Slashdot Mirror
Researchers Take Down a Spam Botnet
The Register is reporting on the takedown of a botnet once responsible for 1/3 of the world's spam. The deed was done by researchers from the security firm FireEye, who detailed the action in a series of blog posts. PC World's coverage estimates that lately the botnet has accounted for 4% of spam. From the Register: "After carefully analyzing the machinations of the massive botnet, alternately known as Mega-D and Ozdok, the FireEye employees last week launched a coordinated blitz on dozens of its command and control channels. ... Almost immediately, the spam stopped, according to M86 Security blog. ... The body blow is good news to ISPs that are forced to choke on the torrent of spam sent out by the pesky botnet. But because many email servers already deployed blacklists that filtered emails sent from IP addresses known to be used by Ozdok, end users may not notice much of a change. ... With [the] head chopped off of Ozdok, more than 264,000 IP addresses were found reporting to sinkholes under FireEye's control..."
Now I don't have to worry about throttled torrent downloads.
Uh right, problem solved there. In other news, once you get an oil change in your car you no longer have to rotate the tires.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
and
Error 001
Security Scan and Virus Detection do not work with your operating system.
Well... first you have to find their command and control channels. Then you have to figure out how they work. Many times the command and control is both distributed and encrypted so it is very hard to "chop the head off"
It'd be a great project, though you do want to be careful, some of these viri are designed to do harm if disabled improperly, and some of these computers could be in situations where their failure could cause the loss of lives.
Again, not saying don't do it...saying do it carefully.
93rd rule of Slashdot: No matter how obvious my sarcasm is, my comment will be taken seriously by someone.
Another botnet is on the verge of picking up a good number of those systems. Within a very short while we'll see the spam levels right back where they were before. Anti-botnet activities are good when done in the name of anti-botnet activity, but they are weak efforts in the name of stopping spam. The way to stop spam is to fight it as the economic problem that it is; if people continue to go after the symptoms of spam like this they will continue to find themselves quickly thwarted.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
At company picnics, employees are encouraged to take part in "Whack-a-mole" competitions during summertime, and ice sculpting during the winter.
If I have seen further it is by stealing the Intellectual Property of giants.
Not to mention a lot of people would be seriously PISSED and you'd be in deep legal shit for messing with other people's computers.. I'm sure these guys could still face possible trouble even for just admitting they've brought down the head of the botnets, but IMO they're pretty justified to do that. Wiping people's machines, while tempting, is just a no-no. If we want vigilante justice to become more acceptable in these situations, then it's best to be 'nice' about it.
which is totally what she said
What would you do with your newly acquired SPAMbot network? Would the power go to your head?
Since the bots all deserve to be botted, I might set up a beowulf cluster with them and distributed render Big Buck Bunny for the fun of it. =)
Eh, depends what you're looking at. Other Botnets have been taken down, usually by physically arresting the hacker who started it. I'm sure that they've tried to stop other Spam Botnets before. They didn't actually STOP Ozdok, they just dented it a bit.
It's difficult to track how these things start because essentially you've got about a million breadcrumbs to go through.
Lets say you've got 3 computers, A, B, and C. A infects B, B infects C. There is no direct correlation between A and C, so you have to work your way all the way up the chain. Now imagine you've got a million infected PC's. Who infected who? How do you work your way backwards? There's lots of ways to do this, most simple of which is to look at the contacts and determine which of the contacts is infected. Then determine the time and date of which the infection occured (Date Modified/Date Created on the file). Whoever was first was who infected the others.
The problem with killing it is that it has a "multi layered fallback mechanism" - which is a fancy way of saying it replicates itself. It can do this by either having a secondary program or script copy itself back onto the infected PC when it detects the original infection is gone, or it can do this by RE-infecting any of the computers it was sent to infect in the first place.
I hope thats enough to make you stagger and wonder exactly how much damage they could have possibly done to this botnet.
You obviously don't work for an ISP, we have to drop SMTP-connections on everything which looks to much like a bot just because of the large number of connection that we get, so we're able to have the legit connections and because scanning all the content would just be to much to handle.
You would be amazed at the volumes of e-mail ISP's get. More then 98% of it is crap you don't want to receive.
New things are always on the horizon
Comment removed based on user account deletion
you are suggesting that someone hooked up a life critical system to the public internet? That in itself should be a felony.
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
Because its actually the government who creates and controls these 'botnets'. They're used to spy on us since they have a computer on each end of each router meaning they can reliably trace data streams in foreign countries to their true original source.
Ok, so that wasn't necessarily accurate. But, I've heard on the low-down that the fellows who were working on Titan Rain are currently trying to map the Chinese governments botnet across the world. Its funny that a growing proportion of our electronics are being sorced from China.
Nothing against the Chinese - great guys and I love mandarin. Just some actions of their leaders seem a bit 'off base' - outside my comfort zone.
"You keep what you kill."
Now... what to do with this enormous botnet?
------ The best brain training is now totally free : )
http://www.symantec.com/security_response/writeup.jsp?docid=2008-021215-0628-99
100%, minus controllers, that might run on any OS
once responsible for an estimated third of the world's spam
lately the botnet has accounted for 4% of spam
Right...because the botnet was measured to be producing precisely 1/3 of the world's spam. I suspect that the original estimate was sufficiently inaccurate that more than one significant figure would not really be justified, let alone an exact value.
So if this is the future...where's my jet pack?
See, Bill Gates wants a monopoly everywhere! Anti-trust! Anti-trust, help help I'm being repressed.
Flexible bare-metal recovery for Linux/UNIX
...the cynic in me wonders whether or not the researchers might be risking legal problems by doing this (at least in Illinois, Colorado, Delaware, Michigan, Oregon, Pennsylvania, and Wyoming and possibly Arkansas, Florida, Georgia, Massachusetts, Tennessee, and Texas as well).
MCSE? No, sir...I don't do Windows. Yes, I am an idealist. What's your point?
From reading all the FireEye blog posts on the operation, I can't find any point where they broke the law or even behaved in a way that violated anybody's rights.
What they did was to coordinate things so that ISPs and domain registrars followed existing procedures to shut down sites and revoke domain names. They also found some domain names that were programmed to be used as fallbacks but had not yet been registered, then registered those.
It looks like at no time did they actually hack anybody or penetrate computers, either innocent bystanders or guilty people, nor did they use the botnet themselves, so there's no legal or ethical problem here -- assuming their reports are complete and correct, obviously.
Zombies aren't people.
If we want vigilante justice to become more acceptable in these situations, then it's best to be 'nice' about it.
Ever read Frank Herbert's The White Plague? It's about a scientist on a trip to Ireland who loses his family in an IRA bombing. He goes nuts and engineers a virus to kill every woman on the planet, figuring "if it has to happen to me, then I'm going to share my misery with the world."
Where am I going with this?
We have some pretty epic hackers on the planet. Guys who can disassemble code by looking at it. Guys who don't give one billionth of a crap about legality. Doubt me? Go check your local torrent tracker. There are groups of people out there who break commercial software all the time. They do it for breakfast.
How much harder could hacker-originated code like botnets be?
Eventually you're going to get some hacker who has simply had enough. And he's going to form the internet version of the Lincoln County Regulators, go rogue, figure out every botnet they can get their hands on, and wipe every single PC they can right through the bot's command channel.
It's not IF, it's WHEN.
Remember - you heard it here first. This is going to happen. Some holier-than-thou uberhacker is going to figure "fuck 'em if they can't handle basic security - they're fucking up MY INTERNET" and lay waste to them all, nuke-it-from-orbit style.
I'm honestly surprised it hasn't happened yet.
Weaselmancer
rediculous.
We really need an analysis done and report made to the public security community. This is a unique chance to discover what are the real vulnerabilities to the mass of computing power on which criminals prey.
A federal or state level court needs to authorize the researchers to do such an analysis. Even a single state would be enough, if the zombie IPs can be reliably mapped to that state. I would envision the analysis to include:
- Make a full study of many individual zombie PCs: What antivirus, firewall, OS, applications, etc. are installed, including version numbers and a fingerprint (to identify whether they are super-vulnerable copies from warez sites, infected OEMs, etc.).
- Monitor usage of a small number of PCs to identify what user habits lead to zombification, based on the theory that these PCs will become zombies of another botnet soon probably. What should be monitored, and for how long?
- Contact (with law enforcement assistance) a small number of individual users to interview them. Publish anonymized interviews for representative cases so the public can better learn what constitutes dangerous habits.
- Report anonymized individual representative cases, trends and statistics.
Discuss whether the defanged botnet should be used to destroy other botnets. Too much discussion would alert the other net owners. People could opt in based on a message sent to infected PCs, if the authorities support it, but unless those bots are hardened they might open the owners to retaliatory attacks.
At least, let's find out if antivirus really doesn't work, what habits led to botnet creation, and how can we alert zombie owners so they adopt more secure practices.
How much of it actually passes an integrity/authorization check like dkim or spf?
Maybe if those were made more widespread we could do a good bit better job tracing and jailing these bastards... ...or blacklisting accomplice ISPs that don't give a rat's arse about the spam they are sending.
Forgery allows spammers to operate anonymously.
Why is some obscure security firm doing the job that governments should have done 10 years ago?
Exactly we hear about "researchers" even broadcasters doing this. But never about regular law enforcement...
Governments don't appear interested it dealing with this. Probably because it isn't the (alleged) profits of the entertainments industry being affected.
>more than 264,000 IP addresses were found reporting to sinkholes under FireEye's control
It's not enough, those 264k IP adresses, should be sent out to a sort of ISP provider sanctuary where
they need to contact the people who have the infected pcs, and tell them to clean their machines, just
leaving the machines with a ongoing malware pinging back home, might still be able to get owned.
They need to take down those infected that they know is infected, and force those users to update or get fixed.
They are a threat to the internet, and need to be delt with...maybe cutting them off the internet for awhile would make them call in
their ISP and then they could be warned they had been owned, and need to clean their pcs.
Any further attempts on their machines parts to contact that same "hole" would force them again to be locked out...until such time
they fixed their machines, no?