Slashdot Mirror
New Russian Botnet Tries To Kill Rivals
alphadogg writes "An upstart Trojan horse program has decided to take on its much-larger rival by stealing data and then removing the malicious program from infected computers. Security researchers say that the relatively unknown Spy Eye toolkit added this functionality just a few days ago in a bid to displace its larger rival, known as Zeus. The feature, called "Kill Zeus," apparently removes the Zeus software from the victim's PC, giving Spy Eye exclusive access to usernames and passwords. Zeus and Spy Eye are both Trojan-making toolkits, designed to give criminals an easy way to set up their own "botnet" networks of password-stealing programs. These programs emerged as a major problem in 2009, with the FBI estimating last October that they have caused $100 million in losses."
Trojans, worms and viruses have been eliminating rivals for a long time. It's all part of the strategy to avoid being detected. The slower a system gets and the more unwanted traffic it generates, the more likely it will be analyzed in depth, and that's not good for the bot net.
Apparently we've decided to go the "natural" route in software security: Instead of making software which cannot be compromised, we do a "good enough" job with software quality and then fight infections with some kind of immune system. IMHO this is the root of the problem. Computers are not highly redundant systems like biological systems. We really ought to create software which is safe by design.
Could be an interesting way to create a "real" AI.
Best Slashdot Co
What could be better than botnets trying to destroy each other? Eventually one of them will screw something up and fewer and fewer systems will be members of any botnet as they get corrupted. That can only be good news as users wind up having to reinstall their software and hopefully at least a small percentage will learn a thing or two about security along the way.
The cesspool just got a check and balance.
How long will it be until this is a reality?
Need Geek Rock? Try The Franchise!
Why isn't this kind of technology being used to fight botnets? Couldn't a program be released using virus-like means to disseminate itself, and try to eliminate malicious software wherever it finds it? Sort of like a distributed-computing project, with each peer actively trying to disseminate a "counter-virus"? Or "antibodies", if you will?
Malware gets exploited... Are we about to see makers start releasing patches for the malware to fix security holes?
Patching an exploit in your exploit? Is that good or bad?
They are competing for resources (which may or may not be scarce) and one can now prey on the other.
Either evolve a defence, or die out.
(Oblig tag)
That's evolution in a nutshell. Note that no one is claiming the programs spontaneously emerged into cyberspace. Evolution has nothing to say about the origin of life. Abiogenesis is not Evolution.
In my day, we called this stuff Core Wars, and we kept our viruses in jars and shook them to make them fight.
If you were blocking sigs, you wouldn't have to read this.
Third world scoundrels, the lot of them. Too bad China doesn't need a(nother) peasant labour force.
Embrace, extend, extinguish...
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
...Lisbeth Salander is behind this!
If it's really costing just American people and companies that much money, maybe it's time to stop using Windows.
There are so many alternatives! Servers should be running OpenBSD, FreeBSD, NetBSD, Solaris, Linux, Mac OS X Server, or even AIX and HP-UX.
Mac OS X and Linux make pretty damn good desktop systems for most users.
And if you need to run Windows, perhaps do it only on a system that isn't networked.
I think it would have been cooler for that "russian botnet killer", if it was able to convert the "enemy" botnet program and have it under its control than just kill it.Then that converted program could start converting its own kind.Just like what Agent Smith was doing in Matrix!
I'll make some popcorn and we can all enjoy the show.
But seriously, only 100M in losses?
I don't have the figures at hand, but "McAfee forecasts $1.8 billion in revenue for 2009". I would put the cost of the extra security in; the US did that when prosecuting Gary McKinnon, so there appears to be precedent.
Just another "Cubible(sic) Joe" 2 17 3061
Botnets already receive upgrades faster than your XP.
Patents Drive Free Software as Hurricanes Drive Construction Industry
Usually the saying "the enemy of my enemy is my friend" would apply but in this case the enemy of my enemy is still my enemy.
Spy Vs. Spy!
"If still these truths be held to be
Self evident."
-Edna St. Vincent Millay
But -- but -- That was my stolen property!
What are things coming to when you can't count on honor among thieves. I mean, thieves stealing from thieves? What is this world coming to!
You have this infected machine, perhaps it's a bot sending out bulk spam. Or you install a game on it, and a trojaned executable steals your CD-key and sends it off.. to China? To Russia? Who knows... Or you do some home banking with it (imbecile!), and possibly some program monitors your keystrokes, and sends of username+passwords to "parties unknown".
But the recurring problem: how to explain this to a noob? They're sitting on this trojaned machine, actively using it, processing private data with it, and just don't seem to care (as long as the apparatus still does the job). Anyone know of a good way to explain it to a person like this, what the dangers are? Why they should desinfect / wipe the machine ASAP? What does it take to make them understand what it means "there's a trojan / backdoor on your machine"?
Or is this futile? Should you just wait until they get hit hard(er)? Bank account emptied, e-mail account hacked, game CD-key blocked etc.? Any ideas?
If you can't expect your botnet-ware to keep your machine secure, then it's time to replace it. That is why we keep it on there right? It's a simple tradeoff, all our identity for some peace of mind.
The news that a botnet is killing its rivals is nowhere near as disturbing as the news that it's decided to kill its rivals.
--
make install -not war
Here it is... the reminder that Capability Based Security can fix this, if we raise awareness of its existence, and push to get it implemented. The idea is older than Unix, for chrissakes.
This may sound naive, but I'm assuming that the vast majority of the machines used in botnets are Windows PCs? So has any attempt been made to make Microsoft take some of the responsibility of this phenomenon on and do something about it?
-= This is a self-referential sig =-
I was thinking more of Battle Bots.
Something i don't quite understand about theses botnets, the numbers are so high I wonder if AV or antimaleware not detect them? Because the size of each botnet are huge!
It makes me wonder if any of my PC"s are part of the bnet, and the AV's just don't detect it. I use game cracks even with games I own so I don't have to deal with CD/DVD's (2 toddlers, nothign is safe) I scan everything with clamAV and at least one other (avast/avg or even trendmicro), but using bittorrent makes it impossible to monitor traffic.
So, would having an up to date AV really protect people?
The spirit of resistance to government is so valuable on certain occasions that I wish it to be always kept alive
They'll be solved by a well-targeted AK-47.
http://www.opensc.ws/opensc-marketplace/9184-new-bot-spyeye-v1-0-formgrammer-autofill-cc-modules-5.html
Spy Vs. Spy!
Why not Bond Girl vs. Bond Girl? The spy can fetch some Martini in the meantime.
Ezekiel 23:20
It can be a reality, it's just that nobody's bothered to set up a virus farm with a malware visualization system yet.
If I could just free up the hardware...
"When information is power, privacy is freedom" - Jah-Wren Ryel
Minor quibble. Yes, botnets suck and mafia run hackers can suck the stale &@%$ out of a necrotic &!#@'s &#%$#. But, does anyone ever believe any of these "X causes $Y Billion" losses estimates? Whether it's the RIAA, MPAA, BSA, FBI, FCC, or whatever, I think they make those numbers up.
Waltz, nymph, for quick jigs vex Bud.
Thanks for it and the botnet tips: spy eye and zeus, gotcha!
You see, Killbots have a preset kill limit. Knowing their weakness, I sent wave after wave of my own men at them, until they reached their limit and shut down.
Michael Coyne
http://turthalion.blogspot.com
Maybe it would be a good analogy if the trojan was programmed only to "spread" and then it decided to take out other trojans so that it could reach that goal.
The trojan is programmed, upon infection, to search for files with certain hashes (or whatever) and delete them. The decisions it made were far, far simpler with simple pre-programmed actions down to very minute details.
Humans are not programmed, for example, to put one foot in front of the other in a high-speed cycle in the direction of a gazelle and rotate the arm forward quickly while holding a spear and release it at a certain point in the throw calculated by the distance and angle to target and then to ambulate over to the corpse grab it with one hand and drag it back to the cave and beat your chest using an alternating reciprocating motion with both arms within sight of a reproductive female. You are programmed to survive and reproduce, those are just ways of going about it.
(I wanted to use a more up-to-date example, but holy shit, it is WAY more complicated these days!)
The intelligence of this trojan is comparable to a jellyfish, to be generous.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Botnet hijack...other botnet!
Botnets are the major attack vector for both infection and exploitation, so our best defense must be an offense to hit the bad guys where it hurts them the most: Destroy the botnets.
I know a lot of gutless security researches say that the criminals will retaliate and maybe even kill people. Well news flash hot shot! - The criminals have always killed the people getting in their way so that changes nothing. We just need to hit them hard enough so that they have nothing to retaliate with, both financially and otherwise.
It's actually very simple: Once a bot is activated to do something besides checking in with its C&C it reveals itself either by sending spam, participating in DDoS or similar. Once revealed it must be destroyed. As most are simple household PCs running unpatched versions of Windows, chances are there are still open exploitable holes as some bots close the avenue of infection behind them but where there's one hole, there's probably dozens of others. Attack the bot and infect it with a doomsday virus that wipes out the system and the bot is dead. Sure the stupid user might re-install and restore from backups but if the bot is reactivated the process is repeated. At some point the user will install proper patches and antivirus software (or a better operating system) or just give up and the problem is solved either way. It can be totally automated and where the bot cannot be taken down from the inside, it must be taken down from the outside. It is trivial to kick a Windows PC connected with a cable modem or ADSL off the net if you're on a backbone yourself.
The youtube thing that Symantec put up really, really bothers me. Sure, they did a good job of blocking out the website they are going to, and trying to block other information from keeping script kiddies from accessing the same pages.
However, when you can watch them scroll through forums, and see usernames as unique as the ones that are present, all someone has to do is to throw the username into google, and immediately get the damn forums with the hacking toolkit. Quickly scrolling through that particular website, it seems several of the "toolkits" posted have been backdoored with some other virus or trojan, so even trying to build one means you get infected. Sure, anyone who tries to actually use that stuff is just going to wind up getting what they reserve, but even so, it bothers me.
I really, really wish companies would stop thinking they are "clever" and showing people how easy it is to access this crap in order to scare them into buying their magical products.
One of these days i'm going to find this 'peer' guy and reset HIS connection!
A better parallel is Internet Core Wars
Laissez lire, et laissez danser; ces deux amusements ne feront jamais de mal au monde. - Voltaire
Or course they would not the public know, but it would be nice if the only person doing this was the FBI themselves, in a hidden way to farm information, and also keep a handle on criminal activity, so starting as of now, I say we let the FBI come up with the best dang trojan, and let them battle it out with the rest of them, and I would willingly go back every once in a while to the FBI infect me site, to make sure to get reinfected with theirs and let theirs remove all the others...could you imagine if we all did that, the only person left to blame for the stolen money would be them...but that would be impossible to prove.
I have used a lot of Anti-viruses but they are just a garbage not more than else To protect PC from viruses is not a simple task. If this software is going to clean all viruses than i am going to purchase it. What you say guys.will it work? by flights to london