Slashdot Mirror
Storm Worm Botnet "Cracked Wide Open"
Heise Security reports that a 'team of researchers from Bonn University and RWTH Aachen University have analysed the notorious Storm Worm botnet, and concluded it certainly isn't as invulnerable as it once seemed. Quite the reverse, for in theory it can be rapidly eliminated using software developed and at least partially disclosed by Georg Wicherski, Tillmann Werner, Felix Leder and Mark Schlösser. However it seems in practice the elimination process would fall foul of the law.'
However it seems in practice the elimination process would fall foul of the law.
I'm sure I'm not alone when I say, "So?"
Who cares about laws? I mean, the criminals don't, the government doesn't care, is anyone still clinging to this outdated model of a coexistance standard?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
They should just publish their code. Let the individual hackers decide what to do with it...
This falls into that whole super-hero vigilante category. Just ask yourself, what would batman do?
Why not just give the code to the FBI and let them turn it on? I'm sure they'd be more than happy to. Or ask them for immunity on this point. It's not like the Feds don't want this thing gone as much as anyone.
That's the problem.
The criminals do not care because they were criminals to begin with. This affects the people who are not criminals but who want to clean up the mess made by the criminals.
Now, if the various governments could/would authorize their law enforcement agencies to use this method ...
Using this background knowledge, they were able to develop their own client, which links itself into the peer-to-peer structure of a Storm Worm network in such a way that queries from other drones, looking for new command servers, can be reliably routed to it. That enables it to divert drones to a new server. The second step was to analyse the protocol for passing commands. The researchers were astonished to find that the server doesn't have to authenticate itself to clients, so using their knowledge they were able to direct drones to a simple server. The latter could then issue commands to the test Storm worm drones in the laboratory so that, for example, they downloaded a specific program from a server, perhaps a special cleaning program, and ran it. The students then went on to write such a program.
Seems like the method involves the server communicating with the client - which could be considered "hacking" and thus be problematic.
Especially here in Germany where even possessing nmap is a crime.
Some people run some botnet ops from some countries with some loose laws to gain some protection.
Is it not as easy to dismantle a freaking botnet from there?
If you manage to disable the storm botnet, someone will just great better botnet software. The end result is just a better botnet.
If you want to stop the botnet, you need to remove its incentive. The botnet operates not for someones jollies, but because it is profitable to have a botnet. If you remove the profit motive the botnet will self-disassemble over time.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
The guys found the "cure" of Storm Worm are university students. They did the research using the university's facilities. They have to follow the university's regulations and everything they do is pretty open to the public. Should they just triggered the switch and take over, the university may find itself in legal trouble.
Unless one of them happens to be Batman.
Colorless green Cthulhu waits dreaming furiously.
I would say that it should be. Why waste time and effort trying to find crackers who will only be replaced by different crackers in different countries if you do manage to prosecute them?
Remove the zombies in your country and the zombie problem is pretty much solved.
But to accomplish that, you need to be able to automate the process and perform it remotely. There just are not enough resources to handle each computer individually.
While OS X, Linux and others are inherently more secure than an unpatched Windows, the user is still the weakest part of the whole setup.
I disagree. Users are a weak link, but currently not the weakest and there is a lot that can be done before modifying users becomes practical.
Wait until we get enough dumb users who install all sorts of shit onto their computers. Granted, the numbers will be much lower than machines which can get infected without any interaction by its owner, but we WILL get users dumb enough to type their password to install "stupid program XYZ" from unknown sources.
Most users have the expectation that installing a program is not the same thing as giving someone else complete control of their computer and the ability to send as many e-mail messages in the background as they desire. This expectation is not met. Most users who install software use many different mechanisms for such installation, some of which do require users to type in their password. Because of this, why would users not type in their password when installing a program?
My basic point is just that we need to fix operating systems and make them relatively secure, consistent, and understandable to users as well as make sure they don't reward unsafe behavior. People interested in making computers and the internet more secure have plenty of room to make improvements. The problem is, they don't have the motivation. The solution is effective enforcement of antitrust laws. Return competition and capitalism to the market and the problem will solve itself in short order.
It's a botnet, not a batnet.
If you can read this, I forgot to post anonymously.
Because we don't need to. The botnet software is readily detectable. Simple solution: require ISPs to warn users if their machines are found to be infected and, if no action is taken (ie. not cleaned up and the user doesn't contact the ISP to discuss it) in a reasonable timeframe, suspend their network access.
If you're driving with a car that's spraying oil all over the road, dropping pieces off and generally posing a hazard to other drivers, the police will cheerfully ticket you and impound the car. They don't try to fix the car, they take it off the road and leave what to do next up to the owner. I fail to see why a similar approach can't be applied (other than "But then they won't be able to use the Internet!", to which I reply "Well, yes, that's kind of the point.").
I know it's terrible form to reply to one's own post, but let me just come out and suggest it:
A collaborative, and perfectly anonymous or pseudonymous code project.
Wicherski, Werner, Leder and SchlÃsser must be protected from punishment for their fine work for the good of humanity. So, informed by their disclosures, I say an open source counter-worm ought to be developed from scratch. To protect those working on it, the collaboration model would have to be a little bit 4channy.
The downside to anonymity (As our good friend the Obama/Library/Poop guy shows us) is that it means people don't have to act accountably. There would probably be tons of ebil coders, seeing a wide-deployment worm accepting code contributions, trying to sneak their own obfuscated backdoors into the code.
But the upside to a system like this is transparency. There are still plenty of eyes on the code, and plenty of coders to call shenanigans on one another.
Whadda ya say?
DRM: Terminator crops for your mind!
In the mean time, the vulnerability has been revealed to those who run the Storm botnet and I bet they're already working to deploy a patch that'll make it inneffective.
By reading this signature, you hereby agree with the content of the above comment.