don't bother to each bricks because there are not so many bricks?

"Termites", "eat".

Same here. virues

"Viruses".

Windows is a soft target it was designed

"target. It".

unable to efect each other

"affect".

if it were to loose it's backwards compatabilty

"lose", "its", "compatibility".

would loose it's monopoly

"lose", "its", "y.".

Re:Interesting.

[Captain Spam]

I was just following the lead... given by the parent... Spock...

Re:Interesting.

[yuna49]

Some solutions include better spam blocking. If those messages get blocked as spam, then the user never has a chance to react insecurely to them.

Relying on users to manage spam, or worse, spam with links to executables is fruitless.

Any effective solution to this problem requires that ISPs and mail providers do a better job of intercepting dangerous messages.

I notice I don't see as much spam from US desktops since many of the largest providers no longer allow their residential customers to connect to port 25 on remote machines. Sadly these policies don't seem to have yet made it to the IP networks in the developing world.

I routinely install filters on mail servers to block inbound messages with attached executable files or links to off-site executables. No won't be able to watch that "Britney n00d" video, but your computer won't become turned into a zombie either.

ISPs don't want to raise security concerns with their customers or inconvenience them in any way. That might make sense for the ISP, but it contributes to the overall insecurity of the network.

Re:Interesting.

[Thundersnatch]

Actually, in a Windows NT4 or active directory domain, all newly-created users are have restricted rights by default. It's been that way since NT4 in 1996 at least. They are members of the "domain users" group only, which is by default a member of the local users group (not administrators or power users) on each machine in the domain.

The problem is Windows systems that are stand-alone or members of Windows workgroups, where local users are created with admin rights during initial setup on XP, 2000, and older. The Server versions of MSFT operating systems always default to unpriviliged users I believe.

How can you tell if a box is zombied?

[oldspewey]

Honest question - without resorting to answers like "if it's not running Linux it's zombied" I'd be curious to know how the average user can even determine whether their box is pwn3d.

Re:How can you tell if a box is zombied?

[John Hasler]

"if it's not running Linux it's zombied"

It isn't that easy. It might also be running BSD.

Re:How can you tell if a box is zombied?

[TheThiefMaster]

If their internet activity light is flashing when they're not doing anything.

It's surprisingly accurate.

Re:How can you tell if a box is zombied?

[StarfishOne]

Zombies are corpses that have been revived and BSD is said to be dying [[Netcraft citation needed]]. I'm pretty sure they can meet somewhere in the middle. ;-P

Re:How can you tell if a box is zombied?

[syousef]

Honest question - without resorting to answers like "if it's not running Linux it's zombied" I'd be curious to know how the average user can even determine whether their box is pwn3d.

No, but you could teach them quickly even if they didn't fully understand what they are doing. Simple recipe
1. Turn off PC for half an hour
2. Start it up, and start your network connection. Do not start web browsers or other happs
3. Open up a command prompt from Start-Run
4. Type netstat -a and look for connections
5. Repeat step 4 several times over an one hour period

Now some connections may be software updating (eg. antivirus) but discounting that if you have lots of open connections or they're regularly changing, you have to assume it's probably owned.

Re:How can you tell if a box is zombied?

[ultranova]

If their internet activity light is flashing when they're not doing anything.

How can you know that they're not "doing anything" ? They could be downloading patches, an e-mail client could be checking for new mail, an instant messenger client could be exchanging "are you still there" packets with the server, the DHCP client could be renewing the lease, etc.

This is in the same category than "there's hard drive activity when you're not doing anything". It's fine for DOS, but near useless for modern multitasking machines.

Re:How can you tell if a box is zombied?

[blueg3]

With botnets, you can get a pretty good idea by comparing external network logs to user-initiated communication. If they're not talking to their C&C, they're not doing much.

Re:How can you tell if a box is zombied?

[v1]

If you are only interested in actively used botnets (for DDoS and spam for example) then when you plug in the ethernet cable the router lights go mad, that's a good sign its pwned.

You can't really look at the network usage using tools ON the machine, as rootkits are designed to hide all their activity from the system tools by modifying them. So the owned windows box may show little or no network traffic while your router is nearly catching on fire. But the lights on the switch/router don't lie.

Re:How can you tell if a box is zombied?

[SaDan]

Are you serious?

How about checking the network activity, AFTER YOU SHUT DOWN ANY APP THAT REQUIRES THE NETWORK TO FUNCTION. This isn't exactly a great leap of logic here.

If you're still blasting traffic AFTER you have shut down your mail client, IM, web browsers, streaming video, automatic updates for Windows, Java, etc, you may have an issue.

I weep for anyone you ever offer to help troubleshoot anything.

Re:How can you tell if a box is zombied?

[scott_karana]

Microsoft Update has periodic monthly tools that are supposed to give the user a feeling of security.

Re:How can you tell if a box is zombied?

[Anonymous Coward]

You know, you can use File->Quit on most of those programs.

Actually, the grandparent is right, it is surprisingly accurate once you quit all programs periodically retrieving data from the internet.

Re:How can you tell if a box is zombied?

[Anonymous Coward]

of course, that is the very important question, and if there were an easy answer, botnets would not be such a problem.
here is what I would do:
get a cheap, used, good old HUB (not a switch) and connect known clean (Linux?) PC together with suspicious one. Then start some sniffer on clean PC, like Wireshark..

Re:How can you tell if a box is zombied?

[TheRaven64]

This is in the same category than "there's hard drive activity when you're not doing anything". It's fine for DOS, but near useless for modern multitasking machines.

Not really. Most operating systems allow you to monitor disk activity in software. If this is showing nothing, but the disk light is on, then there's a good chance there's a rootkit hiding certain activity. Same with network usage. If your operating system thinks there's no activity, but the network card thinks there is, something very bad is probably going on. If your OS and your network card agree that there is network traffic, then you can try identifying it. Once you shut down everything that ought to be generating traffic, then you can analyse the rest quite easily (on a big network, expect around 10KB/s of multicast DNS).

Of course, this doesn't help if it's an application that's been trojaned. You probably wouldn't notice if your IM client, for example, has been infected and patched to initiate secondary connections. You can try using something like netstat (no idea what the Windows equivalent is) and find every remote host each application is connecting to, and check them against what you expect (if your IM client is connecting anywhere other than your IM server in the background it's probably malware or skype, but I repeat myself).

Re:How can you tell if a box is zombied?

[Pyrophor]

I found a computer that had Windows XP Pro SP2 on it and it was using Symantec AV. When an email message was sent out from that machine a 1.5 inch by 1.5 inch box popped up. This computer screen looked like a checkers board from all the emails being sent out on it. When one would close another would open. This is a pretty obvious sign that you have been taken over. You could very well be pwned and not even know it though. And just because you have Linux doesn't mean a thing. My buddy installed a copy of Knoppix on his box a few years back and I taught him a lesson really quick as I ssh'd into his box as root in a matter of seconds. He learned that changing default passwords is important. I could have SCP'd a NASTY file over there and dropped him into drone mode to do evil tasks at my will. Good learning experience for him and even me. An OS is only as secure as the security measures you implement on it.

Re:How can you tell if a box is zombied?

[Kaeles]

hahahahahahhahah

You do realize that in a network of ~10 windows computers there is going to be an average of 20 - 50 kbps of "ambient" network noise, due to net-bios and wins traffic?

That is ALL broadcast traffic, which is why all ISP's should block those ports at the customer premise equipment, as well as subnet the customers to keep them from easily spreading their junk.

Re:How can you tell if a box is zombied?

[flyingfsck]

Spybot Search and Destroy is not difficult to run, though I would not recommend PS tools or Hijackthis to common folk.

Re:How can you tell if a box is zombied?

[Icarium]

Works well enough on a single non networked box, and apart from the DHCP the rest are easy enough to switch off for a few minutes. Had a similar concern a few days ago when I noticed a lot of traffic going through my router even though I knew I was not running anything that should be using it - process manager didn't show any of the usual culprits (auto updates) so I checked the network traffic with a network monitor. It showed a ton of traffic hitting my router on the port that my torrent client (which I had closed about 10 minutes earlier) was set up for. Obviously the trackers hadn't updated yet and were still showing me as a seed or peer, so I was still getting hit by torrent requests.

Reset my connection and no more traffic. Granted, if you're on a network or are in the habit of running a gazillion network reliant apps or services this wont work.

Pretty sure you can get any number of applications that you can use to identify and sort through any network traffic, at least from your own machine.

Re:How can you tell if a box is zombied?

[hesaigo999ca]

But they could still be dormant, so that means still vulnerable to being taken at time xxx in the future.

Re:How can you tell if a box is zombied?

[houghi]

So they must look at the back of their machine that is under the table and then be able to understand the difference between a light that is on and one that goes crazy. The people who are infected will most likely not be able to do that.

The people who are infected will have a hard time understanding the difference between a monitor and a computer and will find doing anything that is not taught in a specific way and order difficult and scary.

OK, this might not be the average user, but I think it is the average user who will be infected.

Re:How can you tell if a box is zombied?

[hesaigo999ca]

Actually being able to turn off my modem by putting it on stand by, and using zonealarm to monitor outgoing traffic requests, lets me see what sort of traffic i have, if I am owned, then it will not be communicating, and I usually do a full reinstall from my backup cds every 3 months, so that in the event i did get owned, i will be only for a short time. At the 3 month interval i also change all the passwords to my accounts. So if someone did have access, they are cut off.

Now however, I do use vmware, and am always weary of vmware rootkits, but don't know enough yet about them to mount a good offensive series of actions against them.

Re:How can you tell if a box is zombied?

[ksd1337]

Ha. We have zombie computers with Windows, and we have demons with BSD. What next, cute little penguins with Linux com... oh wait, never mind.

Re:How can you tell if a box is zombied?

[Anonymous Coward]

I've seen a few of these, helping friends out and so forth, and seriously, most of them are obvious.
The one time I got hit myself, I noticed within seconds.

New processes show up, often with names suggesting it's something to do with Office or Outlook. I've never seen one run under svchost , but looking with Process Explorer will let you see those processes too.

Settings change automatically, like the windows security center turning on all of a sudden. Firewall exceptions added.

Unexpected network activity.. new MP3 files in various folders. (The mp3s carry VBS scripts that WMP can execute, and if you get them into a P2P folder they can spread that way.)

All of this is of course useless if you don't have a handle on what is running on your machine to begin with. But people really should.

Re:How can you tell if a box is zombied?

[drsmithy]

That is ALL broadcast traffic, which is why all ISP's should block those ports at the customer premise equipment, as well as subnet the customers to keep them from easily spreading their junk.

Such broadcast traffic typically won't be going out the WAN port (ie: "internet activity").

Re:How can you tell if a box is zombied?

[TheThiefMaster]

Um, broadcast traffic won't spread outside the subnet by design?

Which means it wouldn't flash the "internet" activity light, only the "network" activity light.

Re:How can you tell if a box is zombied?

[Spatial]

netstat (no idea what the Windows equivalent is)

It's the same. You can even use "netstat -b" to see which processes are using which connections, which can be quite handy.

Re:How can you tell if a box is zombied?

[Whiteox]

Malwarebytes is much better and gets rid of everything (not root kits though)!

Re:How can you tell if a box is zombied?

[maxume]

Watching something like Tcpview:

http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx

or Currports:

http://www.nirsoft.net/utils/cports.html

may work better for a lot of users (anybody who can manage to download and extract a zip file...). A rootkit could still be hiding the traffic, but the approach you outline is better than nothing.

Re:How can you tell if a box is zombied?

[HAKdragon]

You can also add a number to the end of the netstat command to tell how netstat how often to update (in seconds). So "netstat -a 60" will update the stats ever minute.

Re:How can you tell if a box is zombied?

[Kaeles]

Well, there do exist isp's that run bridged networks. Thats what I was pointing at. That and I assumed (falsely apparently) that internet activity light simply meant the lights on a switch. (to most "users" there is no difference).

Re:How can you tell if a box is zombied?

[X0563511]

Where can one find a 100baseT hub? Nobody seems to sell hubs anymore.

Actually, I could see a market for 3-port hubs at modern specs... or even a two-port with a third "RX only" port.

Re:How can you tell if a box is zombied?

[Anonymous Coward]

Productive[=============^=====(you)====]Secure

Filter error: Please use fewer 'junk' characters.
Filter error: Please use fewer 'junk' characters.
Filter error: Please use fewer 'junk' characters.
Filter error: Please use fewer 'junk' characters.
Filter error: Please use fewer 'junk' characters.

Re:How can you tell if a box is zombied?

[amorsen]

Actually, I could see a market for 3-port hubs at modern specs... or even a two-port with a third "RX only" port.

Pretty much any managed switch has the ability to make one port a "monitor" port. Cisco calls it SPAN.

Re:How can you tell if a box is zombied?

[Creepy]

In fact, I am working on just such a case. By dormant, I mean the initial infection was removed, but the virus added some changes to IE so searches almost exclusively go to infected websites and exploit a java bug to reinfect the machine.

    The PC in question was my wife's, and she had followed a link to an unknown sender's e-card (which happened to arrive on her birthday) and it exploited her gullibility and a java bug to install the trojan XP Antivirus '08. I managed to eradicate that virus, but it made a change to IE that I missed initially that takes searches to infected websites and exploits the java bug again to reinfected the machine (mainly with other viruses - Virtumunde has been the latest - both of these are Russian Federation originating). Antivirus software doesn't catch the infections because they happen in resident memory, but the software does find them after they've written files.

The problem is, she needs to have her java patched to remove the java back door, but the virus seems to have tampered with java and it will not patch. I'm going to try a manual uninstall and reinstall tonight. I also likely need to reinstall IE (will try a registry fix first using my XP box as a reference), but MS has made that impossible by design, so I'll probably need to reinstall the entire OS.

Re:How can you tell if a box is zombied?

[Anonymous Coward]

Although if the machine is rootkitted then you can't trust what netstat tells you.

Re:How can you tell if a box is zombied?

[Creepy]

I think there are relatively new exploits that are neither rootkit nor true virus. They seem to involve corrupting IE and crippling java update and then bring your searches to infected websites to constantly download trojans using a java bug (that is fixed in an update).

Incidentally, I've tried both and Spybot and Malware and both seem to find stuff the other does not (malware seems to be better about tracking cookies, spybot exploits). Unfortunately, neither seems to have found the problem I am currently chasing, which is a combination of crippling java update and exploiting IE to go to malicious websites whenever the search box in IE7 is used.

I've only partially had time to deal with this, but according to netstat, there are no open ports again (after I removed a spambot for the second time). I've removed all viruses from the box (using virus checkers and manually removing one that apparently was just found in the wild a couple days ago). I've checked and the search is set correctly both in IE7 and in the registry. As far as I can tell, the machine is clean again - except when I do a search - it always puts malicious sites first. I'm going to go through IE's registry entries with a fine-tooth comb tonight, and if that fails, reinstall Windows.

Re:How can you tell if a box is zombied?

[csartanis]

Your ad hominem attack left your post completely worthless. Also, you should learn what windows services are before you assume the only thing running on your PC are the applications you started.

Re:How can you tell if a box is zombied?

[hesaigo999ca]

As my post above yours to the parent post you posted to( a mouth full there!)
I do reinstall from a ghost image every 3 months, so that even if I get owned, I am sure this is only temporary, and I change all my passwords 3 months too, like clockwork, as well as the image is burned on disk and has been verified as clean so there is no bug, and as for being owned until the next reinstall 3 months down the line, I tend to keep every internet item shut off or locked (zonealarm) this allows me that if I am owned, it doesn't communicate all day long only when I am on, and even then I use a blank pc for such occasions to surf the web, my good pc is for banking etc..

Re:How can you tell if a box is zombied?

[Anonymous Coward]

The problem is, she needs to have her java patched to remove the java back door...

So, what you're trying to say is, someone is backdooring your wife?

Re:How can you tell if a box is zombied?

[Anonymous Coward]

"Assume much you do." - Yoda

Root kits tend to hid processes and connections from the rest of the apps, and this is an app.

Re:How can you tell if a box is zombied?

[Fulcrum of Evil]

So, what you're trying to say is, someone is backdooring your wife?

No, just her box.

Re:How can you tell if a box is zombied?

[NeoSkandranon]

I recall Windows Defender (Microsoft's antispyware/malware offering) to be able to detect and fix alterations to IE's default behavior--have you tried that app? My memory could be bad (or this could just be a different situation) but I think i've used it in the past to fix student computers which had subverted IE installs that did something similar to what you mentioned.

Re:How can you tell if a box is zombied?

[Anonymous Coward]

As a survivor of end-user tech support, I can tell you that the average Windows user has half a dozen programs minimum loading at startup that will be accessing the Internet for various dubious reasons. Many of them spawn new processes with cryptic names to do the actual work. These are "legitimate" pieces of software that the user installed from the Internet, from a commercial software package, or as part of a driver install.

Every $10 USB dongle wants to install a phone home app that checks for updates every time the user moves the mouse.

Re:How can you tell if a box is zombied?

[idontgno]

My ancient Dell Powerconnect 3024 has an option to mirror one port onto another. That's what I'd use in that case.

Re:How can you tell if a box is zombied?

[Sir_Lewk]

Once a machine has been pwnd you cannot trust it again, just reinstall the whole damn thing.

Re:How can you tell if a box is zombied?

[syousef]

TCPView is certainly more convenient than using netstat -o and matching it up with the process ID in the task list, but either way you're still left with cryptic process names like [System Process]:0 which doesn't tell you what's going on.\

While you're at it add ZoneAlarm or Comodo Firewall or similar to the list. Users can learn about traffic and block anything suspicious. Of course firewall software comes with its own issues and management requirements which the average user may not be prepared to deal with.

If you're concerned about rootkits hiding traffic, you're going to need to use a hardware solution. A router with firewall like the Linksys WRT54GL with a decent 3rd party firmware (Tomato is probably better than DD-WRT) for monitoring.

However the more software and hardware you have to install, the further away from what the average user is prepared to do.

Re:How can you tell if a box is zombied?

[Feanturi]

Bittorrent clients keep trying to talk to you for a long time after you shut down the program. Eventually you drop out of their attempts when they realize you're not answering anymore.

Re:How can you tell if a box is zombied?

[rtechie]

Wireshark shims the network stack so you can see outgoing traffic. Do you see mysterious traffic that you can't account for? Congratulations, you've got a troyjan.

Having said that, most "casual" users aren't equipped to do TCP traffic analysis. They're better off with tools like rootkit revealer.

Re:How can you tell if a box is zombied?

[graemdrake]

Disclaimer: IANAP A lot of people are replying with this and similar remarks: "Check to see if the wireless card is flashing when there should be no network activity" or "Most operating systems allow you to monitor disk activity in software. If this is showing nothing, but the disk light is on, then there's a good chance there's a rootkit hiding certain activity." I'm much like most of the people who's machines have been compromised: I have an interest in keeping my machine secure, but am only technically savvy enough to take low level measures like using a software firewall, being careful with attachments, using firefox instead of IE, etc... My question is this: are there any OSS programs out there that are designed to detect discrepancies between what the hardware and software are reporting? It seems to me that all the solutions I've heard involve flipping switches and watching lights when a program could do a more effective job...

Re:How can you tell if a box is zombied?

[Whiteox]

Don't forget to check IE Addons (tools/Manage Addons) and disable Java. Check downloaded programs files in Windows. Delete all java installs there.
Check Service startups - unrecognisable msconfig entries etc. Good luck.

Re:How can you tell if a box is zombied?

[WuphonsReach]

1) Take out the disk, hook it up to a 2nd PC (via USB enclosure or whatever) and run a current virus-scan on it. That will generally nullify it enough that you can then put the disk back in the original PC and use WinXP's system restore to go back a week or two.

But really... once a machine has been compromised, it is no longer trustworthy. There may be other things installed that you *don't* know about and that don't show up in a cursory scan. So the proper fixes are either:

A) Restore from the original WinXP install media.

B) Restore a known-good snapshot created with a program like Acronis TrueImage, Norton Ghost, or Linux NTFSDisk(?).

In order to prevent that happening in the future, do NOT run accounts that have Administrator level privileges in Windows XP. There's too many damn browser exploits out there right now that sail right past IE 7 and Firefox 3 and will infect your machine. (Worse, these infections are present on a lot of mainstream websites, so it's no longer an issue of browsing the darker side of the net.)

Seriously, spend the $40 or whatever for Acronis and learn how to make images of your system disk. It saves a lot of time down the road when you can just restore to a known-good point in time.

Re:How can you tell if a box is zombied?

[Dan541]

But how many people look at their router?

Most people would not even know what that "Box thingy" is for.

Re:How can you tell if a box is zombied?

[blueg3]

If you're talking about simple bot malware that doesn't employ a good rootkit, then there a number of different programs that will output all of your network activity. (Disk activity's a little trickier, I think.) A rough familiarity with what you would normally be connecting to and what programs are knowingly running on your machine (e.g., automatic update software), and something like this will be sufficient.

Note that in the above case, something that searches for discrepancies between what is reported by the OS and what isn't won't do you any good, since the malware is hiding nothing. It can be difficult to automatically differentiate intentional from unintentional usage.

Now, if the bot is using a rootkit, this is a subject of much interest. If you want the tool to run on your machine, then it's a race to see if the malware author or forensic tool author is more clever. Of course, if connectivity to the Internet goes through a router you have access to, you can engineer some way to compare actual network communication with what's reported on the machine. None of these are simple or easy to use.

Re:How can you tell if a box is zombied?

[SaDan]

If you think your machine is infected, would you leave it connected directly to the internet (or left in a static NAT situation behind a firewall) while troubleshooting?

A machine plugged into a switch that leads nowhere is a pretty good start, so nothing can talk to the system in question. I'd think you would want to isolate it from the rest of your systems anyways.

Re:How can you tell if a box is zombied?

[Anonymous Coward]

A bandwidth monitor like NetLimiter Monitor is great. Shows you what programs are sending how much data, and to where. Very easy for someone decent at computers to see suspicious activity.

Of course, for the average user...it's useless.

Re:How can you tell if a box is zombied?

[Feanturi]

The post I was responding to was not about troubleshooting an already-suspected infection, but casually noticing from modem activity that there could possibly be something amiss based on the assumption that you were not intentionally opening/maintaining connections. If Bittorrent has been closed within the past half-hour or so, modem activity lights won't give useful hints.

Re:How can you tell if a box is zombied?

[SaDan]

I was referring to the activity on the local machine, not on the modem. I realize that if you have only one machine connected to a DSL/cable modem, and you are configured in such a way that your public IP resides on the PC, both the modem and the PC will still show activity when any traffic destined for the public IP goes through both systems.

Again, I'd disconnect the PC from the internet to do any troubleshooting and searching for an infection.

clear sign that

[Anonymous Coward]

students have to much free time in the summer holidays..

Re:clear sign that

[Locklin]

I wonder if it has more to do with bored students writing malicious code, or bored students downloading "suspicious" content.

Re:clear sign that

[shaka]

I wonder if it has more to do with bored students writing malicious code, or bored students downloading "suspicious" content.

I'm pretty sure it isn't the latter, these botnets are not the work of "bored students", they are controlled by organized crime and their ilk.

Re:clear sign that

[MadMidnightBomber]

Someone got a mail past our spamfilters at uni, pretending to be from the helpdesk, which contained a URL to some malicious code with instructions to download and run it.

Not only did loads of Windows users run the damn thing, but we got loads of helpdesk tickets from Mac users asking for a Mac version.

Re:clear sign that

[value_added]

Not only did loads of Windows users run the damn thing, but we got loads of helpdesk tickets from Mac users asking for a Mac version.

That has got to be the most depressing thing I've read in some time. There really is no hope for the great unwashed masses, is there?

Re:clear sign that

[besalope]

There was never any hope for the sheep to begin with.

Re:clear sign that

[Kazoo the Clown]

Hey, face it-- for many people the computer just isn't very important. They can ignore what it does or what it "needs," just like they ignore TV commercials.

Re:clear sign that

[nine-times]

I know exactly the type of users you're talking about. It really makes me wonder, can anything be done?

To me, installing software from a link from someone I don't know is like licking a drain grate on the street in NYC. It just feels like a natural aversion, but clearly it's because I've been trained. I wonder if that sort of concept will ever his the cultural mainstream, and be considered "common sense".

a rise in botnets

[nimbius]

can only mean one of two things:
the machines are starting to take over
people arent getting any more intelligent with pc's than they are savvy. job security!

Re:a rise in botnets

[HAKdragon]

"He often speaks of the coming war between man and the brotherhood of machines."

Comment removed

[account_deleted]

Comment removed based on user account deletion

This makes me sad actually...

[O('_')O_Bush]

because it could mean that people who are vulnerable to these types of attacks are on the rise. You would have thought that after all this time and the numerous virus-by-email crises, people would have learned better.

Re:This makes me sad actually...

[v1]

The latest hurricane has given birth to a variety of phishing sites, it wouldn't surprise me if better targets to redirect suckers to inspired them to ramp up their efforts, or perhaps these sites are hosting malware to retruit more zombies.

Re:This makes me sad actually...

[pxlmusic]

damn my lack of mod points! +5 Funny

Re:This makes me sad actually...

[Dorkmaster Flek]

Never underestimate the predictability of stupidity.

Re:This makes me sad actually...

[antifoidulus]

Also keep in mind that in places like India, China, Vietnam etc., the number of people using the internet for the first time is skyrocketing. While it would be nice if all these people used secure OSs, more than likely its a pirated copy of Windows that may or may not be able to get software updates etc.

Re:This makes me sad actually...

[Anonymous Coward]

"...more than likely its a pirated copy of Windows that may or may not be able to get software updates etc."

Or a streamlined installation that comes prerooted.

Re:This makes me sad actually...

[Fex303]

Never underestimate the predictability of stupidity.

I knew you'd say that.

I think I played that

[gEvil (beta)]

Zombie Network Explosion? Wasn't that a Flash game on some site?

Re:I think I played that

[Anonymous Coward]

All I know is that I saw the words "zombie" and "explosion", and thought This is it! Finally! and grabbed my shotgun. So disappointed.

Re:I think I played that

[Anonymous Coward]

At least you did not not shoot anyone.... right?

Re:I think I played that

[Anonymous Coward]

It's okay, they were already dead.

Zombie Network Explosion

[Anonymous Coward]

What is the latest Uwe Boll movie, Alex?

I wonder if it had to do with...

[arhhook]

Vista's Security Rendered Completely Useless leading more machines (with Vista) open to drive by downloads, etc, becoming zombies?

Re:I wonder if it had to do with...

[walt-sjc]

I'm sure Microsoft will blame it on the fact that a massive number of machines shipped with Vista are getting upgraded to XP. Vista adoption numbers look great until you subtract all the those...

Re:I wonder if it had to do with...

[Anonymous Coward]

No.

Re:I wonder if it had to do with...

[Anonymous Coward]

Overblown poop. http://blogs.zdnet.com/Bott/?p=512 http://blogs.zdnet.com/Bott/?p=513

Re:I wonder if it had to do with...

[Creepy]

please don't talk about Vista today - I spent 7 hours with MS tech support last night trying to get SP1 installed on my laptop (taking away time from my virus fight on an XP machine). According to MS support, my registry is corrupt, which is awfully fast, seeing that I just got it back from the repair shop a week ago and they had to wipe my C drive clean and restore to image (suggesting to me that their drive image is corrupt - the repair was for an 8600M graphics card failure). The drive itself reports no errors.

Re:I wonder if it had to do with...

[dedazo]

No. Of course Slashdot only posts the sensationalist bullshit to sell ads, not the subsequent rebuttals.

Keep getting your Microsoft news from Slashdot though, nothing better than shaping your opinions through sponsored FUD.

Re:I wonder if it had to do with...

[Anonymous Coward]

Perhaps you'd be happier frequenting another website.

Please.

Hell Yeah!

[Das Auge]

Hell yeah! I've seen this movie! It rocks!

Wait...what?

Easy

[Toreo asesino]

They've become self-aware. Run for the hills!

Re:Easy

[Missing_dc]

They've become self-aware. Run for the hills!

Won't help, you will be found, in a week we are launching a satelite that has 41 centimeter resolution. The rocket will even have a google logo on the side.

(OK, que the "now they can see my penis(ego) from space" jokes)

Re:Easy

[stjobe]

Cue. Cue the jokes.

Re:Easy

[BotnetZombie]

The net may be self-aware, doesn't mean that I am though. All I know, is that I want a bite of your CPU.
Burp, thank you.

Re:Easy

[Anders]

Won't help, you will be found, in a week we are launching a satelite that has 41 centimeter resolution.

Wow, now they can see my penis from space!

Re:Easy

[Anonymous Coward]

You'd be able to see my penis from space, but your mom obscures it from view.

Re:Easy

[interstellar_donkey]

Um, Skynet is already active. You can see one of the human zombies on their main page.

Re:Easy

[seededfury]

my mom is only .3mm tall... sucks to be you

Re:Easy

[dkleinsc]

No, queue the jokes. I'll process them as quickly as a feel like, thank you.

Re:Easy

[somersault]

Colonel? You'd better take a look at this radar..

What is it, son?

I dunno, sir.. but it looks like a giant-

Dick!

Yeah?

Take a look out to starboard.

Oh my god, it looks like a huuuuge-

Pecker! Wait, that's not a woodpecker, it looks like someone's-

PRIVATES! We have reports of an unidentified flying object! It has a long, smooooth shaft! Complete with-

Two balls!

What is that? It looks just like an enormous-

Wang! Pay attention.

I was distracted, by that enormous, flying-

Willy!

Yeah?

What's that?

Well, it looks like a giant-

Johnston!

Yessir!

Get on the phone to British intelligence and notify them about this!

moaaaning...

[Anonymous Coward]

But it was bots all the way down...

Exactly. That's why all of you need to be working on your zombie plan.

Now if anyone needs me, I'll be in the attic...

Re:moaaaning...

[interstellar_donkey]

I thought Anonymous Cowards WERE zombies.

Vigilante developers

[kaunio]

I'm actually surprised that we don't see any vigilante developers actually developing something that in some way or another disable or display information about the serious state the infected machine is in.

Of course, I see the problems with doing so (hasn't there been an article about this topic earlier?), but still, there are a lot of infected machines that have been so for ages are not likely to vanish. Bandwidth and cpu cycles can definitely be spent on better things than spam.

Re:Vigilante developers

[Neoprofin]

The problem is someone with the drive to do so would come to Slashdot and be told, in hundreds of angry posts, that he has no right to do that and he's just as bad as the zombie botnet overlords. Of course he should have just done it, prayed for the best, and hoped that history would look kindly upon what's been done.

Re:Vigilante developers

[Amouth]

code green .. was a vigilante patcher virus for code red.. it used the same exploite to infect and patch..

i agree we need more of this realy.. cause damnit.. even if MS does patch all the holes people arn't going to install them.. even the OEM's arnt' going to do it.

i recently got a laptop from dell that was running an over 1 year out of date on patchs image driectly from them.. there is no excuse for that.. they should be patching their images monthly at the least

Re:Vigilante developers

[Joe U]

I'm actually surprised that we don't see any vigilante developers actually developing something that in some way or another disable or display information about the serious state the infected machine is in.

As a network admin, I would love to see someone write code to destroy the boot sector of an infected machine and then run a shutdown. (No data is lost, but the system is offline)

As a system admin, I would hate to see code out there that does damage to any process on the system, infected or not.

As a developer, I won't go anywhere near that type of software.

As an end user, I want better antivirus with better alerting that doesn't require a full core of my processor to run.

Re:Vigilante developers

[Sir_Lewk]

As another poster continuing this wishlist, I want a pony.

Re:Vigilante developers

[Joe U]

As another poster continuing this wishlist, I want a pony.

No, you can't have a pony.

Not yours.

Re:Vigilante developers

[John Hasler]

> As another poster continuing this wishlist, I want a pony.

As the owner of a horse farm, I'll sell you one.

I know why...

[Anonymous Coward]

must be related to the decrease in sunspots in recent weeks

Insane increase in SSH attacks

[h2o2]

I noticed an incredible increase in DenyHosts alerts over the last three days to the extent that I had to turn off alert emails. This picture says it all: http://stats.denyhosts.net/stats.html

Re:Insane increase in SSH attacks

[PONA-Boy]

...upon looking at what DenyHosts is...

Neat idea. Thanks!!

Re:Insane increase in SSH attacks

[Megaweapon]

Same here, for some reason one of our servers on our subnet is a frequent attack for distributed SSH attacks, and there has been an explosion of them in the past few days for us. I've been collecting IP addresses and locking them out via firewall, but more just keep coming.

A Zom Comm Bomb?

[PinkyDead]

What else!

Riddle me this...

[davmoo]

So if researchers can detect these things with apparent reliability in their process, why can't ISPs detect them the same way and cut the bastards off?

If Comcast and ilk such as that were really interested in conserving network bandwidth, they'd be cutting off zombies instead of putting on bandwidth caps.

Re:Riddle me this...

[SaDan]

ISPs can, and it was something I used to do as an "added feature" at the wireless ISP I used to work for.

It can be construed as an invasion of privacy, and I was yelled at plenty by some of my former customers. While a pain to administer, it had an incredible impact on our network's performance, and a decrease in customer complaints for individual towers being slow, etc.

The same technology Comcast uses (used?) to throttle Bittorrent users most likely could kill off zombies and DoS attacks. It's a shame they don't apply their resources appropriately.

Re:Riddle me this...

[Anonymous Coward]

Because ISPs do not possess anywhere close to the processing power that would be necessary to packet sniff all of the traffic crossing their networks. Also because when we do detect that someone's computer or network has been compromised and let them know, about half the time they push back and deny that anything is wrong.

Re:Riddle me this...

[Neil Watson]

The cost of monitoring, administering, taking action and fielding the incoming support calls from irate customers who have had their service suspended is probably more than simply capping bandwidth and charging for over runs.

Re:Riddle me this...

[blueg3]

The same technology couldn't be used to stop DoS attacks -- the connections are broken by forging TCP RST packets. Most DoS attacks don't use TCP. They're also doing a particular sort of network pattern detection that catches BitTorrent but won't necessarily catch a bot.

Granted, there are methods for detecting bots and methods for silencing their traffic.

Re:Riddle me this...

[Missing_dc]

So if researchers can detect these things with apparent reliability in their process, why can't ISPs detect them the same way and cut the bastards off?

If Comcast and ilk such as that were really interested in conserving network bandwidth, they'd be cutting off zombies instead of putting on bandwidth caps.

Oh come on, they are all evil, they leave em alone through professional courtesy!

Re:Riddle me this...

[blueg3]

Botnets account for less traffic than P2P file sharing (a few percent).

Re:Riddle me this...

[Missing_dc]

The cost of monitoring, administering, taking action and fielding the incoming support calls from irate customers who have had their service suspended is probably more than simply capping bandwidth and charging for over runs.

You are on to something, but take it up a notch...

The bots are a potential revenue source. The zombie traffic could push normal users over the caps resulting in extra usage fees. How long till an ISP exploits this intentionally (hijack or buy a botnet and make them send files back and forth)?

Re:Riddle me this...

[Anonymous Coward]

User: I want to complain, you cut off my internets!

ISP: Yes, we did that because your PC has been compromised by malicious software.

User: My PC is just fine, I was uploading facebooks to my processor only this moring. I also want to complain about how my internets was all slow before you cut me off and my Word icon takes ages to install onto my screen.

ISP: You don't understand. Your PC and internet is slow because a botnet has taken control of it.

User: Stop trying to shift the blame! I can't afford a new PC! I wants my tubes back!

ISP: I can't do that. Until you get your PC cleaned up, it is a danger to the internet at large. It is now a zombie.

User: What? Botnet? Zombie? I'm cancelling my account and going to an ISP where their tech support doesn't smoke crack.

**dial tone**

Re:Riddle me this...

[davmoo]

How is that possible when I keep seeing figures, from supposedly reliable sources, that spam email accounts for anywhere from 60 to 80 percent (depending on who's figures you want to use) of net traffic? That's not coming from bots?

Re:Riddle me this...

[Anonymous Coward]

If Comcast and ilk such as that were really interested in conserving network bandwidth, they'd be cutting off zombies instead of putting on bandwidth caps.

But you see, if they cut off all the p0wned illiterate computer users' machines, they'd get flooded with calls to tech support.

That costs lots of money.

Re:Riddle me this...

[Spatial]

The P is for Provider, not for Police. It's not their problem, it's the responsibility of the developers making exploitable software, and credulous/careless users.

Re:Riddle me this...

[Anonymous Coward]

My ISP called me to let me know one of our IP addresses was port scanning. They asked that I fix it and if I didn't they would block that IP from sending.

Re:Riddle me this...

[SaDan]

By "technology", I was referring to the black box that sits inline with the uplink(s) to the internet.

The system I used to maintain was such a beast, and it did everything from real-time AV scanning, SPAM scanning, and IDS/DoS functions. It could in fact be used to detect DoS attacks, and send alerts via SMS/email to us. I also used it to shape/limit Bittorrent and other P2P protocols.

http://www.fortinet.com/ is where you can find one example of such "technology".

Re:Riddle me this...

[TropicalCoder]

I think that's spam email accounts anywhere from 60 to 80 percent of all email traffic, not all net traffic.

Re:Riddle me this...

[maxume]

Is that network traffic or email traffic? The latter seems a lot more likely to me (because a single movie download is equivalent to hundreds of thousands of spam messages).

Re:Riddle me this...

[ewieling]

ISPs in the USA seem to be slowly moving to bandwidth caps. If people start getting large overage bills from their ISP maybe they will start caring more about security and anti-virus and safe browsing habits or, maybe they will stop using the internet. I'd be happy with either outcome.

Re:Riddle me this...

[wren337]

I have a domain hosted at home with dyndns, and I used to run my own mailserver. One night I got a phishing email for Chase and I forwarded it to "abuse@chase.com". The next web page I requested was redirected to an obnoxious screen informing me that my computer was infected. Wide open west blacklisted my cable modem's MAC address, and after talking to their front line tech for two hours, I wound up switching to a spare cable modem to get back online. Secondary tech wouldn't even discuss it - "Tell him he's infected and get off the call". He couldn't even get my modem off the blacklist.

Re:Riddle me this...

[bdrewery]

ISP do in fact do this. http://www.exstatica.net/2008/06/27/documentation-of-hijacking-of-irc-servers-by-timewarneraolcox/ They hijack DNS to try and remove botnets via IRC. Sadly they hijack a lot of very valid and legitimate DNS.

Re:Riddle me this...

[Mashiki]

So if researchers can detect these things with apparent reliability in their process, why can't ISPs detect them the same way and cut the bastards off?

ISP's can and do.

The only real question is what's the ISP's policy on zombie'd machines and their reaction to them on their network? Some ignore them, others throttle, some kill them off the network.

An example from my ISP:

We have reason to believe that a computer connected through your Rogers Cable Modem has been infected by virus. The amount of traffic and traffic patterns being generated are consistent with a Trojan Virus.

Typically, these types of viruses do not affect the performance of your computer and instead carry out attacks and malicious activities behind the scenes, without your knowledge. This type of network activity has the potential to negatively impact the overall service. For your reference, we have included a technical summary of the activity for your reference at the bottom of this e-mail message.

To protect your computer and to safeguard other customers on the Rogers Yahoo! Hi-Speed Internet network, we urge you to remove the virus as quickly as possible. This can be done by using an updated Anti-Virus program to scan all the computers connected to your cable modem and choosing to remove the viruses.

Here is how to remove a virus from your computer:

If you have Anti-Virus software installed on your computer:
1. Ensure that your software has been updated to include information on the most recent virus threats (this can typically be done by using your software's update feature).
2. Using your updated Anti-Virus software, run a full virus scan to determine if your computer has been infected.
3. You software should detect the virus (if it is present) and offer to clean or remove it from your computer. Follow the on-screen instructions to do so.

If you DO NOT have Anti-Virus software installed on your computer:
Rogers Yahoo! Provides an Anti-Virus application as part of our "Rogers Yahoo! Online Protection Software" Free to our subscribers. For more information or to download this software please follow the URL below:
Âonlineprotection.yahoo.com/rogers/

If you are unable to remove the virus within 48 hours, we will have to take additional steps to protect other customers and the Rogers Yahoo! Hi-Speed Internet network including temporary service deactivation. Should this occur, we can reactivate your connection once the virus has been removed by calling into our call center.

If the network activity below is not the result of a Virus, we ask that you reconfigure any programs or hardware which is generating the network activity detailed below to reduce the amount of traffic or redirect it to another destination.

High volumes of MX request with a high volume of Error responses usually indicate a Worm, Virus, or Spam Bot infection. These viruses will usually look for anything that looks like an email address and attempt to find a Mail server for anything that comes after the '@' sign. This results in a high number of MX lookups and error responses.

Additional Resources:
- Learn more about the e-mail Anti-Virus tools provided with your service
- Learn more about Rogers Yahoo! SpamGuard:

Copies of our EUA and AUP are available at:

Âna.edit.client.yahoo.com/rogers/ÂÂÂ.intl=ca

Rogers EUA Management Team

Sincerely,

EUA Management Team
Rogers Yahoo Hi-Speed Internet

Âna.edit.client.yahoo.com/rogers/ÂÂÂrm=terms
00722092

IP Add, MX/Unknown Queries, Errors
99.XXX.XXX.XXX, 415, 36

Date Time,Src,Query,Query type
2008-04-15 06:00:04.35154,THIS WAS AN IP,aaanebraska.com.,Internet MX ?
2008-04-15 06:00:05.55534,THIS WAS AN IP,aim.com.,Internet MX ?
2008-04-15 06:00:06.23935,THIS WAS AN IP,altanainc.com.,Internet MX ?
2008-04-15 06:00:06.60587,THIS WAS AN IP,aol.com.,Internet MX ?
2008-04-15 06:00:07.66938,T

Re:Riddle me this...

[rtechie]

So if researchers can detect these things with apparent reliability in their process, why can't ISPs detect them the same way and cut the bastards off?

They do. Comcast has guys that go after botnets full time, usually by going after the IRC servers. They don't go after the bots themselves because it's pointless. They'd just end up with thousands of users complaining that their Internet was down and they wouldn't patch the systems. So it's either let the bots go, or lose thousands of customers. I suppose they could require some sort of bloated client like AOL that checked for vulnerabilities, but they'd get even more complaints about that.

Re:Riddle me this...

[inject_hotmail.com]

So if researchers can detect these things with apparent reliability in their process, why can't ISPs detect them the same way and cut the bastards off?

If Comcast and ilk such as that were really interested in conserving network bandwidth, they'd be cutting off zombies instead of putting on bandwidth caps.

Well, up in Canada one of the larger ISPs named Rogers will cut the connection if their DNS servers are being pounded. They say it's for "security reasons". Someone I know was cut off, and of course they don't call their customer, the customer has to call in and complain that their net isn't working.

So I clean the machine and call Rogers up...I actually asked them to explain their disconnection for "security reasons". Dude said that they don't want their DNS servers to be hacked. It doesn't make sense to me...so I asked why would they have to close off the pipe because their DNS servers are vulnerable? The guy kept saying the same thing over and over...obviously understanding nothing about the subject he spoke. (DNS servers aren't supposed to be updateable by an untrusted source)

The routine is they turn the net back on, but if you get suspended for "security reasons" shortly thereafter, they cancel the account permanently...how's that for customer care!

Anyway...moral of the story is that ISPs can monitor, but customers get pissy and ask for refunds for days of being cut off, so I surmise most ISPs just ignore that traffic.

With or without protection ?

[Anonymous Coward]

I wonder how many Zombies exist in the face of fully updated Anti-virus /security software from a major Vendor?, anyone out ther been 'Zombied' in the face of brand name fully updated and current anti-virus software and definitions , If so?
what brand(s) ?

George A Romero's new movie:

[El_Muerte_TDS]

Internet of the Dead

Uh, no

[phorm]

Because plenty of windows core services still send traffic even if there's not an obvious "app" in charge of them (there are a bunch of normal system processes that tend to run services underneath them, some of which involve networking).

And that doesn't count traffic on your network as well. Even if your computer isn't sending anything out, it may be responding to other traffic on the network depending on how things are configured, even if it's just to say "this is not the machine you're looking for."

Re:Uh, no

[Icarium]

I'm running a fairly standard XP install, and when my machine is idle, so is my network. It's not foolproof, but seeing a blip on my router once an hour is not going to make me think my box is compromised. A network monitor helps to see whether unexpected traffic is originating from my box or not in the rare case I need to check.

I don't doubt it

[Controlio]

I don't doubt it at all. My computer, which is usually the epitome of clean, caught a worm the other day. It was automatically downloaded and executed (no clicks or dialogs) from one of the top 10 mainstream news websites, no less. Most likely one of the injection attacks. Had to really dig into it to find out that it somehow got downloaded by prefetch in Firefox (which has been promptly disabled now).

The ironic part... with all of the precautions I take, it wasn't detected at the router level nor the virus scan level. Windows firewall caught it before it could download its payload. As I manually removed it and restored from yesterday's registry copy, I had to chuckle a little.

But now that I've seen first-hand an unrequested .exe not only downloaded into ./system32 but executed - both without user approval or so much as a dialog box - I can only imagine how many zombies have popped up in the last few weeks.

Re:I don't doubt it

[sapphire wyvern]

Got any more details?

Re:I don't doubt it

[Anonymous Coward]

Microsoft really needs to fix that Firefox! The rest of the world knows that downloading unwanted files is dumb. When are they going to learn?

That's why I use ... nothing.

Re:I don't doubt it

[DigiShaman]

I've cleaned up over 20 infected Office computers in the last few months. Same thing, a random screensaver file, and some random file in the system32 directory. Almost all of them eventually have that damn XP Antivirus 2008/2009 malware installed.

Oh, and it fucks up the local group policy too where you end up with missing display tabs.

I'm not sure what the vector is, but it's comming from both HTML injection and infected SPAM (bogus e-cards).

Oh and it get's worse. Not a single anti-virus program out there can get rid of it (used the top seven in the industry). I'm forced to back up local user data and format/reinstall the system.

Re:I don't doubt it

[WuphonsReach]

I'm not sure what the vector is, but it's comming from both HTML injection and infected SPAM (bogus e-cards).

It's a Javascript injection attack. Either they send out e-mails with the infective bit of Javascript, or else they hack the FTP password for a website and inject their Javascript into all of the HTML pages on that site.

It really really sucks, because you can't tell users "don't browse bad websites". But not letting users run with local administrator rights on the machine stops it cold (it tries to infect, does display a few messages, but a reboot and virus-scan will kill it).

We've tried blocking it at the firewall... but my squid-fu is lacking (I need to get Squid v3 installed and tie it into ClamAV).

Re:I don't doubt it

[El_Oscuro]

A few years ago, I went to hotmail on my Red Hat box and a message popped up:

You have downloaded a file, "adsclient31.dll". What would you like to do with it? Save to disk or open with...

I don't seem to remember downloading anything. I hadn't opened any emails either. This was coming from the main hotmail site. I wonder what would have happened if I was using IE on Windows?

Bottom line:

1. Don't use IE for anything. With ActiveX and all the hooks into the OS, it is just too dangerous.
2. For other browsers, be very paranoid, even if using Linux. The Year of the Linux Desktop (TM) will have arrived when they start targeting us for viruses and botnets. :)

Your story is truly scary shit. A few weeks ago, we were browsing our real estate agents website on Windows when AVAST intercepted a Trojan Horse, probably inserted as part of an SQL injection attack. If we hadn't had up to date anti-virus, our machine would have been PWNED. By our own real estate agent's website.

Scary shit indeed.

Re:I don't doubt it

[Anonymous Coward]

I have to reply as Anonymous Coward because I moderated in this discussion. It is highly unusual for me to mod something as overrated, but your comment does not seem to earn a lofty +5 rating. It appears to be wrong on so many levels.

Some oddities:

The prefetch feature on Firefox does not download anything to the system32 directory.

The prefetch feature on Firefox does not evaluate scripts and therefore, can not "activate" any malicious code downloaded.

Routers typically do not detect any malware whatsoever.

Windows firewall does not deetect any malware whatsoever.

Unanswered questions:

Which website?

Which executable?

How exactly did it get into the system32 directory?

How are you sure it was Firefox?

How are you sure it was the prefetch feature?

Why do you say Windows Firewall caught it before it could be downloaded as a payload and yet claim you found it in system32?

Oddly enough, the "fortune" at the bottom of the page is currently:

One man tells a falsehood, a hundred repeat it as true.

strike

Re:I don't doubt it

[Stealth Potato]

Actually, I think something like this happened to me just a couple weeks ago. I was using Firefox 3 on Windows XP Professional SP3 with AVG and Zone Alarm, all up-to-date. I was browsing several different sites, all with lots of advertisements -- I had recently reinstalled FF, and I hadn't acquired ABP yet. Suddenly, I get a series of popups, followed immediately by a segfault notification for "a.exe." Moments later, AVG alerted me that it had detected a trojan in "C:\WINDOWS\System32\a.exe."

So, not only did some script manage to download a trojan into system32, it executed it completely without any response or authorization on my part.

I forget exactly which trojan it was that AVG found; I was just about to wipe that drive clean and reinstall so my dad could use it in his computer anyway, so I didn't bother to investigate more deeply. Still an alarming experience though, since Firefox is supposed to be less prone to that sort of vulnerability.

Well...

[Anonymous Coward]

We all knew the day would come when Zombies destroyed everything we live for.

A publicity stunt?

[ubergoober]

Come on, all the machines linking up just in time for the season premiere of the Sarah Connor Chronicles? Fox = marketing genius?

/or maybe that's what Skynet wants us to think.

Solution is simple

[Anonymous Coward]

If you block the entrance to a shopping mall you get arrested, but if you take over a tenth of all computers on the entire planet nobody cares?

Hunt the criminals down, fast and hard. Find them and execute them on the spot. Do this everytime a virus breaks out. Everytime.

They will get the message. Yes they will.

Re:Solution is simple

[X0563511]

The message:

Want someone killed, frame them for releasing a virus.

Yes, your proposal will solve the problem with no side effects.

Re:Solution is simple

[Anonymous Coward]

Clearly that is a feature, not a bug.

Re:Solution is simple

[paco verde]

Wow! Supporters of this course of action might find this link useful r.e. the success of some previous attempts to implement this kind of "justice": http://en.wikipedia.org/wiki/Final_solution

Microsoft Windows Zombie Network Explosion

[rs232]

correct headline ..

Re:Microsoft Windows Zombie Network Explosion

[illuminum]

Agreed. This is an epidemic whose root is proprietary/closed systems.

Re:Microsoft Windows Zombie Network Explosion

[Anonymous Coward]

correct headline ..

it is funny that everyone thinks that linux is the answer. What would happen if all of these dabbling idiots were on linux instead of windows. You have to understand that just because you are linux and have made it safe does not mean everyone can. I mean hell if anti virus isnt picking this garbage up on a windows machine whats going to be the out come on a linux machine.

Re:Microsoft Windows Zombie Network Explosion

[pandrijeczko]

The core problem is that far too many Windows users run their PCs with access priveliges that are far too high for what they need - this means that it's easier for a rogue program to get downloaded onto a Windows PC and run with a high level of priveliges so that it can get access into the core operating system.

Plus Windows has a security architecture that allows some programs to gain that access level without you even knowing anything about it and Windows has a security architecture that is beyond the understanding of the majority of normal users.

Linux enforces the idea that you can do all of your day-to-day stuff as a normal user, it's only when you need to do administration work that you need to go in as root. No, it does not stop someone running as root user for day-to-day use but distributions like Ubuntu don't allow root access by default which helps considerably.

You also need to bear in mind that whatever version of Windows you run, at certain levels all Windows PCs present the same single architecture which makes it very easy for malware to propogate. To do so the same way on Linux would require finding a single common application amongst enough Linux machines to get the same level of propagation.

Linux *is* more prone to directed buffer overflow attacks against services that are run on the Internet but these, again, only work against very specific versions of those applications.

Re:I tried to find the original bot once

[Anonymous Coward]

But it was bots all the way down...

The only thing I found was Kevin Bacon...

some do

[Kenshin]

...why can't ISPs detect them the same way and cut the bastards off?

They can, and sometimes do.

One time a friend of a friend brought her PC over for me to look at. She said it wasn't working well, and wanted me to fix it. I plugged it into my internet connection just to check a few things, and then went about reformatting it. Later, when I plugged my machine into the net and tried to access the web, I got a default ISP web page telling me to call network security. It turns out that her machine had sent out insane amounts of SMTP packets, and my connection was automatically shut-off to prevent more. Since I knew what we were talking about, unlike most customers I suppose, they restored my connection right away rather than keeping a 24 hour shutdown.

Obviously her ISP didn't do this, but mine sure does.

why can't ISPs detect them .. ?

[rs232]

"So if researchers can detect these things with apparent reliability in their process, why can't ISPs detect them the same way and cut the bastards off?"

If they did, they risk cutting off their own spamVertisers, there's no money in protecting their own customers, it would break stuff, they can't be bothered ...

windows

[Anonymous Coward]

that's funny, ne? that's what people deserve for running and supporting windows

Re:I tried to find the original bot once

[Anonymous Coward]

Only thing I found was Kevin Bacon...

Not really

[WindBourne]

THere is only one possible explanation; Vista is making inroads, and the botmasters have new openings on it. No other system is growing that fast (vista is being forced onto new systems by MS). And if it was an old base of some system (say XP), then it would grow MUCH MUCH faster.

Botnet Entropy?

[Flayer_of_Minds]

Sorry for being a uninformed moron, but what exactly is the definition of the "entropy of botnet infections"? Their infection rate? Their "healing" rate?

That is false

[WindBourne]

Back in 2002-4, I worked for a company that developed specialized packet sniffers, that processed anywhere from 1mb (sold to small companies) to 100 mb drops (sold to ISPs) and a specialized box with much higher for sale to several gov. agencies. A simple PC with tcpdump, dsniff or Ethereal combined with a little bit of processing behind the scene can easily process 100 MB drops.

Zombie Network in HD?

[Anonymous Coward]

I'm wondering if I can get Zombie network on Cablevision and if it would be in HD.

The end is a new beginning

[4D6963]

If things continue to get worse the year of the Linux desktop will come sooner than you'd expect. I know people who won't do a thing on their computer without worrying about viruses. I think at some point when the concerns and the solutions will have reached a certain point Windows will have irremediably lost its OS monopoly and it won't matter what OS you run anymore.

Not like it matters much anymore for most people anyways, most of what they do involves just a web browser.

Zombie Network Explosion

[Anonymous Coward]

Best band name ever!!

Phishing sites

[angryrobot]

I've now seen more than a few examples of linking to a "YouTube Video" where the site looks exactly like YouTube, but the video window contains an Active X control, and the URL is definitely not youtube.com. I only noticed because we're on Macs here and Firefox asked me if I wanted to download the plugin to view the content.

microsofts new software

[Sfing_ter]

It's all because of Microsoft's new software release, WindowsXP Anti-Virus 2008. Everybody's getting it, microsoft sends them an email telling them to click a link to get the new download. The damn thing won't run on my linux box though, i feel left out... sigh.

Oh, clients, why must you want the silly shit you want?

Zombie Network Explosion

[Anonymous Coward]

This must be the most awesome headline ever

0-day warez is the catalyst

[Anonymous Coward]

Boom! Out go the lights! You're screwed, in a bad way.

Re:0-day warez is the catalyst

[Dekker3D]

Boom! Out go the lights! You're screwed, in a bad way.

by mister T?

So THAT"S how they're dong it!

[rickb928]

I KNEW Microsoft was up to some new antivirus program. The logic is elegant, and brilliant:

- Design a new OS, oh, call it a browser if you want

- Make it a real heavyweight, more RAM used than the host, threads everywhere, screen candy layered over screen candy, shortcuts, you name it, all to consume cycles and starve the bot software (and the viruses, etc.)

- Botnets wither from lack of nutrition. Herders go broke. In fact, no one gets anything else done on their puters any more. No more harm! NO MORE HARM!

- Profit!

Wait... Wasn't Google? Or did Mozilla just release something? Wait, Opera is always coming up with somethi... Couldn't be AOL could it?... Suppose CERN finally... no, can't be, it's not really running yet, oh, those crazy kids at Apple, wait, the Oracle guys finally... nope, maybe somebody finally fixed... no, that's not it... wait.. Gibson? Nawww....

Sounds like

[Anonymous Coward]

http://dummcomics.com/index?sid=31

Uh, yes

[SaDan]

I've had the displeasure of working on plenty of infected systems in my time, and it's fairly easy to disable services that need the network on XP and 2000 systems, and still have a machine you can work with.

Traffic on the network? I would think while troubleshooting a system that you suspect may be infected with something, you would want to isolate the system as much as possible! Putting it in your DMZ instead of on the same network segment as the rest of your network would be a good start. Nothing should be trying to talk to it, intended or not.

Absolutely correct

[SaDan]

I used to maintain a handful of black boxes that easily handled multiple T3 connections to the internet, and did real-time packet inspection.

It's amazing what specialized hardware can do, and even more amazing what a decent PC properly configured can handle.

Wow!

[RockMFR]

The botnets are doing better than the elephants!

Rarely Are Solutions So Simple

[EgoWumpus]

They'll get the message, for sure. Rather than being obnoxious spammers operating out of a basement, they'll be obnoxious spammers operating out of a basement with lots and lots of guns.

So long as the incentive is there, you're going to have people incentivized by it. You can stack on as many penalties or consequences as you want, you'll still get a few people for whom it won't matter.

There are really only two options; remove the incentive. In this case, I have no idea how that works. Alternatively, work to minimize actual damage. Ironically, I think that spammers are likely to feed into anti-net-neutrality movements. When Comcast is filtering all your traffic, they can filter out virus payloads. Everyone is happy in 1984!

Give up - The performance hit is inevitable

[Cassini2]

Speaking as someone that regularly works on number processing and real-time applications, I've given up on Windows machines. I just assume every Windows box is running ample code that is outside my control, and that code will make the machine much slower for any mathematically intensive computations, especially if they involve disk access or network access. All of the anti-virus code designed to stop viruses and bot-nets is killing Windows as a platform.

One way or another, you pay your speed and uptime penalty. You either pay in downtime caused by the "bad" guys writing bot-nets, malware or viruses, or you pay in slow speed caused by the "good" guys like Microsoft, Symantec, and McAfee, who are trying to stop the bot-nets, malware and viruses. The modern "good" vs. "bad" arms race is resulting in anti-virus software that is so slow that it is strangling the Windows platform with endless code bloat. If you want to prove this to yourself, get an older PC with a fresh Windows installation. Start installing software on it, one package at a time. As the newer service packs are applied, the anti-virus software installed, and the software packages installed, the PC will actually slow down!

Building better anti-virus software for Windows is self-defeating. It slows the computer down to the point that Windows is useless.

Run Linux. Take control of your own computer.

Re:Give up - The performance hit is inevitable

[Anonymous Coward]

Fuck off!

Re:Give up - The performance hit is inevitable

[Anonymous Coward]

Grow up and get yourself a real operating system.

Re:Give up - The performance hit is inevitable

[rtechie]

Speaking as someone that regularly works on number processing and real-time applications, I've given up on Windows machines.

Shockingly, you've given up on using Windows for the tasks Windows is least suited for.

I just assume every Windows box is running ample code that is outside my control, and that code will make the machine much slower for any mathematically intensive computations, especially if they involve disk access or network access.

Yes, it's called a "full-featured operating system". You want some kind of minimalist or purpose-built system. Look into Embedded Windows, where you can carefully pick and choose which elements you want, or any number of Linux variants. I know there are variants of Linux entirely dedicated to scientific computing.

The modern "good" vs. "bad" arms race is resulting in anti-virus software that is so slow that it is strangling the Windows platform with endless code bloat.

So don't run AV. If you properly lock down the system you shouldn't need it. If you must have AV, use NOD32. It gets good ratings and is notably less resource intensive that other AV applications. Or you can take regular Ghost images of the system. Resource intensive, but the images will allow you to roll back any changes to the system, including "rooting". The Ghost images would work to protect the Linux system against rooting as well.

Re:Give up - The performance hit is inevitable

[Anonymous Coward]

What about Plan 9?

Nah, it's just stupid users

[Joce640k]

There's that new "antivirus XP" thing doing the rounds. I bet loads of people have been stupid enough to click on that.

Re:Nah, it's just stupid users

[Anonymous Coward]

I work in a computer repair shop. When that and its variants hit about 2 months ago, our floor was covered with computers that had to be cleaned.

I just got five more of it and its variants today. Middle of last week, the Antivirus XP "from Microsoft" spam started rolling into my Spam filter.

is blocking worthwhile?

[damn_registrars]

Not sure if you're having the same experience that I am or not. I have a system at home that acts as a (FreeBSD) web server. Periodically I'll see single days where 300+ individual systems will attempt to get in via ssh. According to /var/log/messages, each system tries on average one user name and then gives up.

Of course quite a few of them are trying root (which any smart admin will disable for remote access), but nonetheless I see a lot of this.

My question for you though is whether or not it is even worthwhile to blacklist and lock out these systems. It seems like they only try once and give up - I suspect that locking all these out could end up just producing an obscenely long list of firewall rules that might not necessarily solve anything.

Feel free to let me know if you think I'm missing something, or if you are seeing something different in your traffic.

Re:is blocking worthwhile?

[Megaweapon]

It appears to be coordinated. One IP will hit once or twice the move on, then a minute or two later another IP will try once or twice. We're running fail2ban to block out the bulk attempts, but all I'm doing for the one-shot'ers is just collecting the unique address then blocking them with iptables. Not much more I can do without making it a research project.

Re:is blocking worthwhile?

[damn_registrars]

It appears to be coordinated.

I agree with that, particularly based on the regular intervals between the attempts. And I've seen it before, too.

However, my question for you is whether or not anything is accomplished by blocking these addresses. I haven't seen the addresses come back later, so I'm not sure there is value in blocking them. It seems like you just end up with a ridiculously long list of rules in iptables.

If there is something that I am missing, please let me know.

Re:is blocking worthwhile?

[Megaweapon]

I haven't seen the addresses come back later

Some of them do keep trying from what I've seen.

However, my question for you is whether or not anything is accomplished by blocking these addresses.

After blocking a bulk of them at the firewall level, doing a "iptables -nL -v |less" shows (first column) a bit of them still throwing packets at the machine, and some of them just keep trying even after they've been blocked for more than a day (perhaps longer even). So, at least in my opinion, it does accomplish something for me at least, knowing that the sshd daemon isn't being bothered as much, and my logcheck mails are smaller.

Not quite THAT bad

[Beryllium Sphere(tm)]

>If your machine's admin password is blank and you're not behind a NAT, you are completely exposed.

As of XP Service Pack 2, the built-in software firewall is on by default, and blank passwords disable network logins. Not that the security posture of the typical home machine is anything we'd consider decent, but it's not the same as running sshd with a blank root password would be.

Chinese SQL Injection Bots

[Anonymous Coward]

I think that this rise in zombies is 100% attributed to the latest sql injection attacks that are going around. The attacks append links to an external javascript file to every field in a sql database in the hopes that it will be rendered on the website. When it is rendered then the javascript tries a bunch of exploits on different browsers and plugins to deliver its payload and create another bot. This attack turns insecure web servers into carriers for the exploit.

The amount of attacks using this has been going through the roof all summer.

How do you know...

[Anonymous Coward]

...if your computer is part of a bot-net?

Re:How do you know...

[Anonymous Coward]

If you have to ask, the answer is "It probably is"

Thanks for the critique

[SaDan]

Glad you had so much to offer in this thread.

Read some more, I clarified my original post in a follow up, and I didn't forget about services, which can be disabled just like applications.

I guess I'll have to start posting 200 page technical docs for folks like you and the guy I originally posted to, since you apparently need the hand holding.

BSD

[Anonymous Coward]

"if it's not running Linux it's zombied"

It isn't that easy. It might also be running BSD.

So now BSD is undead?

Er, wait a second...

Fairwarning?

[ez151]

If they can tell a pc if infected, I guess by the type of traffic it is spitting out, do they let the poor saps know it is infected? Hello your computer if infected click here to run a scan......

Network Card activity light to detect malware???

[Anonymous Coward]

Even powered-down machines have network cards that "blink" regularly depending on the network you are plugged into.

There is plenty of self-sustaining network traffic that is generated across a switched network. Such as:
ARP Requests
Multicasts
DHCP Requests
Netbios Requests (yes - still exists)
Cisco CDP (as others)
Routing protocol HELO's
Are you plugged into a hub?
Any type of Proactive Corporate monitoring

Almost all manufacturers network cards are still active even when you are supposedly powered down the computer or server. This is a bad detection mechanism at best. At worst it is completely misleading.

what are zombie pc's?

[Anonymous Coward]

are they PC's that have died but were able to reboot?

Bad editors!..

[plasmacutter]

This title looks to me more like a bad movie than a story.

How do I know if my server or computer is Zombie?

[Orig_Club_Soda]

What do I look for on my web server? What do I look for on a computer? Can a router or a Macintosh become a zombie?

Re: dabbling idiots ..

[rs232]

"What would happen if all of these dabbling idiots were on linux instead of windows"

The dabbling idiots shouldn't be allowed to use Linux until they learned to compile the kernel and what about all the dabbling Mac idiots .. ?

Love the tag

[Nonillion]

security, windows, brains. The three words that have the least in common.

Re:Love the tag

[webwerks]

security, windows, brains: pick two

Re:I tried to find the original bot once

[Anonymous Coward]

Hey, I posted that first!

Maybe I'm living on a different planet...

[BrokenHalo]

...but I haven't seen such a spike in spam (virus-laden or otherwise) at all.

But then again, I don't check my server logs that often any more. Maybe I should...

Read the writing on the wall..

[Dragoness Eclectic]

Remember what happened the last time the botnets went on a recruiting spree? (Hint: Georgia).

I wonder who they are prepping to DDOS this time? Georgia again? U.S. infrastructure? Which country is Russian invading next--or are they just going to finish the job they started in Georgia?