Slashdot Mirror
The Coming Botnet Stock Exchange
Trailrunner7 writes "Robert Hansen, a security researcher and CEO of SecTheory, has been gleaning intelligence from professional attackers in recent months, having a series of off-the-record conversations with spammers and malicious hackers in an effort to gain insight into their tactics, mindset and motivation. 'He's not the type to hack randomly, he's only interested in targeted attacks with big payouts. Well, the more I thought about it the more I thought that this is a very solvable problem for bad guys. There are already other types of bad guys who do things like spam, steal credentials and DDoS. For that to work they need a botnet with thousands or millions of machines. The chances of a million machine botnet having compromised at least one machine within a target of interest is relatively high.' Hansen's solution to the hacker's problem provides a glimpse into a business model we might see in the not-too-distant future. It's an evolutionary version of the botnet-for-hire or malware-as-a-service model that's taken off in recent years. In Hansen's model, an attacker looking to infiltrate a specific network would not spend weeks throwing resources against machines in that network, looking for a weak spot and potentially raising the suspicion of the company's security team. Instead, he would contact a botmaster and give him a laundry list of the machines or IP addresses he's interested in compromising. If the botmaster already has his hooks into the network, the customer could then buy access directly into the network rather than spending his own time and resources trying to get in."
Yeah, interesting concept but the fear would be that the botnet owner would respond by saying knock, knock, the FBI is here (substitute the agency you think applies if the FBI isn't your cup of tea).
If you do something yourself you know all the players. If you pay someone to do it you don't know if you are walking into a trap.
disclaimer: I'm not too worried about this as I don't plan on taking either route.
How is this a "stock exchange"?
AccountKiller
Finally! Someone has figured out the missing step.
1. Create an idea
2. Implement it
3. Create a botnet for hire!
4. PROFIT!
Is SecTheory a harbor for these malicious users? Why does Hansen have such deep contacts?
So you have just hired a bot master. How do you pay them? You know they are dirty hackers, so it isn't like you would just give them your credit card number or Pay Pal account. Maybe the guy just wakes up and finds a crate of Jolt and Hot Pockets on his doorstep.
"I'm not a quack, I'm a mad scientist! There's a difference." - Dr. Cockroach
Cloud Computing FTW!!!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Yeah, whatever. If I was an evil cracker I'd be damn sure to randomly target machines so I could use them for my targeted attacks. And I'd want a lot of them so I could bounce the attack through them to make it more difficult to find me.
If anything, if this guy was such a great cracker/hacker, wouldn't he already know about the percentages? Cracking any single specific machine is difficult. Cracking any random machine in a specific block would be much easier.
Then you'd use that machine (those machines) to more easily target the specific machine.
And what happens to FOSS developers who accidentally leave a bug in their code?
You have oversimplified the issue. The root causes are;
1. Windows / [insert other exploitable program here (ie. Flash/Adobe PDF reader)]
2. Stupid users
If your user downloads and runs malware, there's almost nothing your OS can do to stop it. The only way to stop it is to force application signing... but who really wants that?
So tell me, which OS would you choose that could stop all malware even with stupid users?
AccountKiller
Can somebody do a survey of all of these infected machines and check what OS
version they're running?
If there's a growing number of Vista and Win 7 machines then someone should
get back to MS and let them know whatever they're doing ain't working.
With all of these security initiatives I'd have thought botnets would have been a shrinking
problem - not something that was a growth industry as this article seems to indicate.
don't be a spelling loser
Come off the "I am not trolling" bullshit. Everything you post is a troll designed to discredit the beliefs you appear to be promoting.
At least that's what I hope, because you do more damage to the Free Software movement with your posts than any positive effects you may have had.
Windows is no more secure than Linux, or whatever hippie OS you're into. Any OS as popular as Windows is going to get the crap hacked out of it, the only reason Linux (assuming you're into that, but substitute it for whatever you like) is 'more secure' is because your grandmother doesn't open .exe attachments on it.
To trade stocks in the first place? Buy some penny stocks/junk bonds whatever and get/steal/buy enough logins to various brokerages than just pump the price at an opportune time, take the money and run.
An Education is the Font of All Liberty
The solution, is obvious too: use another operating system.
And when the windows l^Husers switch to another operating system and want to see their dancing bunnies, then what?
I've been spending more and more time talking to blackhats lately. Frankly, I think they're fascinating people
They are criminals who steal from people. Fascinating people? How sick.
Glamorizing thieves and moral creeps is sending a wrong message especially to young people. If it were up to me I would lock this Robert Hansen into a jail together with his "blackhats" thieves and thrown away the key. This is where he and they belong.
How do you pay them?
That is easy, you use a botnet bank of course. The difficult question is how to bail them out when the botnet bubble burst.
It's not quite that simple. Proving that a product as complex as a consumer-level GUI operating system is bug-free and secure is in general an undecideable problem.
We can't even prove that our critical, lower-level embedded software (aerospace, health-related, etc) is bug-free, and this is why there is substantially more effort put into ensuring that such software is of high quality. For example there are extensive regulations on how exhaustively testing must be done on various components of an aviation-related piece of software, depending on its criticality
Try enforcing something like this on Windows, and even monopolistic Microsoft's fabled profit margins would disappear -- it would be the push that crowd-sourced OSS software would need to acheive a real foothold in the desktop market.
It would be interesting if enough unsophisticated users who unknowingly run bots decided that something like the iPad is "good enough" for them and they got rid of their PC. I say would be because it's not going to happen.
But to answer your questions, very casual users, and iPhone OS.
the comment field for your comment and the subject line for your subject?
He's reposting word for word what happens on a daily basis and its his model? Is anyone else slightly confused by this?
Though TFA does at least mention "This model makes sense on a number of levels and may well have been implemented already."
Theres even underground exchanges between the various botnet holders to some extent. If botnet controller A does not have enough(or any) compromised machines related to a target in one of his customers shopping lists he'll go to botnet controller B, C, or d-z in order to find what he needs. Obviously they don't trust each other much but there is some level of cooperation.
Even targeted hacks will often try the same methods as used to spread botnets in the first place, if you're in that line of business and there are somewhat reliable sources of compromised machines out there that will get you what you need faster and thus a) reduce your own work load and headaches and b) end up with a happier customer for a prompt job completion. (aka they'll think you're the shit and come back again if they need something else, every business out there, legal or otherwise, needs return customers)
Come on, these guys are doing highly illegal, highly technical, very high problem solving ability oriented tasks for a living. You think they haven't been doing this for, oh, over a decade now? Thats about how dated my information is... I think its a safe bet to assume its still going on.
even app signing wouldn't work, it would ahve to be open enough to allow small outfits to produce code, and would need to allow dev to test run their code prior to the app signing. Both of those are holes, whats to stop a hacker from making a legit app and then using the same cert on both it and the malware?
*nix without admin rights, and their home dir mounted no_exec with backup taken every 6 hours, admined by dell/HP/etc. No way to install a new app, and no way to run something from the home dir, problem solved.
All of the above was encrypted with a Quad ROT-13 method. Unauthorized decryption is in violation of the DMCA.
Another uninspiring Hansen/RSnake media attention whoring article.
Nothing new here whatsoever - people willing to pay to gain access to networks/information.
Linux is more secure because things from the internet don't just open and run automatically. On windows, to own the machine is simple, deliver an exploit and execute it. Grandma Linux user might click the exe attachment and get it downloaded and delivered, but you're not going to trick her into going into a shell, set the x bit(s) so it can run and then running it. Has not at all to do with how many machines there are, its simple fact that running an exploit on Windows is low hanging fruit and its easy -- not a thing at all to do with Windows being popular.
Until the day that Windows gets a proper package manager like a Linux distro has, there will be no end to the Windows malware infestations.
Windows users install software by visting some website, thinking something looks cool and downloading it - a couple of yes clicks later and a new zombie joins a botnet.
Linux users install software by checking a repository where its downloaded from a trusted source. While its certainly possible to visit a website and download, install, something on a Linux machine as well, thats made much less likely because anyone without the knowledge to do that will just get something from the package manager.
Doesn't matter if there are 10x more windows, it would be just as true if there were 10x as many hippy os machines
Simple fact of the matter is windows software deployment model is severly flawed. It needs a package manager with some basic white-lists like a Linux distro has. Add that to windows and then make it so that something from the internet doesn't just run when you click on it because it ends in .exe and Window's security might get somewhere. And another dialog box to click "yes" or "install" on doesn't help.
*nix without admin rights, and their home dir mounted no_exec with backup taken every 6 hours, admined by dell/HP/etc. No way to install a new app, and no way to run something from the home dir, problem solved.
I guess we need to add the criteria of 'user needs to be productive'.
You can do that in Windows as well, by the way. GPOs and NTFS permissions are wonderful little toys.
So if someone who owns a Toyota runs someone else over with malice we should sue Toyota and let the driver go? Get a fucking clue, you troll.
Windows is no more secure than Linux, or whatever hippie OS you're into. Any OS as popular as Windows is going to get the crap hacked out of it, the only reason Linux (assuming you're into that, but substitute it for whatever you like) is 'more secure' is because your grandmother doesn't open .exe attachments on it.
So why does windows 7 need a virus scanner????
HX Stocks rose today, as they aquired Zues.
I am Bennett Haselton! I am Bennett Haselton!
I'd be up for disconnecting them from the matrix.
Sorry, but you're wrong, and your superficial understanding of how operating systems work and how they are exploited is why.
The repository model would not scale to the level that Windows exists in. The users would not put up with it.
Non-execute bits are nothing but an annoyance in Linux - so much that modern DEs have dozens of ways to get around it.
Exploits (buffer overflow + shellcode) are just as possible in Linux as they are in Windows.
Repeat after me: NOBODY. GIVES. A. SHIT. ABOUT. YOUR. HIPPY. OS.
Because grandma opens .exe attachments from her email, facebook, and other random places on the interwebs.
All wealth is created in arbitrage. All wealth arises in the differences between what I know, what I can do, what I want to do and what you know, what you can do and what you want to do. If you hand over your target information, you've closed the gap so much that profit will disappear altogether -- especially if the botnet owner involved figures out what he can gain from the target.
I scream. You scream. I assume that means we're both acquainted with the problem. We proceed.
It's already being done on fractions of a cent in arbitrage between the closes and opens of various stock and currency markets. All legitimate trades, mind you.
Go back and look at the Societe Generale incident from 2008. And that guy was just working with Excel macros!!
I scream. You scream. I assume that means we're both acquainted with the problem. We proceed.
We are making Toyota responsible for all the incidents, and possible future incidents with their acceleration issues, aren't we? Why not hold microsoft responible for their own products too?
You mean other than the fact that the EULA you agree to when using Windows says that Microsoft disclaims all warranties and Toyota has no such contractual agreement with purchasers of their car? And before you go on about being able to ignore that and claiming EULAs are unenforceable (which is a common slashdot meme but it is wrong) then you would have to say that any such disclaimers in FOSS software would be null and void too thus opening them up to being held responsible for any bugs in their software.
The concept seems sound and trades are not uncommon in the cracker world but this is not the problem. - "How do you know that your system is secure?" - "Aaaa, I have an antivirus and broadband router that is handling my Internet connection. That should keep me safe" - "Ok. And why are there all those ports opened on your router?" - "Well, I'm forwarding everything through it in order to be able to play _______" (Insert game name here) - "I see. Ok." An antivirus and a firewall will not help you if you are stupid enough to open the latest XXX e-mail that knocks on the door of your never-updated Outlook Express or if your password is 123456.
Just the Programmer P.O.V.
Why?
Dilbert RSS feed
We can't even prove that our critical, lower-level embedded software (aerospace, health-related, etc) is bug-free
Car braking software...
So tell me, which OS would you choose that could stop all malware even with stupid users?
Plan 9, CapROS, or Coyotos. Not all malware, but most. (Assume for the point of the argument that the stupid users would be able to actually use them.)
Hey, I just launched a new BotNet on 127.0.0.1 so if anyone wants to
****** CARRIER LOST *******
Place nail here >+
Whoa, whoa, hold on there a minute!
The botnet is "just about the same" as a stolen gun, a stolen axe, stolen lockpicks, etc. Generic tools have no inherent moral dimension; lockpicks can be used to save a baby locked in a burning building, an axe can be used to build a house for a homeless person, a gun can be used to defend against criminals or to hunt for food.
A tool only has the moral dimensions the tool user imposes upon it by the circumstances of its creation, ownership and use.
The botnets are created from unwillingly compelled zombies; they exist as a continuous theft of resources from the zombie owners. Therefore they are not "just about the same" as my gun, my axe, or a set of lock picks.
"So tell me, which OS would you choose that could stop all malware even with stupid users?" - by Galestar (1473827) on Monday March 15, @01:45PM (#31485434)
Reiterating my subject-line, once more: Windows, albeit AFTER security hardening & user education!
How so? Ok:
----
HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA/Windows 7 (+ make it "fun-to-do" via CIS Tool Guidance & beyond):
http://www.tcmagazine.com/forums/index.php?s=568d95985ad83ef4add94de09f6026d3&showtopic=2662
----
It works!
It's based on the concept computer security folks the past few years have been calling "LAYERED SECURITY"...
Proofs to its efficacy?
Ok, some quoted testimonials:
----
http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=2
"I recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual." - THRONKA, user of my guide @ XTremePcCentral
AND
"APK, thanks for such a great guide. This would, and should, be an inspiration to such security measures. Also, the pc that has "tweaks": IS STILL GOING! NO PROBLEMS!" - THRONKA, user of my guide @ XTremePcCentral
AND
http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=3
"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads. APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, needed system local)" - THRONKA, user of my guide @ XTremePcCentral
AND
http://forums.theplanet.com/index.php?s=80bbbffc22d358de6b01b8450d596746&showtopic=89123&st=60&start=60
"the use of the hosts file has worked for me in many ways. for one it stops ad banners, it helps speed up your computer as well. if you need more proof i am writing to you on a 400 hertz computer and i run with ease. i do not get 200++ viruses and spy ware a month as i use to. now i am lucky if i get 1 or 2 viruses a month. if you want my opinion if you stick to what APK says in his article about securing your computer then you will be safe and should not get any viruses or spy ware, but if you do get hit with viruses and spy ware then it will your own fault. keep up the good fight APK." - Kings Joker, user of my guide @ THE PLANET
----
(Those results are only a SMALL SAMPLING TOO, mind you - I can produce more such results, upon request, from other users & sites online)
Addtionally - Users
Mostly because developers (including large companies) would refuse to distribute their software via such a model, and you would end up in a situation where a large amount of software people want would only be available outside of the repository. The repository model works now because 99% of software for Linux is open source and there really isn't a hell of a lot of software (compared to Windows) available for Linux. The 10K apps you'll find in a typical Linux repository is pales comparison to the number of apps available for Windows. Even with Linux in it's current state there are outliers. America's Army, which I used to play on FreeBSD comes to mind. They distributed the Linux version of the game via a Loki installer.
Why? They can set up their own repositories, and the software would warn user about updates. They don't have to rely on distros' repositories.
It's true that they would have to make multiple packages, but that's not exactly astrophysics, and can easily be automated in the build process. And the repository itself is usually little more than an HTTP server with a particular directory layout.
Dilbert RSS feed
iPhone - though I would like to be able to install 3rd party apps - flash for instance.
Keith Rowley
iPhone
Um, no. *cough* macfag *cough*
Here's why;
though I would like to be able to install 3rd party apps - flash for instance.
You can either have draconian software policies which will protect stupid users from malware - which is why app signing was mentioned, or you can put the control back to the user - which allows for malware.
You can't have your cake and eat it too.