Slashdot Mirror
Storm Worm Botnet "Cracked Wide Open"
Heise Security reports that a 'team of researchers from Bonn University and RWTH Aachen University have analysed the notorious Storm Worm botnet, and concluded it certainly isn't as invulnerable as it once seemed. Quite the reverse, for in theory it can be rapidly eliminated using software developed and at least partially disclosed by Georg Wicherski, Tillmann Werner, Felix Leder and Mark Schlösser. However it seems in practice the elimination process would fall foul of the law.'
However it seems in practice the elimination process would fall foul of the law.
I'm sure I'm not alone when I say, "So?"
However it seems in practice the elimination process would fall foul of the law.
Whose law?
The higher the technology, the sharper that two-edged sword.
Who cares about laws? I mean, the criminals don't, the government doesn't care, is anyone still clinging to this outdated model of a coexistance standard?
Yes. Governments.
The higher the technology, the sharper that two-edged sword.
That's the problem.
The criminals do not care because they were criminals to begin with. This affects the people who are not criminals but who want to clean up the mess made by the criminals.
Now, if the various governments could/would authorize their law enforcement agencies to use this method ...
Some people run some botnet ops from some countries with some loose laws to gain some protection.
Is it not as easy to dismantle a freaking botnet from there?
If you manage to disable the storm botnet, someone will just great better botnet software. The end result is just a better botnet.
If you want to stop the botnet, you need to remove its incentive. The botnet operates not for someones jollies, but because it is profitable to have a botnet. If you remove the profit motive the botnet will self-disassemble over time.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
While OS X, Linux and others are inherently more secure than an unpatched Windows, the user is still the weakest part of the whole setup.
Wait until we get enough dumb users who install all sorts of shit onto their computers. Granted, the numbers will be much lower than machines which can get infected without any interaction by its owner, but we WILL get users dumb enough to type their password to install "stupid program XYZ" from unknown sources.
While OS X, Linux and others are inherently more secure than an unpatched Windows, the user is still the weakest part of the whole setup.
I disagree. Users are a weak link, but currently not the weakest and there is a lot that can be done before modifying users becomes practical.
Wait until we get enough dumb users who install all sorts of shit onto their computers. Granted, the numbers will be much lower than machines which can get infected without any interaction by its owner, but we WILL get users dumb enough to type their password to install "stupid program XYZ" from unknown sources.
Most users have the expectation that installing a program is not the same thing as giving someone else complete control of their computer and the ability to send as many e-mail messages in the background as they desire. This expectation is not met. Most users who install software use many different mechanisms for such installation, some of which do require users to type in their password. Because of this, why would users not type in their password when installing a program?
My basic point is just that we need to fix operating systems and make them relatively secure, consistent, and understandable to users as well as make sure they don't reward unsafe behavior. People interested in making computers and the internet more secure have plenty of room to make improvements. The problem is, they don't have the motivation. The solution is effective enforcement of antitrust laws. Return competition and capitalism to the market and the problem will solve itself in short order.
If a user installs some program on either Linux or OS X, what's to stop that program from making outbound connections to port 6667 (to receive instructions) and to port 25 (to send spam)? I've never understood this "if users wouldn't run as Administrator/root, we'd all be safe" argument, you don't need superuser privs to send email.
Because we don't need to. The botnet software is readily detectable. Simple solution: require ISPs to warn users if their machines are found to be infected and, if no action is taken (ie. not cleaned up and the user doesn't contact the ISP to discuss it) in a reasonable timeframe, suspend their network access.
If you're driving with a car that's spraying oil all over the road, dropping pieces off and generally posing a hazard to other drivers, the police will cheerfully ticket you and impound the car. They don't try to fix the car, they take it off the road and leave what to do next up to the owner. I fail to see why a similar approach can't be applied (other than "But then they won't be able to use the Internet!", to which I reply "Well, yes, that's kind of the point.").
Part of the difference with Linux is that downloading random-ass crap from untrusted sources and blindly running an installer is not the usual way to install software. With the major distros, the user will get stuff out of the official repositories, which have been examined and vetted. This is especially true of the "clueless user" type you're describing.
Malware is so prevelent on Windows partially because Windows provides no way for a user to know what the hell is going on. The expected means of installing software is to visit random websites, owned by god-knows-who, download some executable, and run it. You rarely have any means of telling what it's actually installing, where it's installing, and just what these programs actually do. When this is the preferred way of doing things, is it any wonder that people download and install malicious stuff without even knowing it?
A fine example is Chrome, which I installed in the first few days it was released. I didn't notice that stupid Google Updater thing which was silently installed alongside, until much later when I was checking my running processes for unrelated reasons. Getting rid of it was a pain in the ass, too. I'm a veteran user who knows what the hell I'm doing, and Google "should be" a trusted source -- yet this slipped right by me. That thing could easiliy have been malicious (though to my mind, anything that "updates" unknown servers with unknown information about my computer is malicious).
The Linux repository and package management system isn't perfect but it is far and away lightyears ahead of the Windows method.
mirrorshades radio -- darkwave, industrial, futurepop, ebm.
Well, the Storm net depends on deniability. Whoever is directing the zombies, they needn't reveal anything about themselves to the botnet, or connect from a particular place The command just needs to find its way into the wild.
Naturally, the cure is going to have to exploit the same dynamic. If we're as careful as the botnet designers were, retribution would be basically impossible.
DRM: Terminator crops for your mind!
My only regret is that I'm not smart enough to be able to contribute directly to a project like this, but as a Mac user, who uses a Mac because "that's what he has", I say hell yes, go for it! I don't like seeing people on any platform being victimized at all. Why ask permission? Just put on the white hats out there and gun it. I could offer some cluster server space if that helps at all.
I also think that the "get the Feds on it" idea is ridiculous. This is about doing the right thing, for the right reason, and we don't need them for that... far from it, really.
In the mean time, the vulnerability has been revealed to those who run the Storm botnet and I bet they're already working to deploy a patch that'll make it inneffective.
By reading this signature, you hereby agree with the content of the above comment.
Why not get the user's consent first ?
If a zombie is detected, it should be isolated in the same way as a commercial wifi node : no access to the net, and web access pointed to a login page. That page would then offer the option of continuing to use the machine offline, or having the bot software neutralised.
No need to worry about knock-on failures from disconnecting a critical machine : any critical system that relies on its net connection is either broken by design or so unusual that it could be handled as a 'do not block' case by the service provider.
I've never understood this "if users wouldn't run as Administrator/root, we'd all be safe" argument, you don't need superuser privs to send email.
A big difference is that although a non-admin bot can run, it can't hide. It can't conceal its existence from OS tools which display processes and files, and so it can't hide from any removal/detection tools.
One more reason not to use tor. What if the "purge command" leaves tor network through me, something goes wrong, the "purge command" is traced back to me, and I find my door being knocked on by few officers wanting to have a little friendly chat?
If more people were using software written by another guy from Finland 16 years ago, there would be no W32 crime wave and we would not need super cracker cops authorized to violate your privacy.
Right, there would be a Linux crime wave instead. Linux doesn't prevent users from running trojans or force them to get their operating system patched.