Slashdot Mirror
Torpig Botnet Hijacked and Dissected
An anonymous reader writes "A team of researchers at UC Santa Barbara have hijacked the infamous Torpig botnet for 10 days. They have released a report (PDF) that describes how that was done and the data they collected. They observed more than 180K infected machines (this is the number of actual bots, not just IP addresses), collected 70GB of data stolen by the Torpig trojan, extracted almost 10K bank accounts and credit card numbers worth hundreds of thousands of dollars in the underground market, and examined the privacy threats that this trojan poses to its victims. Considering that Torpig has been around at least since 2006, isn't it time to finally get rid of it?"
why dont they just send a self destruct/uninstall command and kill it or would that be too simple ?
no, maybe, oh I don't know. Why do I get all the hard questions?
The BBC got in trouble when they took control of a botnet for one of their technology shows: http://www.guardian.co.uk/technology/blog/2009/mar/12/bbc-botnet-legality-questioned. While this research was performed in the US, I think they must have broken a law somewhere. I don't see how grabbing personal info obtained illegally for the sake of research, even if they didn't infect the computers originally, makes it permissible under US law.
Take a machine. Install Windows XP SP1. Hook it to an unfiltered intenet access. Watch Sasser install. Mean time before infection: 30 seconds.
That nuisance is 5 years old and still running rampart. Now, far from being the threat that Torpig is, but it shows you just how hard it is to get rid of something. And unlike Torpig, it's not really "in use" anymore. Its maker is gone, it doesn't get any updates or new variants to faciliate infection. We're talking about the same old crapware that every single AV kit knows and removes by now. Worse, it's a threat that any halfway decently patched machine is not susceptible to.
And you want to get rid of Torpig?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
How about we make the punishment for infecting a computer $100 and one day in jail for each system you infect. This way, someone who does something stupid but isn't actually malicious pays a few hundred dollars and spends a few days in jail while the real criminals pay big bucks and spend years in jail. For 180k systems, that's an eighteen million dollar fine and nearly five hundred years of jail time.
Of course, the problem is catching these bastards who tend to live in countries where the government doesn't care or is actively involved in these illegal activities (I'm looking at you Russia).
-- Will program for bandwidth
No, they purchased a domain name, set up servers to accept data sent to that domain, then collected that data. That their research had told them that the domain would be used by the botnet is incidental. If you mail your credit-card information to my domain, I haven't committed any crime if I accept it and turn it over to the authorities.
It doesn't hurt to be nice.
Getting altruism out of people is hard enough at the best of times. Asking for altruism when the likely reward is getting arrested.. no.
How we know is more important than what we know.
What bothered me after reading this paper is nowhere does this paper come out and say that the infected machines are all running Windows, although this is strongly implied by the description of how the virus works. The reader is left to wonder whether machines other than Microsoft Windows were infected.
Instead, the paper leaves the impression that all computing has the same architectural vulnerabilities. I thought that was a surprising defect, sufficient to make me wonder what else isn't captured/stated/analyzed in the paper.
Why does this sound like a cross between an Onion and Swine Flu?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
If your recovery disks simply restore an image to the hard-drive, just install into a virtual machine, then download the the redistributable version of Windows XP SP3, then make an image of that and restore at your leisure.
In fact, try that even otherwise. Simply install to a Virtual Machine without internet access, then get the redistributable SP3 using your safe Linux distribution, then create a slipstreamed ISO inside your Virtual Machine and burn it in your Linux distribution if you can't have passthrough enabled in the virtual machine.
Never tried this myself (I use a Linux distro), but can't see why it shouldn't work, and it should be safe.
Fortunately they're quite easy to spot due to the red coloration.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."