Slashdot Mirror
New Massive Botnet Building On Windows Hole
CWmike writes "The worm exploiting a critical Windows bug that Microsoft patched with an emergency fix in late October is now being used to build a fast-growing botnet, said Ivan Macalintal, a senior research engineer with Trend Micro. Dubbed 'Downad.a' by Trend (and 'Conficker.a' by Microsoft and 'Downadup' by Symantec), the worm is a key component in a massive new botnet that a new criminal element, not associated with McColo, is creating. 'We think 500,000 is a ballpark figure,' said Macalintal when asked the size of the new botnet. 'That's not as large as some, such as [the] Kraken [botnet], or Storm earlier, but it's... starting to grow.'"
Don't people use auto-update?
Weak. In the good ol' days, a first post troll would have picked up on the words massive and hole and made a Goatse joke. You are a disgrace to the once proud troll race.
It's time MS write botnets to exploit their own holes as means for patching said hole. Who gives a shit about the ethics of it, we are losing.
ISPs need to be more vigilant as well. Cut off subscribers ASAP when they're machine begins sending botnet traffic.
Three words:
Incompetent IT Department.
Every time i see one of these high-yield Windows remote execution holes, I'm tempted to couple a timed network-stack-erasing payload to it (24 hours should be enough for it to be able to infect through vpn-connected laptops and such) and send it cracking. Then i always begin to wonder why this hasn't been done already; is the combination of narcissistic recklessness and technical competence really that rare? It could be argued that it's more fun to play pranks and infiltrate corporate and government networks, but we don't even see things like that (I know it was more common up to the early 90s, when the "criminal prankster hacker scene" still existed outside of small tight groups...)? Or do people just cover it up? You sysadmins out there, have you ever had anything like that happen to you, or anyone you know?
Pretty much. The closest was the "I Luv U" email which overwrote media files.
Since then, it's all about profit. Why destroy a computer when you can use it to send spam?
If you want to be really cruel, your "virus" would randomly alter a few numbers on any Excel spreadsheet it could access.
Reminds me an ancient joke:
Windows is same as whores: They both have massive hole and full of viruses.
just wonder why there are so many anonymous cowards in this world....
Do you want a larger, firmer botnet? One that all the ladies will love and other guys will envy? Here's how to enlarge your botnet quickly and easily.
If your botnet stays up for 6 hours or longer, please seek the help of a physician.
Have gnu, will travel.
Indeed, my father in law is stuck on dialup, and wondered why his computer was so slow. (I hadn't been supporting him previously so I didn't look at his patch status) A quick speedtest (20 minutes later) showed he was downloading at less than a kilobyte per second.
Thats when I noticed it was downloading SP2 every single time he connected to check his mail. It has probably been downloading SP2 since it came out, years prior.
I think he was almost 70% complete with sp2 it probably would have been done in another year of intermittent use, but not before sp3 came out ;)
I now give him service packs on CDs
Web Developers: Celebrate to our roots! Animated Gifs and Tiled Backgrounds, dont let our history die!
Hit at our company today. Pain in the butt. PC's that had lagging or broken anti-virus updates got hit the most.
Table-ized A.I.
If you buy a gun, and leave it sitting in your front garden, then some criminals come along, take control of it, and kill everyone in your street, you're kind of responsible for that.
Apart from the obvious killing != spam and/or fraud, how is leaving an unprotected OS with known problems available to be hijacked by anyone who wants to do damage with it any different? You should still be responsible (although the punishment might be different). Suppliers should be forced to make this obvious to people buying this stuff.
Follow me
I use Norton, Mccaffee and AVG Grisoft all at once, oh wait nevermind. I don't use windows anymore.
Oh Crap, I'm an optimist.....
Does that mean Macs have 10% of the market share of annoying ass spam networks? Cause they've already got 100% of the annoying and misleading commercials...
Wow.
Simply wow.
I mean, I haven't seen a collection of stupidity like this in years, and I read Stallman's articles from time to time.
Please, get yourself spayed before you breed.
if the people writing exploits for these security holes wrote a worm that once it had got onto a computer patched the exploit and then detached?
You could call it Good Samaritan Computing or something ;)
"Botnets, spammer's botnets!
What kind of boxes are on botnets?
Compaq, HP, Dell and Sony, true!
Gateway, Packard Bell, maybe even Asus, too!
Are boxes, found on botnets.
All running Windows, FOO!"
I'm running Mac OS X 10.5.5, here.
Why, yes. I AM a smug bastard!
Thanks for asking.
Guaranteed! This comment 100% Anthrax free!
I'm curious - how do infected computers survive on the Internet?
We have legions of honeypots for the detection of infected hosts (not to mention the likes of GMail). ISPs have been qqing about bandwidth - surely bandwidth consumed by infection is the most loathsome waste.
Why don't ISPs have a takedown system? They could restrict who they trust - perhaps only Symantec and McAffee, maybe hotmail, yahoo, and GMail as well. The could do a limited takedown of outbound email only, adding a message to the customer's email account. Perhaps have an HTTP interceptor display a page with links to tools for system cleaning, maybe commercial products if they feel the defense of their corner of the net is not sufficient recompense.
OK, I can dig the risk of inappropriate takedowns - but we run that risk non-stop with the DMCA for a heckuva lot less tangible benefit.
Expense? I'm sure we could get a few dozen folks together to write the software.
Customer experience? Really now - if my Mom's computer was infected and her ISP told her, and gave her links to fix it, she'd love it.
Inability to trust the router droppings? Half the Internet connections in the world are probably covered by a couple dozen ISPs - start with trusting only those router entries.
So - what am I missing?
Stop-Prism.org: Opt Out of Surveillance
"I haven't seen a collection of stupidity like this in years"
Never read the comments at the John McCain YouTube site, have you.
Pure, refined and concentrated crazystupid, all in 500 characters or less.
Guaranteed! This comment 100% Anthrax free!
Just block excessive web-requests or mails coming from a regular home connection and you have defanged whatever bot or zombie that might be lurking there. Without the ability to send spam or to participate in DDoS blackmail attacks, the machine is essentially worthless to the cyber-criminals. Sure, it might provide a password to some online backing and maybe a credit card number, but that's about it.
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
I think of Windows antivirus and I think of this picture. "Ur doin it rong."
http://rocknerd.co.uk
Isn't it about time DHS declare Microsoft Windows a Weapon of Mass Destruction (WMD)? "Stop palling around with terrorists," says Governor Sarah Palin.
revolves around unscrupulous business tactics and emergency fixes to a dated and uncompetitive product turned fixture by lock-in, an enormous spinning vortex of shit known as a botnet is only natural.
Windows vista and its DRM in and of themselves are a botnet that offer you plugins and upgrades at the expense of your CPU time and sanity much the same way a botnet effectively doles out dickpill adds.
you can hurl your best in-house antivirus at it, but since that was composed by coders flogged to the finish line by marketing, i dont see how thats destined to placate the issue.
Good people go to bed earlier.
Flaming sentiment: check.
Questionable grammar: check.
DRM + Vista mention: check.
Zero citations: check.
Please feel free to comment similar sentiment when non-Microsoft OS's get patched up quickly.
In other news, Apple is now recommending Anti-Virus for Mac OSX. Now that is a curious turn of events, don't you think?
throw new NoSignatureException();
As someone who occasionally boots an illegitimate copy of Windows to play his legitimate copy of Half-Life (tried it in Wine but it blew up the entire system somehow) I can state that such a person would perhaps not be inclined to update, out of uncertainty about what installing the WGA program might entail (now or in the future). Certainly WGA identifies one as a vile and wicked person, and most likely (now or in the future) it might somehow cripple the system. Therefore, no updates. Yes, I do feel the pangs of guilt with regard to the pirated copy, but if somebody where to give me 200 bucks and told me to choose between a new cpu+mobo or a donation to an organization which imho does more damage than good ... tough choice.
I concure: I believe I get some security with less - no, lesser than that - instead of more protections.
I run a win XP SP1 at home. Behind a NAT rejecting non solicited traffic.
Apart of that :
- no soft firewall
- no real time virus scanner
- no OS updates ever
but even less than that:
- disabled about 90% of startup process
- disabled about 70% of all startup services
- disabled all automatic updates
- uninstall un-needed stuff
- no toolbar-crapware-[younameit]ware
- aggressively remove crap ( CrapCleaner helps ) The one time I was too aggressive : I broke a soft. Guess what: I downgraded the soft. Worked fine since.
- Being somehow prudent internet surfer: etc/hots + addblock + rip + a few other things giving me a browser doing lesser than usual but well.
I obtain a seemingly clean radar when I scrutinize my box from time to time.
Sometime less is more.
I remember once at a work place : the automatic update on win boxes got the source code repository access screwed. Halted the nigtlies for the company. Since that, I consider automatic updates as viruses: you don't know when and what comes in. Yet it is often allowed and recommended. Mad.
Bye.
Z.
Apple Quietly Recommends Antivirus Software For Macs http://it.slashdot.org/article.pl?sid=08/12/02/1314208
As someone who occasionally boots an illegitimate copy of Windows to play his legitimate copy of Half-Life.... if somebody were to give me 200 bucks and told me to choose between a new CPU+mobo or a donation to an organization which IMHO does more damage than good ... tough choice.
Which organization do you mean: Microsoft or Black Mesa?
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
If its as bad ad they say, offer a freedownload WITHOUT the checkers to those with valid or invalid windows xp ...and let them update THAT hole....problem solved....oh yeah M$ != profit....sorry my mistake.
Go back and check those 31 pages again... Go ahead, click on the links to the issues themselves... Now click solution... Good. Now, as a homework assignment, count how many of those 31 pages are actually "outstanding". For extra credit, apologize to the slashdot community for talking shit without having a clue.
BTW, the closest I found to an "outstanding" issue were 2 bugs (I only checked the first page). One had a PROPOSED patch (I'd count that as outstanding) and the other recommended uninstalling the Microsoft provided patch. Hrm. Maybe those 31 pages don't seem so daunting after all.