New Mega-Botnet Discovered

yahoi writes "According to the DarkReading article, 'Researchers have discovered a major botnet operating out of the Ukraine that has infected 1.9 million machines, including large corporate and government PCs mainly in the US. The botnet, which appears to be larger than the infamous Storm botnet was in its heyday, has infected machines from some 77 government-owned domains — 51 of which are in the US government. Researchers from Finjan who found the botnet say it's controlled by six individuals, and includes machines in major banks.'"

Comments

Can Help?

[arizwebfoot]

Can they fix the government? Infect AIG and get our money back?

Maybe this isn't such a bad thing after all.

Re:Can Help?

[Daengbo]

Maybe this isn't such a bad thing after all.

Maybe it'll finally open the government's eyes to protecting their networks. They are generally in really bad shape. There are some exceptional sysadmins out there, but they are often hogtied by anti-security regulations and expectations.

Re:Can Help?

[udippel]

Maybe it'll finally open the government's eyes to protecting their networks. They are generally in really bad shape.

So true. And so uncalled for here. Because surfing legitimate sites and catching a trojan is nothing that network security can do about.

Re:Can Help?

[PotatoFarmer]

So true. And so uncalled for here. Because surfing legitimate sites and catching a trojan is nothing that network security can do about.

How so? Network security in this context doesn't mean setting up a firewall and calling it a day, it means layered security of the entire network, including all the devices attached to it.

In the case of a trojan payload, properly patched machines along with restricted user accounts help quite a bit.

Re:Can Help?

[HockeyPuck]

Cue the response of the typical /. user:

"I use linux and firefox and noscript and noflash and adblock plus.... so therefore I should be able to surf ANY site I want to..."

Re:Can Help?

[FlyingBishop]

He was talking about anti-security regulations. Like regulations requiring that software go through a several year government testing phase before it can be adopted, placing them horribly out of date.

Every machine in the LoC is using IE6, because they designed some proprietary crap 8 or 9 years ago that would be too expensive to upgrade to an infinitely more secure Firefox or even IE8-based system.

On the other hand, those were the most sandboxed terminals in the world, probably safe even with IE6 (there was some McAffee kiosk control system running that looked pretty hardened.)

Re:Can Help?

[dov_0]

Actually I do have fun occasionally picking at malware and malicious websites, but I can't get them to infect my Linux machine. Even without noscript, noflash, nofun etc. At the present time, those with a reasonably secure Linux box at home are pretty safe from nearly all common attacks.

Re:Can Help?

[muckracer]

> In the case of a trojan payload, properly patched machines
> along with restricted user accounts help quite a bit.

So why does the XP installer first create an Administrator account and then prompts you to create a "user" account, which ALSO has (to have) administrative access??

There's a few million infections right there...

Re:Can Help?

[LostCluster]

Maybe it's unavoidable that when you let people download, they may get fooled. However, noticing you've got a botnet on your network is Network Security's job.

Re:Can Help?

[Anonymous Coward]

It won't open eyes. It will encourage laws like the DMCA to sweep the problems under the rug. Security through obscurity doesn't work in the long haul, but in the short run, it is great.

I can see Draconian laws being passed banning ownership of "hacking tools" (debuggers come to mind) that might catch some clueless script kiddie from some junior high school, whom is promptly made an example with, having adult felony Federal charges pressed. However, the people in Elbonia will still be running their botnets and will be more undetectable because sysadmins won't have the tools to detect attacks. The result will be less DETECTED attacks, and that is what top brass in a number of companies and organizations want.

In my experience, most companies don't give a shit about intrusions. Its the ones that make the press they care about. If they can make it where detecting it is harder, then the top brass is happy, even though someone from Elbonia is using their main Exchange server as a P2P hub.

Re:Can Help?

[thePowerOfGrayskull]

> In the case of a trojan payload, properly patched machines > along with restricted user accounts help quite a bit.

So why does the XP installer first create an Administrator account and then prompts you to create a "user" account, which ALSO has (to have) administrative access??

There's a few million infections right there...

We're not talking about home users, we're talking about sys admins who should know better than to allow this when they configure users in their domains; and when they mass-prepare their workstation images.

Re:Can Help?

[pwizard2]

Although Linux is better than most systems out there and is resistant to the various drive-by attack methods, nothing is completely impervious to malware. Linux can still get hit with a trojan if the user can be tricked into installing a tainted package as root.

Re:Can Help?

[PotatoFarmer]

Why would a competent sysadmin be using the XP installer instead of a locked down image? Again, we're talking about good security and network management practices here.

Re:Can Help?

[Anonymous Coward]

Maybe it will open the government's eyes to the problem of botnets and get them to change the laws so that our white hats can legally use the bots themselves to unload their malware from the subjugated machines.

Re:Can Help?

[Khyber]

Why would a competent sysadmin even design a network hooked to the general internet to begin with if security is an absolute must?

Physical separation 100% is REQUIRED.

Re:Can Help?

[dov_0]

So the attackers for the main part have to fall back on social engineering. That's a pretty good advertisement for the software I reckon!

Re:Can Help?

[maxume]

Required for what exactly? There are probably government computers that legitimately need access to the internets.

Re:Can Help?

[dimeglio]

Why would a competent sysadmin even design a network hooked to the general internet to begin with if security is an absolute must?

... maybe because of Internet banking? Risk, cost or convenience, pick two.

Re:Can Help?

[Anonymous Coward]

Maybe it'll finally open the government's eyes to protecting their networks.

Oh, they realize it. There is a big push to have a standard secure desktop to all of the Fed's computer. The standard is good. It does everything that you'd expect for a secure desktop. Restriction of services, and admin accounts, and blocking Active X controls. Lock down the ability to connect to Windows share willy-nilly. Make sure that all the patches to software are installed in a timely fashion. (IE: Conflicker should not be infecting Federal machines, if they were following these guidelines, they would have had the patch deployed in 10 days) And the best part is (in theory anyway, I have yet to see it actually happen) that if a software vendor wants to be on GSA, they need to certify that their application can run without admin rights. And if they don't they need to document exactly why.

The problem? It was supposed to be implemented February of 20088. And outside of a few big pilot programs, nobody has the thing 100% implemented yet.

Part of the problem is that if you implement everything, you're practically guaranteed to not be able to work in your environment, so one must find and document the exceptions. If you have a crappy network/desktop practices to begin with, you'll be screwed in your deployment. Our practices were good to begin with, scoring 80% compliance, and it didn't take much to get to 90%, but that last 3% to be in the green is proving to be a killer.

There are some exceptional sysadmins out there, but they are often hogtied by anti-security regulations and expectations.

The regulations generally aren't the problem (Though just last month it was announced that Entrust encrypted email is no longer acceptable to send PII through. You have to use an encrypted USB thumbdrive. And not just any drive, A Kanagaroo drive. No BlackBox Data Travellers, no IronKeys, just these colorful Kanagroo drives, so sometimes the regs don't make sense), it's the expectations. I'm always told that "The company (I work for a subcontractor to the feds) will do everything that they can to make sure that we meet Cyber's needs". Which is great until somebody with enough political clout is inconvenienced. Fortionatly, this is becoming more and more rare, as the Feds have been backing our decisions.

Support from software vendors also suck: "It works for us, why don't you give them admin rights, that'll fix it?" Uh, not just no, HELL NO

Re:Can Help?

[steveb3210]

Cue the response of the typical /. user:

"I use linux and firefox and noscript and noflash and adblock plus.... so therefore I should be able to surf ANY site I want to..."

Too bad you forgot to turn off images and just got pwned by the 0 day buffer overflow the hackers discovered in libjpeg.

Re:Can Help?

[Daengbo]

Lynx to the rescue! Lynx should be the only browser allowed on secure networks. Hehe.

Re:Can Help?

[Daengbo]

From the FAQ

What operating systems have FDCC settings?

Currently, FDCC settings are intended for Microsoft Windows XP Professional with Service Pack (SP) 2 or SP 3 and Microsoft Windows Vista Business, Microsoft Windows Vista Enterprise, and Microsoft Windows Vista Ultimate with SP 1.
...

The Federal Desktop Core Configuration (FDCC) is an OMB-mandated security configuration.

So ... to be in compliance, you can only run Windows desktops, is that correct? Wow! Way to feed the MS machine.

Re:Can Help?

[Daengbo]

No. NIST does not endorse the use of any particular product or system. NIST is not mandating the use of the Windows XP or Vista operating systems, nor is NIST establishing conditions or prerequisites for Federal agency procurement or deployment of any system. NIST is not precluding any Federal agency from procuring or deploying other computer hardware or software for which NIST has not developed a publication, security configuration checklist, or virtual testing environment. Although the FDCC currently applies to Windows XP and Vista, security guidance is available for other platforms. The OMB and GSA updated the Federal Acquisition Regulation (FAR) on February 28, 2008, Part 39 now reads as follows:

Nevermind. My first post was inaccurate.

Re:Can Help?

[steveb3210]

Lynx to the rescue! Lynx should be the only browser allowed on secure networks. Hehe.

Too bad you just got owned by the buffer overflow the hackers found in the VT100 emulator library.

Re:Can Help?

[Bigjeff5]

Ever notice that 99% of trojan and virus attacks require user intervention?

Social Engineering is the primary attack risk to a computer network once basic protection measures are taken (firewall, AV, and current updates), because users are the primary vulnerability. That's why it is usually worth the trouble to simply give the user bare minimum rights to their machines. It helps limit the damage they can cause.

This is, however, inconvenient, and so is not done universally. There are even reasons not to do it that are sound, though requiring any kind of security generally makes low user rights a necessity.

Re: Can Help?

[Anonymous Coward]

Insightful? This lame comment?

You PotatoFarmer, and thePowerOfGrayskull & LostCluster make me sick.

You've probably never said anything truly insightful in your life.

I doubt you could do half as well as the admins I know. PC security is *hard* and you are too much quick & easy.

Scum.

Re:Can Help?

[quanticle]

To be fair, though, that's the major attack vector for Windows users too. There aren't a whole lot of zero-day attacks out there for Windows; most worms, trojans, etc. propagate via users who haven't bothered to patch their machines.

Basically, it comes down to the fact that the Linux userbase is still more security conscious than the Windows userbase.

Re:Can Help?

[gad_zuki!]

This is true in windows too. Remember Storm? It was created with simple .exe files, not any exploits. I believe they just mass emailed 'greetingcard.exe.' Grandma ran it. Thats all it takes. It blows my mind mail servers are sending out executable to people in this day and age.

A computer is just as secure as its operator.

Re:Can Help?

[Mia'cova]

Wow! I'm glad I have Windows!

Re:Can Help?

[lord_sarpedon]

The fact that buffer overflows are even still possible is rather silly.

It's even sillier that a user's processes are allowed to run rampant with his or her privileges.

Re:Can Help?

[Anonymous Coward]

Even VT100 emulation isn't perfect. Ages ago remember some ANSI terminals accepting macros from the other end, so one could feed it a certain sequence, and it would act as if the stuff was typed in on the keyboard.

Re:Can Help?

[Anonymous Coward]

Wow! I'm glad I use a real VT100 on a serial port instead of those crappy emulators!

Re:Can Help?

[Phroggy]

Although Linux is better than most systems out there...

Did you mean to say, "Windows is worse than most systems out there"? I don't think Linux is particularly more secure than any other non-Windows operating system...

Re:Can Help?

[slash.duncan]

That's a bit harder on x86_64, with its required -fPIC (position independent code) for dynamically loaded libraries, randomizing their load address, than on ia32 (tho it's possible to use position independent code there as well, but few do as it's a de-optimization speed-wise). And it's harder still attacking someone whose binaries are basically unique, as is the case on a from-source distribution like Gentoo, with individualized USEflags/CFLAGS/CXXFLAGS/LDFLAGS, as opposed to say some mass-distributed binary distribution with thousands of people running the same easily procured and examined binary.

OTOH, while Gentoo has some security signing and source checksumming, at present it's not at the level of verification some of the other distributions have, so it's theoretically possible someone could sneak some compromised code in somewhere in my upstream sources (Gentoo or upstream package) without detection.

In any case, I've no illusions. If someone with the resources (say the NSA) wanted me cracked bad enough, I'd be split open like an egg dropped on concrete, as would most of us.

Re:Can Help?

[umghhh]

And also the linux user base is much smaller than the one of windoze which makes possible profit smaller and effort not feasible maybe?

Re:Can Help?

[Daengbo]

Ten years ago, you wouldn't have needed to explain what I meant by "anti-security regulations" because most Slashdotters were working in the industry. Meh.

Re:Can Help?

[slash.duncan]

The particulars of the following story might not apply to you, but you owe it to yourself (and your security) to check it out.

http://www.handlewithlinux.com/are-you-safe-internet-security-on-linux

Briefly...

The guy was checking out a malware site, laughed at the standard fake AV dialog using the standard Windows scheme, as if it could do anything to him running Linux. Then he went on about his business, apparently including logging onto his website to upload something.

Well, unbeknownst to him, the malware site was still running in the browser in the background, and took advantage of the login to spread itself to his site. So while his computer itself didn't catch anything, his site did.

Fortunately his hosting provider caught (part of) the malware as it uploaded, and warned him. Of course at that point the guy was SCARED, as had no idea WHAT was up except that he had been browsing that malware site. The rest of the tale is how they figured out what happened, that his computer itself was (luckily) not infected (only that browser session), and how they cleaned up.

Now I don't agree with all the suggestions made in the column. In particular, AV to protect a Linux system (as opposed to scanning stuff before it's passed on to help protect downline Windows systems) isn't likely to catch any Linux targeted malware that does exist, at least not right away, because the AV vendors simply aren't particularly checking for Linux malware at this point, because even if there were malware to check for, they simply don't have the customers in that market to support it. As the comments point out, noscript or similar is a better bet -- don't let it run in the first place, tho perhaps he'd have had to to get the animation to run.

However, the base message, that if you are playing with fire you better have tested that asbestos suit and not be simply trusting some claim you heard about it somewhere, rings as true as ever. As I said above, noscript (or similar scripting-off-by-default in other browsers, the konqueror I use for instance, tho noscript on firefox certainly has better control than most) would have likely saved him, possibly even if he had turned scripts on for that particular site, due to its cross-site-scripting measures, etc. Or, simply being prudent and not using the same browser session he had JUST been browsing the malware site with to login to his web site, would have saved him.

Just be careful out there, alright! I don't want it to be you I'm reading about the next time an article like this comes to my attention, as it surely will!

Re:Can Help?

[rdnetto]

It blows my mind mail servers are sending out executable to people in this day and age.

Why shouldn't we be able to send exes via email? As it is, I have enough trouble sending exes on Windows Messenger (I prefer GTalk but no-one I know uses it).

All we really need is the all mail servers to just run an AV scan on all attachments. Most of the HTTP ones (Hotmail, Gmail, etc.) already do.

Re:Can Help?

[speculatrix]

actually, computers can be made much more robust to viruses and trojans, however, there's fundamental problems with the x86 architecture and the way we program that are hard to overcome.

Let me take you back in time to when most computers were embedded systems. The program ran from ROM (or EEPROM) and could not be changed at all without physically switching out the non-volatile memory - in-system programming was a rarity. Moreover, many processor architectures had entirely separate executable and data spaces - you couldn't actually write to the executable memory, so even if it was flash or battery-backed static RAM, it wouldn't work. Thus no matter how corrupt the data became, it could only crash the software or make it misbehave; to restore operation you'd simply reset the CPU and everything would return to normal!

In contrast, the x86 usually boots the OS into RAM, even shadowing the BIOS into RAM (because it's faster), and it's possible to scribble all over executable code space - the obvious example being to overflow stack space to execute unauthorised code. The NX bit was added relatively recently to ameliorate these problems.

Sparc architecture has been more resilient to attack too, partly because of its relative obscurity, but mainly due to its relative immunity to stack smashing.

Re:Can Help?

[amorsen]

You jest, but...

CSI 1 ; 6 8 ; "FORMAT C:" ; 13 p

In ANSI.SYS, that reassigns F1 to insert "FORMAT C:" and press return. Similar functionality is available as DECUDK in vt220. Luckily most modern terminal emulators don't implement it.

Re:Can Help?

[amorsen]

Argh, it's much worse than I thought. I thought we had weeded this crap out yonks ago.

Hopefully Lynx can't be convinced to output arbitrary escape sequences.

Re:Can Help?

[WgT2]

One thing I find in common to news about these bot-nets - they never talk about what OS they are running on. I don't know if the even know what OS they're running on, but they don't talk about it.

I wish they would: the Windows mono-culture is proving to be a dangerous place.

Re:Can Help?

[lxs]

VT52 all the way baby, no fancy flashing text for me.

Re:Can Help?

[c1t1z3nk41n3]

Any time I want to send an executable to myself I just put it in a password protected rar file and mail that. Sure it's a bit of an annoyance but I'd rather take that then have gmail start allowing executable attachments.

Re:Can Help?

[dov_0]

Sounds like he went to a Windows tech... He was however quite right in his presumption that his Linux box was quite safe in itself. We've all seen the fake scanners and they are funny. The the issue here though was that the malware passed on to a server through his browser. That IS interesting!

Re:Can Help?

[muckracer]

> In particular, AV to protect a Linux system (as opposed to scanning stuff before it's passed on
> to help protect downline Windows systems) isn't likely to catch any Linux targeted malware that
> does exist, at least not right away, because the AV vendors simply aren't particularly checking
> for Linux malware at this point, because even if there were malware to check for, they simply
> don't have the customers in that market to support it.

Well, I have found numerous malware, flooder scripts etc. (mostly on servers) with use of anti-virus programs (am talking about Linux FS level here, not mail and its attachments).
So I believe, your conclusion is wrong. Scanning is easy and as much as we'd like to think we don't need it on Linux, you do miss out on several thousand potential threats if you don't on occasions.

Re:Can Help?

[slash.duncan]

I yield to your experience, then. It would seem my "Linux AV" claim may be a bit dated.

Re:Can Help?

[crashumbc]

[quote]This is true in windows too. Remember Storm? It was created with simple .exe files, not any exploits. I believe they just mass emailed 'greetingcard.exe.' Grandma ran it. [/quote]

wish i had mod points..
This a thousand times over.

Windows is MUCH less secure then Linux. But if you had 100,000 grandma's opening a self-installing virus on Linux, you'd be reading about how Linux had a 99,999 user BOTNET (the last Grandma couldn't figure out how to click "yes" to the install as root question)

Re:Can Help?

[slash.duncan]

Well, given the site name... and that the tech obviously knew a reasonable amount about Linux as well, I'd say he probably handled both Linux and Windows. But I agree, it does sound like the thinking of a Windows tech. He didn't seem to be thinking like a Linux native, in any case.

As for the AV, see muckracer's reply (to my original citing the story). In deference to his experience I'm reducing the scope of my original claim, tho I don't believe there's evidence I should entirely recant. It seems that at least in regard to servers, at least some AV products detect enough flooder scripts and other malware to be worth periodic scans. However, I still hold that the position of the kernel devs, that Linux doesn't need on-demand/per-access scanning, is correct. Periodic scanning may indeed be helpful it would seem, but I don't believe there's a need for real-time on-demand/per-access scanning on Linux.

Re:Can Help?

[dov_0]

I do regular scans of removable media, but only cos I'm a tech working with windows machines and my flash drives get around a fair bit.

Re:Can Help?

[dov_0]

Actually 99% of the time I can pick malware up on a flash drive armed only with Nautilus or Dolphin.

Re:Can Help?

[drinkypoo]

Linux is probably more secure than any other Unixlike OS out there. Trusted Whatever? Fuck that. selinux. (Both are a PITA to administer, so that's no differentiator.) And since everyone and their mom is taking in the GNU userland and lots of other stuff like perl and python, yet every commercial Unix vendor patches these packages less often than Linux, they are by definition behind most of the time. Apple is particularly guilty of this, you'd think they could hire some people to update those things and run regression tests so that you can have perl modules from the last year or two, right?

Re:Can Help?

[Anonymous Coward]

So am ... NO CARRIER

Re:Can Help?

[greyhueofdoubt]

>>You have to use an encrypted USB thumbdrive

I work for the DoD, too (USAF), and we can't use *anything*. No usb drives, no digital cameras- nothing. If we have to take a picture of a repair for the engineers (happens often), we have to take the camera down to comm and get it scanned and whatever voodoo they do and then burn the 2 or 3 pics to a CD and walk back to the shop.

And it's uphill both ways.

-b

Re:Can Help?

[3.5 stripes]

I'll block you anyways.. amavisd will find what's inside the rar (even if it can't read it) and deny it passing..

Unless of course you rename the exe to something like .jpg, then it might be able to slip through.

Re:Can Help?

[BigBlueOx]

Mod points! I need mod points! NOW!

+1 Someone Who Gets It

Oh, BTW, a special +2 mod is available to anyone who can get a VAX vs VMS flamewar started.

Re:Can Help?

[quanticle]

The OS is presumed to be Windows unless the article mentions otherwise; Linux and Mac botnets are sufficiently rare that discovery of one still provokes comment, whereas Windows botnets are common enough to talk about without having to specifically mention that they're on Windows.

Re:Can Help?

[Creepy]

Not even trojans necessarily - I read that USB stick drives are the major way of getting onto government and military networks. Most people that use these drives don't use either encryption or write protection, so simply inserting one into an infected machine (like a home computer) and then inserting it into a secure network can infect the machine on that secure network and perhaps others if it is a worm. Since home users often have lax security, this is a major way to infect private networks.

Re:Can Help?

[Creepy]

hmm - well, the fact that ANSI hasn't secured their libraries is silly, but you could always use the _ names on Windows if you're writing for Windows only. Most programmers I know found out about the existence of the _name commands from this bug where ANSI C programs would spit out warnings about the C library being deprecated (C++ had similar issues).

Re:Can Help?

[SnarfQuest]

It was supposed to be implemented February of 20088.

Well, that only gives them about 18,000 years to get it implemented. With the government involvement, I don't think they left enough time.

Re:Can Help?

[sexconker]

The XP installer just creates the Administrator account for me.

Re:Can Help?

[sexconker]

HOW THE FUCK is this offtopic?

If you want your shit secure you get it offline, lock it up, put a guy with a gun to watch people who access it, and put a dog to watch the guy with the gun.

Re:Can Help?

[sexconker]

Yup, there sure are.
And there are tons that don't, yet do.

Important shit needs to be severed from the internet and the intranet and CDs/Flash Drives/etc by default, and access to each granted on a i-can-has? basis.

That aside, these stories always imply that OMG THEY GOT INTO THE MISSILE CONTROL SILO. No, they got into the computer of some office assistant at some university. That's a "government computer".

Re:Can Help?

[Nemesis][]

/me misses flash attacks on IRC...
(not the Galacticomm BBS game!)

Now get off my lawn!

Re:Can Help?

[maxume]

The blaring second paragraph distracts from closely reading the last 5 words of the first paragraph (for me anyway, my above comment is a result of this).

Re:Can Help?

[Mr. Firewall]

Why shouldn't we be able to send exes via email?

Sounds good to me. You send me your ex, and I'll send you mine. We can call it, uh, "recycling" to make it all sound acceptable....

Re:Can Help?

[Anonymous Coward]

I work for a federal agency and get weekly emails about all the patches and updates they're doing that week. I got a flood of emails about conficker back around the end of March.

Problem is, I need IIS and I need admin rights to do my job so it's really hard for me when they try and lock down my computer.

Re:Can Help?

[Anonymous Coward]

Wow! I'm glad I have Windows!

LOL, best one yet.

Re:Can Help?

[sopssa]

And still it only takes one option to enable when creating that rar and its unable to read the filenames.

Big PC's!!!

[gandhi_2]

large corporate and government PCs

So small ones are mostly safe.

Re:Big PC's!!!

[Red Flayer]

So small ones are mostly safe.

Duh. Small PCs make small packets, which are far less likely to clog the tubes.

My question is, since when is 1.9 million PCs a megabotnet?

A botnet by definition needs at least four PCs (since otherwise it's a botpoint, botlinesegment, or bottriangle -- you can hardly catch fish with a "net" without cross-segments, which you need at least four nodes to make). So a megabotnet needs (1 million)*4 == 4 million PCs.

Sheesh.

Re:Big PC's!!!

[geekoid]

Actually it's 4194304

Re:Big PC's!!!

[Your Pal Dave]

Wouldn't that be a mebibotnet.

Mebibotnet, Mebibotnet... Now that just rolls off the tongue!

Re:Big PC's!!!

[LostCluster]

Mega gets thrown around a lot. Here in Massachusetts, "Megabucks" sometimes has a jackpot of less than $1,000,000.

Re:Big PC's!!!

[Anonymous Coward]

google frghdhdshsg grgqrg

Re:Big PC's!!!

[Red Flayer]

Seriously, wtf? Insightful?

That was a complete tongue-in-cheek post...

Wish I could *whoosh* the moderator(s).

Re:Big PC's!!!

[Red Flayer]

Mebibotnet, Mebibotnet... Now that just rolls off the tongue!

Mebibotnet, mebibotnetnot -- only time will tell.

Re:Big PC's!!!

[droopycom]

Not to be pedantic but, really, your calculation are off...

Your definitions are correct: a botnet needs 4 botpoints, and is composed of 4 botlinesegments, and 4 bottriangle.

However, its easy to see that by adding only 1 botpoint to the botnet you can create a 4 additionals botnets and as scuh create a 5-botnets.

So you can create a 5-botnet with 5 PCs (if they all connect to each other).

Now its easy to see that 1.9M PC can be used to create a 1 MegaBotnet, and potentially much more if they were all interconnected.

The maximum botnet value that can be created from N botpoints, is left as an exercise to the astute Slashdot read.

Finding an example of a N-botnet obtained from N botpoints is also left as an exercise, but I will give this hint: torus!

Re:Big PC's!!!

[droopycom]

Your definitions are correct: a botnet needs 4 botpoints, and is composed of 4 botlinesegments, and 4 bottriangle.

Correction a botnet needs 4 botpoints, and is composed of 6 botlinesegments, and 4 bottriangles.

Re:Big PC's!!!

[Plutonite]

>My question is, since when is 1.9 million PCs a megabotnet?

Look sonny, in my day, we had to carry our megabotnets uphill both ways, in the snow, and we didn't complain, and the master nodes sent out instructions with punch cards that were sent via carrier pigeon. A million computers was something we doubted any deity could create, but we were wrong. I don't think I have to tell you to get off my lawn. Wait, you're still there? GET OFF MY F*CKING LAWN. Damn kids.

Re:Big PC's!!!

[ColdWetDog]

Mega gets thrown around a lot. Here in Massachusetts, "Megabucks" sometimes has a jackpot of less than $1,000,000.

That's cuz you're state is so damned small. It's an insecurity thing. (See how I got back on topic?)

Re:Big PC's!!!

[clarkkent09]

Has it occurred to you that the moderation itself was a joke? Whoosh to you!

Re:Big PC's!!!

[Kingrames]

friggin marketers. 2^10, not 10^6.

Re:Big PC's!!!

[InfiniteLoopCounter]

The maximum botnet value that can be created from N botpoints, is left as an exercise to the astute Slashdot read.

What a cop out! It's not like you couldn't take the time to find out the answer on your local botnet -- seems just about everyone has one these days.

Re:Big PC's!!!

[InfiniteLoopCounter]

Just out of interest, my botnet eventually returned the following:

n! / ( (n-r)! r! ) as the number of maximum possible botnets producible with n botpoints, r=4, and n>=4.

Re:Big PC's!!!

[Siffy]

Since you decided to over think this just a bit, I'll take it a step further. Keeping the square net design and two crosses (the parts that catch fish) between all nodes, you need 4 nodes to catch 1 fish, 9 nodes to catch 4 fish, etc. So you see the pattern fish^2 -> nodes^2, where nodes = fish + 1. So for the 1,000,000 catching points, you need 1,001^2 = 1,002,001 bots for a megabotnet.

Re:Big PC's!!!

[StarfishOne]

Mebibotnet, Mebibotnet.. Maybe it's a Mebibotnet, maybe.. ;p

Re:Big PC's!!!

[VShael]

Yes, but don't say it 5 times in front of an old CRT monitor...

Re:Big PC's!!!

[IsoRashi]

Wouldn't that be a mebibotnet.

I dunno... mebbe?

Guardian

[Tiger4]

It looks like Guardian has finally been uncovered. Everybody act really friendly, no fast moves to the on/off switch.

Need I say more?

[udippel]

From the article:
Around 45 percent of the bots are in the U.S., and the machines are Windows XP.

On the other hand:
Nearly 80 percent run Internet Explorer; 15 percent, Firefox; 3 percent, Opera; and 1 percent Safari
What else does one expect? Since it is an infection spread through trojans on legitimate sites and XP the target, what can we expect the browser to do?

In the end, we might see all browsers running completely sandboxed on demand, that is: no interaction with the rest of the system; a 'browse-only' kiosk.

Re:Need I say more?

[Zak3056]

In the end, we might see all browsers running completely sandboxed on demand, that is: no interaction with the rest of the system; a 'browse-only' kiosk.

Given the story a few posts down the main page about an exploit that can jailbreak out of a VM to attack other VMs and the host itself, or the one from a few months back that infected the BIOS to the point where the only possible repair was to pull and replace the the chip itself, I don't think that even a fully sandboxed browser will be good enough in the future.

It would both amuse and sadden me if something like "trusted computing" were the only result that ended up with a secure system (though my money's on THAT being broken/exploited, too, which leads to my next thought: the future is a world of hardened, single purpose, completely locked down devices, and won't that just be a "wonderful" future to live in.)

Re:Need I say more?

[Anonymous Coward]

If browsers become completely sandboxed, you might see botnets living in the browser's CPU/filesystem space that are active in the background, and either running via an extension, or perhaps running in the executable space of the browser itself.

Re:Need I say more?

[udippel]

If browsers become completely sandboxed, you might see botnets living in the browser's CPU/filesystem space that are active in the background

Sure. To me that's like in those cyber-cafés where the whole machine is riddled with crapware at the end of the day; when it will be wiped and receive a clean install from an image over the network. When the browser shuts down, all those botnets are gone. Assume, that history and cache are likewise. 'Kiosk', as I wrote.
Assuming sandbox is what it is supposed to be, we would see transient botnets. Which in itself would be a great improvement to the current resident ones.

Re:Need I say more?

[Anonymous Coward]

Yes... that was 1963.

Quick!

[anjilslaire]

Get Abby & the whole NCIS crew on the job. Everyone know a goth hacker chick will solve it!

Re:Quick!

[TheOtherChimeraTwin]

For the tough hacking cases, they have to call in McGee. For the really tough cases, it takes both Abbie and McGee, typing as fast as they can. And for a Mega-Botnet, it takes Gibbs delivering Abbie a Caf-Pow and whispering in her ear about a little something-something later on, and Gibbs slapping McGee on the back of the head and whispering in his ear about a little something-something later on too.

Re:Quick!

[Penguinshit]

I am ashamed that I understand your post. My wife forces me to watch that show.

Re:Quick!

[Anonymous Coward]

You forgot that they can find it even faster if Abbie AND McGee are typing as fast as they can ON THE SAME KEYBOARD.

Re:Quick!

[x_IamSpartacus_x]

Maybe she can create a GUI interface using visual-basic and track an IP address and find whoever is responsible! TV fake-geeks FTW!!!

Re:Quick!

[antdude]

No, get Chloe from 24. She can totally handle it.

Re:Quick!

[Anonymous Coward]

I am ashamed that I understand your post. My wife forces me to watch that show.

And yet you openly admit it. Enjoying the shame of NCIS????

Re:Quick!

[adavies42]

i'd prefer chloe from smallville, ideally from the period where she was infected with bits of brainiac

Re:Quick!

[Anonymous Coward]

admit it, she doesn't force you to watch anymore than she forces you into bed.

Re:Quick!

[Hucko]

Heh, you don't understand the trials of being married to a nymphomaniac. Sure, it sounds like fun at first....

Re:Quick!

[Daengbo]

It never gets boring.

Re:Quick!

[AbRASiON]

and you love every minute of it, be honest!

Re:Quick!

[jonaskoelker]

As long as they don't bother setting up a VB GUI to frigging traceroute...

FTP?

[tepples]

In the end, we might see all browsers running completely sandboxed on demand, that is: no interaction with the rest of the system; a 'browse-only' kiosk.

Then what would people use to download and upload files? Would FTP come back into style?

Re:FTP?

[TubeSteak]

Then what would people use to download and upload files? Would FTP come back into style?

I already use a program called SandBoxie after seeing it mentioned on /.
You can either allow files to escape the sandbox on a case by case basis or setup default allows wherever you like.
And as a general comment, it's terribly easy to allow files into a sandbox, like when you want to upload something, but not allow any changes out.

P.S. FTP server/client software has terrible security. Even the most popular ones, which have been around for over a decade, still get hit with remote exploits.

Re:FTP?

[udippel]

As you may guess, I am aware of the consequences. Though it seems to make sense in many cases, when everything any anything that one downloads is just for rendering the site.

Would FTP come back into style?
I, actually, hope not. Not FTP. But maybe a new system where users click some 'I want to download this file' button and get the content via an e-mail? Oh, wait, that's only slightly better than FTP.
Still, yes, a separate channel for file transfer outside of that box, not using any http could be safer.

Re:FTP?

[Starayo]

But maybe a new system where users click some 'I want to download this file' button and get the content via an e-mail?

Right, because uninformed people opening attachments don't cause enough problems already...

Re:FTP?

[Anonymous Coward]

Sandboxie rules!! I don't use XP machines often but if I have to run something that I don't entirely trust *cough*keygen*cough* I just use it.

Something to note, as my wife painfully discovered: Sandboxie is useless with patches since it can't "technically" patch the real binary, and if it patches the binary with a trojan AND you move the patched binary out of the sandbox...you're fUx0R3d. Yeah, now she's using Linux and forbidden from playing any Windows games at all after that episode...and she was sitting RIGHT NEXT TO ME and never once bothered to ask if she was doing something not good..."Task Manager has been disabled by your Administrator", when you're an admin is usually not a good thing to read.

Re:FTP?

[Anonymous Coward]

The protocol behind FTP was sound back when it was fine to have a control connection using TCP, and fire back a data connection with the binary info, but these days with NATs on both ends of most transactions, people are just best off sending the data via TCP with http.

Re:FTP?

[evilkasper]

I've been playing around with this a bit http://www.sandboxie.com/ even though it puts your browser in a sandbox, you can move anything you downloaded to it to your system. I'm not sure how well it works I've only just found it.

Re:FTP?

[evilkasper]

Lets add to this email isn't designed for large file transfers.

Re:FTP?

[Browzer]

File Transfer Protocol has been around since the early 1970s, and while most servers/clients FTP implementations have a history of exploits, their weakness is due not necessarily because of the exploits but rather because of the way the FTP protocol transfers information. FTP communication includes not only the transfer of files but also the transfer of authentication parameters. All this information is transferred in clear text. Clear text is also the way http transfer information/files. You can think of http as an ftp with anonymous authentication (no authentication required) Clear text transmission only became a major problem when the Internet spread like a virus, and the network could not be trusted from prying eyes.

As a result, secure File Transfer Protocols have been developed, which is nothing more than a transfer protocol (ftp, http, telnet) on top of an encrypted/secure layer. HTTPs, SSH, SFTP, FTP over HTTPS are such protocols, which are used every time security information has to be exchanged securely.

So in conclusion,file/information transferring is performed every time you click a link, not only when you want to upload/download a file. If the contents of the file/information does not need to be secure than the information is transferred in clear text. If on the other hand, information(including not only content, but also authentication)/files have to be secure, than a secure/encryption layer HAS to be used, and has been used since the mid 90s.

Re:FTP?

[Anonymous Coward]

Just run Windows games in virtualization with modifications only allowed in the save directory (have that directory be on a "network share" to the host OS and don't write back to the disk image).

Re:FTP?

[Nimey]

Too bad SandboxIE doesn't work with 64-bit Windows.

is it really this bad?

[FudRucker]

are the government IT in the USA really this incompetent?

Re:is it really this bad?

[Fastolfe]

Why are you blaming the US government for (a) defects in software they didn't write; and (b) a malicious botnet created and operated by someone else? The only reason the US government is being singled out in this article is because it makes the story more sensational, which means more eyeballs, which means more ad revenue.

Re:is it really this bad?

[Anonymous Coward]

are the government IT in the USA really this incompetent?

Was that a rhetorical question?
What did you smoke?

   

Re:is it really this bad?

[Anonymous Coward]

are the government IT in the USA really this incompetent?

- 1 hidden comment

Says it all.

Re:is it really this bad?

[Anonymous Coward]

Why shouldthe senators and congressmen from the state of Washington take all the heat?

Re:is it really this bad?

[mea_culpa]

I think it is more widespread. I'll take my local bank as an example. I stop by to make a deposit, I notice the teller minimizing her facebook page as I glanced at the screen.
I am shocked that a bank would allow any www access on a machine that has direct access to accounts. Dollars to donuts there is some form of malware on that machine, or already throughout their network.
It was my belief that competent IT would only allow the necessary Intranet infrastructure to run the banks applications. But I would bet their policies get changed by ignorant management that are sold on 'security' appliances and software to protect themselves while granting www access.

Re:is it really this bad?

[mlts]

That is a pretty sweeping statement, similar to saying that all American companies can't lock their doors down.

This varies by department, organization, and sysadmin. A lot of US government divisions have intelligent, alert, and aware employees who do a good job at what they do. However, these people don't make the news.

This is one of the things with IT. If you do a good job, nobody notices. Its only if stuff fails is when people notice. Same thing with this mess.

Re:is it really this bad?

[shentino]

For starters they let MS off the hook too easily, which could be the reason that Windows sucks so bad at security in the first place.

Re:is it really this bad?

[LaskoVortex]

Why are you blaming the US government for (a) defects in software they didn't write

But Microsoft gives them opportunity to review the code for security purposes, so they should have seen this coming.

I just made that up.

But I didn't make up the fact that the US government can review the code of open source alternatives. So they screwed up in at least one of two ways: (1) no ability to recognize security holes in the software they are using, (2) choosing a closed source system. Either way, they don't get off the hook on this one.

Re:is it really this bad?

[Trogre]

I blame them for letting Microsoft get away with leveraging their low-security rubbish, and not taking them down when they had the chance.

Re:is it really this bad?

[Anonymous Coward]

Why are you blaming the US government for (a) defects in software they didn't write...

I don't blame them for flaws in software they didn't write, I blame them for buying that crap in the first place....

Re:is it really this bad?

[dbcad7]

I agree with you, for different reasons than you think. Facebook at work.. IM or personal email at work.. all bad.. I'm as much an internet junkie as anybody, but I have learned to separate my personal life and interests from my work life... I think more worrying than the bots, is the ease at which she could copy information and send it to herself.

As to mixing web access and banking.. well I do online banking all the time. I might be more paranoid about it I suppose, if I had to keep cleaning my machine of bots, virri and malware.. (you can guess why I don't have to).. I suppose if she was running Facebook on a different OS it wouldn't be so concerning, but more than likely she wasn't

Re:is it really this bad?

[Anonymous Coward]

I am shocked that a bank would allow any www access on a machine that has direct access to accounts.

I'm shocked they're still your bank.

But if you're not willing to put in extra effort to protect your own money, why are you surprised your bank doesn't?

Re:is it really this bad?

[Anonymous Coward]

This statement reeks of someone who has little or no experience in the business/real world. This all sounds well and good in academia, but do you seriously expect people to sit and stare at a computer for 8 hours and not have any "downtime?" I agree that Facebook is probably not a great website to be visiting on company time, but I think your statement is a little to naive.

Re:is it really this bad?

[Anonymous Coward]

Because they're stupid enough to use Windows.

Re:is it really this bad?

[religious freak]

I'm really curious... what bank?

Re:is it really this bad?

[spud.dups]

I would more blame the government for using way too much of our tax dollars, and not take the time to hit the little "Windows Update" button or install some virus protection. We're not talking about some 70+ year old grandma, but a government with a multi-trillion dollar spending plan. I would expect multiple levels of encryption, routine computer updates and a full suit of anti-virus software on each machine with internet access just to start. For that I blame the government.

Re:is it really this bad?

[FRiC]

Could be worse. I had an operation a few weeks earlier. While lying in bed waiting for the doctor to get ready. I heard keyboard sounds and opened my eyes to look, and the nurses were looking at their hi5 pages...

Re:is it really this bad?

[cboslin]

I do not know the exact law, exact regulation or a link or I would list it, but when I mention this, it will seem obvious to most.

I talked to a tech at a bank, he stated that there were laws on the books that made it illegal to connect up the banks private network that connects to other banks.

He also indicated that automatic updates (any and all) would be considered a violation of those same banking laws.

This is probably why nobody screams bloody murder and why the banks are so quick to eat losses due to fraud and scamming. They know that once the TRUST in the system is compromised, they have lost the war.

Yet just a couple of days ago I read about institutions who did NOT segment their networks (physically separating the connections between public internet and backend banking systems) and were finding that someone with enough technical knowledge could install monitoring software between connections and watch everything that passes. That much of the information is not encrypted as it is suppose to be.

Lets face it people, if you are NOT monitoring your outgoing packets and communications you simply do NOT KNOW whether you are safe or not. This monitoring takes time, time is money. Have you looked at salaries of IT professionals in the Security area of networks. You get what you pay for and the pay typically lags behind almost everyone else in IT, except in specific rare cases and where companies understand the importance. Than they pay higher rates for better people. You do not have to believe me, just go to Glassdoor and see for yourself.

These companies literally lose billions when they are hit, yet they will not pay a simple 6 figure salary to have someone with TCP/IP monitoring and packet sniffing experience montior their networks. Just hiring 3 or 4 of these types of IT professionals would be cheap insurance at preventing break ins and quickly cutting off attempts that probe your networks for weaknesses.

Personally I think companies should create Tiger teams of 3 - 5 IT white hat hackers to work each of three shifts. When the company is probed, have their team attack back. When the honey pot is accessed, proof positive of a cracker and/or hacker, basically someone doing something they should not be doing, go on the offensive.

I have always thought the best defense was a strong offense. Pretty soon the smart crackers would leave your company alone as they do NOT want their infrastructure crippled by attacks any more than you do. And if someone has left their PC unprotected and gets attacked, well that is their personal responsibility. Had they never allowed themselves to get cracked in the first place they would never have been used, attacked and thrown away.

Re:is it really this bad?

[Fastolfe]

So, everyone that has their Windows computer compromised has only himself/herself to blame? They could have used Open Source, and they could have hired someone to review the Open Source software, which guarantees that it's bug-free, right? So it's really their own fault for getting hacked. Riiight..

Re:is it really this bad?

[Fastolfe]

You're making unreasonable assumptions about the ability of the government to have prevented this: that these machines weren't fully updated with the latest virus protection, and that updates and virus protection are infallible, which would require that virus authors submit their work to all of the anti-virus vendors before releasing it into the wild.

If you want to hold the government to a higher standard, good for you. I suspect the tax consequences of that higher standard would prevent us from ever reaching it, though.

Re:is it really this bad?

[LaskoVortex]

Riiight.

Everybody != Government of USA

"can be used..."

[Destoo]

Have they used it yet, and have we seen an effect?
Within the past few days, I have seen an increase in spam volume.. It's been an interesting week so far.

Anti-MS Marketing Spin

[Anonymous Coward]

MS has helped terrorism and foreign enemies by creating and defending such a lousy operating system. MS has basically handed our infrastructure to communists.

Hah. Defend that, you pro-IP right wing charlatans.

Re:Anti-MS Marketing Spin

[deepershade]

How about not, and it's actually more a case of the consumer's fault for demanding an easy life instead of something that works without breaking everything, but hey, dont let me get in the way of a good bit of MS bashing.

Re:Anti-MS Marketing Spin

[icannotthinkofaname]

In the future, please refrain from implicitly (or, for that matter, explicitly) equating communists with terrorists and/or enemies. They are nowhere close to being the same group of people.

Thank you.

Re:Anti-MS Marketing Spin

[colinrichardday]

Did anyone hold a gun to Microsoft's head demanding that it pander to consumers? Indeed, some of Microsoft's defenders on this site praise its responsiveness to consumers.

As for bashing, why waste a good shell?

How do you tell if you were/are infected?

[Anonymous Coward]

Do they email you?

Re:How do you tell if you were/are infected?

[Anonymous Coward]

no, they don't email me. they email you actually. thats why you get so much spam.

If only...

[scubanator87]

They had switched to Vista like MS was chanting all along they would not have had all thoes security holes in XP... oh wait Linux is what i was thinking of not Vista lol

One of four malware tools to find it...

[east coast]

I wonder if the AVG product they were using was the freeware version or one of the commercial products...

I think it's great that they find this kind of stuff but at the same time I have some misgivings about how they don't do much to point the public in the right direction as far as finding out if they're infected or what they can do to remedy the situation. It seems that a lot of security articles are lean on providing the details about helping yourself to a more secure system.

Re:One of four malware tools to find it...

[muckracer]

> I wonder if the AVG product they were using was the freeware version
> or one of the commercial products...

Actually several of the displayed AV tools seemed somewhat out-of-date. It'd be nice to have them make the actual trojan available for download and real-life testing of your personal AV 'solution'.

Re:One of four malware tools to find it...

[mcrbids]

It seems that a lot of security articles are lean on providing the details about helping yourself to a more secure system.

If your system was more secure, you wouldn't need security experts to secure it.

Re:One of four malware tools to find it...

[hipifreq]

I agree. The article is full of blurred out addresses and file names. Makes me wonder if it's just a joke, or something to really think about. It's all well and good to say "zOMG! They're fuxord!" But it's another thing entirely to say "We've discovered a massive botnet, and here's how to detect infections, oh and here's some current ways to block it."

And don't tell me that this is about the ability of more Windows boxes to get pwned. That would be both redundant and redundant. We all know that Windows machines get zombified all the time, and the list of infections does include machines running Safari (Macs perhaps?) and Opera (Linux?), so it's not just a vanilla problem.

no definite article needed

[osvenskan]

It's just "Ukraine", not "the Ukraine".

Re:no definite article needed

[Anonymous Coward]

It's just "Ukraine", not "the Ukraine".

It's just "Russia", not "the Ukraine".

Fixed it for ya.

Re:no definite article needed

[Anonymous Coward]

Sometimes it helps to give a reference: http://www.infoukes.com/faq/the_ukraine/

Re:no definite article needed

[Nimey]

It's one of those habitual things. Some English-speakers (not sure if this is American-specific) refer to certain countries with the definite article, like the Ukraine or the Sudan.

I'm not sure where that came from.

Re:no definite article needed

[tr897]

No it's not; Ukraine is not a republic of Russia, it's a separate country. Ya know, like Canada.

Re:no definite article needed

[Anonymous Coward]

It's just "Ukraine", not "the Ukraine".

After the botnet strikes, it will be "Ukraine, The Ukraine".

Re:no definite article needed

[xSander]

You know Ukraine was once part of Russia? That's where the article originally came from, I think.

Re:no definite article needed

[Anonymous Coward]

I thought the article is needed for this country. Did a quick search and found this: http://www.infoukes.com/faq/the_ukraine/ . Looks credible. Will try to verify when I find time.

In German, the article is used for some countries. Ukraine is one of them.

Re:no definite article needed

[hey!]

That's right. It's not a state, like Georgia.

Oh, wait a minute...

Oh, wait a minute wait a minute ......

Re:no definite article needed

[Anonymous Coward]

...but only since 1991 for the USA. Old habits do die hard.

Re:no definite article needed

[tr897]

I'm sorry, but I completely fail to understand what you mean by this... Please explain!

Re:no definite article needed

[tr897]

Oh, I see... You assume that a republic is always a country! Well, this is simply not true.

Re:no definite article needed

[DarthStrydre]

You can stubbornly call it Ukraine in all cases, but I prefer to follow the spoken english aid of adding a definite article to precurse the yoo sound, for instance, after a preceding oo as in "to the Ukraine". Per proper English pronounciation, the 'the' in this case is with a long 'ee' as with 'thee'. While there is nothing requiring the 'the' in this case, there is likewise nothing prohibiting it, and the pronunciation aid makes it useful. It is likewise useful in other linguistic gymnastics with preceding vowel sounds.

As a supporting argument against the insistence on dropping the 'the', I find the common dialect often also refers to the Yukon, the Yucatan, the Gambia, the Congo, the Netherlands, the United States. The argument that 'the' is unnecessary because there is only a singular Ukraine fails in the other cases, since there is similarly only one Gambia, Yukon, etc.

Re:no definite article needed

[Anonymous Coward]

You can stubbornly call it Ukraine in all cases, but I prefer to follow the spoken english aid of adding a definite article to precurse the yoo sound, for instance, after a preceding oo as in "to the Ukraine". Per proper English pronounciation, the 'the' in this case is with a long 'ee' as with 'thee'. ...

Great, I will take your suggestions into account the next time I go to the Utah or to the Uganda.

Regarding your other examples, they are all correct except Yucatan. The article is used for the Yucatan Peninsula, but not for the Mexican state.

Other posters have mentioned a very good reference on why Ukraine mistakenly got an article, why the use of the article is going away, and in when it is correct to use the article in the name of a country: http://www.infoukes.com/faq/the_ukraine/.

Re:no definite article needed

[alexo]

It's one of those habitual things. Some English-speakers (not sure if this is American-specific) refer to certain countries with the definite article, like the Ukraine or the Sudan.

Or the Iraq?

Re:no definite article needed

[Nimey]

Actually I've never heard that particular usage.

New Mega-Botnet!

[geekoid]

Now with more Bot to boost your immune system!

Re:New Mega-Botnet!

[nsheppar]

It's what the bots crave.

Re:New Mega-Botnet!

[Anonymous Coward]

In a cup!

Re:New Mega-Botnet!

[Anonymous Coward]

It's what the bots crave.

Nahh thats electrolytes.

Here you go

[Anonymous Coward]

www.blockacountry.com

Let's all welcome the new botnet overlord

[Anonymous Coward]

Of course I'm running Linux. Think I'm suicidal?

Clean up botnets

[DragonDru]

How can we expect to clean up the botnets if the hosts are never contacted. I may think I am clean, but if I unknowingly lack the skills to know better, I would never know better, and would never do better. The big papers detailing botnets never provide enough details to know if *I* screwed up the internet.

Re:Clean up botnets

[muckracer]

> The big papers detailing botnets never provide enough details to know
> if *I* screwed up the internet.

You did and we'll never forgive you! :-)

Re:Clean up botnets

[shentino]

Bear in mind, the good guys have to follow the same rules the bad guys get away with breaking.

Re:Clean up botnets

[Anonymous Coward]

Bear in mind, the good guys have to follow the same rules

A bear in whose mind? Must be a big mind? Please bare a thought for the bears stuck in minds.

Re:Clean up botnets

[Barny]

I am on it, you see I have this great product called Antivirus 2009, don't worry, I have sent out over 2 billion emails detailing its advantages to people.

Also, I have these pills...

Re:Clean up botnets

[Anonymous Coward]

My thoughts remain fully clothed, bear that in mind.

Re:Clean up botnets

[Dadoo]

Personally, I think it's time we started fining people, when their computers are found in a botnet. Start small at, say, $10, then double it for each subsequent violation, until it reaches $160, or even $320. Then, Microsoft will either have to fix the problem, or people will start using more secure operating systems. Either way, it's a win for the Internet.

Re:Clean up botnets

[Anonymous Coward]

that's an easy one! take over the botnet, wether it is by force or through a nice rootkit, then command all machines to go to this site: http://goodbye-microsoft.com/ (not all at once, of course). that's it! hey, no need to thank me, really. always glad to help ;).

Re:Clean up botnets

[Anonymous Coward]

I find your description interesting and wish to subscribe to your newsletter.

Re:Clean up botnets

[Barny]

Your already on it :)

Coincedence?

[AnalPerfume]

I thought this article was about this story from the BBC about UK government PCs in botnets, is it a coincidence that two Windows based government botnet stories appear at the same time? Or is this just a sign of how fit Windows is for the job.

http://news.bbc.co.uk/1/hi/technology/8010729.stm

"All of the infected machines were Windows-based PCs and the vulnerability was targeting security holes in Internet Explorer and Firefox."

Virus devastates millions of complacent idiots

[David Gerard]

A computer worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is posing a growing threat to users blitheringly stupid enough to still think Windows is not ridiculously and unfixably insecure by design.

Despite many years' warnings that Microsoft regards security as a marketing problem and has only ever done the absolute minimum it can get away with, millions of users who click on any rubbish they see in the hope of pictures of female tennis stars having wardrobe malfunctions still fail to believe that taking Windows out on the Internet is like standing bent over in the street in downtown Gomorrah, naked, arse greased up and carrying a flashing neon sign saying "COME AND GET IT."

Microsoft cannot believe people have not applied the patch for the problem, just because they keep trying to use Windows Genuine Advantage to break legally-bought systems. "Don't they trust us?" sobbed marketing marketer Steve Ballmer.

Millions of smug Mac users and the four hundred smug Linux users pointed and laughed, having long given up trying to convince their Windows-using friends to see sense. "There's a reason the Unix system on Mac OS X is called Darwin," said appallingly smug Mac user Arty Phagge.

"It can't be stupid if everyone else runs it," said Windows user Joe Beleaguered, who had lost all his email, business files, MP3s and porn again. "Macs cost more than Windows PCs."

"Yes," said Phagge. "Yes, they do."

Ubuntu Linux developer Hiram Nerdboy frantically tried to get our attention about something or other, but we can't say we care.

Re:Virus devastates millions of complacent idiots

[Anonymous Coward]

Go back to the LemonParty, you sick, gothic troll.

Re:Virus devastates millions of complacent idiots

[David Gerard]

You guys really are stretching these days. PR budget not as healthy? Tomorrow's the financials! Four failed quarters in a row! I'm sure you'll all be doing double duty.

Re:Virus devastates millions of complacent idiots

[LaskoVortex]

"It can't be stupid if everyone else runs it," said Windows user Joe Beleaguered, who had lost all his email, business files, MP3s and porn again. "Macs cost more than Windows PCs."

Go back to the LemonParty, you sick, gothic troll.

What's the matter Joe? Did it push a button with you?

Re:Virus devastates millions of complacent idiots

[tooyoung]

I liked this comment best when you posted it on April 6th: http://it.slashdot.org/comments.pl?sid=1189359&cid=27477809

New mega-botnet discovered?

[Anonymous Coward]

Yeah, it's called President Obongo supporters.

Wow

[David Gerard]

For once, an article on botnets notes that the infected machines are in fact Windows. You don't see that often.

Re:Wow

[Barny]

Thats because its normally assumed ;)

Re:Wow

[Erikderzweite]

That was the only possibility before the iBotnet. Now it is not.

Re:Wow

[cboslin]

For once, an article on botnets notes that the infected machines are in fact Windows. You don't see that often.

Did you read the article. I did, also the link, neither mentioned Windows specifically. Though the article has a tag of Windows, perhaps that is what you saw.

When I saw that a user had to run a .exe file, I knew it was Windows specific.

Granted we all knew it was Windows!

Re:Wow

[David Gerard]

It mentions Windows XP near the bottom. Or did when I looked.

Re:Wow

[sgt_doom]

"For once, an article on botnets notes that the infected machines are in fact Windows."

Good point, usually those darn INFECTED machines won't admit to anything!!!!! (Of course, if I was infected, I wound't either.....)

initial infection

[muckracer]

So somebody please explain to me, how the initial infection actually happens (from TFA):

"victims are infected when visiting legitimate Websites containing a Trojan"

How does this even run, nevermind take over the whole system??

Re:initial infection

[Culture20]

Flash ad? Excel spreadsheet? PDF? It's all in the plugins.

Microsoft quality

[Anonymous Coward]

Microsoft are pretty competitive in the cloud computing arena.

Hey Vegeta...

[Anonymous Coward]

what does the scouter say about the botnets powerlevel?

Re:Hey Vegeta...

[Anonymous Coward]

IT'S OVER 9000!!!!!!!!!!

seriously thats what it said.

So where's some real info?

[Plekto]

Blurred screen shots, off-handed mention of files and sites...

Why not at least release specifics so that we can avoid these sites?(or at least get them to clean up their act)? Why not give us details about the actual filenames and so on?

Or at least give us details on the actual control application and the files it is paid to infect the computers with so that we can avoid them.

Articles like this annoy me because they accomplish nothing constructive.

Re:So where's some real info?

[symbolset]

Because it's pointless? Any list of compromised webservers would be obsolete before you read it, as would any list of known hooks.

The network is untrusted. Windows gets malware. That is what you need to know.

Re:So where's some real info?

[east coast]

Windows gets malware. That is what you need to know.

Pointless. Considering that some of us work in Windows shops and Windows runs our apps... I'm going to keep running Windows. So you can go on and keep bashing Windows but, for me, it's paying the bills and it's giving me reasons to turn my computer on in the first place.

Nigger music is the only music that actually...

[Anonymous Coward]

devolves as time progresses. I present Exhibit A for your consideration:

http://www.youtube.com/watch?v=czR1yxKfhUc

That's quite a step down from the people who brought us jazz music and rock 'n roll.

Security stupidity...

[Anonymous Coward]

I am shocked that a bank would allow any www access on a machine that has direct access to accounts.

It is funny how people can spend a fortune on security and then do something like install a WEP protected Wifi access point in one of the offices that is trivial to crack and that gives you direct access to otherwise heavily fortified networks. Another thing that can guarantee a good laugh is wireless connected security cameras. I saw this interview on TV the other day with a guy whose child had some sort of chronic disease. Apparently he was something of a Nerd because had installed a camera in the back of his car hooked up to and a Netbook or some such gadget so he could keep an eye on the kid. He told the reporter that the system worked fine but he had to make some modifications to the software because when he used the out-of-the-box configuration when he was driving through the city centers and business districts, he would keep getting cross connections from wireless connected security cameras all the time. You'd think that in this day and age wireless security cameras would have an encrypted connection.

Re:Security stupidity...

[Techman83]

We used similar cameras to record our last road trip, several of the Road Houses we stopped were recorded by accident. Did get a good laugh from us.

security

[OrangeTide]

I've switched to lynx.

Re:whoosh

[maxume]

I thought that was the whole point of posting.

Ahh yes, those immune Macs

[Sycraft-fu]

Sure a good thing those Macs don't have an active botnet out there or anything. Errr, well, ok but surely this will be the only one ever. If more people switch making the platform a larger target, there won't be any more, ever!

I get a little tired of this silliness of "Oh Windows is unfixably hackable!" That shows an amazing ignorance of computer security. Good admins realize that there is no such thing as perfect security, and no system that can't be broken in to. So the answer isn't the hunt for the perfect system, the answer is defense in depth. You secure your systems and network on multiple levels, and you keep an active watch on what happens. You take proactive steps to keep things secure, you don't just sit back and say "Well my OS is invincible."

It is the same basic philosophy you see in physical security. Good physical security doesn't come from trying to have a single unbreakable defense, it comes from layers.

The crowing on about Macs really makes me think of a home analogy: The Mac types have decided security comes from living in a gated community away from the "rabble". They pay to live in their special enclave, and figure the exclusivity keeps them safe. Over all, it does, they are a smaller target. However they are lax on their security because of this, they leave doors unlocked, valuable laying around and so on. However the security is all in appearances, it isn't real. Finally, someone decides to hit the community, and simply goes off road and bypasses the gate guard. They then have free run, because of the laxness of the users.

Me? I take the bad neighborhood view, regardless of OS. Security comes from a host firewall, and a network firewall, and a virus scanner, and an IDS, and keeping the system patched, and a good password, and running as a deprivileged users and so on. No one of those things is what makes security good, it is the more of them you do. It is a defense in depth, so that a single failure doesn't have wide spread implications.

So if your security is switching to Macs, well have fun then. Best you DON'T encourage others to join you though, since your security is all in remaining small.

Re:Ahh yes, those immune Macs

[db32]

What? You mean that downloading illegal software and then installing "evil trojan" isn't safe? Hell those Mac users probably even got a nice dialog box asking them for their password to continue to install the trojan. Totally the same thing as the drive by installs so common in Windows.

Now I agree with most of what you say, but the OS design behind XP and friends IS inherently flawed. Defense in depth is the only sane approach to security, but the depth that you must go to is going to be influenced greatly by the quality of the products involved. The more flawed the products, the more layers required, and the more expenses involved. It is all very simple to crow about defense in depth when you aren't begging the finance department for the funds to purchase those levels of depth. The reality is that most places simply cannot afford the defense in depth required to protect themselves. I can't tell you how many times I get drug along kicking and screaming because some "Critical" app requires all users on that computer to be administrators, or some such other nonsense that is DIRECTLY linked to piss poor OS design and the bad coding practices it encouraged. The piles of sensitive and authentication information that gets held in insecure places just to facility "easy" and "automatic" tasks is revolting. I don't know much about Vista, the fact that it is MUCH easier than XP to work as a user and only elevate privs as needed is pretty nice, but it has piles of other irritations that I don't have much patience for.

Re:Ahh yes, those immune Macs

[icannotthinkofaname]

The crowing on about Macs really makes me think of a home analogy: The Mac types have decided security comes from living in a gated community away from the "rabble". They pay to live in their special enclave, and figure the exclusivity keeps them safe. Over all, it does, they are a smaller target. However they are lax on their security because of this, they leave doors unlocked, valuable laying around and so on. However the security is all in appearances, it isn't real. Finally, someone decides to hit the community, and simply goes off road and bypasses the gate guard. They then have free run, because of the laxness of the users.

By the same analogy, Linux users moved some place where there was no town or civilized society of any sort, built their own community brick by brick, and the place isn't even on the map. But, they still aren't boneheaded enough to leave their doors unlocked. Linux users lock their doors using locks that they created, made their own latching systems to actually open the doors when unlocked, and know what their houses looked like when they left, so they can identify anything out-of-place when they return. Not only is it small, like the Mac community, but the people living there designed their own security into their customizable systems. The reward-to-effort ratio is just not high enough to justify even trying to get at the valuables inside, which may or may not be valuable to wherever the burglar came from in the first place.

Am I right?

Re:Ahh yes, those immune Macs

[symbolset]

Good admins realize that there is no such thing as perfect security, and no system that can't be broken in to. So the answer isn't the hunt for the perfect system, the answer is defense in depth.

Defense in depth includes not leaving in stupid defaults like services listening on the network and autorun. Somebody should fix those things. If there's no unhackable system, there's OpenBSD which is fairly close. At the other end of the spectrum is a box configured to allow remote desktop with a published guest account username and password, with administrator privileges, with a world-routeable IP address. Somewhere in between is Windows and the various Linux distributions. It's theoretically possible that Windows is waaay over there in the corner with FreeBSD all by itself... in sort of the same way it's theoretically possible that in any given moment all the molecules of air in your room will randomly happen to occupy your coffee cup instead of being more evenly distributed.

You don't want to admit that Microsoft is responsible for some of this pain by leaving in stupid defaults because they're popular. That's fine. More and more people are tired of having their computer cleansed on a regular basis. Microsoft is winning more converts to Apple and Tux every day. It's like a billion dollar marketing campaign that never stops.

Antivirus? Really? Of what purpose is an antivirus on a platform with no viruses in the wild? You might as well install some bigfoot repellent while you're at it.

Re:Ahh yes, those immune Macs

[Anonymous Coward]

That is a decent approach. The best thing is having the machine that is touching the Internet be a hardened firewall, either a router made for the task, or a PC with a highly locked down OS (and it matters less what the OS is, than what is running on it and what is disabled.)

I add one more layer to security: Backups. Having a secure, hardened backup server with some type of IDS software on it will help recover things in case a machine gets compromised and data erased or corrupted. The problem is that a backup server holds all the crown jewels, so a solid effort has to be made to ensure that this machine is highly secure.

Application firewalls, either using ipchains in Linux, ipfw in BSD, the one on Mac, Windows's built in one, or a third party, should be considered part of the last line of defense. An attacker should never be able to be able to get to actual machines without going through some sort of router first. Of course, this can't be done in some cases, such as someone using a laptop with wi-fi, but this is a best practice.

My best practice is to not just put my machines in a good neighborhood, but lock the doors with sturdy deadbolts box by box. This minimizes risk if the outer firewall gets compromised.

Re:Ahh yes, those immune Macs

[Anonymous Coward]

Estimated size of iBotnet based on number of trojan infections : 0 - 49. Which makes this single botnet 38000 times larger than the mac one.

It seems like OSX design might have at leat something to do with that. (in b4 correlation is not causation)

Re:Ahh yes, those immune Macs

[Anonymous Coward]

I believe that mac botnet was reported to consist of 67 machines.

Hardly in the scale of 1.9 *million* is it?

(not-a-mac-user)

My tinfoil hat...

[SuperCharlie]

I am continuously validated on a little theory I have come to about computer security.

There is no such thing.

I see people say Windows this Linux that and Oh My Mac but I have come to believe that unless the dam thing is cut off from the internet, wireless cards removed and under guard physically 24/7, if someone wants in the thing bad enough, they will do it.

Re:My tinfoil hat...

[maxume]

Well gee.

Are your doors sledgehammer proof?

Re:My tinfoil hat...

[SuperCharlie]

Umm no.. but then again I dont go running around telling everyone my doors are sledgehammer proof and then appear shocked every time someone does break in..

DingDingDing!

[Gription]

We have a winner!!!

The fact that the military discovered that they had lost terabytes of info on a new fighter tells me that they have no clue. A secure military network with any sort of internet link??? GAAAAK!

Anyone who says they can absolutely protect an internet connection is either lying or deluded. You can protect against known attacks. There is no way to be 100% protected against unknown attacks. The attacks to be worried about are always the unknown attacks.

Idiots with lots of your dollars at work.

Re:DingDingDing!

[jake-in-a-box]

The data was not lost from military systems, it was obtained by crackers who penetrated military contractor's commercial systems. Yes, that leads to a whole bunch of questions and is not by any means an absolution of the military's IT security. But your statement does not match the facts.

Re:DingDingDing!

[Randall311]

The data was not classified, just FOUO. Electronic copies exist for convince sake. It depends on the project, but there is usually no requirements for encryption of such documents. Expect that to change... soon.

Re:DingDingDing!

[sexconker]

There is no way to be 100% protected against unknown attacks.

Manually approve each packet?

Not surprised

[AMSmith42]

This is anecdotal, but after having recently spent a month in Ukraine (please, not THE Ukraine... it isn't plural) and witnessing first hand the rampant use of illegal versions of XP, I am not surprised by this discovery at all. The illegal versions (DVD eXtreme Edition, Fuck You Bill!) can't be subjected successfully to WGA and therefore cannot be fully patched. Blame who you want, but this is how it is there right now. The culture is such that they don't bat an eye at getting a burned DVD in a shiny official-looking case (with XP DVD! printed on it) for way less than what they'd pay for one from Microsoft. To be clear, this is the Ukrainians I'm talking about. I have no idea about the U.S. government buildings.

Re:Not surprised

[InsertWittyNameHere]

I don't think it's fair that the US government has to pay full price for the same eXPerience that THE UKRAINians get for (almost) free!

WGA should block these pirated copies of XP from running this popular New Mega-Botnet software.

Transformers

[electrosoccertux]

Get off my lawn! Megabots are so 1980's. We had Transformers back before you whippersnappers were even born!

Ha, all your bases belong to us!

[Anonymous Coward]

For real!
LOL!
ha ha

He is Legend...

[Anonymous Coward]

Mega Botnet?!?!

He is Legend.

How Does The Infection Happen

[WebmasterNeal]

Anybody have any idea how this type of infection happens? I.e does a user simply visit the site, and without any sort of prompt automatically downloads a file that runs amok or does the user actually have to invoke something once on the site to download this?

Re:How Does The Infection Happen

[PPH]

Anybody have any idea how this type of infection happens? I.e does a user simply visit the site,

Exactly!
IE. A user simply visits a site....(fixed the punctuation for you).

*yawn*

[icannotthinkofaname]

Only 1.9 million PCs? Boooo-ring! Wake me up when it gets as big as Conficker.

Overinflated figures

[Anonymous Coward]

I don't think you can just grab some numbers from a convenient botnet CnC portal and say ah-hah 1.9 million infected machines for a lot of reasons.

Check out the blog about counting botnet victims at http://blog.damballa.com

Using "fag" as a derogatory term...

[Anonymous Coward]

...proves you are a monstrous ass whom all good people should permanently ignore.

In fact

[WindBourne]

if windows ever gets their act together so that Windows is better than *nix (linux, mac, solaris, etc), then you can bet that the crackers, virus writers will turn to where it is easier.

Only six?

[PPH]

Researchers from Finjan who found the botnet say it's controlled by six individuals,

We should be able to shut this one down with one clip in a .45.

Re:Only six?

[mjwx]

Researchers from Finjan who found the botnet say it's controlled by six individuals,

We should be able to shut this one down with one clip in a .45.

-1 inefficient, you should only need a revolver for this job.

Re:Only six?

[DynaSoar]

Researchers from Finjan who found the botnet say it's controlled by six individuals,

We should be able to shut this one down with one clip in a .45.

-1 inefficient, you should only need a revolver for this job.

Why go with the minimum required when you can enjoy exploring the practical application of overkill? I'd love the chance to play with an AA-12 fully automatic 12 gauge shotgun. http://gizmodo.com/gadgets/guns/recoilless-auto-shotgun-fires-300-rounds-per-minute-no-cleaning-or-lube-required-324453.php

Re:Only six?

[frodo527]

So use a Smith & Wesson Model 625 revolver. Six rounds of .45 ACP in a full moon clip. :-)

Re:Only six?

[himself]

Nah, shoot their computers, too. Bring an extra clip, come to think of it, and shoot their backup gear and then TP their yard with the backup tapes.

Re:Quick! get some Caf-Pow!

[Anonymous Coward]

And for the Ultra Mega-Botnet you also have to have Ziva doing something covert, and Tony doing something illegal (cause thats when he knows he is having fun).

I guess that all falls under the lyrics of a song that say "Sometimes you gotta do the wrong thing to the right thing".

What's that catchy tune everyone's humming?

[Chris Tucker]

Could it be this?

Botnets. World wide botnets.
What kind of boxes are on botnets?

Compaq, HP, Dell and Sony, true!
Gateway, Packard Bell, maybe even ASUS, too!

Are boxes. Found on botnets!
All running Windows, FOO!

3 questions

[Anonymous Coward]

Sorry guys,
I see a lot of replies to the post but not enough answers.
I only have 2 little questions since I also use Windows XP.
I use a thinst... "sandboxed" Opera to do my browsing.

1) How can I know if I am already infected / vulnerable?
2) What measures can I take to protect my system?

The "I know my system is safe and I dont have to worry" atitude is security's biggest enemy in my humble opinion.
So I have no problem to state that I am not sure that my system can not be harmed :(

P.S. Before starting a Win/Linux/MacOs OS war let me tell you that
I would prefer to learn to secure a OS that I already know something than to learn how to secure
a OS that I really don't know.

Thanks for any comments/answers
Have a nice day
fade

what of the ISP's

[cdn-programmer]

What of the ISP's that host these botnets. Many of these botnets are used to spew spam. If they do then this is easily detected and IMHO the ISP uplink in question should simply pull the plug and advise their client that it looks as if their toilet is broken because there sure seems to be a lot of sh*t coming from them.

I know my ISP does this. I know because they have phoned me and I had to advise them its not my OpenBSD servers generating spew, but another of their clients on the subnet. We found it fairly quickly.

I've heard so many excuses. Some involve excuses it would breach service agreements. So lets look at that one. How many end users write service agreement contracts? How many end users even read them? I think the answer here is obvious. Pretty much anything reasonable can be written into the contracts so that sort of excuse doesn't hold much water.

The obvious answer is the ISP's in question actually might make money carrying this spew. They certainly made money when they provided connectivity to known spammers. They also make money when they charge extra for static IP's. Note that a static IP makes it much easier to trace and quarantine a bot.

If we want these problems to go away then one way to address the issue is to look at issues of an accessory either before or after the fact.

Let me provide an example. If someone digs a big hole in the road and someone else drives in and wreaks their car and many kills some people in the process, then the excuse of "I didn't know a car could fall into a hole" or "I didn't think anyone would drive their car down this road at night" or any other excuse that might be dreamed up is not likely going to carry much weight. If someone sees the hole and ignores it using the excuse that "Well, its not my hole", then that excuse also is not likely to hold much weight.

An ISP hosting infected machines should be just as liable as the client who owns it. Many of these botnets reveal themselves. We need to start asking for accountability.

Consider people like Conrad Black. Last I heard he's in jail. That is accountability. Any excuses he and his lawyers might have dreamed up didn't carry much weight.

Here is another example. In the movie called "Nuremburg", Alec Baldwin asks in one scene if "anyone in this country accepts responsibility for anything?". I think this says an awful lot. Only one person seemed to be responsible for the killing of millions.

So in this story we have over 1 million bots discovered and apparently 6 perpetrators and how many are responsible? These bots are identified, now what? I've had more than 50,000 bots attack my servers. Can I call the cops? If I provide IP addresses does anyone pull a plug?

We need to think on this.

Re:what of the ISP's

[cboslin]

While I agree with the basic philosophy and your stance, I know it would be abused. I base this on actual experience in the telco industry.

Having worked in a telco and been responsible for using the Network General Sniffers to troubleshoot networking problems, I can guarantee you that if that day ever arises, instead of your being called and asked, as you are now, if it is your machine, you will simply be shut off.

My guess is that you have something other than regular residential service to even get that call. Most of us do not want to pay more for a business type of connection.

Just like TWC and Comcast automatically throttle now, even when traffic is light. No reason for it, other than it is easier for them to do it all of the time, rather than allow you to use more bandwidth than they want you to use when no one else is using it.

To add insult to injury, when you are cut off. You will be assumed to be guilty. You will be required to prove your innocence before they turn you back on. Granted they will not provide you with any information. Just like when they stated that they needed CAPs, but they could not provide you with information on how much bandwidth you are using now and have been using in the past. With no information, even an expert would find troubleshooting difficult if not impossible.

Also, if you are not physically monitoring when you get cut off, good luck finding the problems if you are a typical user. The expert would have saved log files, but that is way far from the norm compared to most people.

In reality you are paying for service, there should be fines involved when your service is lost for any reason. Have you ever heard of any individual having fines, nope, how many have an actual contract with their ISP. Terms of Service do NOT qualify as a signed contract between entities.

At the telco, there are fines when service is lost. So everyone denies, denies, denies and you MUST prove to them that the problem is on their end or they will simply deny that it is their problem. We ALWAYS had to take copies of our sniffer logs on both ends of the fiber connections and physically prove to them the problem was theirs. Every time, time and time again.

It would be comical if it was not so pathetic. You would think that after proving to them over a half dozen times that the problem is in their system or on their lines, that they might believe you when you called them and actually check. Nope, even after a dozen times, we would have to copy off segments of the logs, attach them to an email and send them to the company providing our lines before they would sigh, admit that it was their problem and finally do what they should have done as soon as you called them, fix the problem.

If you did have a Linux sniffing software tool (more available than for windows, but they exist for windows too) would you be able to set another one up on the internet, to monitor your communications on both sides of your ISP? Probably not.

And we had sniffers at each of our buildings in different states, not a cheap proposition, but a necessary one. How many reading this are even monitoring their own outgoing TCP/IP packets from their own router to their ISP and the internet? Probably zero, being slashdot, perhaps one person reading this might be.

The point, watch what you wish for. If they start doing this, you can bet you will not like the results, and they will be doing it to help you. Just like they are using Deep Packet Inspection to help you. Just like they are forging RST packets to help you. Just like they are throttling your service at 3 am, when few people are online, telling you that bandwidth is scarce, while filing government reports stating their bandwidth usages have actually decreased. Just like they will be helping you when they deny you Net Neutrality. They will mention porn, child pornography, crime, crackers, viruses, all the same old tired scare tactics and FUD

At some point

[Anonymous Coward]

At some point I really really hope that people running these botnets wipe the hard disks of people running insecure systems. It sounds mean, but people who chose insecure systems, over and over, need to be punished. Stupidity should never be rewarded. Ever. Find out what a secure system is. Find out what an insecure system is. Know the difference. I've seen too many 'go blind' when making decisions like this. Guessing is being stupid. Saying 'oh, I just don't know' is honest, but stupid. Read a little. Learn a little. People who repeat the same mistakes need to be punished.

One port, one exploit.

[Anonymous Coward]

Just leave one port open and we will pwn you with a brand new 0day exploit !!
Linux boxes are the most precioussssss of hostsssss..
By the time you patch it will already be too late.

6 individuals ....

[Anonymous Coward]

controlling a million machines ....

You're misrepresenting the FAQ!

[jonaskoelker]

So ... to be in compliance, you can only run Windows desktops, is that correct? Wow! Way to feed the MS machine.

See also:

Is NIST endorsing or mandating the use of the Windows XP or Windows Vista operating systems or requiring each setting be applied as stated?

No. NIST does not endorse the use of any particular product or system. NIST is not mandating the use of the Windows XP or Vista operating systems, nor is NIST establishing conditions or prerequisites for Federal agency procurement or deployment of any system. NIST is not precluding any Federal agency from procuring or deploying other computer hardware or software for which NIST has not developed a publication, security configuration checklist, or virtual testing environment. Although the FDCC currently applies to Windows XP and Vista, security guidance is available for other platforms. The OMB and GSA updated the Federal Acquisition Regulation (FAR) on February 28, 2008, Part 39 now reads as follows:

It seems as if they're quite open to non-MS products. Now, I have read the "now reads as follows" bit, so I might be mistaken. But on the face of it...

I have picked up a mod troll

[drinkypoo]

I have picked up a mod troll! They are following me around and modding posts which clearly are not troll as such.

Re:I have picked up a mod troll

[Phroggy]

Heh, I've had that happen too. One of the perils of pissing people off on the Internet. Well worth it.

Re: Praetorians

[jatemack]

The government probably installed Cathedral software to initially protect themselves. Who would have thought there was a backdoor?

Fight! Fight!

[ghostis]

Just for fun, someone should program two botnets to adapt themselves and hate each other and then see what happens. ;-)

Well then there's no issue.

[symbolset]

You're in a Windows shop. You run Windows apps. It doesn't matter if Windows gets malware. You're Windows all the way, Ra RA! Good for you.

A pity for your customers, though. I hope they aren't processing my credit application. Or my medical records. Or my driver's license. Or anything else having to do with me.

Re:Well then there's no issue.

[east coast]

The fact is the majority are. If you want to be an advocate to the point of self destruction be my guest. The rest of the world moves on as do I...

And watch the games become slideshows

[tepples]

Just run Windows games in virtualization

And watch the games become slideshows. Or has support for DirectX and OpenGL in virtualization improved since I last checked? Or did you mean things like solitaire and Tetris®, which are probably already cloned to heck and back on every single L*n?x desktop environment?