Man Challenges 250,000 Strong Botnet and Succeeds

nandemoari writes "When security officials decide to 'go after' computer malware, most conduct their actions from a defensive standpoint. For most of us, finding a way to rid a computer of the malware suffices — but for one computer researcher, however, the change from a defensive to an offensive mentality is what ended the two year chase of a sinister botnet once and for all. For two years, Atif Mushtaq had been keeping the notorious Mega-D bot malware from infecting computer networks. As of this past November, he suddenly switched from defense to offense. Mega-D had forced more than 250,000 PCs to do its bidding via botnet control."

Comments

PR "Stuff" from Fireeye

[winkydink]

For some value of "Stuff".

Yeah. He succeeded in eradicating the mega-D botnet. For about 2 weeks anyway.

From MessageLabs Intelligence: 2009 Annual Security Report "Almost eradicated on 4 November 2009 as the result of community action to disrupt the botnet, spam from Mega-D fell to approximately 1% of all spam. Mega-D returned on 13 November using a different collection of bots, sending between 4-5% of spam."

Re:PR "Stuff" from Fireeye

[Anonymusing]

Also, FTA: "Mushtaq and two FireEye colleagues..." -- not just one guy.

Re:PR "Stuff" from Fireeye

[nomadic]

Mega-D returned on 13 November using a different collection of bots, sending between 4-5% of spam

In other words he cut the amount of spam he sent in half? That's not too shabby.

Re:PR "Stuff" from Fireeye

[Red Flayer]

Almost eradicated on 4 November 2009 as the result of community action to disrupt the botnet, spam from Mega-D fell to approximately 1% of all spam. Mega-D returned on 13 November using a different collection of bots, sending between 4-5% of spam."

So now there can be coordinated effort against the new botnet, he'll come back with new bots, community response to kill that one off...

Fighting spammers is like fighting against a guerilla army. Constant vigilance, swift response times, and, eventually, wholesale destruction of the people supporting the guerillas will be necessary to win the war. Impact of spammers can be reduced by constant counter-attacks, but the only way to eliminate spam networks hosted on compromised machines is to remove compromised machines from the network (and as many compromisable machines as possible).

The cost of this may be too high to be worth it... but if you take away someone's internet access for a while when they get hosed, then maybe they'll stop getting hosed.

Re:PR "Stuff" from Fireeye

[LandDolphin]

So, Mega-D is going to be his Vietnam (Or Iraq)?

Re:PR "Stuff" from Fireeye

[Anonymous Coward]

Militarily the US beat the living shit out of the North Vietnamese. The reason for the loss was the failing will of the public in the US. If that hadn't happened the North Vietnamese would have thrown in the towel

I take it you mean the North Vietnamese that were still living in North Vietnam, since by the time we gave up the Viet Cong had moved into South Vietnamese towns where they looked and talked exactly like our allies, leading to the various infamous massacres that made it obvious that we had no fucking clue who the enemy was anymore, and nobody had any ideas on how to figure it out except to either kill everyone or have our soldiers march around in circles until someone killed them.

Re:PR "Stuff" from Fireeye

[shentino]

Finally, someone treats the army of compromised computers like what it really is, an army.

Re:PR "Stuff" from Fireeye

[Anonymous Coward]

...and now Jenny herself was torn between her boyfriend and the man she met at the party, with who she continued to tryst.

It's "with whom", you fucking illiterate dirtbag!

Re:PR "Stuff" from Fireeye

[shentino]

I'd call it electronic quarantine.

Re:PR "Stuff" from Fireeye

[Anonymous Coward]

Soldat trolls are really fascinating.
Do you guys just write these things up on the fly?

Re:PR "Stuff" from Fireeye

[techno-vampire]

The reason for the loss was the failing will of the public in the US.

The real reason is that the NVA waited until after the US pulled out then violated the treaty they'd signed and invaded. When that happened, the US Congress also ignored its treaty obligations and sent nothing but some token munitions.

Re:PR "Stuff" from Fireeye

[Anonymous Coward]

I wrote it on the fly. Sometimes it all just comes to you when you're "in the zone". The community as a whole benefits when the trolls are somewhat literate and original. Like most Slashdot trolls, I used to copy and edit dirty stories from online before posting them, but that method is much more obvious and unfulfilling.

Slashdot is the foremost science and technology website and so its trolls should also held to higher standards of, um, trolling.

Re:PR "Stuff" from Fireeye

[Anonymous Coward]

Very entertaining post, maybe a bit offtopic, not to mention vulgar and racist, but a surprisingly funny and entertaining read. Clever ending to tie into the topic too.

Re:PR "Stuff" from Fireeye

[RobertM1968]

Exactly. The only way for the US to have won in Nam would have been to destroy everything (which was humanely and politically unpalatable). The only way to win in Iraq is to turn it into a glass parking lot (which would also be humanely and politically unpalatable).

But with spam... that may be a bit more palatable, if we can get people to accept responsibility for getting hosed.

Since such a solution in the computer world would NOT be unpalatable, then, this is the answer...

"Zero-Zero-Zero Destruct Zero"

Re:PR "Stuff" from Fireeye

[Anonymous Coward]

I think removing spammers is easier. They are not that numerous. And don't say, most of them are abroad. The infected bots are too.

Re:PR "Stuff" from Fireeye

[Anonymous Coward]

Doubt it. The US lost not for any other reason except for the fact that the Vietnamese were fighting for their freedom. I don't know the original quote, but it's alluded to here (Posted by Gico Dayanghirang on April 2, 2009 11:16 ET). Consequently, that's why they'll lose Iraq and Afghanistan.

Re:PR "Stuff" from Fireeye

[Loopy]

That's like saying Einstein had 2 lab assistants, not just Einstein. Troll.

Re:PR "Stuff" from Fireeye

[aedil]

I think you miss another important aspect of this "war"... As in fighting a guerilla army, you usually end up being on the less effective side of the conflict due to rules and regulations that one tends to be bound by, whereas a guerilla army usually couldn't care less about the rules. Spammers do not care about breaking rules, regulations, and protocols, so they can play very dirty whenever they want (and botnets are a clear example of that). Offensive action against them is usually still bound by some rules, and thus they have a natural advantage. Spammers do not care about any collateral damage... System administrators and othe people fighting the spammers usually do have to care about collateral damage.

Re:PR "Stuff" from Fireeye

[Anonymous Coward]

and, eventually, wholesale destruction of the people supporting the guerillas will be necessary to win the war.

Too bad that was tried in the Southern America. It didn't end well. The "deep throat" famously told to follow the money. Spam is unsolicited junk e-mail advertising something. Somebody is paying for the campaign. Lets get them on the basis of them financing the criminal activity.

Re:PR "Stuff" from Fireeye

[Anonymous Coward]

This is a really bad analogy.

The Tet Offensive was the end of the Viet Cong, except the US didn't believe it. Had the US simply stayed a while longer the [police action] may well have ended with an American victory.

Iraq is already won.

What has to happen to win against spam is to bream the business model. Nothing else is required, nor sufficient.

Re:PR "Stuff" from Fireeye

[Captain Splendid]

Damn it, I'm getting all misty here.

Re:PR "Stuff" from Fireeye

[vegiVamp]

Do try to put some more sex in it, next time. There's more of us with a penchant for humongous black cock, you know.

Re:PR "Stuff" from Fireeye

[vegiVamp]

> The cost of this may be too high to be worth it... but if you take away someone's internet access for a while when they get hosed, then maybe they'll stop getting hosed.

The trouble with this, is that the people who are prone to get hosed, are the people who have no real clue as to how or why they get hosed, let alone how to prevent it.

Had this practice started way back when eternal september was barely more than a witticism, we probably wouldn't have been where we are now; and while my gut says that it would be very benificial to just kick all the lusers off 'our' net again, that's not really an option in and of itself - it's mostly *because* of the constant influx of new users that we now have nice fat pipes.

The trouble is, for the most part, that users don't have much incentive to do something about malware on their machines as long as they're not impacted too much. Kicking infected PCs off the net for a while (and gradually longer with each new occurrence) may well provide that incentive, BUT it is then also our responsibility to educate them on how to avoid infection IN A WAY THAT THEY UNDERSTAND. That latter part is not always one of the strong points of our community :-)

And, one can only dream, maybe the unwashed masses will finally start demanding a more secure operating system from the majority vendor, or choose more secure alternatives. Before you lot start hammering me, I know full well that *nix isn't perfect, either, but if Redmond starts shaping up, maybe we'll be the next target, and we'll fix the holes we have, too :-)

Re:PR "Stuff" from Fireeye

[icannotthinkofaname]

But what does this have to do with botnets? Don't allow strange things into your system or bad things will happen.

Impressive. A moral to the story, and one that's actually relevant to the article, at that.

This is why I browse Slashdot at -1. Sometimes, what gets modded down can be a good read, even if it's generally irrelevant to the article.

Re:PR "Stuff" from Fireeye

[OeLeWaPpErKe]

That's like saying Einstein had 2 lab assistants, not just Einstein.

When writing special and general relativity Einstein used these resources :
1) Pencil (not even a pen)
2) Paper

So they're not in fact equal. Your statement is a lie (factually incorrect).

And lots of people play the offensive game against botnets. Just ask a few ircops. It doesn't last, and it attracts ddoses like hell. If I was this guy's ISP, I'd be pissed.

Re:PR "Stuff" from Fireeye

[Anonymous Coward]

Constant vigilance, swift response times, and, eventually, wholesale destruction of the people supporting the guerillas will be necessary to win the war.

In this case that is the customers who buy what is advertised in the spam. Are you suggesting we take over the botnets and send out arsenic instead of viagra?

re:PR "stuff" from fireeye

[ed.han]

strictly speaking, to be a lie, doesn't that require the speaker be aware that the statement is factually incorrect? untrue lie.

Re:PR "Stuff" from Fireeye

[witherstaff]

OT here, but the US air war was fighting with one arm tied behind it's back. The Vietnam Rules of Engagement included such wonders as only shooting at enemy aircraft or SAMs after they were fired upon. I can understand not firebombing whole cities but not taking out enemy air fields, SAM sites, anti aircraft and enemy fighters is insane.

Re:PR "Stuff" from Fireeye

[TheCarp]

No, a guerrilla army still has a command and control structure. While an individual botnet, or individual criminal enterprise would have such a structure, "botnets" don't. Its more like crime fighting. Anyone could choose to commit a crime at any time. Most wont (mostly) and some will. Some criminals you will put a stop to, some you wont.

You are never going to win a war against "crime" any more than the war against "botnets". The best you can ever hope to do is raise the perception of how hard it is to create, maintain, and control botnets higher than the percieved value of doing so. The same way the cost and probability of getting caught shoplifting in a store with cameras stops a certain number of people who might otherwise shoplift.

-Steve

Re:PR "Stuff" from Fireeye

[TheCarp]

Kind of like the treaty that the South Vietnamese violated by refusing to hold elections, because they knew that the communists would win the election; the violation that prompted the US to back the South in the war? Or are we forgetting that VietNam was the war where we sided against democracy from the start?

From Wiki:

Vietnam was temporarily partitioned at the 17th parallel, and under the terms of the Geneva Convention, civilians were to be given the opportunity to freely move between the two provisional states. Elections throughout the country were to be held, according to the Geneva accords, but were blocked by the South Vietnamese president, who feared a communist victory.[43]

( http://en.wikipedia.org/wiki/Viet_Nam_War )

Command & Control

[phantomcircuit]

All they did was get the DCs hosting the command and control servers to shut them down and register the spare domain names.

Obviously this was a temporary solution.

Re:Command & Control

[bragr]

It is, from what I read it seams that the botnet generates a random domain every hour or day to fall back on, and all they did was knock out the existing C&C and register all the fall back domains for the next 2 weeks. Surely the botnet will have taken a hit, and the information gathered will possible help reduce the number of infections, but it wasn't shut down permanently.

What they should have done is hijacked the botnet using the fall back domains, and either run a self destruct if there is one, or uploaded a new "version" that effects an uninstall. Of course, that would make their business, selling security appliances, less necessary.

Re:Command & Control

[Anonymous Coward]

Sophisticated botnets use encryption to verify that the payloads and instructions from the C&C server are genuine. Plus there's the possibility that you'd get in trouble for essentially breaking into people's computers.

Re:Command & Control

[abulafia]

What they should have done is hijacked the botnet using the fall back domains, and either run a self destruct if there is one, or uploaded a new "version" that effects an uninstall. Of course, that would make their business, selling security appliances, less necessary.

Funny you concentrate on a claimed conflict of commercial interest.

It also would have opened them up to a potentially huge legal problem. No matter how carefully coded an uninstaller, the likelihood of some number of machines having problems after being infected by a remover, when talking about .25M machines, is high. Such an action also is criminal computer intrusion in its own right.

No person in their right mind would do such a thing.

Re:Command & Control

[vlm]

No person in their right mind would do such a thing.

Which makes me all the more surprised that no one has tried.

Re:Command & Control

[bragr]

Legal implications aside, this is an interesting ethics question. Is it more ethical to interfere with another's property, without permission, to solve a larger problem, or is it more ethical to respect private property and privacy? Surely there are cases for both.

If I remember correctly, sometime in the last year, a security research team from UCSD (I think) hijacked a portion of a botnet to research the success of spam and how botnets operate. I believe that after they finished, they caused the bots under their control to self destruct, and the BBC rented a botnet for an article, both bringing up similar ethical questions.

Re:Command & Control

[ceoyoyo]

There have been several cases of people trying the "helpful malware" trick. The most recent widely publicized incident I remember was the guy who wrote some code to exploit jailbroken iphones with default passwords and replace the wallpaper with a warning to change the password.

Re:Command & Control

[soundguy]

It also would have opened them up to a potentially huge legal problem. No matter how carefully coded an uninstaller, the likelihood of some number of machines having problems after being infected by a remover, when talking about .25M machines, is high. Such an action also is criminal computer intrusion in its own right.

No person in their right mind would do such a thing.

Wrong. A motivated person who knew he could not get caught COULD easily do such a thing. And they SHOULD. Any computer that is accessible via any kind of network is subject to intrusion, compromise, and possible complete destruction. That's simply the facts of life. You accept that possibility by connecting your computer to the outside world. It doesn't matter if it gets mangled by Eastern European hackers, well-meaning but inept vigilantes, or government spooks. Whatever happens to it is YOUR fault, whether someone else broke the law or not.

The only "safe" computer is one that hasn't been turned on yet.

Re:Command & Control

[interval1066]

The first being the famous Morris Worm from the 80's; http://en.wikipedia.org/wiki/Morris_worm/.

Re:Command & Control

[hardburn]

Not so much being out of your right mind, but rather, having sufficiently flexible ethics and keeping a clear image of your goal in mind. Kind of like what Lelouch vi Britannia would do if he ran a security company rather than trying to take over the world.

Re:Command & Control

[c6gunner]

Which makes me all the more surprised that no one has tried.

It's been done on a smaller scale. Back when botnets were still mostly communicating via IRC, I took down a few myself. The difference it that I didn't document the process and then blab about it to the media in order to advertise my security products/services.

Re:Command & Control

[c6gunner]

Legal implications aside, this is an interesting ethics question. Is it more ethical to interfere with another's property, without permission, to solve a larger problem, or is it more ethical to respect private property and privacy? Surely there are cases for both.

I don't really see an ethical issue. If someone stole your car, would you be upset if an anonymous stranger stole it back without your permission and delivered it to your door? Maybe some people would, but they have to be insanely rare. The only issue here is the legal one, and it's not one that can be easily resolved.

Re:Command & Control

[thejynxed]

Why shut them down when you can seize control of them and use them yourself?

This is turning a blind eye, my friend.

They make an arrest and get a big article in the paper once in awhile just to say they are doing something, and to justify those tax dollars being added to their budgets.

Seriously, after the recent articles about the Air Force creating their own botnets for "cyberwar" with China or Russia, does this surprise anyone?

Re:Command & Control

[Anonymous Coward]

Is it more ethical to interfere with another's property, without permission, to solve a larger problem, or is it more ethical to respect private property and privacy?

That is a false dichotomy. It is not a matter of solving a larger problem. The question to answer is: Do you defend someone else against certain intrusion of privacy and loss or damage of private property, even if that means you run a small risk of your own actions causing intrusion of privacy and loss or damage of private property? Does the inaction of people with infected computers justify action which may cause further damage to their systems? IMHO it does, but unless someone is attacking you and you're acting in self-defense, such action should only be taken by law-enforcement under authorization of a judge.

Re:Command & Control

[whoever57]

I don't really see an ethical issue. If someone stole your car, would you be upset if an anonymous stranger stole it back without your permission and delivered it to your door?

What if they got into an accident and wrecked your car on the way to your house? The risk is that any bot removal might have side effects.

Re:Command & Control

[c6gunner]

What if they got into an accident and wrecked your car on the way to your house? The risk is that any bot removal might have side effects.

That's a legal issue, not an ethical one. If someone t-bones me at an intersection tomorrow I won't think of them as an evil person, but I will hold them legally accountable.

Re:Command & Control

[hedwards]

But, requiring greater sophistication reduces the profitability of spamming. Most spammers use non-compliant mail programs for a reason, which is why greylisting has worked so well for so long and will likely be a part of the solution for some time to come. Same thing here, requiring encryption limits the amount of work that a particular computer can do since gumming up a computer tends to draw attention and cause the owner to take it in for a repair.

But the other thing it does is increase the amount of sophistication necessary to create the tools and somewhat increase the cost of getting into the game as well as the cost of staying current.

Re:Command & Control

[Anonymous Coward]

Wrong. A motivated person who knew he could not get caught COULD easily do such a thing. And they SHOULD. Any computer that is accessible via any kind of network is subject to intrusion, compromise, and possible complete destruction. That's simply the facts of life. You accept that possibility by connecting your computer to the outside world. It doesn't matter if it gets mangled by Eastern European hackers, well-meaning but inept vigilantes, or government spooks. Whatever happens to it is YOUR fault, whether someone else broke the law or not.

The only "safe" computer is one that hasn't been turned on yet.

The fact that you are encouraging people to break into and destroy other's data shows that you do not have the maturity to be allowed to do things online on your own.

If I get a new computer, I will need to be online in an unprotected status for at least a few minutes while I download the various antivirus, anti-malware and other security programs in order to properly safeguard myself. If something happens to my computer before I even have a chance to protect myself, is it my fault? Or is it the fault of the asshole malware creator who destroys data belonging to others and cause undue hardship to those affected in order to appease some sadistic worldview?

If you cannot understand this, or if you still think that it is okay to break into other people's system and wreck things, I have to wonder if perhaps you are one of those that causes so much headache(from trying to get rid of your malware) and heartache(when priceless data such as photographs and video are destroyed) to others online.

Re:Command & Control

[Rich0]

Yup, I'd certainly have no qualms about the FBI cutting down the waste that is spam by killing botnets. The really big ones don't just sprout overnight, and they are probably easier to take down than they are to build. Most likely the US already has sufficient survailence on its border routers to trace this sort of thing, and if nothing else they can easily shut out the bot operator and poison the bots DNS so that they phone home to the FBI.

Liability isn't an issue for the US government. At most you might have foreign governments upset that the US is intruding into systems outside its jurisdiction, but the US probably just needs to tell them that if they don't hack into US computers, the US government won't hack into theirs. For governments that are friendly there could even be cooperative efforts.

Re:Command & Control

[sjames]

The big problem is that even if you do it perfectly so that you do no harm whatsoever, the odds are a number of those machines will have unrelated problems that you'll be blamed for.

Re:Command & Control

[Fnord666]

What they should have done is hijacked the botnet using the fall back domains, and either run a self destruct if there is one, or uploaded a new "version" that effects an uninstall. Of course, that would make their business, selling security appliances, less necessary.

No, what they should have done was hijacked the botnet using the fallback domains and nuked the offending bots from orbit. It's the only way to be sure. Seriously. Distribute a payload that reformats the primary boot partition.

Re:Command & Control

[FictionPimp]

How many people would even notice. If they have a botnet node running on their machine do you really think they are going to notice if you screw it up more?

Re:Command & Control

[mysidia]

It's not that hard... there are free encryption libraries, many cheap authenticators, stream ciphers, e.g. Poly1305-AES, Salsa20/8, Curve25519, Rabbit, Blowfish, for actual data. No need to use AES-768 here.

Actually, message encryption isn't required to protect against command hijacking, only digital signing and public key authentication (using a MAC) which is extremely cheap, and easy to do, thanks to open source OpenSSL and also, crypto libraries built into Windows.

server digitally signs a MAC / message hash with DSA, client authenticates only the hash, then validates the message matches the hash.

I think the only reason botnet operators aren't widely using message authentication, is they know, security researchers rarely go on the offensive, there might be legal issues with tampering with their code, AND:

There's no point in trying to defeat security researchers, with digital signatures.

Security researchers are essentially hackers themselves -- bringing in bloat like cipher code makes it probable the security researchers can find a buffer overflow, or other exploitable element in the botnet code itself, thus the bloat involved to digitally sign things becomes self-defeating.

Re:Command & Control

[psnyder]

If someone stole your car, would you be upset if an anonymous stranger stole it back without your permission and delivered it to your door?

Nobody stole the computer. They just infected it. The majority of computers are still usable and the owners don't know they've been infected.

Car analogies break down.

Re:Command & Control

[mysidia]

A warning in the form of a picture of Rick Astley?

Re:Command & Control

[mysidia]

If you see a lamp on the ground and the couch burning through your neighbor's front window, is there a problem with you opening the front door, and dragging a bucket in, to douse the flames?

Yeah, I guess they could have you thrown in jail for barging in like that, and getting some water on their rug....

Re:Command & Control

[couchslug]

"Is it more ethical to interfere with another's property, without permission, to solve a larger problem, or is it more ethical to respect private property and privacy? Surely there are cases for both."

One may make such a decision from preference, and not ethics.

Re:Command & Control

[spydum]

This has been done to a degree. Not with a C&C style bot that I know of, but back in the self-proliferating worm/virus days, one of the big nasty virii had come out, and someone wrote the "anti-virus" that basically infected using the same exploit, and started trying to "infect" the virus host with the cleanup virus, then self-destructing. It had some flaws and turned out to be just as aggressive as the original bot, which caused yet additional DoS's on providers and hosts. The name of the virus and the cleanup "virus" escape me at the moment though.

Re:Command & Control

[BronsCon]

Do you mean to ask if I enter my neighbor's house behind a man I witness breaking in, with the intent of getting him the hell out of there, even if it means I might knock over a lamp or break a table in the struggle?

Hellz tha' fuk yeah I do!

Then again, my neighbors and I are of sound mind and understand that small losses are often incurred in order to prevent large losses; I know my neighbor wouldn't sue me over the broken lamp or table, nor would they press charges against me for entering their home to remove the scumbag who broke in.

Re:Command & Control

[rtb61]

Ultimately of course security researchers are also security documenters. I would hope certain government departments from around the globe where paying attention and seek documentation from the process undertaken to disrupt those activities and implement those procedures.

Major intelligence and police forces from around the glob can maintain 24/7 disruption of those networks, as you can readily put thousands of white hate hackers working together against a hand full of black hats(for each network). Investigation and disruption whilst not the goal, should be a logical interim step until capture, prosecution and incarceration can be achieved. Those people whose machine has been turned into a bot should also be sent a notification so that they can clean up their machine.

Government security forces should not allow themselves to be caught into the trap of waiting till they have sufficient evidence for a prosecution before acting to alleviate the problems caused. Benefit is, put the black hats under sufficient pressure and they will start taking greater chances and making more mistakes, they can't resist, greed will drive them as it already does.

Re:Command & Control

[BronsCon]

I download my security software on my blackberry, which i then use as a USB disk to install that software. the system DOES NOT see ANY network without protection.

Re:Command & Control

[dissy]

The big problem is that even if you do it perfectly so that you do no harm whatsoever, the odds are a number of those machines will have unrelated problems that you'll be blamed for.

On the other hand, perhaps my hackable-but-on-the-internet machine is that critical system that will kill hundreds of bunnies if it goes offline, and the system you just complained about the cleaning action is the one that automatically hacked mine.

With that logic, you should have the same amount of sympathy for me and my total disregard for those bunnies lives as you do about the other system.

So to keep the bunnies from dying, we must remove the other system from the Internet, to prevent it from potentially hacking my extremely out of date and vulnerable system that is so critical!

Re:Command & Control

[BronsCon]

And you're sure to be flamed for your comment. That's sad, as you make a very valid point. If people valued their data, their systems, and their time, they would take precautions to prevent infection in the first place.

If the cure truly is worse than the infection, they really can only avoid that cure until it is forced on them. That will happen, one day, I hope.

Me? I keep online backups across multiple operating systems, as well as weekly-updated offline backups. If I ever do get infected, only a portion of my network is vulnerable to that infection, and all of my data is safe. I also run the appropriate security software on all of my Windows, Mac, Linux, and BlackBerry devices.

tl;dr: If you can nuke an infected system, I'm all for it, because I'm not a fucking moron.

Re:Command & Control

[BronsCon]

In my hurry to support the post I was replying to, I forgot to add the following:

Maybe after losing their irreplaceable photos of little Timmie a few times, people will wise up and take security a bit more seriously.

Re:Command & Control

[sjames]

Personally, I agree, but I doubt the courts will ask me for my opinion.

Re:Command & Control

[michaelhood]

It is, from what I read it seams that the botnet generates a random domain every hour or day to fall back on, and all they did was knock out the existing C&C and register all the fall back domains for the next 2 weeks. Surely the botnet will have taken a hit, and the information gathered will possible help reduce the number of infections, but it wasn't shut down permanently.

And in 2 weeks, they'll simply patch the algo so it checks an order of magnitude more domains, making pre-purchasing them uneconomical for these guys from the article.

Re:Command & Control

[Moridin42]

You probably say "thanks" and update your insurance claim. Since they have less wiggle room to not pay. The car is wrecked, now. Not stolen and potentially recoverable.

Are you BadAnalogyGuy in disguise or something?

Re:Command & Control

[LaminatorX]

I've thought for years now that the only thing that can fight the botmasters effectively would be a handful of deeply paranoid grey hat vigilantes willing to wipe out the botnets via pushing innoculants to the bots themselves and being invisible enough to pull it off without getting hauled off by the law or gunned down by the mobsters behind the botnets.

Re:Command & Control

[Anonymous Coward]

Is it more ethical to interfere with another's property, without permission, to solve a larger problem, or is it more ethical to respect private property and privacy?

Is it technically theirs if it has been hijacked by a botnet? I understand they still have 'possession' of it

Re:Command & Control

[Anonymous Coward]

> What if they got into an accident and wrecked your car on the way to your house? The risk is that any bot removal might have side effects.

That said, the kind of people who get infected by botnets don't seem like they'd be the kind of people who could trace a hacker's movements, so how would they know it was someone destroying the bot, rather than someone trying to uninstall it, unless someone announced what they had done?

Re:Command & Control

[soundguy]

Wrong. A motivated person who knew he could not get caught COULD easily do such a thing. And they SHOULD. Any computer that is accessible via any kind of network is subject to intrusion, compromise, and possible complete destruction. That's simply the facts of life. You accept that possibility by connecting your computer to the outside world. It doesn't matter if it gets mangled by Eastern European hackers, well-meaning but inept vigilantes, or government spooks. Whatever happens to it is YOUR fault, whether someone else broke the law or not.

The only "safe" computer is one that hasn't been turned on yet.

The fact that you are encouraging people to break into and destroy other's data shows that you do not have the maturity to be allowed to do things online on your own.

If you are connected to any kind of network, ALL of your data MUST be backed up OFFLINE. Sensitive data MUST be encrypted. Anything less is irresponsible and naive.

If I get a new computer, I will need to be online in an unprotected status for at least a few minutes while I download the various antivirus, anti-malware and other security programs in order to properly safeguard myself. If something happens to my computer before I even have a chance to protect myself, is it my fault? Or is it the fault of the asshole malware creator who destroys data belonging to others and cause undue hardship to those affected in order to appease some sadistic worldview?

It's your fault. You failed to take adequate precautions when entering in a known hostile environment. If you can't swim and you drown in the ocean, is it the ocean's fault?

If you cannot understand this, or if you still think that it is okay to break into other people's system and wreck things, I have to wonder if perhaps you are one of those that causes so much headache(from trying to get rid of your malware) and heartache(when priceless data such as photographs and video are destroyed) to others online.

I am a systems administrator. My job is made infinitely harder by people like you who are too uneducated to even be on the internet. You NEVER EVER connect ANY computer directly to the internet without first configuring it to be as secure as possible. If the "chicken vs egg" thing is too much for you, take your new computer to a PROFESSIONAL and have it set up with AV, a correctly-configured firewall, and encryption of your personal data before you attempt to connect to the outside world.

If my commercial systems are being attacked by your computer because you allowed it to be compromised and turned into a zombie, then YES, I fully support any means necessary to remove the attacking computer from the internet. If your data is "lost" because a vigilante miscalculates his own skills and ends up trashing your hard drive when trying to kill the botnet at the roots, then it's YOUR fault entirely because you cluelessly allowed a compromised box to remain online and you did not back up your own data.

Re:Command & Control

[wisty]

No, it's more like if somebody was hiding in your trunk (and jumping to rob people at intersections), could you also sneak into their trunk and wrestle him out?

Re:Command & Control

[Anonymous Coward]

So you'd need the owners approval, right?

So make your counter-malware pop up a warning window offering free anti-virus scan, the user clicks OK, and you remove the botnet. How do you think they got infected in the first place?

Re:Command & Control

[Anonymous Coward]

So knowing the risk of getting into an accident and having to take legal blame if it goes awry begins with an ethical decision.

Re:Command & Control

[ArsenneLupin]

No person in their right mind would do such a thing.

Wrong. A person in their right mind might very well do such a thing, but the smart way. Namely, anonymously, without bragging about it.

So, in the improbable event that some of the .25M got more fubarred than they were before, the lusers would not know whom to sue.

Re:Command & Control

[ArsenneLupin]

This was not an attempt to remove malware, but rather malware itself, so not really the same thing.

Re:Command & Control

[ArsenneLupin]

Back in my younger days, I tried to shut down nazi spammers by alt.test-subscribing them to zillions of listservs. Kinda worked, but triggered lots of collateral damage :-)

With this stunt, I might have unintentionally contributed to the phasing out of alt.test functionality.

Another favorite pastime was goatsing spammers' servers via SQL injection, or dropping their entire subscriber list. Unfortunately, nowadays, spammers no longer use unsecured ASP as much as they used to.

And, like you, I never bragged about it under my real name (but some smart coworker did suspect me anyways after the nazi spam incident, hehe...)

Re:Command & Control

[Anonymous Coward]

No person in their right mind would do such a thing.
 
No one in their "right mind" would run an operating system that's so easy to compromise. The simple fix is to ban any user sending spam from an infected machine. Cut off their internet connection for a month. They'll soon realise that the problem lies with them rather than elsewhere!

Re:Command & Control

[richy freeway]

Blaster was the original, Welchia was the cleanup.


http://en.wikipedia.org/wiki/Welchia

re:command & control

[ed.han]

you know, while it's certainly self-serving, it's also useful to know because with evidence that at least one sysadmin is going on the offensive and has gotten results, the idea may gain mindshare elsewhere. to me, that prospect ameliorates my misgivings re: the self-serving part of the announcement.

Re:Command & Control

[Ihmhi]

Well, presumably the botnet outputs data to an address, right? Like let's say everything it collected was sent to a particular IP adadress. The "uninstaller" could have just been, say, something that edits the hosts file and just blocks the IP at that level. It doesn't risk harming the computers (it only adds one address that will fail to connect) and it completely cripples the botnet.

Re:Command & Control

[whoisisis]

A good attack on botnets would be to make them delete zombie machines owners files.
Then the malware would get much more attention.

A decade ago, the mission of vira was to destroy as much as possible locally,
today they use stealth to be able to send spam, earning the virus writer money.

Re:Command & Control

[Dan Ost]

The real value isn't killing the command & control part of the botnet. The real value is putting honeypot C&C machines in place that can capture the IPs of infected machines so that volunteers can track down the owner/ISP of the infected machine and clean it up.

With that in mind, adding more domains doesn't do anything to prevent the capture of infected IPs.

The real question is whether infected IPs can be cleaned up faster than new machines can be (re)infected. More secure operating systems will help. Better identification and cooperation from ISPs will help. Greater security awareness of computer owners will help.

I'm optimistic.

Re:Command & Control

[interval1066]

That's not how the NSA, CERN, The FBI, and other agencies saw Morris' act. He was found guilty in a trial and sentenced to quite a bit of community service and fines in the millions. That sounds exactly like the same thing to me.

Re:Command & Control

[Anonymous Coward]

What I've never understood though was thus:

The botnets are required to register a random domain name to get instructions from. Why in the HELL have they not just... solved the problem right there? Make it so that automatic, instantaneous domain registration isn't possible. Or such that it costs say... a buck to register a domain name. Or that it requires a phone call. SOMETHING to stop the instant, automatic domain registration, or at least make it ludicrously infeasable for registering hundreds or thousands of domains.

Re:Command & Control

[stand]

Exactly! The only really effective means to combat this would have to be done on the same level of covert-ness at which the botnets themselves run (i.e. if I tell you about it, I have to kill you). It may already be happening. It would be an interesting research project to go looking for it.

Re:Command & Control

[Yvanhoe]

No person in their right mind would do such a thing.

That's why all heroes are completely nuts

Re:Command & Control

[abulafia]

We're getting perilously close to tort law here, and this discussion is way past prime.

However, ethics don't stop at the choice to act. (Torts are insanely messy and counterintuitive. $legalreference like West is your friend, if you have it, etc.)

By taking posession of the car, in your hypothetical, you are taking responsibility for it. That you have a minimal goal in mind is a mitigating circumstance (you mean well), but not a reason to abdicate responsibility for what you've chosen to do.

I realize I'm mixing law and ethics. That's what humans do. But if you want to play a pure ethics argument, consider how the 'save a fella on broken ice' hypothetical works out. It doesn't come out in your favor. I'm not asserting this is the proper way to think about ethics questions (I don't think it is), but you're grabbing the wrong straw there.

Wow

[Anonymous Coward]

It sounds like Ghost in the Shell-like tactics. Did he do it manually or from his cyberbrain?

Last week I killed seven with one blow...

[tyroneking]

... ants that is...

Re:Last week I killed seven with one blow...

[Anonymous Coward]

... ants that is...

You certainly are one primo blower.

Treat the illness, not the symptoms...

[Last_Available_Usern]

All of the effort associated with this, and other endeavors to thwart botnets, would really be better served isolating the primary reason why these botnets continue to be successful and create new ways to thwart them before they occur. The machines that are infected are still vulnerable. All the original botnet owner is going to do is modify a new botnet to use different domains or IP's and back to life it comes.

Re:Treat the illness, not the symptoms...

[Paradigm_Complex]

I'm usually not trying for "insightful" when I quote comedians, but: "You can't fix stupid." - Ron White

As long as there are stupid people out there using computers which are connected to the internet, they'll find a way to get their machines pwned. Unless you're proposing the anti-botnet efforts be directed towards keeping stupid people off internet-connected computers, I don't see a viable way to "treat the illness."

Re:Treat the illness, not the symptoms...

[Requiem18th]

What illness Windows? The Windows ecosystem security is hopelessly broken.

Lot's of outdated machines won't upgrade because the upgrades are expensive, and even if they were free they might brake software OR compatibility, and even if they are free and don't break compatibility many of these systems use pirate copies of Windows and they aren't going to expose themselves to unexpected lockouts.

No, the solution is implementing a counter-spaming initiative at the ISP level. With counter spaming I mean spaming the spamers, NO, I don't mean naively counter-spaming their email addresses, I mean spaming their honey pot channels, there was a thunderbird extension for this, basically they follow the links in the spam message and sign up/buy whatever they ask for, credit card numbers, friend email addresses, SSN, etc, all fake of course. Unlike their source email addresses they use to spam, they DO pay attention to information sent this way, because it is the way they make money, it's their biggest weak point, spam that and you take them out of business.

Re:Treat the illness, not the symptoms...

[ClosedSource]

Perhaps "You can't fix stupid" but sometimes you can replace it. The Internet protocols and infrastructure just weren't designed with security in mind. Well designed products/services for consumers don't rely on sophisticated knowledge for safety and efficacy.

Re:Treat the illness, not the symptoms...

[Anonymous Coward]

Pretty much what ClosedSource said above me. The issue isn't going to be fixed a the user level, or even the users' OS level because there will always be people using old, unpatched systems.

The issue has to be resolved at a higher level. The ISP's is the most likely, but assuming local providers can be wrangled into submission creating a "national firewall" for unwanted sources/traffice makes the most sense. However, that of course would lead to speculation about government abuse (ie. China v2.0).

Re:Treat the illness, not the symptoms...

[Interoperable]

As long as people are willing to execute programs with administrative privileges to get free wallpapers there will be botnets. People should be held accountable for damages caused by their machines, wittingly or unwittingly. Unsafe conditions on property are certainly grounds for a negligence charge and municipalities often compel unsafe or even unsightly conditions to be remedied. Electronic conditions should be handled similarly.

Re:Treat the illness, not the symptoms...

[CharlyFoxtrot]

The machines that are infected are still vulnerable. All the original botnet owner is going to do is modify a new botnet to use different domains or IP's and back to life it comes.

I've long thought that one way to deal a deadly blow to spammers would be for Microsoft to announce a "Windows amnesty" where people could carry in their computers to volunteer geeks and get a legit fully patched version of whatever (pirated and probably infected) Windows is on their system. It would generated a lot of positive press too but it's probably too costly.

Re:Treat the illness, not the symptoms...

[spongman]

expensive? upgrading from XP to Win7? that's $200 for ~9 years, less than $2 a month.

Re:Treat the illness, not the symptoms...

[whoisisis]

Fix the botnet so it deletes the user files. That ought to turn mr. stupids attention to keeping his computer clean of malware.

Re:Treat the illness, not the symptoms...

[Anonymous Coward]

The illness in this case is human greed -- the greed of those sending the spam, the greed of those wanting to use the spammer's services for cheap, the greed of those individuals who actually make spam lucrative.

When you find out how to treat greed, let me know. Until it's fixed, the problem will just shift to another domain.

Arms race

[Locke2005]

Sure, cutting off botnet access to C&C machines works now, but what happens when they adopt a true peer-to-peer control structure, rather than the primitive centralized control structure they are using now?

Re:Arms race

[winkydink]

The p2p C&C infrastructure has been talked about since at least 2005. Not much has been seen "in the wild". It has been speculated that this is because a p2p botnet infrastructure has, by its very nature, a much lower efficacy.

Re:Arms race

[MadnessASAP]

Then we are all truly fucked.

Or alternatively the internet becomes a whole lot more fun as we learn to take control of parts of the botnet by hijacking these p2p links.

Re:Arms race

[mysidia]

I think it's so hard to develop good peer-to-peer network structure that it might not happen.

There aren't that many truly peer-to-peer networks that have ever succeeded.

I'd say the Internet itself, but even the Internet has to have DNS...

Something central has to give you a starting point, at least.

I've yet to see any peer to peer network technologies that don't require a "seed list" of some central nodes to initially connect to the network.

Re:Arms race

[DMUTPeregrine]

It's been discussed since 2002, with the curious yellow whitepaper. As discussed there it can actually be more efficent in some ways than a centralized worm.

Re:Arms race

[selven]

It's a lot more viable than you think. We already have these, and these networks are a major field in artificial intelligence.

Re:Arms race

[mysidia]

Viable is one thing.. efficient is quite another.

Wireless ad-hoc networks exist at a tiny fraction of the scale of botnets.

P2P is definitely more complicated, and the very process of trying to discover other nodes could reveal the existence of a bot...

Re:Arms race

[PerfectionLost]

I'm assuming that a P2P update system would be even more vulnerable. Once you hook into it, you could hijack their bread and butter.

The way you really stop this, is by finding the people. And look, all of their servers were in America, with the exception of 2. I'm willing to bet that most of them live in america. With two operatives in foreign countries. If an actual law enforcement agency was doing this, they would be able to issue subpoenas, and follow the paper trail to who owns the domain--or atleast what identity theft persona owns it.

and PC World distributes software for the botnets

[Anonymous Coward]

i should of guessed really, a site that has 80% of screenspace dedicated to advertising or "partners" isnt safe let alone one that distributes trojans and adware

http://www.siteadvisor.com/sites/pcworld.com/downloads/

Antibiotic abuse

[gmuslera]

Only the really strong, and the ones that managed to evolve will survive. And without the competition of the "weak" ones, they will prevail, and leaving you with no tool to get rid of them. Darwin have precedence over Moore.

Re:Antibiotic abuse

[TubeSteak]

Only the really strong, and the ones that managed to evolve will survive. And without the competition of the "weak" ones, they will prevail, and leaving you with no tool to get rid of them. Darwin have precedence over Moore.

The only problem with your analogy is that, generally speaking, the good guys own the middleground.
We may not control the hardware that is getting botted, but we do control the DNS and we do control the ISPs.
The blackhats have no choice but to go through hardware we control in order to reach their target.
It's just a matter of marshalling the resources we have in order to close down (domestic) botnets.
Unfortunately, it'll still be just a game of whack-a-mole until all version of Windows in use have robust security.

Re:Antibiotic abuse

[PRMan]

The most intelligent design will prevail...

Re:Antibiotic abuse

[taustin]

Are you referring to the criminals running the botnets, or to the crusaders who combat them? Because if your evolutionary pressure applies to one, it certainly must apply to the other.

Re:Antibiotic abuse

[Arancaytar]

until all version of Windows in use have robust security

That's from some verse in the Book of Revelation, isn't it?

Re:Antibiotic abuse

[mysidia]

Don't hold your breath. [Although I am still hopeful], It has not been demonstrated (yet) that any version of Windows ever developed or that will ever be developed has robust security.

Re:Antibiotic abuse

[gmuslera]

You can enhance the crusader, till it start having undesirable side effects. Taking away internet freedom and privacy and doing full inspection of everything could end with botnets, but probably noone want that.

Re:Antibiotic abuse

[gmuslera]

Define intelligent. Sometimes brute force is the only viable design, sometimes the ingenuos approach is the successful one. The smartest way is also the dumbest one in a lot of cases.

Re:Antibiotic abuse

[david_thornley]

To generalize, no general-purpose operating system can have robust security. If the user can run arbitrary code, sufficiently many users can be induced to run the bad guy's code. Blacklisting code (i.e., virus scanners) can't make a computer secure, as we all know. Whitelisting, like the iPhone, is the only answer.

Re:Antibiotic abuse

[Dan Ost]

What do we know about Windows 7 in that regard?

Is it not more secure than it's predecessors?

Re:Antibiotic abuse

[mysidia]

That depends. Security against what type of threat?

Perhaps. The jury is still out on that front, and it will be at least 6+ months, before it can be known for sure.

Windows 7 has improved defaults, such as the requirement for users to 'elevate' to perform Administrative functions. Helps protect against unintentionally running a program.

Reducing the number of users who will accidentally run malicious code, and UAC is an improvement, but not a robust security improvement really -- the user education in UAC has not gone far enough. When the threat is misguided, misinformed, or conned users, UAC is a pretty feeble improvement.

Also, I am not sure that "Making it harder for users to run as Administrator", and imposing it by default counts as a better security. You could do this even in XP, in an IT environment, don't give users Administrator rights to their own workstations, setup suitable NTFS file permissions.

Do user interface changes to reduce user mistakes count as security improvements? No, they count as better education for humans.

Still, on the vulnerability front, the attack surface is still as large as before, and there are many reasons to suggest a large number of vulnerabilities will eventually be discovered in this behemoth OS, just as they were found in XP.

I believe we can expect more in the same vein as the SMB v2.0 MS09-050 vulnerability, in the near future, and more local user privilege escalation holes as well.

Replace spam with copyright infringements

[Anonymous Coward]

Now, if RIAA were to say that the ISPs used by ipredator should not be allowed to access the internet backbone, you would probably immediatelly see the problems in that statement.

shows its possible

[Gothmolly]

1 guy, in 2 weeks, trashed a botnet. Why again can't major ISPs do this? Oh wait, they're getting paid to look the other way by their colocation clients (the spammers).

Re:shows its possible

[emilper]

yeah, right, the ISPs are greedy bastards ... now, please, tell me, how would an ISP know that one of the dedicated servers it sold, or one of the collocated servers it hosts, is a C&C server for a botnet ? Please, ton't tell me they should look inside the packets, or plot traffic, destinations etc. ... that's invasion of privacy at best, industrial espionage at worst, and I would not want to host my servers with an ISP that does that on a regular basis.

Until C&C data bounced around by botnets will look radically different from legitimate trafic from, for example, a SOAP server, ISPs cannot do police work. Know an ISP that hosts botnet-related servers ? Please, tell them: they will be quite grateful to kick the bastards out and rent the space to companies that need a vanity page.

Re:shows its possible

[element-o.p.]

Seconded.

I used to work at an ISP with a rather...ummm...rabid...abuse administrator. The dude literally had a zero tolerance policy towards spam from our network. I saw him shut down a number of Internet customers who probably had no intention of violating our AUP's, and (IMHO, at least) had no idea why what they were doing might be frowned upon.

Then we got a several-thousand dollar a month customer who claimed that he wanted to build a VoIP network, but either 1) did not understand anything at all about network security or 2) was lying about the primary source of income for his servers. His servers were hacked (so he says) about once a month, and every time I tried to shut down his network, I was told to reenable his account because he had "fixed the problem". Yeah, right.

Money talks, unfortunately.

Re:shows its possible

[Anonymous Coward]

At least one professional security researcher, with the resources of a professional computer security firm spent two years studying the way a particular botnet worked. At the end of that, he and two professional security colleagues, along with however many people at various ISPs and domain registrars, worked to suppress the activities of the botnet. The continued suppression effort is planned to be handed off to a group of volunteer computer security professionals.

One guy in two weeks did not trash a botnet.

Re:shows its possible

[mysidia]

Plotting traffic, and destinations, in the aggregate is standard practice, get over it.

Ever hear of IPFIX, Netflow? If you send 100 gigs a day over port 25, to umpteen thousand destinations, you bet your ISP should consider looking into that, if the traffic is unusual/anomolous.

Looking at specific packets, or capturing sessions, I think is unlikely for ISPs to do in most cases, unless nefarious activity is already strongly suspected in those packets.

It's not realistic due to the amount of bits most ISPs transferred, they would need massive storage capacity to hold even a few hours of traffic.

The only way I think ISPs ever do take detailed looks into your packets, or some connections' packets is using automated tools: deep packet inspection, primarily, to detect and throttle Peer to Peer traffic (such as BitTorrent).

It is conceivable that some day, someone might make a "Botnet CnC detector" appliance, however.

Re:shows its possible

[owlstead]

Bollocks, a botnet costs them way more than they could deliver because of colocation. One of the things mostly hit by botnets are mail servers and many ISP's run a large set of those. What about the number of MB that these botnets generate? In the end, data capacity is not free.

Re:shows its possible

[emilper]

a C&C server won't send "100 gigs a day over port 25", most likely will send 100 megs a day over some random port.

My ISP checks manually every domain registered through them or hosted on a DS or VPS: for funny names, fake street addresses etc.

How do you define "unusual/anomalous" traffic ? Like when I host an online shop, and I get a lot of traffic on the 9494 (no, it's not that port, only an example) port where I keep my jsonrpc server ?

Plotting traffic and plotting destinations is fine with me ... plotting traffic against destinations on a regular basis, that's quite close to looking at my client base, and I would not want that to happen: the only thing worse they could do would be to dump my databases and look for clients lists.

ISPs have to thread a thin line when dealing with fraud: if they kick out a legitimate user, next day Slashdot etc. will be up with pitchforks and torches, and in a month they'll have an empty datacenter, if not an army of lawyers camping outside the gate.

Re:shows its possible

[mysidia]

How do you define "unusual/anomalous" traffic ? Like when I host an online shop, and I get a lot of traffic on the 9494 (no, it's not that port, only an example) port where I keep my jsonrpc server ?

No.. but if you had never generated any 9494 traffic before, and suddenly generate a huge volume of it to a bunch of Korean IP addresses (from a US-based server), that might be considered a bit suspicious.

I would guess, in most cases, the ISP would probably ignore port 9494 traffic, unless, say it was udp 9494 at a 500,000 packets per second rate..

Also, if you started generating traffic to some known compromised/botnet hosts...

Yeah that's how I read it too

[Weaselmancer]

All they did was get the DCs hosting the command and control servers to shut them down and register the spare domain names.

Obviously this was a temporary solution.

Yeah, it sort of seems like they could have done a better job. If they could get cooperation from the primary ISP of the main C&C controller, and they could even set up honeypots that would accept connections to count the number of computers in the botnet - why not do more than simply remove the command servers?

Why not set up a bogus C&C server to have the botnet erase itself?

I'm not promoting a "format c:" option here (although that would work, obviously) - but why not have the botnet destroy itself once you breach it's command structure? Have the botnet pass around a binary that erases the botnet binaries from the infected PC on the next reboot, then force a reboot? The researchers certainly know enough to create such a binary. And they obviously know enough about command parsing if they can make honeypots. Why not go that extra 2% and kill the thing?

The hard work was already done it seems. This botnet could be completely dead, not just disconnected and waiting.

Re:Yeah that's how I read it too

[bragr]

This makes sense to me, if they have really been studying it to the degree they claim, I'm sure they know every file and registry key associated with the bot, and exactly what each one does. It that position, I don't see why a clean removal, with no collateral damage, would not be possible, especially since the bot wouldn't be trying to defend against the removal.

Re:Yeah that's how I read it too

[Anonymous Coward]

Except the botnet's client software verifies commands with against a public key. Official commands are signed by the private key and only executed if they have the proper signature. Botnet authors are getting better :)

Is Spam really that evil?

[tjstork]

I'm only asking, because, as much as we hate botnets and trojans and malware, that, any sort of world capable of rapidly sniffing out and squelching "bad" content is a world that is capable of sniffing out and squelching out "any" content. Perhaps in this case, just as many of us accept some combination of deaths from gun violence, abortions, incendiary speech, and family breakdowns and other things, that come as a consequence of the misuse of freedom, might accept spam as a misuse of freedom too, rather than try and trade it all for a world that has no freedom at all.

Re:Is Spam really that evil?

[Anonymous Coward]

OTOH without a constant arms race between the censors and the spammers, we won't have the necessary tools for either.

Re:Is Spam really that evil?

[Anonymous Coward]

Cost out per person per minute per machine for the billion or so people affected with this shit. Add in the costs of all the software people use to reduce spam, add in the costs of people installing, updating, maintaining this anti-spam software for every company or home machine that uses it. Add in the costs of delayed mail, false positives etc. Spam has nothing to do with freedom, no legitimate company will use it as a marketing tool. Spam isn't unwanted adverts, you can opt out of legitimate company campaigns. Spammers do not send from their own email addresses, they fake the headers to pretend to be from someone else, this is pure fraud. Guess who gets the bounced mail? Yup, the victim of the domain fraud. If you're still stuck with dial up and find you're email address has been used as a sender by a spammer, you can lose your net connection because so much shit is bouncing back to you, your pipe is effectively fscked by the crap coming in. I could go on far longer. Follow the money, the company ultimately processing the transactions should be treated as part of the spammers' networks. Hit them with fines, massive fines, this will allow class action suits against them. They'll soon hand over affiliates getting commission. These in turn can do jail time, 1 day per spam.

Re:Is Spam really that evil?

[Paradigm_Complex]

Abortion is complicated, but the aspects of the other things you've mentioned, such as gun violence, which make them evil is that they (unjustly) hurts others. The reasons the possibility is allowed is because there are justified uses for these actions/tools that don't (unjustly) harm others. For example, guns: target shooting doesn't hurt anyone, and self-defense is justified. There is no aspect of spam which makes the possibility of spam acceptable. It actively harms others... and that's it.

You're right that action against spammers could be used against "good guys," but that alone isn't enough to make it unacceptable. Things which stop murders and rapists can also be used to stop "good guys," but are necessary nonetheless.

There is a line which shouldn't be crossed in the name of stopping it - raping and killing someone's family members as torture to force someone to find the ISP of a spammer, for example, isn't justified. But the actions described in TFA are certainly acceptable against spam, even if the same actions could be used against the innocent.

Yes, spam really is that evil, and it should be stopped.

Re:Is Spam really that evil?

[hardburn]

In the office, every spam message that pops up has to be checked by the worker and deleted. This is a small cost for each individual message, but when you receive thousands per day (which you easily can) it all adds up to a whole lot of people-hours.

Plus, there's the administrative and hardware cost of the extra traffic, which is a significant percentage IP traffic these days.

Re:Is Spam really that evil?

[Anonymous Coward]

Perhaps in this case, just as many of us accept some combination of deaths from gun violence, abortions, incendiary speech, and family breakdowns and other things, that come as a consequence of the misuse of freedom, might accept spam as a misuse of freedom too, rather than try and trade it all for a world that has no freedom at all.

None of your examples are consuming 75% to 95% of the available resources at any given time.

Re:Is Spam really that evil?

[Anonymous Coward]

Well, considering how some of the 409 spam has lead to significant financial loss and death, I'd say it can be. However, I won't say that it *is* because people who act upon those messages had the choice to think about their decisions before making them.

Re:Is Spam really that evil?

[Daley_G]

...and you're right. Consider the local library's "freedom" to the public internet. You can't do squat on those machines - either legitimate or not - because they're locked-down. You're granted a small bit of "freedom" in exchange for a high level of immunity. On the other hand, not running any sort of antivirus, spam filter or firewall means you have complete, unrestricted access, but at a penalty. Sure, modern society is capable of stopping the bad guys, but at what cost? I don't want my ISP filtering my access any more than I want my government telling me who to work for.

Re:Is Spam really that evil?

[FictionPimp]

I'm surprised spam is really still an issue. I have not seen a spam message in m personal or work email accounts in at least a year.

It all stopped once we moved our mail to google.

Re:Is Spam really that evil?

[FictionPimp]

Granted, my spambox has hundreds of messages in it, but I never see them. I haven't had a false positive either.

if no one ever sees the spam, what is the point of sending it?

Re:Is Spam really that evil?

[Anonymous Coward]

The evil that is spam is explained quite simply: it wastes that most precious of resources.....time. Time is a commodity far more valuable than any coin, the loss of which incurs not only financial consequences, but loss of peace, and very noticeable emotional, mental damage, as well. The last thing to do the same as this, was cable tv, and prior to that, temptation itself.

Ok, seriously, though, the loss of time has repercussions throughout every aspect of an already time starved society.

Re:Is Spam really that evil?

[wolrahnaes]

Because some still do see the spam. Remember that spamming costs incredibly little. One single sale could cover the cost of millions of messages. No matter how few see it and how many fewer buy it, apparently the economics of the situation work.

Which makes sense if you think about it.

[khasim]

Let's use this botnet as an example. 250,000 zombies. What is the likelihood of finding another zombie with random scanning? Not to mention that not everyone leaves their machines on all the time. And even the machines that are on all the time don't always keep the same IP address. Comcast seemed to change my IP address every month.

Somehow, somewhere, the new code has to be uploaded to the zombies. New spam messages. New address to send the spam to. Patches to the zombie code. No matter how you phrase it, that's Command and Control.

Propagating those updates is simple if all the zombies know them. It becomes very slow if it is random chance that propagates the updates.

Of course, you can speed up the process by having the zombie increase the scans. But then you run the risk of the person complaining that their machine is "slow" and having someone wipe it and re-install it.

A layered approach would be the best for the zombie master. Centralized C&C for speedy deployments with P2P for a fall-back in case the original C&C is unavailable. At least then he could regain control of the zombies.

BUT!!!!!

Why isn't anyone focusing on the domain names? Implement a 1 week wait for new domain name deployments so that the payment has time to clear the bank. That way you'll be able to identify the guy paying for the domain names.

As always, follow the money.

Re:Which makes sense if you think about it.

[c6gunner]

Let's use this botnet as an example. 250,000 zombies. What is the likelihood of finding another zombie with random scanning?

Yah, I know! Although we're really going to be in trouble if someone figures out a way to store IP addresses in some sort of file. Why, if that were to happen, they might even be able to pass the IP lists from one computer to another! I hope that nobody ever comes up with something like that ....

Re:Which makes sense if you think about it.

[soundguy]

Why isn't anyone focusing on the domain names? Implement a 1 week wait for new domain name deployments so that the payment has time to clear the bank. That way you'll be able to identify the guy paying for the domain names.

As always, follow the money.

Because 100% of the time, the domains are paid for with stolen credit cards.

Re:Which makes sense if you think about it.

[rdebath]

A p2p communication could be done in about 20 minutes to 250,000 machines without a full list. It's the same problem as an initial 'flash worm' infection except the botherder is the only person who can send out a valid update because of the worm's use of public keys. This assumes you know of a couple of thousand machines to start the update, if you only know of one it will take a bit longer to find those first thousand.

See Warhol worm

Re:Which makes sense if you think about it.

[Anonymous Coward]

Western union and other cash transfer services don't need to "clear the bank".

Re:Which makes sense if you think about it.

[Anonymous Coward]

What about when that IP list is fully turned off?

Domains are easy to update as the C&C machines get pulled offline.

What is "evil"?

[khasim]

I'm only asking, because, as much as we hate botnets and trojans and malware, that, any sort of world capable of rapidly sniffing out and squelching "bad" content is a world that is capable of sniffing out and squelching out "any" content.

It isn't the content. It's the volume (number of messages in this case).

You can say whatever you want. But when you start flooding mail servers with your messages, you've lost the moral high ground.

Now as to whether blocking zombies is the same a sorting through the content of email messages ... if you're worried about that I recommend encryption. There are lots of forms of encryption available.

Perhaps in this case, just as many of us accept some combination of deaths from gun violence, abortions, incendiary speech, and family breakdowns and other things, that come as a consequence of the misuse of freedom, might accept spam as a misuse of freedom too, rather than try and trade it all for a world that has no freedom at all.

That's a rather extreme jump. So far I haven't seen anyone proposing that we surrender all of our Freedoms.

Re:What is "evil"?

[tjstork]

That's a rather extreme jump. So far I haven't seen anyone proposing that we surrender all of our Freedoms

Oh I think I've probably posted in favor of instituting IPV6 and mandatorily identifiable IP addresses, executing spammers, torture for passwords, and worse. Now I'm just arguing the opposite side of the coin as its worth exploring.

Athletic Doping Metaphor

[MarkvW]

The USOC once gave max due process to suspected drug cheats. Dopers would get off for the stupidest reasons. Now, the focus has shifted to a 'you are responsible for the content of your own body.' This has been good for sport.

Just like a polluted athlete pollutes his sport, so does a bot pollute the internet. Suspending access is not a question of right or wrong, it is a question of ensuring the integrity of the network.

The world will get to that place sooner or later.

Welchia

[khasim]

http://en.wikipedia.org/wiki/Welchia

Ah, the good old days.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Signed software.

[khasim]

Have the botnet pass around a binary that erases the botnet binaries from the infected PC on the next reboot, then force a reboot?

Because most of them depend upon digitally signed updates now. So you cannot use the zombie code to remove the zombie code unless you first have the key.

Which makes it rather difficult.

On the other hand ... writing a removal routine should be a LOT easier. A clean removal. Removing just the zombie code and ALL of the zombie code.

The problem then would be getting it to run on the zombies.

This is where the ISP's come in. It's easy enough for them to redirect all your traffic to a web page with the removal code available there. And since it is easy enough to identify the zombies, their IP addresses and their ISP's ... that should be easy, right?

Except it would cost the ISP's some money and they won't do that unless someone forces them to spend the money. So it will take a new law requiring them to do so.

Re:Signed software.

[Weaselmancer]

It's easy enough for them to redirect all your traffic to a web page with the removal code available there. And since it is easy enough to identify the zombies, their IP addresses and their ISP's ... that should be easy, right?

Hah! That's brilliant.

If these machines are infected with the bot, that means they are probably unpatched machines. Maybe the bot installed by drive by.

Have ISPs (who are controlling the local machines DNS) identify bot infected machines, and redirect them to a drive by webpage that will "infect" the visiting machine with a bot cure.

Re:Signed software.

[LaminatorX]

If you have a few infected honeypots and can eavesdrop on the C&C, shouldn't you be able to compromise the key exchange as well? Not trivial but doable when the stakes high. Or are the botmasters using a sequence of one-time-pads for their updates similar to their domain name fallbacks?

Re:Signed software.

[the_enigma_1983]

They just eavesdrop on communications between bots and the C&C. Trying to "compromise" the key exchange is as easy as breaking the asymmetric encryption algorithm. Aka, not very easy at all.

Re:Signed software.

[Almahtar]

I believe what the GP is suggesting is that you intentionally infect a machine you own then look for the decoded key in memory.

Re:Signed software.

[Almahtar]

... excuse me, sorry, I forgot to mention that I already know this is not going to work since it's public/private key crypto and the client never does get the private key. I was just clarifying the intent of the GP's question as I understood it.

Contents

[dandart]

Is this a botnet made of men or mice?

Yeah, you might want to think about that one, too.

[khasim]

Yah, I know! Although we're really going to be in trouble if someone figures out a way to store IP addresses in some sort of file. Why, if that were to happen, they might even be able to pass the IP lists from one computer to another!

Given that the majority of zombies are on home ISP networks (such as Comcast), all that would take to defeat would be for Comcast and other to rotate the IP addresses by 1 whenever the zombie traffic becomes problematic.

So the list of IP addresses becomes useless and the zombies have to fall back to random scanning.

Last week your IP address was 10.10.10.10? This week it is 10.10.10.11. So none of the other zombies can find you at the old address.

In related news ....

[PPH]

... botnet sends android back in time to kill researcher's mother.

Fines to cure malware?

[Interoperable]

I wonder if fines could be an effective solution to botnets. Certainly the only way to treat the problem is to make people responsible for what their computers are up to. If people were held accountable for spam sent from their machines and were fined appropriately they may be more inclined to watch what ends up on their machines.

Of course, there's a theme among the non-"tech-savvy" public to utterly refuse to understand how the technology they use works. Fines on bots would likely be a boon for virus scan companies but other efforts may be required to convince the general public to care. What's needed is less focus on ill-defined "threats" and more on general understanding.

Re:Fines to cure malware?

[Thetawaves]

Yeah, good idea in this economy.

Re:Yeah, you might want to think about that one, t

[c6gunner]

Given that the majority of zombies are on home ISP networks (such as Comcast), all that would take to defeat would be for Comcast and other to rotate the IP addresses by 1 whenever the zombie traffic becomes problematic.

Yuhuh. So since most guns are owned by law-abiding citizens, all it would take to stop murder-by-shooting is to make it illegal, right?

I'm not trying to be a smartass ... actually, yeah, I am, but seriously ... even if 99% of bots were on Comcast, and even if you could rotate all 99% of addresses all at once ... that still leaves 2,500 bots out there whose addresses will remain the same. The botnet could restructure itself in a matter of hours.

The role of Microsoft

[dhammabum]

I see nothing here about what I see to be one of the primary culprits. Microsoft have consistently produced easily exploited, vulnerable software. And they run services and programs with full system access. Sure, they have improved somewhat lately, but they continue to include legacy code in SMB and probably in Office and IE - the whole code base is no doubt riddled with it. No way you should be able to compromise a system with a just a document or a web page.

There are enough vulnerabilities in Linux and MacOS, no doubt, but not such easy meat as Windows.

Re:The role of Microsoft

[Anonymous Coward]

shut up, you big flaming homo

Re:The role of Microsoft

[Anonymous Coward]

And they run services and programs with full system access

No, they don't. Nice try at FUD though. You should update your talking points you got at the last anti-ms troll conference.

No way you should be able to compromise a system with a just a document or a web page.

Cool, so no code execution vulnerabilities have ever been found on Linux? No browsers on Linux have ever been found to have exploits? The dope is good...

An idea:

[Hurricane78]

If the botnet client runs on your own computer... then by definition, your own CPU interprets the list of commands that it resembles.

So nothing can stop you from modifying that program in-place, so it infects all other clients too, until the whole botnet in yours. At least if the clients have some update mechanism.

With a bit of luck, you could even trick the original “owner” into getting infected by your own trojan horse, find out all contact / address data on his system, where he lives, and either send him the cops, or beat him up.
I’d choose: Gay child porn with dead animals on his computer, and then the cops beating him up. ^^

More questions than answers

[Earthquake Retrofit]

I still don't see why the company that makes the penis pills isn't arrested. Why do I hear ads for e-mail marketing services on NPR? A non-governmental approach would be to convince 'legitimate' businesse' that their profits are at risk from spam. Trillion dollar multi-nationals might not be averse to extra-judicial means.

Re:Yeah, you might want to think about that one, t

[StuartHankins]

How does that work when IPV6 becomes the reality?

Only if they have all the addresses on file.

[khasim]

Which makes it even easier because then all you need is a honey net and some virtual machines to be continually "re-infected" and load that file with over a billion fake IP addresses. Or 2 billion.

So when the IP address rotation happens, the zombies have to dig through billions of fake addresses to find the other machines to download the newest patc-another rotation happens and the zombies have to dig through billions of fake addresses to find the other machines to download the newest pat-another rotation happens ... and so on and so forth.

Your claim about 2,500 addresses is simply centralized C&C under a different name. And it is defeated in the exact same way.

Re:Only if they have all the addresses on file.

[c6gunner]

Which makes it even easier because then all you need is a honey net and some virtual machines to be continually "re-infected" and load that file with over a billion fake IP addresses. Or 2 billion.

So, in addition to never having heard of IP lists, and not understanding statistics ... you've also never heard of encryption?

Hell, while you're at it, why not just give your botnet-hunters godlike powers, and have them Miracle the botnet out of existence?

Even ignoring the possibility of encrypted communications channels, it's childs-play to code in a simple function which checks all new IP's as they're added and rejects or sets a lower priority on ones which aren't active. Sorting IP's by "last seen" status is the first thing I did back when I was experimenting with making a P2P app. Putting in a limit on how many commands can be received from each connected peer would also be a common-sense measure that any programmer with half a brain would automatically add.

Really, though, it's the encryption which makes or breaks any botnet. I've taken down small botnets in the past; I've only been able to do that with ones that use crappy encryption or no encryption at all. If you're going to assume that we're able to break the encryption on this hypothetical botnet, then the type of communication it employs becomes irrelevant, and all your fancy plans to disrupt it's communication methods become pointless.

Your claim about 2,500 addresses is simply centralized C&C under a different name. And it is defeated in the exact same way.

That's retarded. You may as well claim that the eD2k network is just an FTP server under a different name. You seem to have no concept of how p2p works.

Re:Only if they have all the addresses on file.

[Locke2005]

Any encryption scheme is crackable when you've got unlimited access to the machine code that actually does the encryption and decryption. Then it simply becomes an exercise in reverse engineering. That means you can decrypt the messages sent in both directions, but not necessarily spoof messages sent by the master since they may be using a trap-door function.

Re:Only if they have all the addresses on file.

[c6gunner]

Any encryption scheme is crackable when you've got unlimited access to the machine code that actually does the encryption and decryption. Then it simply becomes an exercise in reverse engineering. That means you can decrypt the messages sent in both directions, but not necessarily spoof messages sent by the master since they may be using a trap-door function.

Very true. That's why all DRM methods are useless in the long run - they'll be broken eventually. The difference is that when you release a new encryption method for digital media, there will be tens of thousands of people working on figuring out the problem. Whereas when you create a botnet, there may be a few hundred people working on figuring it out, IF you're a big enough problem.

I'll admit that, while I was under the legal age for prosecution, I created a very simple botnet. At one point I had about 3,000 individual computers under my control. I stopped doing that about a decade ago, yet, even today, when I run those old binaries through a virus scanner, none of them are detected. If you keep your endeavors small enough, chances are nobody will ever bother with them. If you create 50 different variants which all communicate on the same network, there's no reason why you couldn't create a much larger network which nobody really pays any attention to. However, the key point here is that even the very large botnets rarely have much in the way of resources directed towards countering them. The average person is going to be much more interested in cracking the newest DRM encryption than in defeating the newest worm or trojan. So yeah, your P2P botnet may eventually be cracked, regardless of how well you encrypt the binaries and the communications channels. However, you'll probably get at least a few years of use out of a well designed network before that happens, and you'll be able to rebuild it in a matter of months. In the end, as long as the people fighting this kind of stuff are reactive rather than proactive, they're fighting a losing battle.

Exactly what are you talking about?

[khasim]

So, in addition to never having heard of IP lists, and not understanding statistics ... you've also never heard of encryption?

You lost. If you cannot admit that, that's fine. Right now all you are doing is demonstrating how badly you've lost.

Even ignoring the possibility of encrypted communications channels, it's childs-play to code in a simple function which checks all new IP's as they're added and rejects or sets a lower priority on ones which aren't active.

Why wouldn't they be active? They're in a honey net. The machine communicating with the external zombies has already validated them.

So in your mind, having all the zombies validate all of the IP address before accepting them is rational?

They'd die just from the traffic of 250,000 connection attempts each.

After 4 IP address rotations, they'd EACH be validating a MILLION address.

And with a simple filter at the ISP level, they'd UNLEARN the 2,500 address you claimed would re-start the zombies after the IP swaps.

250,000 machines validating 1,000,000 addresses = 250,000,000,000 connection attempts.

Looks like you failed math big time.

Re:Exactly what are you talking about?

[c6gunner]

You lost. If you cannot admit that, that's fine. Right now all you are doing is demonstrating how badly you've lost.

This isn't a competition. I'm giving you information based on work I've done. You can take it as a learning experience, or you can get offended and ignore what I'm telling you - it's your call.

Why wouldn't they be active? They're in a honey net. The machine communicating with the external zombies has already validated them.

You have 2.5 billion virtual machines in your honey net? Boy, you must have access to a hell of a lot more resources than I do!

Anyway, you specifically said you wanted to feed the bots "fake addresses" which, by definition, wouldn't be active. Now, if you want to change your plan that's fine, just don't pretend that you meant something else all along.

So in your mind, having all the zombies validate all of the IP address before accepting them is rational?

Yes.

They'd die just from the traffic of 250,000 connection attempts each.

First, they wouldn't have 250,000 addresses to validate. When you sign on to the Limewire network, your computer doesn't cache 3+ million addresses. If I were designing the botnet, I'd put the limit at maybe 10k, and tweak it as required. If I really wanted extra redundancy I might cache 100k, but only have 10k verified at any given time. Second, validation only needs to occur once in a while, and can be done with just a few packets. Lastly, nobody would design a client to make 10,000 connection attempts simultaneously, so your flood scenario is just silly.

After 4 IP address rotations, they'd EACH be validating a MILLION address.

No, they'd simply drop addresses at the end of the list in favor of new ones which actually work. This isn't rocket science. File sharing clients do the same thing - non-responding addresses get dropped in favor of ones which work.

And with a simple filter at the ISP level, they'd UNLEARN the 2,500 address you claimed would re-start the zombies after the IP swaps.

Sure, if you know which addresses to filter. The same technique could theoretically be used to stop spammers TODAY, but, for some strange reason, nobody seems to have been able to pull it off. Maybe you could go to one of the bigger ISP's and offer them your expertise.

250,000 machines validating 1,000,000 addresses = 250,000,000,000 connection attempts.

Looks like you failed math big time.

No, I just know how to think, and I don't have your strange emotional attachment to this issue. If you would actually stop for a minute and think about the claims you're making, you yourself could probably come up with ways to get around the supposed problems. Even a script kiddie should have more familiarity with this stuff than you're presently exhibiting.

Of course, if you've never done any communication-oriented programming/scripting, I can understand your confusion. If that's the case, just say so, and I'll be more than happy to answer any questions you may have.

Spammers

[Anonymous Coward]

Dude...we are all spammers on some level. Just not always using computers.

metaphor abuse

[interkin3tic]

We have a limited number of effective antibiotics. Once a bacteria is immune to an antibiotic, there are fewer effective antibiotics you can treat it with, and if you can't find an effective antibiotic for the next infection, the patient dies.

I don't know much about computer security, but you can't convince me that there are a limited number of ways to fight botnets.

Furthermore, the way to prevent antibiotic resistance is to reserve antibiotics for when they're necessary AND use them in a way that is effective.

This seems about as necessary as fighting botnets come, this was a big botnet that was actually doing damage. This sounds like it was used as effectively as it could have been.

Re:Yeah, you might want to think about that one, t

[Anonymous Coward]

fall-back to scanning that subnet, etc.

Slashdoters should attack the ISP that do not help

[Anonymous Coward]

Slashdot has a huge following. The should attack thsi ISP that do not support the take down. The word "attack" should be legal, I do not condone illegal activity.

Guerrilla Gorilla

[fm6]

Fighting spammers is like fighting against a guerilla army. Constant vigilance, swift response times, and, eventually, wholesale destruction of the people supporting the guerrillas will be necessary to win the war.

Is your use of "wholesale destruction" metaphorical, or do you really think guerilla warfare works that way? Because we tried that in Vietnam, and it didn't work. Which is why U.S. counterinsurgency doctrine got revised to exclude the myth that you can win a guerrilla war just by killing people. You also have to change the environment on the ground so that supporting your side instead of the guerrillas is a realistic option for the general population.

Now, if the war against malware is like a guerrilla war, then it's never going to be over. There will always be some place for the other side to run and hide. We can't order other countries to not host services we don't like, if only because we don't want them to do the same to us.

Fortunately, the analogy with guerrilla warfare only goes so far. The Internet is something people invented, not a foreign country with a complicated history and obscure customs. We can rework the thing so that the Bad Guys have a less friendly environment.

Re:Guerrilla Gorilla

[selven]

I'm pretty sure simultaneously hitting every point on the country with nuclear weapons annihilates a guerrilla army just fine.

Re:Guerrilla Gorilla

[fm6]

No it doesn't. Can you think of a better recruiting tool for a terrorist movement than the deaths of millions of people?

Re:Guerrilla Gorilla

[selven]

Dead people can't blow themselves up in airports.

Re:Guerrilla Gorilla

[fm6]

True, but all their friends who are pissed at you for killing them.... But I covered that issue already.

Do you have any more mindless cliches you want to share? If so, please put them all in one post, so I can shoot then down more efficiently. This will be less work for both of us, and I can tell that avoiding unnecessary mental strain is a high priority with you.

Re:Guerrilla Gorilla

[selven]

I was never talking about making everyone love the country and not attack it. I was talking about militarily defeating people hiding in caves and among civilians. The first is impossible no matter what strategy you use, my whole point is that the second is quite doable. The idea that everyone who doesn't like that the hypothetical country killed millions of people and does something about it automatically joins the "guerrilla army" stretches the concept quite far.

Re:Guerrilla Gorilla

[fm6]

The idea that everyone who doesn't like that the hypothetical country killed millions of people and does something about it automatically joins the "guerrilla army" stretches the concept quite far.

Classic false dilemma. There are other possibilities besides "everybody" and "nobody". And it doesn't take that many to launch a suicide attack or keep a conventional army running in circles.

THIS WAS GOOD USEFUL NEWS FROM /. TODAY 4 ME...

[Anonymous Coward]

Per my subject-line above: WE have the freedom to judge, for ourselves, 1 way or another. Nicest part about being online & understanding how the IP stack works (BSD based ones), is that you can control it yourself, vs. things you know are not "for the good" in your or others' estimation (most importantly your own though):

For me though, well... on that note above? The NICEST part about catching this @ 4 a.m. for me personally while having a cup of coffee is that they provided 3 new records of bogus servers/systems used by this thing, for my HOSTS file to blockout, in:

io7grec9merhpzga.org
g8nolnusu5tveruo.org
b7znmw6skpsorjkp.org

I chose HOSTS files to do the job, & they work... across ALL of my webbound apps, not just a particular browser (which is a limitation of browser addons that also eat CPU, where HOSTS don't (just a filter really), or browser blocklists too).

Heck, because of doing this in a HOSTS file? Hey - I could "suck in" a malware or botnet client program & it too, just like me? CANNOT GO & CALL OUT FOR ORDERS FROM THE COMMAND & CONTROL SERVERS BLOCKED IN MY HOSTS FILE... period.

(LOL... it works on that note too)

So, per my subject-line above?

Well - This article here on /. only made my HOSTS file, that much stronger!

(Just by reading this article, & of course, thus, my "hat's off" to those that nuked this botnet of course, those who printed their news, & those that put it up here too - thanks all of those just mentioned, from me)

APK

P.S.=> All in all - A good article &, actually useful to me!

I state that, because of my statements above, about using HOSTS files to blockout known bad servers & this extends to any and all webbound apps unless they use static IP addressed systems inside their code or in a table it uses.

I.E.-> I'm actually GLAD that there are people that do what they did get noticed & printed about, because for me & how I use a HOSTS file to secure myself online, basically via the simplest principal there is in "if you can't go near the fire you can't get burned" blacklisting (and - which works)?

Well, just by reading this & editing my HOSTS file, my protective method in HOSTS got that much stronger for my reading of this article - by the 3 botnet C&C servers (or other types of botnet constituent machines) being blocked in it as of 4:24 a.m. this A.M. here today over a cup of coffee.

Actually "GOOD NEWS" that was useful news to me as well to me personally, & to my friends + family and other users online that I give my HOSTS file to for the same gains (more speed, better security)... apk

Make ISPs accountable

[Anonymous Coward]

Just make ISPs accountable for what is done with their IP range.

Then they'll be forced to check their traffic and shut botnet victims away from the outside world.

Of course, it will make full internet access hugely expensive and impossible to do anonymously, but limited access (surfing and emails) can still be free for the masses.

The internet is too powerful to not be policed.

I'll stick to math instead, kthx.

[khasim]

This isn't a competition. I'm giving you information based on work I've done. You can take it as a learning experience, or you can get offended and ignore what I'm telling you - it's your call.

And yet the math doesn't add up. Looks like your "work" hasn't been of much value.

You have 2.5 billion virtual machines in your honey net? Boy, you must have access to a hell of a lot more resources than I do!

What was that about the "work" you did? It's addresses. Since I control the routing, it would appear to the infected machines that there are billions of addresses with machines at those addresses.

So what is this "work" you do that you fail basic math AND you fail basic routing?

If I were designing the botnet, I'd put the limit at maybe 10k, and tweak it as required.

Yeah. So you'd start a list of addresses and when the zombies no longer worked, you'd fix the list of addresses.

So, how are you going to fix the list of addresses when you cannot connect to the zombie anymore because it has the wrong addresses in it?

Again, nice "work" there.

If I really wanted extra redundancy I might cache 100K, but only have 10k verified at any given time.

LMAO.
You're talking about caching 100K addresses on a botnet that has 250K members.

Remember that part where I told you that you failed math? You just failed again. This "math" thing is kicking your ass.

Second, validation only needs to occur once in a while, and can be done with just a few packets. Lastly, nobody would design a client to make 10,000 connection attempts simultaneously, so your flood scenario is just silly.

What is this "once in a while". It needs to occur more frequently than the ISP's rotation of IP addresses. Again, you fail.

Which means that those 10,000 connection attempts (I won't even go into how you have no idea what the size of a packet is) need to happen before the next rotation or they're useless. Again, routing and math. You fail them both.

No, they'd simply drop addresses at the end of the list in favor of new ones which actually work. This isn't rocket science. File sharing clients do the same thing - non-responding addresses get dropped in favor of ones which work.

You might want to review how file sharing clients work. Because you seem to have missed the part where they INITIALLY connect to a centralized server for a list of clients sharing a file.

But in your "work" you probably knew that already, right?

Looks like you failed file sharing, also.

Sure, if you know which addresses to filter.

Wouldn't that information be easily available by watching what one of the boxes in the honey net does after the IP address rotation?

Like I said, you fail routing. Big time.

Seriously. You need me to point out each of the basic flaws? And only then do you try another flawed work around. Why is that when you claim to have so much "work" experience?

No, I just know how to think, and I don't have your strange emotional attachment to this issue.

Since I keep pointing out the flaws in your "work", this must be some new definition of "think" that means "make errors".

If you would actually stop for a minute and think about the claims you're making, you yourself could probably come up with ways to get around the supposed problems.

Yeah, you might want to work on that "think" thing again.

I've already explained how to I would approach the problem. YOU are the one claiming that it wouldn't work and offering up all the flawed approaches (and math failures) trying to show that it wouldn't work.

You don't even know how LimeWire works. I mean, really. It's not magic.

Of co

Re:I'll stick to math instead, kthx.

[c6gunner]

This is idiotic. You've concocted a scenario where:

1. You know exactly which machines are infected.
2. You're able to reverse-engineer the code in order to obtain the required commands and passwords.
3. You're able to isolate the infected machines and feed them whatever data you want.
4. You're able to rotate IP's any time you feel like it, without having to worry about disrupting the service to all of your clients.

In other words, you've taken my earlier offer at face value and literally given your bot-hunters godlike powers. In such a scenario, you're absolutely right - the botnet would have no chance (even if you are completely wrong about WHY). Unfortunately, real life doesn't work that way. Since you clearly don't have an inkling about the issues involved here (or a basic understanding of math and statistics, apparently), and are unwilling to listen, I think we're done.

Don't hate me because I'm beautiful.

[khasim]

2. You're able to reverse-engineer the code in order to obtain the required commands and passwords.

Whoa there, son.

You might want to add "reading with comprehension" to the list of things you've failed. No where did I say that. Feel free to re-read and post a link if you can find that.

3. You're able to isolate the infected machines and feed them whatever data you want.

Yep! You might also want to add "honey net" to the list of your failures. That is one of the properties of it.

In other words, you've taken my earlier offer at face value and literally given your bot-hunters godlike powers.

Yeah, you might want to address the points that you keep failing at before making statements like that. It only seems "godlike" because your understanding is so limited.

Once you address the flaws in your understanding, you'll be better able to hold a discussion.

Unfortunately, real life doesn't work that way. Since you clearly don't have an inkling about the issues involved here (or a basic understanding of math and statistics, apparently), and are unwilling to listen, I think we're done.

You were the one suggesting that scanning 100K IP addresses was viable.

Yes you were. :)

Re:Don't hate me because I'm beautiful.

[c6gunner]

No where did I say that. Feel free to re-read and post a link if you can find that.

Your entire argument depends on it, jackass. Without the ability to connect to the botnet, you cannot distribute new IP's to it. At this point it's clear that you don't even know WHAT you're arguing for.

Yep! You might also want to add "honey net" to the list of your failures. That is one of the properties of it.

I don't think that phrase means what you think it means.

You were the one suggesting that scanning 100K IP addresses was viable.

"You might want to add 'reading with comprehension' to the list of things you've failed"

Well then you shouldn't have a problem, right?

[khasim]

Your entire argument depends on it, jackass.

Well then you shouldn't have a problem linking to it, right?

Right?

Oh, you can't.

Is it because you don't know how to post a link a here?

Is that it?

Do you want me to tell you how to do that? I can.

Tell me that you want me to teach you how to post a link.

I don't think that phrase means what you think it means.

So you are saying that I do not control the routing in a honey net? Is that it?

Or that I don't control the IP addresses? Maybe that is it?

Or that I don't control the machines on it? Is that what you think?

Just tell me that you want me to teach you how to post a link. It's okay if you don't know how to do that. You don't have to feel bad about it. It's okay. Ha ha hahahahahahaha

Re:Well then you shouldn't have a problem, right?

[c6gunner]

Well then you shouldn't have a problem linking to it, right?

.... HUH??

A link to ... ???? What? YOUR ENTIRE FUCKING ARGUMENT???

Sure, here's your link. I hope you find it highly informative. In the meantime, if you have any idea what you're talking about you should have no problem providing a purple monkey dishwasher, right?

Well?

Oh you can't.

Is it because you don't know how to think?

Is that it?

Do you want me to tell you how to do that? I can.

So you are saying that I do not control the routing in a honey net? Is that it?

No, I'm saying that you're a complete twit, and that I'm done wasting my time. A fucking chimpanzee would have understood this by now, and would have left less shit on the walls. I can cure your ignorance, but not as long as your narcissism is in the way. Seek help.

Yay! I taught you about honey nets.

[khasim]

No, I'm saying that you're a complete twit, and that I'm done wasting my time.

So you agree that on a honey net I do control the routing.

And the IP addresses and the machines.

Yet you seemed to be claiming that it isn't possible for me to:

3. You're able to isolate the infected machines and feed them whatever data you want.

And now you admit that I can do that. :)

I am such a great teacher! I have taught you that. It probably gives you a very warm feeling in your heart to have me teach you things that you did not know.

One day you will realize how much I have taught you and you will thank me.

So, shall we review what I have taught you? On a honey net, I control the routing and the machines and the IP addresses. Can you say that with me?