Slashdot Mirror
Microsoft Secretly Beheads Notorious Waledac Botnet
Barence writes "Microsoft has quietly won court approval to deactivate 277 domain names that are being used to control a vast network of infected PCs. The notorious Waledac botnet is being used by Eastern European spammers to send 1.5 billion spam messages every day, and infect hundreds of thousands of machines with malware. In a suit filed in the US District Court of Eastern Virginia, Microsoft accused 27 unnamed defendants of violating federal computer crime laws. It further requested that domain registrar Verisign temporarily deactivate the domains, shutting down the control servers being used to send commands to the machines. The request was secretly approved by District Judge Leonie Brinkema, allowing the action to be taken covertly, preventing Waledac's operators from switching domains."
This is nice (if reactionary) but how long before we can get a court order to legally fight the botnet by 'infecting' the target computers with a patch, or at least some sort of message that warns the user to seek help?
Would Microsoft ever go that far? Would that be admitting that the only solution to the holes in Windows is vigilantism?
Even if the control machines loose DNS resolution, might not the botnet be configured to fall back to connecting to well known IP addresses to accept commands? Seems like the logical thing to do if you are creating an illegal network...
It's not crap in the OS that causes the vast majority of infections. It's crap in the user's heads.
Why not just add code to check for an infection in the next Windows update. If found, then the user is presented with a dialogue at every boot that they must ok, and prevents them from logging in for 5 minutes for the first boot, increasing by 1 minute for each subsequent boot. Even lazy idiots will eventually get sick of this and do something about their machines.
Code, Hardware, stuff like that.
MS has the "malicious software removal tool" that shows up monthly in Automatic Updates and it will take care of it - but unfortunately WAY too many people don't have the automatic updates enabled or just refuse to run them. If they would run them a couple of these botnets would be gone.
... but HOORAY FOR MICROSOFT!
I hate printers.
It's not crap in the OS that causes the vast majority of infections. It's crap in the user's heads.
Cheap cop-out.
You're in a mass-market. You can not expect the majority of users to know anything about computers. You can debate that point all you like, but that's how it is. Saying otherwise is like saying only car mechanics should be allowed to drive cars.
Assorted stuff I do sometimes: Lemuria.org
This can also be started manually by running "MRT.exe" from the run prompt. The month of the update is in the title bar, so it's easy to tell if you're current or not.
-- "Freedom is the right of all sentient beings" -Optimus Prime
Cheap cop-out.
You're in a mass-market. You can not expect the majority of users to know anything about computers. You can debate that point all you like, but that's how it is. Saying otherwise is like saying only car mechanics should be allowed to drive cars.
No, it's more like saying "people should know how to drive before taking their car on public roads"
The Ukranians, Poles, and Chechs called. They're insulted that you're lumping them in with the Rooskies, and they're rooting your box.
The insulted Czechs are now rooting your box.
That explains all the spam. The Czechs are in the mail.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
You're in a mass-market. You can not expect the majority of users to know anything about computers. You can debate that point all you like, but that's how it is. Saying otherwise is like saying only car mechanics should be allowed to drive cars.
But you can tell them to perform preventative maintenence like fluid changes, etc. Then it is their fault if they think they know better and ignore the manufacturer's recommendations.
An example would be brake pads. If you're lazy, you might never replace your brake pads, making you a hazard to everyone else on the road. So, brake pads have metal filings in the last portion of the pad to make an obnoxious grinding noise when it's time to change them. What better way to get people to take care of their car/computer than to annoy them until they fix the issue?
Write your representatives! Repeal the 2nd Law of Thermodynamics!
Is today the day we like Microsoft?? I just want to make sure I have that right. Its not some trick to cover them acting like vigilantes is it??
I am Slashdot. Are you Slashdot as well?
It's not "president". You probably meant "precedent".
No he really does mean "president". You see, now that Bill isn't there, Microsoft has this big tank of goop out in the back, and whenever they need a new VP to make a bold policy change they open a valve and flow the goop into a person shaped mould. Then they have to let it harden or "set". After which time they decant the new president and set him to work
Thus the OP was expressing his concern for the Zombie like creatures that this policy has brought to (semi) life
He must be a member of PETZ
I am Slashdot. Are you Slashdot as well?
At least that is what the headline could be. Disabling foreign internet service is a big deal.
Could be a serves them right for registering as .com rather than .country. But this is one branch of the US government disabling some foreign infrastructure.
I am by nature a MS basher ... at times even a rather venomous one .. but let's give MS some credit here. They went to court and obviously provided enough evidence that a judge was convinced (yes, yes, I hear the chorus of 'what qualifications did the judge have?'). They didn't take actions into their own hands and they released the information about it once the court ruling was made.
... I feel a little dirty now ... I better go clean up. I'm pretty sure Steve Jobs will personally come over to repossess my Apple Fan Boy card. Sniff, I'm going to miss it ... a lot. But, I'm rather excited to finally meet Mr Jobs :-)
The fact remains that MS was actually acting in their own best interest and that of their customers. Those of use who don't use Windows will probably benefit by receiving a little less spam every day, too.
Hmmm
In most cases, a court won't issue a TRO without notice to the defendants and a hearing to allow the sought-to-be-enjoined party to response to the Motion for TRO. In some situations, like this, where mere notice might allow the Defendants to further the harm, the court orders the TRO without notice to the enjoined party. The Order allows the Plaintiffs to demand third parties to do or stop doing something for the enjoined party - the first notice to them is when they can't access bank accounts, or their vendor refuses to cooperate, etc.
The safeguards built into the system are (1) the cash bond, (2) a neutral judge that weighs the likelihood of irreversible damage and proof of the initial allegations against the harm from enjoining a party before a verdict, and most importantly, (3) that these are TEMPORARY. The judge will order a hearing with BOTH parties within (usually) 10 days of the TRO issuance, at which time the Defendants can object, rebut the Plaintiff's allegations, and ask the court to lift the injunction. At that point, it is a dispute between two noticed parties before a neutral court.
If you break your leg tomorrow. Were is your money coming from? Right, your boss. Sick leave. Burglers haven't got it.
Neither can you boss turn out to be carrying a gun and blow your brains out rather then pay you.
If you botch up your work, you won't land in a small cell with a guy named Bubba who likes you very very much.
You ex-gf can't turn you into your boss, even if you really screwed up.
A live of crime sound easy, but it isn't. If it was, more people would do it.
Take the pirates of somalia, sounds like easy money, but how many regular sailors can have their brains blown out by a sniper and nobody gives a damn? And if you think it sucks that your wife wants your wages, wait till you have to deal with the crime hierarchy. They are like the IRS, but not as nice. Oh, and then there is the IRS who can hook you up with Bubba again if you can't account for every penny in your pocket.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Ever heard of Malicious Software Removal Tool that is rolled out in in the monthly patch cycle. It kills software MS deems bad. No court approval for that.
No court approval needed, you clicked that you agreed with the TOS, EULA, description of what these files contain. Last time I used MS update (admittedly over a year ago) each download had it's own name. If there was a name like Malicious Software Removal Tool I would definitely take a peek inside the description to see exactly what it was doing.
This brings us back to the whole user issue. Most users accept all updates from MS (and pretty much any software vendor) without even so much as looking at the titles of the files their downloading. Maybe if people took a little more responsibility they wouldn't be surprised as to why their friendly purple gorilla buddy disappeared (I thought that thing had died years ago but I just saw him on someone's computer in the library last week).
"Educate the mind but never at the expense of the soul."~Blessed Basil Moreau
If MS would stop including questionable programs or new versions (not just bugfixes) in their Automatic Updates, people would trust them more. But there's nothing like having a working system screwed up by some new version of software to make you turn the damn thing off.
Automatic Updates should not be the equivalent of loading some unstable branch in Linux. We pay MS a lot of money to get this shit right, and they're full of fail.
Going by the microsoft graphic of the operation, they could just arrest people who wear dark sunglasses and colored head scarves.
"Waste not one watt!" - CZ
So Microsoft secretly filed a suit against 27 unnamed individuals, and got a secret order taking 277 domain names away from them, all based on a mere accusation.
Oh, but since we're fighting spam, I guess that's okay.
Wait until Microsoft starts doing this to go after copyright violations. Will y'all be cheering then?
My fiancée IAL working in a federal district court. I have mod points, but I guess it's more illuminating to reply than mod down this ridiculous comment.
Stuff is filed under seal in court all the time. The idea is that you don't want the defendant you're pursuing to know you're pursuing them if there's a high chance they can cover their tracks. You can't just make a "mere accusation" and get a court to do whatever you want. That, of course, would be silly.
Most judges are really quite reasonable about the decision to keep things sealed. In any event, all the docs will become unsealed relatively quickly -- and if you think the court was *unreasonable*, that they abused their discretion somehow, you can take your complaint to the appellate court.
Court proceedings are slow, but some crooks (especially intelligent, well-funded crooks) can move fast. This is the balance we've found between thinking things through carefully, and satisfying the public's right to this information, while still prosecuting agile crooks.
In copyright infringement cases, the plaintiff would probably have a hard time convincing the judge that docs need to stay sealed.
Believe it or not, the system actually works pretty well sometimes.
Look, I'm all for an intelligent discussion of the shortcomings of the legal system, of which there are plenty. But you should really try to learn something about it before criticizing it. Otherwise you're just wasting everyone's time.
Because idiots are amazingly inventive, persistent, and breed at a rate so ferocious that rabbits are envious.
Come up with a "foolproof" way for securing a system and some imbecile will find a way around it.
Not to mention all the inconveniences such a lockdown method would inevitably entail.
Chas - The one, the only.
THANK GOD!!!
This has nothing to do with US control of DNS.
They went to the domains' REGISTRAR (GoDaddy) and got THEM to disable the domains.
Control of DNS could be in the hands of Bumblefuckistan and they still could have done this.
Chas - The one, the only.
THANK GOD!!!