Slashdot Mirror
The Birth and Battle of Conficker
NewScientist has an interesting look back at the birth of the Conficker worm and how this sophisticated monster quickly grew to such power and infamy. "Since that flurry of activity in early April, all has been uneasily quiet on the Conficker front. In some senses, that marks a victory for the criminals. The zombie network is now established and being used for its intended purpose: to make money. Through its peer-to-peer capabilities, the worm can be updated on the infected network at any time. It is not an unprecedented situation. There are several other large networks of machines infected with malicious software. Conficker has simply joined the list. The security community will continue to fight them, but as long as the worm remains embedded in any computer there can be no quick fixes."
But I think we all saw that one coming.
Regular people just care that whatever is on their computer isn't directly costing them money or causing it to visibly malfunction. From experience, I know most would ignore any offers to help, sadly. Guess the trick is to find a way to make them want to disinfect their computers.
Exactly, other than adware or software that directly and immediately causes identity theft, most people don't care, after all computers are supposed to be slow after about a year because all the hardware goes obsolete right?
Taxation is legalized theft, no more, no less.
Yes, but what happens if this leads to more filtering? Such as "Your computer has been using a lot of P2P, install this to scan for any unwanted programs" and it sends all the data to the RIAA/MPAA?
Taxation is legalized theft, no more, no less.
Guess the trick is to find a way to make them want to disinfect their computers.
Or make them want something that Linux has but Windows doesn't. Unfortunately, users tend to have weird priorities. They won't budge over the seemingly intangible factor known as 'security', but they might switch in a heartbeat for Gnometris.
Regular people just care that whatever is on their computer isn't directly costing them money or causing it to visibly malfunction. From experience, I know most would ignore any offers to help, sadly. Guess the trick is to find a way to make them want to disinfect their computers.
Easy, do what the government does... fearmonger.
"ZOMG Identity theft!!#!"
They'll be begging for free help.
Botnets, worldwide botnets.
What kind of boxes are on botnets?
Compaq, H.P., Dell and Sony, true!
Gateway, Packard Bell, maybe even Asus, too!
Are boxes, found on botnets,
All running Windows! Foo!
Guaranteed! This comment 100% Anthrax free!
If you read the article, the problem isn't Microsoft failing to offer patches and fixes, it's the failure of users to install them. Conficker was detected in the wild *after* the patch to remove the vulnerability became available, but people didn't install it. I suspect a few of the monthly malware removal updates deal with it as well (though I don't know for certain). What do you want MS to do, deploy goon squads to forcibly patch people's computers?
$_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
As usual, life rarely has one single element at play
No, I'm sure that all these Windows Botnets have a single thing in common besides that they're computers.
Item 1: Lack of firewall. A workign hardware or software firewall prevents all network infections.
That's funny. You have no idea. Anyway, I'm pretty sure the German army has a firewall in place for their Windows computers. That's not it.
Item 2: Lack up updates. Machines that did not recieve security updates did not get the patch that fixed this issue prior to the apperance of Conficker.
No, I'm pretty sure it got onto some of these Windows networks through AutoRun even if all the PCs were fully patched.
What we're looking for is a common thread - something all these Windows computers have in common. It can't be that they're computers -- if we give up our computers Windows won't run at all.
Help stamp out iliturcy.
hasn't there been multiple worms for openssl and apache?
i'm suprised i have to make this point yet again, but there are more machines infected than the whole linux marketshare. until linux is really in the hands of the common newb you won't have an apples and apples comparison.
Silence, in this context, really is golden.
The absence of data actually does signify, as far as this argument is concerned. In effective terms, users can find a secure haven in non-Windows systems. There is, admittedly, some truth to the assertion that there's a myth of invulnerability surrounding FOSS systems. Amusingly, black hats seem to buy into it as much as anyone else.
Want effective protection from malware right now? Don't run Windows.
Will that protection exist tomorrow? Will it exist even after everyone and their dog has flocked to FOSS? These are, for the moment, academic questions. Developers, however, deal with such academic questions all the time. My personal feeling is that FOSS developers are up to the task of securing their systems even in the face of concerted attacks.
So what about that famously touted malware vector, 'stupid user tricks'? Ignorance and naivete are vulnerabilities in any system, technical or human. One doesn't have to look far for proof of that. But there's a fundamental logical flaw in this argument when applied to FOSS systems: The argument essentially says, "Once FOSS is just like Windows, it will be just as insecure as Windows."
This assumes that a mass movement to FOSS won't be accompanied by a cultural change, and I can't see how that's possible. The culture of the incurious, uninvolved and too-trusting Windows user is exactly what keeps Linux (and much of FOSS) off the desktop. FOSS punishes each of those tendencies. In effect, it pushes back against the very behaviour that remains Windows' last, greatest vulnerability.
I'm not trying to make the case for cultural change. Frankly, I'm getting jaded enough that I'm not so sure there will ever be a year of Linux on the desktop. But here's the thing: I don't care. Linux (and FOSS systems generally) work for me and my customers now. That's enough for today. I'll continue looking ahead with caution, but today, at least, I'm safe, and most of the rest of the world is not.
Crumb's Corollary: Never bring a knife to a bun fight.
Really?
All the linux systems floating around for years and years and years, and no one has gotten a proper linux virus to propagate. You know why that is? Uncle joe can install his porno software (not really aware of what that would be, but for the argument), and still have relatively secure computing because of the WAY LINUX IS DESIGNED, USED, AND MAINTAINED!!!!
Living in Chile
I routinely encounter people who have disabled windows update because they believe Microsoft is out to get them. They worry that the updates their computer nags them about are filled with unnecessary crap. Crap that will spy on them, display advertisements, install toolbars and hijack their machine. I think this is largely due to some weird cultural concept that Windows is both evil and necessary. In truth, it's neither.
If a Linux based distribution was the dominant desktop OS the morons who run a PC would be infected within minutes. They'll click on, suck up, snort or fk anything presented to them. I've had intelligent people click on, install or follow complex instructions that disable all security on a PC so they could install 'that cool looking game' and then lie about it even when I had logging software logging to a remote server.
I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
I've got it... It's people!
And more specifically the sort of people who would install stuff just because a pop up tells them they are infected and they should install "Antivirus 2009".
And those who would type in passwords for encrypted zipfiles to decrypt them and install the stuff inside them...
> If software gets patched quickly, that can stop a lot of infections,
Uh, if those windows machines actually ran "windows update" there would be no conficker.
So if Desktop Linux had the same users, they may not run "ubuntu update". Why? Because the last time they updated their machine stopped working properly
Think that will never happen? See: https://answers.launchpad.net/ubuntu/+question/24523
Notice that user actually understands "grub" and "kernels" and knows where to find help. Other users might just never update. If the O/S ever has millions of users, these users start to add up.
> the fact that unix and unix-like operating systems were designed to be secure.
Incorrect. Unix is a watered down Multics.
Linux and most Unix OSes don't provide much security by default.
By default, any program the user runs, can do everything that user can do. There is no sandboxing.
And whatever a unix/linux normal user can do is more than enough for the conficker worm to make money for its masters.
So all the bad guys need to do is get the user to run their program.
If Ubuntu ever has "windows class" users I doubt it'll be hard to get them to download a file and type:
perl conficker
Then it's pwnage time.
If desktop linux ever has the market share that windows has, it'll start to have lots more "dancing pigs" applets that people want to run.
Some will actually be OK. And some will be malware.
An O/S whose security depends on people being able to tell whether something is safe or not, without the people actually being able to see and understand the source code, or know the entire inputs, is an O/S that expects people to solve something harder than the halting problem.
Thus in my opinion Windows and most Unixlike OS have poor security.
There are ways to give users better info on whether something is safe or not before they run it.
For instance say an O/S requires a program to list out what sort of access it requires ("guest applet access", or "full system privileges").
Then the O/S can provide the user more meaningful AND true information, and the O/S can also enforce those limits if the user decides to actually run the program.
So if a "dancing pig" applet claims to not want network access, it will NOT get network access, even if it tries to later.
That's far more secure than what the current O/Ses do.
In theory they're not actually morons ;).
;).
Because in theory it's impossible to solve the halting problem.
In theory users have to figure out whether a program is safe (analogous to "halt") even though
1) They don't have the actual true description of the program
2) They don't know the full inputs of the program
And that's a harder problem than the halting problem
While you could say - nobody should install anything that's "Not Expert or Vendor Approved", to me that's a rather dismal state of things.
Things could be so much better. Really.
For instance if you had an O/S that will require applications/applets to list out the type of access they require.
Then the O/S can provide a meaningful and TRUE description to the user of what the application might do.
And the O/S can also enforce the limits of the access.
So if something says it's a screensaver, it's only going to get screensaver access. It's not going to be able to make recordings from your microphone and webcam, and send them to Elbonia behind your back. It's not going to be able to write to anywhere other than it's own designated scratchpad area, not even your USB drives.
And that would be a secure modern O/S.
Then you can tell your "morons" - "You can install whatever stuff you like, unless the O/S gives you that red warning dialog box about the program requiring full user or system privileges".
In terms of security, most current O/Ses aren't even better than what was available 40 years ago. Heck, Unix is a watered down Multics.
They're just decorated with fancy graphics and animations so most people think they're advanced.
Yes, Vista does have some sandboxing, but the way MS has implemented stuff makes many people turn off many of the protections. So they'll become the next hosts for the next Conficker.
As for Linux, Apparmor and SELinux don't appear "Desktop Ready" yet.
I'm tired of this meme.
The thing about worms like Conficker is that they absolutely do not rely on user interactivity with some sort of trojan interface. No, "CLICK HERE FOR FREE PORN!" or, "DOWNLOAD THIS APP AND GET GREAT WAREZ!" apps.
Conficker spreads site to site silently through vulnerabilities in Windows.
Yes, it's possible to own *NIX boxen via trojan horse deployments, but for home users who aren't running apache, mysql, openssl, ssh, ftp, gopher, BIND, etc. the non-user infection vectors dry up. This is because Windows *sucks* for system security. While it's possible to pull privilege escalation on *NIX machines, and other OSes, often, they're a pain in the ass and usually require specialized setups(certain version of MySQL running with certain version of Apache, with... etc). Home users really don't have to worry about Samba file/print sharing owning their machine like NetBIOS on Windows users have to worry about their machines being similarly owned.
Sure, disabling autorun, running firewalls, virus scanners, etc. is great computing practice, I think it's more to expect from a typical home user who just wants the damned thing to work regardless. Lots of people use a computer thinking it's, well, a computer. Not a car, or a fax machine or a rifle that every so often needs to be broken down and maintained. Nor should it be. Modern file systems are virtually self-optimizing and aside from system updates and making sure there's room on your disk, which NO OS can really claim to do for you, unless you count Apple's MobileMe/.Mac service, even then it's only 20 gigs, most modern OSes can just be used on end with out much worry. Except most machines aren't running with components designed in this decade, they're often running Windows.
Non impediti ratione cogitationus.
>Linux has picked up a lot of mindshare
The problem with Linux on the desktop is that it's not very compelling.
Linux shines when the people around you are using it. That is, on your LAN or within telnet's reach. X is amazing, when used remotely. Why download and install a program when you can just telnet over to where its installed? Assuming the bandwidth is there (and it's a hell of a lot more there each year), the program will run. And it will be a lot faster than doing it the newfangled way, which is to make it a web service.
Linux makes a great desktop, if by "desktop" you mean network terminal. But we don't have a network. We have the web, which is a single graphical application (the "browser") that runs best on Windows. Just like a video game.
Linux won't, and probably can't, catch on until the network is there to support it. That includes small and large businesses, which have networks that would benefit from it, and are still using Windows. Businesses can use Linux the way it is intended, right now. But the "home desktop" is designed to deliver applications, not services.
Let's put it this way: The day some 14-year-old kid installs IIS for XP and hosts a webpage from his bedroom will be the first day of Linux's life. To my knowledge, nobody is hosting squat. Except on bittorrent, which doesn't quite count, because although BT is a protocol, people use it like just another Windows app.
It may not be popular on /., but Windows isn't the main problem here. The core of the problem is people not giving a shit about the security of their system. Whether that system is Windows, Linux or Mac is irrelevant.
Windows has reached a point where it can be considered "fairly secure". There are few known security holes, and none that can't be fixed with a little system tweaking and putting a router in front of the machine. But what can the system do if the user is the main point of failure, when he grants everyone any kind of privileges?
Take a look at the Dancing pig problem. In a nutshell: "Given a choice between dancing pigs and security, users will pick dancing pigs every time."
A webpage promises the user what he wants to see or do. Firewalls and security systems ring alarms because what the page actually will do is install malware. But the user clicks it away and allows it in. Because he wants to see the dancing pigs (or install a crack, or see some pron, or ...).
What system could avert that? Only one that does not allow its owner to do what he pleases. Do we want machines that we don't own but that only install what's "good for us"? I wouldn't want to go there...
As long as people don't give a shit about their security, this problem will not end. Be it with Windows, Mac, Linux or FantasyOS. And people will not give a shit about their system's security and whether their system is a threat to the rest of the internet as long as they are not held responsible for their system's actions.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You are talking about servers which have these things called Linux administrators, or Guru if you will, that actually read security bulletins, patch on time, have IT experience, etc. This makes them a lot harder target than Velma.
Everybody, meet Velma. Say hi Velma-(Hi Y'all!)
Working in PC repair and sales since the days of Win3.xx, when dinosaurs roamed the earth as my oldest puts it, I have found Velma to be a VERY typical Windows user. She rarely if ever patches because it scares her that it might "break" something, if it wasn't for me should would be running the Norton that expired in 2004 for an AV, and worst of all, like WAY too many of my customers, she has a serious weakness. In Velma's case it is her BFF Kim. You see, her BFF Kim is what some of us in the biz call a "click whore", in that she will click on ANYTHING. Spam attachments, chain letters, you name it. And Velma will ALWAYS trust her BFF Kim no matter what to tell her. Now please enjoy an ACTUAL account of my working with Velma-
/Me/Velma, that is a password protected zip file. It is even telling you to turn off the AV before opening! It is a Virus, do NOT open that!
(Velma) Ohh...You worry too much. It is from my BFF Kim! She wouldn't send me anything bad! See, it says "happy puppy pics!" Isn't that nice?
/Me/ Velma, it isn't pics. Pics end with .jpg. That is Happ_Pup.exe! That is a virus! Do NOT run that! (Velma) Oohhh...drink decaf, it'll be fine! See it has Kim's name on it and everything! /Velma turns off and ignores AV warnings, runs .exe, popups start sprouting everywhere and the network crashes from all the activity/
(Velma) Whoops. But it MUST be a trick, because my BFF Kim wouldn't do that! /Me/.....
NOW do you see why Linux "security" wouldn't be worth a bucket of warm spit if Linux got all the Velmas of this world? If you ever do manage to get Velma and Kim and all their little buddies onto Linux your good friends at the Russian Business Network and their friends in China and Nigeria would be sending "Happ_Pup.sh" along with easy to follow instructions on how to run it. And Velma and Kim WOULD run it, no matter how many times you told them not to. It is simply the dancing bunnies problem and short of forcing Velma and all her kind to run locked down thin clients with no rights at all to their own machines Linux will NEVER fix it. Sorry.
ACs don't waste your time replying, your posts are never seen by me.
> Do you have even the faintest idea what you're talking about? Didn't think so.
;).
That's not a nice thing to say. Why did you say that? Did I hurt you somehow before?
> The worst they can do is to nuke their own files.
Nah. As I've been saying - they could run the wrong program and then the bad bad things could happen.
While having their own data destroyed is typically far worse than losing their entire operating system, that's NOT the worst that could happen when a user runs the wrong program.
1) Their data could get silently corrupted. Silent corruption is often far far worse than complete data loss. When you have complete data loss, it's obvious. So you restore from backups, or deal with it in other ways. When something tampers with the data, you could be screwed so badly and not know why. By the time you realize something is wrong, all your backups could be of the corrupted data.
2) Their secrets could get exposed and abused.
3) Their computer could get taken over and used for illegal stuff. While they might eventually be exonerated, the pain and damage involved is likely to be more than mere data loss.
Plus it's probably easier to live if people think you're some incompetent loser who went out of business because of massive data loss, than if people think you really downloaded, stored and shared all those illegal and _disgusting_ porn.
I'm sure others can think of many other things worse than "nuking their own files".
e.g. they could unknowingly help Skynet survive and grow in strength