Slashdot Mirror
New Russian Botnet Tries To Kill Rivals
alphadogg writes "An upstart Trojan horse program has decided to take on its much-larger rival by stealing data and then removing the malicious program from infected computers. Security researchers say that the relatively unknown Spy Eye toolkit added this functionality just a few days ago in a bid to displace its larger rival, known as Zeus. The feature, called "Kill Zeus," apparently removes the Zeus software from the victim's PC, giving Spy Eye exclusive access to usernames and passwords. Zeus and Spy Eye are both Trojan-making toolkits, designed to give criminals an easy way to set up their own "botnet" networks of password-stealing programs. These programs emerged as a major problem in 2009, with the FBI estimating last October that they have caused $100 million in losses."
Trojans, worms and viruses have been eliminating rivals for a long time. It's all part of the strategy to avoid being detected. The slower a system gets and the more unwanted traffic it generates, the more likely it will be analyzed in depth, and that's not good for the bot net.
Apparently we've decided to go the "natural" route in software security: Instead of making software which cannot be compromised, we do a "good enough" job with software quality and then fight infections with some kind of immune system. IMHO this is the root of the problem. Computers are not highly redundant systems like biological systems. We really ought to create software which is safe by design.
How long will it be until this is a reality?
Need Geek Rock? Try The Franchise!
Why isn't this kind of technology being used to fight botnets? Couldn't a program be released using virus-like means to disseminate itself, and try to eliminate malicious software wherever it finds it? Sort of like a distributed-computing project, with each peer actively trying to disseminate a "counter-virus"? Or "antibodies", if you will?
They are competing for resources (which may or may not be scarce) and one can now prey on the other.
Either evolve a defence, or die out.
(Oblig tag)
That's evolution in a nutshell. Note that no one is claiming the programs spontaneously emerged into cyberspace. Evolution has nothing to say about the origin of life. Abiogenesis is not Evolution.
In my day, we called this stuff Core Wars, and we kept our viruses in jars and shook them to make them fight.
If you were blocking sigs, you wouldn't have to read this.
Embrace, extend, extinguish...
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
If it's really costing just American people and companies that much money, maybe it's time to stop using Windows.
There are so many alternatives! Servers should be running OpenBSD, FreeBSD, NetBSD, Solaris, Linux, Mac OS X Server, or even AIX and HP-UX.
Mac OS X and Linux make pretty damn good desktop systems for most users.
And if you need to run Windows, perhaps do it only on a system that isn't networked.
"What could be better than botnets trying to destroy each other?"
Well, on the surface it looks good, but before long they'll be collaborating and eventually they'll learn to mate and produce better offspring. Then we'll have to amend the Defense of Marriage Act to keep botnets from getting married and start enforcing Don't Ask Don't Tell for networks.
It's amazing how many people don't know that SkyNet's parents were homosexual transvestite liberal russian hackers that smoked heavily and collected guns.
dARIUS qUAN predicted all of this. We should have listened!
I'll make some popcorn and we can all enjoy the show.
But seriously, only 100M in losses?
I don't have the figures at hand, but "McAfee forecasts $1.8 billion in revenue for 2009". I would put the cost of the extra security in; the US did that when prosecuting Gary McKinnon, so there appears to be precedent.
Just another "Cubible(sic) Joe" 2 17 3061
Spy Vs. Spy!
"If still these truths be held to be
Self evident."
-Edna St. Vincent Millay
But -- but -- That was my stolen property!
What are things coming to when you can't count on honor among thieves. I mean, thieves stealing from thieves? What is this world coming to!
You have this infected machine, perhaps it's a bot sending out bulk spam. Or you install a game on it, and a trojaned executable steals your CD-key and sends it off.. to China? To Russia? Who knows... Or you do some home banking with it (imbecile!), and possibly some program monitors your keystrokes, and sends of username+passwords to "parties unknown".
But the recurring problem: how to explain this to a noob? They're sitting on this trojaned machine, actively using it, processing private data with it, and just don't seem to care (as long as the apparatus still does the job). Anyone know of a good way to explain it to a person like this, what the dangers are? Why they should desinfect / wipe the machine ASAP? What does it take to make them understand what it means "there's a trojan / backdoor on your machine"?
Or is this futile? Should you just wait until they get hit hard(er)? Bank account emptied, e-mail account hacked, game CD-key blocked etc.? Any ideas?
Your ideas interest me and I would like to subscribe to your newsletter.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
The news that a botnet is killing its rivals is nowhere near as disturbing as the news that it's decided to kill its rivals.
--
make install -not war
Here it is... the reminder that Capability Based Security can fix this, if we raise awareness of its existence, and push to get it implemented. The idea is older than Unix, for chrissakes.
This may sound naive, but I'm assuming that the vast majority of the machines used in botnets are Windows PCs? So has any attempt been made to make Microsoft take some of the responsibility of this phenomenon on and do something about it?
-= This is a self-referential sig =-
http://webtorque.org/wp-content/uploads/malware_biz.pdf
the really quiet well made ones you don't hear much about.