Slashdot Mirror
Researchers Hijack Mebroot Botnet, Study Drive-By Downloads
TechReviewAl writes "Researchers at the University of California at Santa Barbara hijacked the Mebroot botnet for about a month and used it to study drive-by downloading. The researchers managed to intercept Mebroot communications by reverse-engineering the algorithm used to select domains to connect to. Mebroot infects legitimate websites and uses them to redirect users to malicious sites that attempt to install malware on a victim's machine. The team, who previously infiltrated the Torpig botnet, found that at least 13.3 percent of systems that were redirected by Mebroot were already infected and 70 percent were vulnerable to about 40 common attacks."
Isn't IE marketshare about 70%? What a coincidence!
Fleur de Sel
Strikes me that this is a "crime" somewhat akin to stealing money from a drug dealer. Sure, I guess you are doing something "illegal" since it's not your money, but it's not like the drug dealer is going to report you to the police...
Announcing this activity publicly doesn't strike me as particularly prudent, even if it is valuable information...
I have no problem with your religion until you decide it's reason to deprive others of the truth.
so universities can break the law but common criminals can't? remind's me of nazi/japanese experiments on humans in the name of 'science'.
Really? Intercepting a botnet reminds you of experiments leading to the deaths and suffering of thousands of helpless adults and children? No I see your point, exactly the same thing.
I am the lawn!
Leave it to people who exploit pcs to get sloppy enough to leave the kitchen door unlocked. Its more like carjacking a carjacker's own personal vehicle. News or no news, its a ray of sunshine that reminds us that this universe still has a balance. And it's got a sense of humor.
so universities can break the law
They broke the law? Citation needed.
Oh wait... you didn't even RTFA.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Maybe they were able to break into it because (dun dun dun) they wrote it!
Isn't that how things work in all those lousy movies with some kind of computer virus in them.
Or that Mac virus can infect alien computers
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
If this can be done, hijacking botnets, it should be... and then the botnet should be neutralized. Didn't anyone think of this?
The Admin and the Engineer
but same idea, doing things in the name of science though they are illegal justifies anything. and yes hijacking a botnet is illegal if you didn't know.
I used to have a rather gruesome book detailing some of those experiments, and while I don't think a lot was gained by transplanting spare heads onto victims &c., I understand that the data from dropping "test subjects" into ice water to see how long it took them to die has been quite valuable for things like Naval Air rescue planning. Always look on the bright side, mate.
The cost of that cleanup, of course, will be borne by taxpayers, not industry.
It's the principle of the thing. Botnet creators are entitled to a reasonable expectation of privacy, under the law, right? Besides, if it were YOUR botnet they were infiltrating, you would be pissed, too.
It is exactly the same thing for those of us with boundary issues, or anyone trying to argue in good faith. I happen to be both. I don't give a damn about human suffering--I do care that "scientists" appear to get a free pass to circumvent the law--which is clearly the point the person was making.
You might want to say we should address the issue and not compare the two--one being supposedly horrible. Fine...all well and good. But at the core, you have just ran an argument by appeal to emotion...that is to say...you have failed to make a correct argument.
It isn't law if one group gets to ignore it and another is punished--it's privilege. The same privilege exerted by the the group that already Godwinned this debate--the claim that they were above the law because they did it for a good reason.
RTFA. Researchers registered domains that were next in line to receive messages from the infected machines, and listened to what was coming in.
Often, these bot nets are designed to install software for commission. The company paying the commission should be held accountable. They can play dumb and claim that they didn't know it was being installed in this manner, sure. But it would be fairly simple to make it so the installed software makes itself known to the user. It would be fairly simple to make it easy to un-install as well.
I know there are ways around it. But, it'd be great to see the companies selling the products that are making revenue to be accountable. They are enabling it. And they know it.
There have been studies on how far people travel daily/weekly/monthly. To do so, the study used thousands of people's locations based on cellphones. The participants of the study were fully unaware that they were being tracked for months. At least this one isn't scary...
did they at least disinfect the systems? kinda seems dumb to infiltrate a botnet and not take it down.
btw, the "unknown variable" ("The second characters of the day's most popular search term on Twitter.") can likely be subverted by working with twitter to return some static string after determining it's part of the botnet via the http request header (i doubt they are emulating a browser).
http://slashdot.org/comments.pl?sid=1393007&cid=29649223&art_pos=1
Yes, they actually did commit a crime. and yes I did RTFA. They reverse engineered the algorithm of the js package. That algorithm was essentially copy protection aka DRM. This is a federal felony under the DMCA.
I'm not sure how many of these "companies" have a solid US presence, but there are plenty of scummy ones like those "antivirus 2009" and the like (which fake an infection to then sell you fake antivirus software to remove it). I believe a lot of these are run by offshore outfits from Russia, etc but I wouldn't be surprised to see a bunch of local companies complicit with them as well.
Somebody nailing them would make me a very happy person, more than when I managed to catch them trying to spoof my own site(s) with URLs for their infectoware products and got a few high-level domain names yanked away from them...
Think of all the illegal copies of windows....now imagine that overnight they were to offer a special deal for those with an illegal copy of windows. Buy a license from us for 6months at 50$
rechargeable every 6months after that...atleast everybody and their grandmother would get the first 6 months, get their updates, be rid of 90% of viruses and problems, getting rid of 3/4 of the botnets out in the wild, and then when it came to the next 6motnhs, Microsoft would have made their money already, the people will probably revert back to being non legal, with no ill effects, except for those talked into keeping their copies legit for further patches. The people that did buy legal copies would not have anything to bitch about, as these were not legit copies and revert back to being bad people...which most owning a legit copy do not want to be branded...
everybody wins.
Oh, you weren't trying to be funny? "legally copyrighted software produced by bot net authors"? How exactly did they copyright anything, and how was it legal?
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
All creative works (software included) are under copyright from the moment they are published under US law (most other western nations as well).
oh... sorry about the multiple replies, I didn't notice that you were the parent author for both posts.
I am pointing out that it is a crime, not that it should be a crime.
so universities can break the law but common criminals can't? remind's me of nazi/japanese experiments on humans in the name of 'science'.
Wow... you put the "Hyper" in hyperbole.
I think you pulled enough G's ( unit: Godwin ) there to create a cognitive singularity.
I've lost all my marbles except one & It's fun to test angular & centripetal acceleration in my skull
> "Researchers...hijacked the Mebroot botnet for about a month and used it to study
> drive-by downloading...The team, who previously infiltrated the Torpig botnet,
now intends to infiltrate Borg-infested systems by following a Borg cube as it travels Borg territory, under the assumption they'll be ignored indefinitely as a non-threat.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
+5 Insightful really? To legally intercept and record conversations of suspected criminals in the USA you need a judge to issue a fucking warrant. I am not a lawyer but I don't think I need to be to make that statement. (Oh and please don't try and quote Patriot Act shit on this, it will just make me laugh)
No, you DON'T need a warrant to record private conversations of suspected criminals (or anybody), unless you are a government official acting in a capacity of law enforcement.
Private citizens can record whatever the hell they want, unless there are specific laws against it. Some states require every party to consent to recording conversations. Many do not.
After all, I am strangely colored.
It is exactly the same thing for those of us with boundary issues, or anyone trying to argue in good faith. I happen to be both. I don't give a damn about human suffering--I do care that "scientists" appear to get a free pass to circumvent the law--which is clearly the point the person was making.
You might want to say we should address the issue and not compare the two--one being supposedly horrible. Fine...all well and good. But at the core, you have just ran an argument by appeal to emotion...that is to say...you have failed to make a correct argument.
It isn't law if one group gets to ignore it and another is punished--it's privilege. The same privilege exerted by the the group that already Godwinned this debate--the claim that they were above the law because they did it for a good reason.
First of all I was replying to the comment by GP, and there was no argument in this post by this AC. Secondly while the AC was trying to bind the events together I was showing how to separate them, using the exact same type of rhetoric as him. You try to sound sophisticated, yet you fail epically. And no -- a complete lack of empathy isn't a "point of view", it's called sociopathy.
I am the lawn!
They have some serious cojones to be messing with dangerous organised criminals. Good on 'em and I hope they keep fighting the good fight -- and not come unstuck. They are stepping on the toes of some seriously ugly, violent people.
My father is a doctor, and I raised this point with him. He indicated that while there were some very broad things that could be drawn from these 'studies', most of them were flawed in major ways that precluded their ongoing usefulness. In particular, he mentioned some of the Nazi studies that may have started, on the surface, to have a legitimate scientific goal, but they were quickly revealed as a means to explore the depravity of the researcher.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
I guess I equivocated too much. The cold water survival times were useful data, which has found purpose, but indeed the other stuff was incredible mad-scientist stuff that clearly illustrated deep derangement on the part of the psychos doing the work. I wish I still had that book, it was truly INcredible, and I'd like to show it to some of the stupid Nazi-symps in my ghetto hometown.
The cost of that cleanup, of course, will be borne by taxpayers, not industry.
so universities can break the law but common criminals can't? remind's me of nazi/japanese experiments on humans in the name of 'science'.
Really? Intercepting a botnet reminds you of experiments leading to the deaths and suffering of thousands of helpless adults and children? No I see your point, exactly the same thing.
Dude... Why even bother to reply? This is a classic case of reductio ad Nazium, he managed to Godwin the entire discussion with the first post.
Richard Kemmerer, one of the authors, gave a Tech Talk at Google titled "How to Steal a Botnet and What Can Happen When You Do." The video of the talk is available on YouTube.
In the vast majority of states they cannot, at least one party to the conversation has to consent. In some states, all parties must consent.
In those states they can... as long as they don't violate federal (or state) wiretap laws in the process.
It generally means they can record conversations they have in a public place, but they can't hook up recording gear to the phone box outside people's houses.
And they may be able to record conversations in a private place, using a very sensitive microphone, provided they avoid violating breaking + entering and trespass laws, they should be OK, although may be subject to civil prosecution.
On the other hand... if the journalist doesn't mind becoming a criminal themselves, they could choose to break any or all these laws.. once they publish the recording, it cannot easily be suppressed.
Oh hot damn... Godwinn'ed...
I didn't even think it was possible to relate this subject to Nazis.. Mad props to you.
But these botnet studies (at least the well done ones) are in no way similar. Most security researchers actually are very careful with their methodology, and perform their studies in a way that assures they won't cause any harm (except maybe to the botnet operator by revealing their methods, in some cases).
It's not a crime. It's a specious theory that the code the botnet authors utilize might somehow be viewed by the court as a technical measure that effectively controls access to or ability to copy a work, and that the researchers did circumvent those controls under 1201(a)(1)(A) of the DMCA.
The belief that the malware can be considered a "publication" is in doubt. The software is non-creative, non-beneficial.
But you have forgotten (j) Security Testing. - (2) Permissible acts of security testing. - Notwithstanding the provisions of subsection (a)(1)(A), it is not a violation of that subsection for a person to engage in an act of security testing, if such act does not constitute infringement under this title or a violation of applicable law other than this section, including section 1030 of title 18 and those provisions of title 18 amended by the Computer Fraud and Abuse Act of 1986.
And also, S1204(b) (b) Limitation for Nonprofit Library, Archives, Educational Institution, or Public Broadcasting Entity.â" Subsection (a) shall not apply to a nonprofit library, archives, educational institution, or public broadcasting entity (as defined under section 118 (g).[1]
Also, failure to register as required by S 407(a), has an effect: 1208 S 408(f)(4)... If you don't register the work within 3 months of publication, you lose the right to most infringement actions, except a 106A(a) infringement (infringement of author's right to attribution and integrity).
So by failing to register, the author loses a lot of rights.
AC does have a bit of a point in his troll. There is a certain criminal element to the "researcher's" tactics. Is it ethical to break the law to study lawbreaking?
Other than this text, there is no discernible information contained in this sig.
Comment removed based on user account deletion
All credit goes to the GP for mentioning Imperial Japan, a Godwinning on the sly.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
So, The researchers were able to preregister the domains that the botnet was going to use to download software. Wouldn't it be possible to upload a patch to the website (obviously formatted such that it would be downloaded and executed by the infected machines)? I think that'd be pretty damn funny and efficient. Every infected machine patching itself at once and eliminating the virus. Some of the machines wouldn't be online at the time, but any machine not online also isn't a risk.
-1 disagree is not a modifier for a reason. -1 troll, flaimbait, redundant, overrated are NOT acceptable substitutes.
There have been studies on how far people travel daily/weekly/monthly. To do so, the study used thousands of people's locations based on cellphones. The participants of the study were fully unaware that they were being tracked for months. At least this one isn't scary...
I don't trust college kids, most of them today are fanbois. I don't trust the government, most of them are totalitarians, egalitarians, corporatists or socialists. That said, I trust the government officials 1000 times more than I trust some college prick.
Where is the oversight? Where is the transparency? Which judge signed the wire tap warrant that gave these motherfuckers the legal right to spy on people? The fact is, no judge in their right mind could ever sign a broad sweeping warrant against multiple John Does, it's just not possible. Making this "study" a complete fraud, a crime, unethical, and a violation of the Constitutional rights of everyone they spied on.
Please mod me flamebait again I really need to lower my Karma.
"Be prepared, son. That's my motto. Be prepared." --Joe Hallenbeck
+5 Insightful really? To legally intercept and record conversations of suspected criminals in the USA you need a judge to issue a fucking warrant. I am not a lawyer but I don't think I need to be to make that statement. (Oh and please don't try and quote Patriot Act shit on this, it will just make me laugh)
No, you DON'T need a warrant to record private conversations of suspected criminals (or anybody), unless you are a government official acting in a capacity of law enforcement.
Private citizens can record whatever the hell they want, unless there are specific laws against it. Some states require every party to consent to recording conversations. Many do not.
Yes you DO need a warrant to perform a wiretap. Period. A phone call, email, IM, etc, are all protected speech. I can happily arrange an experiment, one in which you illegally perform a wiretap on me, and one in which I alert the authorities of your behavior. Would you like to participate?
"Be prepared, son. That's my motto. Be prepared." --Joe Hallenbeck
On the other hand... if the journalist doesn't mind becoming a criminal themselves, they could choose to break any or all these laws.. once they publish the recording, it cannot easily be suppressed.
Amen. Relating to the story, apparently if you are a college student you can participate in these criminal activities and the fanbois will support you.
"Be prepared, son. That's my motto. Be prepared." --Joe Hallenbeck
Sure, and then I'll laugh at you for your silly antics and your ignorance of the actual laws governing recording of private conversations in my state. If I'm a party to the conversation, I can record it (this is, in fact, true of most states).
RTFA; they didn't break the law at all. They reverse-engineered an injection script, registered some attack domains before the botnet owners were able to do so, and then profiled the machines which were sent to their honeypot server by the injection script. (The script was a javascript which was somehow injected into innocuous sites by the hackers; its purpose was to redirect visitors to the actual malicious URL, which was auto-generated and different each day – but predictable, so that the botnet owners, or the researchers, could register it ahead of time and set up a server there.)
The only questionable thing they did was to reverse-engineer the script, but since it was Javascript they already had the source code; there really wasn't any reverse-engineering (in the true sense of the term) involved. Besides which, that's already allowing DMCA protection for malicious code and somehow I don't think that would hold up in court...
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Another thing... Javascript = source code. Obviously, if you publish your source code, people can examine it and see how it works. You really can't call what the researchers did "reverse engineering". (Nor can you call the Javascript source code "copy protection" or DRM.)
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
I wish these researchers would stop being pussies and destroy some of these botnets.
Fuck the legal issues, who the hell is going to sue you for destroying a botnet?
Well, you're inviting me to record your conversation. So I'm pretty sure I will be okay. I'm game.
After all, I am strangely colored.
Well, you're inviting me to record your conversation. So I'm pretty sure I will be okay. I'm game.
Ahh, so asking you to break the law is justification for breaking the law? I see how your mind works now...
"Be prepared, son. That's my motto. Be prepared." --Joe Hallenbeck
You already consented to being recorded. How would I be breaking the law by recording a conversation between us?
After all, I am strangely colored.
You already consented to being recorded. How would I be breaking the law by recording a conversation between us?
I can't consent to illegal activities. Your circularly flawed logic does not compute.
I can happily arrange an experiment, one in which you illegally perform a wiretap on me
You are free to break the law. You are also bound by it, and may be required to suffer the consequences of doing so.
"Be prepared, son. That's my motto. Be prepared." --Joe Hallenbeck
I can happily arrange an experiment, one in which you illegally perform a wiretap on me, and one in which I alert the authorities of your behavior. Would you like to participate?
Now that's some seriously skewed logic... by you arranging the "wiretap" in question, you're directly consenting to the recording. Now, let's look at what you just said:
I can't consent to illegal activities. Your circularly flawed logic does not compute.
Once again, you're not consenting to illegal activity in a case where you're the one offering to arrange the event, given the fact that it would then be perfectly legal. If you're going to accuse someone of lacking basic logic skills, you should probably make sure you're not the one in need of an education.
What is your level of formal education, anyhow?
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
Let's go back to what you said before.
I can happily arrange an experiment, one in which you illegally perform a wiretap on me, and one in which I alert the authorities of your behavior. Would you like to participate?
Now that's some seriously skewed logic... by you arranging the "wiretap" in question, you're directly consenting to the recording. Now, let's look at what you just said:
I can't consent to illegal activities. Your circularly flawed logic does not compute.
Yes let's run around in more circles and go back to what I said.
I can happily arrange an experiment, one in which you illegally perform a wiretap on me, and one in which I alert the authorities of your behavior. Would you like to participate?
As a citizen I cannot give you permission to violate the law. That means that inviting you to participate in an experiment where you commit an illegal activity in no way gives my consent for you to commit said illegal activity. For you to be correct, I would have had to have worded it not only specifically without the qualifier "illegally," but also without the word "experiment." So, it would have looked more like the following sentence:
I can happily arrange for you to perform a wiretap on me, would you like to?
That would be an invitation and consent to do a wiretap, not an invitation and consent to break the law.
Once again, you're not consenting to illegal activity in a case where you're the one offering to arrange the event, given the fact that it would then be perfectly legal.
Once again, you are trying to use your circularly flawed logic, but as I said before it does not compute.
If you're going to accuse someone of lacking basic logic skills, you should probably make sure you're not the one in need of an education. What is your level of formal education, anyhow?
3 years of technical college for computer programming (Fortran/Pascal/C/C++), 2 years of community college for mathematics (calculus), English, and Japanese, and 1 year of university for Japanese.
I very easily see your circular logic. I can, in fact, write your argument compared to mine in pseudo code to prove that yours is basically a silly infinite loop.
"Be prepared, son. That's my motto. Be prepared." --Joe Hallenbeck