Slashdot Mirror
Researchers Take Down a Spam Botnet
The Register is reporting on the takedown of a botnet once responsible for 1/3 of the world's spam. The deed was done by researchers from the security firm FireEye, who detailed the action in a series of blog posts. PC World's coverage estimates that lately the botnet has accounted for 4% of spam. From the Register: "After carefully analyzing the machinations of the massive botnet, alternately known as Mega-D and Ozdok, the FireEye employees last week launched a coordinated blitz on dozens of its command and control channels. ... Almost immediately, the spam stopped, according to M86 Security blog. ... The body blow is good news to ISPs that are forced to choke on the torrent of spam sent out by the pesky botnet. But because many email servers already deployed blacklists that filtered emails sent from IP addresses known to be used by Ozdok, end users may not notice much of a change. ... With [the] head chopped off of Ozdok, more than 264,000 IP addresses were found reporting to sinkholes under FireEye's control..."
now get going on the other 96%
bomb the us up set someone
Now, part two: I don't know how these things work, but, why does it seem so hard to track these things down and find the source?
I hope they'll patch these machines. Otherwise, how long will it be before the bot wrangler just takes his net back?
Better yet, just wipe the hard drives. The users might think harder about security if something other than their net connection gets abused.
1) Counter-attack researchers
2) Analysis and evaluation
3) Rebuild and redeploy
4) Profit
Hopefully those hacked machines get addressed quickly. While the botnet itself is down, there's probably a few ways to grab the zombies and make a new system.
"Common sense will be the death of us all"
Now I don't have to worry about throttled torrent downloads.
Uh right, problem solved there. In other news, once you get an oil change in your car you no longer have to rotate the tires.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
and
Error 001
Security Scan and Virus Detection do not work with your operating system.
I learned about that just in time! I'm calling right away to cancel that tire rotation appointment I had for tomorrow!
What's the Windows OS percentage of that botnet?
You forgot to include your closing sarcasm tag.
Great work! I would of done it but I was at home sick... *Cough*
If it isn't broke, tinker with it till it is!
Another botnet is on the verge of picking up a good number of those systems. Within a very short while we'll see the spam levels right back where they were before. Anti-botnet activities are good when done in the name of anti-botnet activity, but they are weak efforts in the name of stopping spam. The way to stop spam is to fight it as the economic problem that it is; if people continue to go after the symptoms of spam like this they will continue to find themselves quickly thwarted.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I just hope Netcraft does not jinx this by reporting premature death of botnets...
Yea I made that mistake. My car just stopped on the freeway, and when I called the roadside assist service for a jump start, they tried to upsell me a tank of gas.
Damn salespeople.
I hate printers.
At company picnics, employees are encouraged to take part in "Whack-a-mole" competitions during summertime, and ice sculpting during the winter.
If I have seen further it is by stealing the Intellectual Property of giants.
Next thing you know we'll take the same approach to murder, theft, gangs, drugs, etc and soon we'll end up with a utopia... then how will the billionaires get $100 bills to light their $500 cigars???
"All great wisdom is contained in .signature files"
What would you do with your newly acquired SPAMbot network? Would the power go to your head?
Since the bots all deserve to be botted, I might set up a beowulf cluster with them and distributed render Big Buck Bunny for the fun of it. =)
I'll be happy when they start upselling items from their fully stocked mini-bar.
"Common sense will be the death of us all"
Uh right, problem solved there. In other news, once you get an oil change in your car you no longer have to rotate the tires.
Obviously you've never worked with Windows users.
Comment removed based on user account deletion
Since when does 1/3 equal 4%?
Because its actually the government who creates and controls these 'botnets'. They're used to spy on us since they have a computer on each end of each router meaning they can reliably trace data streams in foreign countries to their true original source.
Ok, so that wasn't necessarily accurate. But, I've heard on the low-down that the fellows who were working on Titan Rain are currently trying to map the Chinese governments botnet across the world. Its funny that a growing proportion of our electronics are being sorced from China.
Nothing against the Chinese - great guys and I love mandarin. Just some actions of their leaders seem a bit 'off base' - outside my comfort zone.
"You keep what you kill."
Now... what to do with this enormous botnet?
------ The best brain training is now totally free : )
I think all hijacked botnets should be made to run BOINC distributed computing projects. The users who can't keep their machines secure and contribute a huge volume of spam to the internet should be sentenced to community service. In form of having their machines dedicate most clock cycles to the advancement of esoteric scientific pursuits.
So if this is the future...where's my jet pack?
I'm not against taking down a botnet. But I still think that basic laws are more important. If we don't apply the same rights on really everybody, those "rights" become meaningless.
FireEye isn't exactly a police or government agency. How exactly can they raid zombie computers of private people? I can't think of any way that this is legal. Which does not make them better than what they are "prosecuting" (A term, that when associated with a private company, usually makes a crime itself.)
Is it like Blackwater? A bunch of criminals who like to legally murder and beat up people? Just that here they like to raid computer systems?
If you take down a botnet, do it in a legal way!!
Any sufficiently advanced intelligence is indistinguishable from stupidity.
I for one welcome our new botnet masters.
That is, until botnet operators start using BitTorrent (or a derivative of it) to transmit commands and Comcast gets a new excuse to throttle torrents.
...the cynic in me wonders whether or not the researchers might be risking legal problems by doing this (at least in Illinois, Colorado, Delaware, Michigan, Oregon, Pennsylvania, and Wyoming and possibly Arkansas, Florida, Georgia, Massachusetts, Tennessee, and Texas as well).
MCSE? No, sir...I don't do Windows. Yes, I am an idealist. What's your point?
If we want vigilante justice to become more acceptable in these situations, then it's best to be 'nice' about it.
Ever read Frank Herbert's The White Plague? It's about a scientist on a trip to Ireland who loses his family in an IRA bombing. He goes nuts and engineers a virus to kill every woman on the planet, figuring "if it has to happen to me, then I'm going to share my misery with the world."
Where am I going with this?
We have some pretty epic hackers on the planet. Guys who can disassemble code by looking at it. Guys who don't give one billionth of a crap about legality. Doubt me? Go check your local torrent tracker. There are groups of people out there who break commercial software all the time. They do it for breakfast.
How much harder could hacker-originated code like botnets be?
Eventually you're going to get some hacker who has simply had enough. And he's going to form the internet version of the Lincoln County Regulators, go rogue, figure out every botnet they can get their hands on, and wipe every single PC they can right through the bot's command channel.
It's not IF, it's WHEN.
Remember - you heard it here first. This is going to happen. Some holier-than-thou uberhacker is going to figure "fuck 'em if they can't handle basic security - they're fucking up MY INTERNET" and lay waste to them all, nuke-it-from-orbit style.
I'm honestly surprised it hasn't happened yet.
Weaselmancer
rediculous.
We really need an analysis done and report made to the public security community. This is a unique chance to discover what are the real vulnerabilities to the mass of computing power on which criminals prey.
A federal or state level court needs to authorize the researchers to do such an analysis. Even a single state would be enough, if the zombie IPs can be reliably mapped to that state. I would envision the analysis to include:
- Make a full study of many individual zombie PCs: What antivirus, firewall, OS, applications, etc. are installed, including version numbers and a fingerprint (to identify whether they are super-vulnerable copies from warez sites, infected OEMs, etc.).
- Monitor usage of a small number of PCs to identify what user habits lead to zombification, based on the theory that these PCs will become zombies of another botnet soon probably. What should be monitored, and for how long?
- Contact (with law enforcement assistance) a small number of individual users to interview them. Publish anonymized interviews for representative cases so the public can better learn what constitutes dangerous habits.
- Report anonymized individual representative cases, trends and statistics.
Discuss whether the defanged botnet should be used to destroy other botnets. Too much discussion would alert the other net owners. People could opt in based on a message sent to infected PCs, if the authorities support it, but unless those bots are hardened they might open the owners to retaliatory attacks.
At least, let's find out if antivirus really doesn't work, what habits led to botnet creation, and how can we alert zombie owners so they adopt more secure practices.
Why is some obscure security firm doing the job that governments should have done 10 years ago?
Exactly we hear about "researchers" even broadcasters doing this. But never about regular law enforcement...
Governments don't appear interested it dealing with this. Probably because it isn't the (alleged) profits of the entertainments industry being affected.
What about sender proof-of-work systems?
Mailing lists and legitimate bulk emails would need to be white listed but individual emails could be either rejected or flagged as SPAM if they do not include proof-of-work authentication unless they were individually white listed. That in itself does not stop SPAM but it does slow the generation rate significantly and makes it easier to detect compromised systems since the rouge processes would be consuming significant computing resources if they chose satisfy proof-of-work requirements instead of just making use of the network.
>more than 264,000 IP addresses were found reporting to sinkholes under FireEye's control
It's not enough, those 264k IP adresses, should be sent out to a sort of ISP provider sanctuary where
they need to contact the people who have the infected pcs, and tell them to clean their machines, just
leaving the machines with a ongoing malware pinging back home, might still be able to get owned.
They need to take down those infected that they know is infected, and force those users to update or get fixed.
They are a threat to the internet, and need to be delt with...maybe cutting them off the internet for awhile would make them call in
their ISP and then they could be warned they had been owned, and need to clean their pcs.
Any further attempts on their machines parts to contact that same "hole" would force them again to be locked out...until such time
they fixed their machines, no?
And then somebody approaches the bored hacker and says "You're just doing this for fun... wouldn't you like to make a boatload of money for doing exactly the same thing?"
Isn't that exactly how this got started? People wrote viruses for lulz. Then someone offered them cash.
It's not okay to needlessly approximate an approximation. Numerator/denominator is the best way to represent any fraction, in general. It's short, doesn't use any unusual mathematical symbols, and allows you to calculate the value to as many decimal places as you want.
"When information is power, privacy is freedom" - Jah-Wren Ryel
1) Make a list of all porn sites / web pharmacies / other dubious entities being "promoted" with the spam.
2) Use your new botnet to initiate DDoS against said entities.
3) ???
4) Profit!!! Or just laugh your ass off at the irony.
I prefer rogues to imbeciles because they sometimes take a rest.
And this got an Insightful moderation (5 points)???
Grand-parent said:
Governments don't appear interested it dealing with this.
I don't necessarily have confidence that the government could implement solutions to control spam, but at least different countries could cooperate to fight spam - maybe that's what GP mpe meant.
Instead, we have governments the world over (Europe, US,...) passing laws to limit file sharing, as if this was a more significant problem to society and the economy.
GP said:
Probably because it isn't the (alleged) profits of the entertainments industry being affected.
I share this opinion more and more. It's sad. Governments, who should be protecting us the little guys (we have the votes...but don't always use them), seem more interested in protecting the interests of corporations (which have the economic power).
I mean look at French president Nicolas Sarkozy. He's famous for exchanging favors with his friends CEOs of mega-companies. What has he been doing with his infamous Hadopi three strikes law for instance? Aren't there BIGGER problems to solve for a government than copyright infringement?
Dammit.