Slashdot Mirror
Researchers Take Down a Spam Botnet
The Register is reporting on the takedown of a botnet once responsible for 1/3 of the world's spam. The deed was done by researchers from the security firm FireEye, who detailed the action in a series of blog posts. PC World's coverage estimates that lately the botnet has accounted for 4% of spam. From the Register: "After carefully analyzing the machinations of the massive botnet, alternately known as Mega-D and Ozdok, the FireEye employees last week launched a coordinated blitz on dozens of its command and control channels. ... Almost immediately, the spam stopped, according to M86 Security blog. ... The body blow is good news to ISPs that are forced to choke on the torrent of spam sent out by the pesky botnet. But because many email servers already deployed blacklists that filtered emails sent from IP addresses known to be used by Ozdok, end users may not notice much of a change. ... With [the] head chopped off of Ozdok, more than 264,000 IP addresses were found reporting to sinkholes under FireEye's control..."
now get going on the other 96%
bomb the us up set someone
Now, part two: I don't know how these things work, but, why does it seem so hard to track these things down and find the source?
I hope they'll patch these machines. Otherwise, how long will it be before the bot wrangler just takes his net back?
Better yet, just wipe the hard drives. The users might think harder about security if something other than their net connection gets abused.
Now I don't have to worry about throttled torrent downloads.
Had to be said
These researchers are true heroes saving the internet from impending doom.
1) Counter-attack researchers
2) Analysis and evaluation
3) Rebuild and redeploy
4) Profit
Hopefully those hacked machines get addressed quickly. While the botnet itself is down, there's probably a few ways to grab the zombies and make a new system.
"Common sense will be the death of us all"
and
Error 001
Security Scan and Virus Detection do not work with your operating system.
What's the Windows OS percentage of that botnet?
Great work! I would of done it but I was at home sick... *Cough*
If it isn't broke, tinker with it till it is!
Another botnet is on the verge of picking up a good number of those systems. Within a very short while we'll see the spam levels right back where they were before. Anti-botnet activities are good when done in the name of anti-botnet activity, but they are weak efforts in the name of stopping spam. The way to stop spam is to fight it as the economic problem that it is; if people continue to go after the symptoms of spam like this they will continue to find themselves quickly thwarted.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I just hope Netcraft does not jinx this by reporting premature death of botnets...
At company picnics, employees are encouraged to take part in "Whack-a-mole" competitions during summertime, and ice sculpting during the winter.
If I have seen further it is by stealing the Intellectual Property of giants.
Next thing you know we'll take the same approach to murder, theft, gangs, drugs, etc and soon we'll end up with a utopia... then how will the billionaires get $100 bills to light their $500 cigars???
"All great wisdom is contained in .signature files"
Comment removed based on user account deletion
Since when does 1/3 equal 4%?
Because its actually the government who creates and controls these 'botnets'. They're used to spy on us since they have a computer on each end of each router meaning they can reliably trace data streams in foreign countries to their true original source.
Ok, so that wasn't necessarily accurate. But, I've heard on the low-down that the fellows who were working on Titan Rain are currently trying to map the Chinese governments botnet across the world. Its funny that a growing proportion of our electronics are being sorced from China.
Nothing against the Chinese - great guys and I love mandarin. Just some actions of their leaders seem a bit 'off base' - outside my comfort zone.
"You keep what you kill."
Now... what to do with this enormous botnet?
------ The best brain training is now totally free : )
My wife just called from home. Apparently my server just melted.
First they came for the spammers, and I did not speak out—because I was not a spammer;
Then they came for the crackers, and I did not speak out—because I was not a cracker;
Then they came for the hackers, and I did not speak out—because I was not a hacker;
Then they came for the pirates, and I did not speak out—because I was not a pirate;
Then they came for me—and there was no one left to speak out for me.
I'm not against taking down a botnet. But I still think that basic laws are more important. If we don't apply the same rights on really everybody, those "rights" become meaningless.
FireEye isn't exactly a police or government agency. How exactly can they raid zombie computers of private people? I can't think of any way that this is legal. Which does not make them better than what they are "prosecuting" (A term, that when associated with a private company, usually makes a crime itself.)
Is it like Blackwater? A bunch of criminals who like to legally murder and beat up people? Just that here they like to raid computer systems?
If you take down a botnet, do it in a legal way!!
Any sufficiently advanced intelligence is indistinguishable from stupidity.
I for one welcome our new botnet masters.
...the cynic in me wonders whether or not the researchers might be risking legal problems by doing this (at least in Illinois, Colorado, Delaware, Michigan, Oregon, Pennsylvania, and Wyoming and possibly Arkansas, Florida, Georgia, Massachusetts, Tennessee, and Texas as well).
MCSE? No, sir...I don't do Windows. Yes, I am an idealist. What's your point?
If we want vigilante justice to become more acceptable in these situations, then it's best to be 'nice' about it.
Ever read Frank Herbert's The White Plague? It's about a scientist on a trip to Ireland who loses his family in an IRA bombing. He goes nuts and engineers a virus to kill every woman on the planet, figuring "if it has to happen to me, then I'm going to share my misery with the world."
Where am I going with this?
We have some pretty epic hackers on the planet. Guys who can disassemble code by looking at it. Guys who don't give one billionth of a crap about legality. Doubt me? Go check your local torrent tracker. There are groups of people out there who break commercial software all the time. They do it for breakfast.
How much harder could hacker-originated code like botnets be?
Eventually you're going to get some hacker who has simply had enough. And he's going to form the internet version of the Lincoln County Regulators, go rogue, figure out every botnet they can get their hands on, and wipe every single PC they can right through the bot's command channel.
It's not IF, it's WHEN.
Remember - you heard it here first. This is going to happen. Some holier-than-thou uberhacker is going to figure "fuck 'em if they can't handle basic security - they're fucking up MY INTERNET" and lay waste to them all, nuke-it-from-orbit style.
I'm honestly surprised it hasn't happened yet.
Weaselmancer
rediculous.
We really need an analysis done and report made to the public security community. This is a unique chance to discover what are the real vulnerabilities to the mass of computing power on which criminals prey.
A federal or state level court needs to authorize the researchers to do such an analysis. Even a single state would be enough, if the zombie IPs can be reliably mapped to that state. I would envision the analysis to include:
- Make a full study of many individual zombie PCs: What antivirus, firewall, OS, applications, etc. are installed, including version numbers and a fingerprint (to identify whether they are super-vulnerable copies from warez sites, infected OEMs, etc.).
- Monitor usage of a small number of PCs to identify what user habits lead to zombification, based on the theory that these PCs will become zombies of another botnet soon probably. What should be monitored, and for how long?
- Contact (with law enforcement assistance) a small number of individual users to interview them. Publish anonymized interviews for representative cases so the public can better learn what constitutes dangerous habits.
- Report anonymized individual representative cases, trends and statistics.
Discuss whether the defanged botnet should be used to destroy other botnets. Too much discussion would alert the other net owners. People could opt in based on a message sent to infected PCs, if the authorities support it, but unless those bots are hardened they might open the owners to retaliatory attacks.
At least, let's find out if antivirus really doesn't work, what habits led to botnet creation, and how can we alert zombie owners so they adopt more secure practices.
I know not all of you here like SPAM very much, but it has been a classic for many, many years. Now that 4% of SPAM has cut production, there are going to be many unhappy faces and SPAM inflation. Think of the families struggling to get by!
Why is some obscure security firm doing the job that governments should have done 10 years ago?
Exactly we hear about "researchers" even broadcasters doing this. But never about regular law enforcement...
Governments don't appear interested it dealing with this. Probably because it isn't the (alleged) profits of the entertainments industry being affected.
I submitted this story on the 6th and it was deleted.
Now someone else posts it, and now it's up on the front page.
I'm never submitting a story again.
What about sender proof-of-work systems?
Mailing lists and legitimate bulk emails would need to be white listed but individual emails could be either rejected or flagged as SPAM if they do not include proof-of-work authentication unless they were individually white listed. That in itself does not stop SPAM but it does slow the generation rate significantly and makes it easier to detect compromised systems since the rouge processes would be consuming significant computing resources if they chose satisfy proof-of-work requirements instead of just making use of the network.
>more than 264,000 IP addresses were found reporting to sinkholes under FireEye's control
It's not enough, those 264k IP adresses, should be sent out to a sort of ISP provider sanctuary where
they need to contact the people who have the infected pcs, and tell them to clean their machines, just
leaving the machines with a ongoing malware pinging back home, might still be able to get owned.
They need to take down those infected that they know is infected, and force those users to update or get fixed.
They are a threat to the internet, and need to be delt with...maybe cutting them off the internet for awhile would make them call in
their ISP and then they could be warned they had been owned, and need to clean their pcs.
Any further attempts on their machines parts to contact that same "hole" would force them again to be locked out...until such time
they fixed their machines, no?
And then somebody approaches the bored hacker and says "You're just doing this for fun... wouldn't you like to make a boatload of money for doing exactly the same thing?"
Isn't that exactly how this got started? People wrote viruses for lulz. Then someone offered them cash.
Amazing that this got through moderation...
Hmmmm... lesee... "let" the government take responsibility for "protecting" the National Information Infrastructure..... Hmmm lesee what happens when the government takes "responsibility" for anything like this.
we have gotten:
1) FBI's Carnivore (everything is secure, except to the FBI)
2) FBI's $25k fine to all telecom providers which will not provide individual phone line tapping capabilities to all new switched PBX, and other telecom equip.
3) NSA's Echelon (extra US cell phone tapping)
4) Cracked PGP (hounding Phill Zimmerman for over a decade), cracked DES, RSA, etc.
5) Known crackable AES as a "standard encryption" enforced by the government
6) Open FBI presentations at DEFCON exposing WEP cracking in seconds
7) Warrentless wiretapping which is exposed to have been occuring for over a decade
8) AT&T and other telecoms admit having provided open trunks to NSA for monitoring
9) Government involvement in ISO, etal. stds orgs fighting adoption of standards for trunk encryption and authentication (including CIX)
10) Goverment backs away from control/influence of ICANN and Network Solutions (etal) only to be besieged and then backtrack when it is found that without US govt involvement/leadership the entire net becomes something far beyond Wild Wild West.
Hey I'm only summarizing the huge stupidity of expecting a government run by vote fradusters to treat the net for the strategic resource that it is.
And this got an Insightful moderation (5 points)???
If any resource deserves/needs a benevolent dictatorship (or group [oligarchy]), it is the net, and certainly not the US government unchecked. The problem will always be that congress critters are (and I propose will always be) more motivated by re-election than by any desire or willingness to understand something with a life and value far beyond anything they can really do much more with than influence. They (congress) have an inherent need/desire to control everything they touch, and that is the inherent failure. Something so signficant should be controlled in their view. The idea that something like the net can be so influenced by non-ownable things/entities (like ICANN, NSI, etal) escapes them completely, and so... they retrench to "policies" and "funding" for policy enforcement. This ultimately means they are caught with limp efforts at best for dealing with creative anarchist crap like spam.
The best solutions to this have very little to do with government (except some notional secret squirrel sort of stuff dealing with direct counterthreat stuff), and much more to do with enlightened quasi-governmental influence. The government is most distinctly NOT equipped to deal with "protecting" the NET (less so than even healthcare).
It's not okay to needlessly approximate an approximation. Numerator/denominator is the best way to represent any fraction, in general. It's short, doesn't use any unusual mathematical symbols, and allows you to calculate the value to as many decimal places as you want.
"When information is power, privacy is freedom" - Jah-Wren Ryel
1) Make a list of all porn sites / web pharmacies / other dubious entities being "promoted" with the spam.
2) Use your new botnet to initiate DDoS against said entities.
3) ???
4) Profit!!! Or just laugh your ass off at the irony.
I prefer rogues to imbeciles because they sometimes take a rest.
And this got an Insightful moderation (5 points)???
Grand-parent said:
Governments don't appear interested it dealing with this.
I don't necessarily have confidence that the government could implement solutions to control spam, but at least different countries could cooperate to fight spam - maybe that's what GP mpe meant.
Instead, we have governments the world over (Europe, US,...) passing laws to limit file sharing, as if this was a more significant problem to society and the economy.
GP said:
Probably because it isn't the (alleged) profits of the entertainments industry being affected.
I share this opinion more and more. It's sad. Governments, who should be protecting us the little guys (we have the votes...but don't always use them), seem more interested in protecting the interests of corporations (which have the economic power).
I mean look at French president Nicolas Sarkozy. He's famous for exchanging favors with his friends CEOs of mega-companies. What has he been doing with his infamous Hadopi three strikes law for instance? Aren't there BIGGER problems to solve for a government than copyright infringement?
Dammit.