Slashdot Mirror
Zeus Botnet Dealt a Blow As ISPs Troyak, Group 3 Knocked Out
itwbennett writes "Ninety of the 249 Zeus command-and-control servers were knocked offline overnight when two ISPs, named Troyak and Group 3, were taken offline. Whoever was behind the takedown 'just decided to knock out a large area of cyber-crime, and this was probably one of the easiest ways to do it,' said Kevin Stevens, a researcher with SecureWorks. As with the McColo takedown of just over a year ago, Troyak's upstream providers seem to have knocked it off the Internet, Cisco said in a statement. 'The ISP was "De-peered,"' Cisco said. 'Troyak's upstream network providers effectively pulled the plug on Troyak's router, refusing to transmit its traffic.'"
What about the other 150?
I have a difficult time understanding how Zeus is *still* around; it started in mid 2007! According to WP, it has more than 3.6 Million infected PCs.
There is no reasonable stance that defends the existence or the activities of botnets either legally or morally. How is it that we know there are 150 other command nodes, presumably that we can also discover their IP addresses, but law enforcement has been unable to bring them down?
While I understand there are differences in laws, and with what is legal and what is accepted in different jurisdictions, but this seems patently absurd. If an ISP provides service to a verified botnet control node, and refuses to quickly turn them off, I would expect immediate upstream action like this. Why hasn't this happened even more?
Read that, figured it was Nine, read the article, 90 of 249
I'm not sure exactly how many Niney is, but it sounds like a lot!
Niney n. The amount of drinks it takes to say this word correctly.
knocked offline...taken offline....takedown...knock out.......have knocked it off..."De-peered,"'...pulled the plug... refusing to transmit
I'm sorry, you're going to have to repeat that; what happened? Were they somehow removed from the internet?
Might as well call it by its name: Internet Death Penalty
John Chambers thinks he's John Wayne.
Violation of network neutrality?
Because the spammers and such are paying good money for such "bullet-proof" hosting sites.
Meanwhile, the more legitimate ISP's don't want to spend the money to block the command/control servers individually on their networks.
All I have to say is, "Bout time"!
In Russia, Chuck Norris knocks out your bot net niney times , as he turns seveny.
I smell my karma burning.
According to this article: "Just hours after Internet service providers severed network connectivity to Troyak, an ISP associated with the Zeus botnet, the ISP has regained connectivity after peering with a new upstream Internet service provider."
As far as I can tell, Cisco wasn't involved in the decisions. It looks like the writer went to the two ISPs for comment, but came up dry--well, except for that one anoymous comment. Then the writer asked Cisco what they thought about the whole thing to fill out the piece. Probably the ISPs are afraid of being targeted in retaliation and want to keep a low profile.
knocked offline...taken offline....takedown...knock out.......have knocked it off..."De-peered,"'...pulled the plug... refusing to transmit
... IT IS A DEAD ISP! </cleese>
When the gods are at war it is us, mere mortals who suffer because of it. Ye best beware the Ides of March will soon be upon us!
The only way to truely combat cybercrime is to just cut the connection.
When you have a country that willingly harbors criminals - just because they are attacking someone else - the problem ceases to be one of law enforcement or diplomacy. Sure, you can try to send some cops over there and see what can be accomplished. For the most part, not much.
The key is that if Russia, Bulgaria, Romania or whereever wants to have "Internet freedom" for their citizens where they can do whatever they heck they want without any consequences, the only possible response is for everyone else on the planet to just agree to pull the plug.
Now, so far it has been impossible to make this happen. Nobody has cared enough because "well, it is just some virtual land called cyberspace." For the most part, law enforcement doesn't care if people are robbed in cyberspace - it isn't really their jurisdiction. There is no global cop that can go anywhere to track down cybercriminals, and in most of the world a request to please go down and arrest someone because they committed a crime somewhere else is met with guffaws and snickers. So as long as your local law enforcement was willing to turn a blind eye to your activities, you could pretty much get away with anything.
And believe me, in most of the world today, law enforcement has a lot better things to do than deal with any sort of computer crime. So there are zero consequences. Something a lot of people have learned over the last 15 years or so. Of course a few Unix geeks knew that since 1980 or so.
Now, if this sticks and if it can be repeated - both of which are highly doubtful - we might actually get somewhere in having some real consequences for bad actions on the Internet. But I suspect this will all be put back together next week (if not sooner) and there will continue to be zero consequences. Keep this in mind, because if you annoy someone enough on the Internet there is a chance they already know there are no consequences in most of the world. Lori Drew is a case in point. They really wanted to nail her for something, anything. But the rule of cyberspace wins out in the end. The physical world has real consequences, the virtual world has only virtual consequences.
The target is a "user". Anyone that doesn't understand system administration and security that is left alone with a computer can defeat anything that the OS does. If your grandma wants to install something like WeatherBug on Linux and the software to do this exists, she will succeed. If it requires root access and she has it, she will provide it in copious amounts for the malware application. Whatever is needed will be provided. Because she knows she wants to install this, for some utterly unknown reason.
Now, if you have a computer that it is impossible for the user to install stuff on, well then you have a much more secure platform. Unfortunately, this requires an administrator for those cases where something is really needed and actually should be installed. Once the user and the administrator are the same person, you have just lost any semblance of security.
99% of the Windows machines in homes out there do not have an administrator other than the user themselves. If these were magically replaced by Linux machines with the same administrator, this wouldn't solve anything. Sure, the user would need to do sudo or su in order to really screw things up, but if the application they thought they wanted to install asked for it, they would do it.
There seems to be an implication that Troyak and Group 3 were somehow complicit with all this botnet activity, yet no such claims are actually being explicitly made - just that the ISPs have been "associated" with these botnets, whatever that means.
Did these ISPs have legitimate customers who have now been cut off because of the criminals alongside them on the ISP's network? Was the ISP asked to deal with the situation first, and either ignored or refused such requests? If these ISPs were fronts for the botnet owners, where's the evidence? Did someone just think, oh, there are a bunch of bad guys on this ISP; let's cut the whole thing off and fuck the rest of their customers?
This action sounds like the IT equivalent of a government blowing up an entire city block because a couple terrorists are renting an apartment there.
If these ISPs have legitimate customers, hopefully they sue the hell out of the upstream for this.
Liberty in your lifetime
In the past, when this sort of thing has been suggested, the cries of "vigilante" and "lawlessness" were cried from the highest mountaintops, and the lowest swamps of the Internet. And anyone who actually DID anything was pilloried and run out of town on a rail.
[sarcasm] What changed, I wonder? [/sarcasm]
Now that the losses are in the hundreds of millions, in several dozen different currencies, those same voices seem to have lost their enthusiasm.
[End Of Line]
36% of their highly redundant infrastructure was made unavailable, leaving 64% of the control servers online and fully capable of servicing the millions of bots under its control.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
Nobody likes to see crooks get away with being crooks but keep in mind if you are championing the forced removal of content like this, then you are also championing the removal of any content deemed objectionable by a governing body.
boycott slashdot February 10th - 17th check out: altSlashdot.org
Now, if you have a computer that it is impossible for the user to install stuff on, well then you have a much more secure platform.
What you have is a damn iPad
The same way Turkey took down YouTube
By pushing bogus BGP packets to the backbone routers you have access to. Only the routers the people who dislike botnets have administrative control over are not just inside Turkey.
-- Terry
What is there to do then? We started out at a level #1 where the mainframes had maintainers and users (scientists.) Decades passed and things went the other direction to #2. The "maintainers" are people who no longer touch our PC because we have it under lock and key under a desk. But they have "unplug" control... wasn't the ultimate control over a machine that same one where nobody but "us" controlled the hardware and OS passwords? Technically, #3 is the midpoint: a place where we just play around in a sandbox, and IT decides what we can do and when we can get permission, "for our own good." Having had all three choices, I sure as heck don't want #1, and users sure as heck don't want #3 either, because they want to call the shots ignorantly but with 100% of their own perceived control.
Maybe it's because this is Slashdot, and everyone with half a brain knows that the malware writers target Windows almost exclusively. Whether this is because it's insecure or because of popularity, or otherwise, is up to the reader. None of the rest of us need that to be repeated over and over again to satisfy the sense of self-worth you get just because you don't use it.
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
... hundreds of bot nets were created... but they got 1, they are happy.
Because Windows has nothing to do with it you moron. Give your mom root and she'll fuck up her Linux box once more than 10 people use Linux so that malware actually gets written for it
"If these were magically replaced by Linux machines with the same administrator, this wouldn't solve anything. "
Bla bla bla. The point is that RIGHT NOW you have 20 kazillion PC's infected with God knows what crap. So don't tell me that "there might be a problem in the future if we move to Linux"..... while RIGHT NOW we being swamped with shit.
Or a properly configured terminal server. Or a WINDOWS PC joined to an Active Directory domain where the System Administrators know what they're doing. Or a Commodore 64.
What you DON'T have is an iPad. The end user will still be able to install applications, even ones riddled with spyware, to an iPad just like they can to an iPhone and the iPod.
cdguru
You are not vary familiar with Linux I hope or work in Redmond WA at worst. There are exactly 0 Linux viruses in the wild to catch. In linux most user aimed distros install with no server based services by default unlike Windows which has the "server" service going just fine so when I bang with Medusa on your little windows network I WILL GET A PASS FROM SOME DAMN BOX and then its game over for your whole windows LAN most likely. A little sniffin and a little pasing the hash around and every damn box will get pwned in no time. It just is not that easy against a linux network.
Windows puts profit and control far above your safety and they like it that way as it supports their "CERTIFIED PARTNERS" like Norton's ( the worst AV that due to ad dollars spent some IT think is good, Hell last thing Symantech made was defrag and that was in the last century ). So for the people who are too stupid to use anything but point and click "Your screwed" try not to go many places or just pay geeksquad 200$ to "Fix" it everytime your kid is surfin for the pron.
For the rest of us lucky few thank god there are other options