Slashdot Mirror
The Coming Botnet Stock Exchange
Trailrunner7 writes "Robert Hansen, a security researcher and CEO of SecTheory, has been gleaning intelligence from professional attackers in recent months, having a series of off-the-record conversations with spammers and malicious hackers in an effort to gain insight into their tactics, mindset and motivation. 'He's not the type to hack randomly, he's only interested in targeted attacks with big payouts. Well, the more I thought about it the more I thought that this is a very solvable problem for bad guys. There are already other types of bad guys who do things like spam, steal credentials and DDoS. For that to work they need a botnet with thousands or millions of machines. The chances of a million machine botnet having compromised at least one machine within a target of interest is relatively high.' Hansen's solution to the hacker's problem provides a glimpse into a business model we might see in the not-too-distant future. It's an evolutionary version of the botnet-for-hire or malware-as-a-service model that's taken off in recent years. In Hansen's model, an attacker looking to infiltrate a specific network would not spend weeks throwing resources against machines in that network, looking for a weak spot and potentially raising the suspicion of the company's security team. Instead, he would contact a botmaster and give him a laundry list of the machines or IP addresses he's interested in compromising. If the botmaster already has his hooks into the network, the customer could then buy access directly into the network rather than spending his own time and resources trying to get in."
Yeah, interesting concept but the fear would be that the botnet owner would respond by saying knock, knock, the FBI is here (substitute the agency you think applies if the FBI isn't your cup of tea).
If you do something yourself you know all the players. If you pay someone to do it you don't know if you are walking into a trap.
disclaimer: I'm not too worried about this as I don't plan on taking either route.
How is this a "stock exchange"?
AccountKiller
Is SecTheory a harbor for these malicious users? Why does Hansen have such deep contacts?
So you have just hired a bot master. How do you pay them? You know they are dirty hackers, so it isn't like you would just give them your credit card number or Pay Pal account. Maybe the guy just wakes up and finds a crate of Jolt and Hot Pockets on his doorstep.
"I'm not a quack, I'm a mad scientist! There's a difference." - Dr. Cockroach
Cloud Computing FTW!!!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Yeah, whatever. If I was an evil cracker I'd be damn sure to randomly target machines so I could use them for my targeted attacks. And I'd want a lot of them so I could bounce the attack through them to make it more difficult to find me.
If anything, if this guy was such a great cracker/hacker, wouldn't he already know about the percentages? Cracking any single specific machine is difficult. Cracking any random machine in a specific block would be much easier.
Then you'd use that machine (those machines) to more easily target the specific machine.
And what happens to FOSS developers who accidentally leave a bug in their code?
You have oversimplified the issue. The root causes are;
1. Windows / [insert other exploitable program here (ie. Flash/Adobe PDF reader)]
2. Stupid users
If your user downloads and runs malware, there's almost nothing your OS can do to stop it. The only way to stop it is to force application signing... but who really wants that?
So tell me, which OS would you choose that could stop all malware even with stupid users?
AccountKiller
Can somebody do a survey of all of these infected machines and check what OS
version they're running?
If there's a growing number of Vista and Win 7 machines then someone should
get back to MS and let them know whatever they're doing ain't working.
With all of these security initiatives I'd have thought botnets would have been a shrinking
problem - not something that was a growth industry as this article seems to indicate.
don't be a spelling loser
Windows is no more secure than Linux, or whatever hippie OS you're into. Any OS as popular as Windows is going to get the crap hacked out of it, the only reason Linux (assuming you're into that, but substitute it for whatever you like) is 'more secure' is because your grandmother doesn't open .exe attachments on it.
To trade stocks in the first place? Buy some penny stocks/junk bonds whatever and get/steal/buy enough logins to various brokerages than just pump the price at an opportune time, take the money and run.
An Education is the Font of All Liberty
The solution, is obvious too: use another operating system.
And when the windows l^Husers switch to another operating system and want to see their dancing bunnies, then what?
I've been spending more and more time talking to blackhats lately. Frankly, I think they're fascinating people
They are criminals who steal from people. Fascinating people? How sick.
Glamorizing thieves and moral creeps is sending a wrong message especially to young people. If it were up to me I would lock this Robert Hansen into a jail together with his "blackhats" thieves and thrown away the key. This is where he and they belong.
It's not quite that simple. Proving that a product as complex as a consumer-level GUI operating system is bug-free and secure is in general an undecideable problem.
We can't even prove that our critical, lower-level embedded software (aerospace, health-related, etc) is bug-free, and this is why there is substantially more effort put into ensuring that such software is of high quality. For example there are extensive regulations on how exhaustively testing must be done on various components of an aviation-related piece of software, depending on its criticality
Try enforcing something like this on Windows, and even monopolistic Microsoft's fabled profit margins would disappear -- it would be the push that crowd-sourced OSS software would need to acheive a real foothold in the desktop market.
It would be interesting if enough unsophisticated users who unknowingly run bots decided that something like the iPad is "good enough" for them and they got rid of their PC. I say would be because it's not going to happen.
But to answer your questions, very casual users, and iPhone OS.
the comment field for your comment and the subject line for your subject?
He's reposting word for word what happens on a daily basis and its his model? Is anyone else slightly confused by this?
Though TFA does at least mention "This model makes sense on a number of levels and may well have been implemented already."
Theres even underground exchanges between the various botnet holders to some extent. If botnet controller A does not have enough(or any) compromised machines related to a target in one of his customers shopping lists he'll go to botnet controller B, C, or d-z in order to find what he needs. Obviously they don't trust each other much but there is some level of cooperation.
Even targeted hacks will often try the same methods as used to spread botnets in the first place, if you're in that line of business and there are somewhat reliable sources of compromised machines out there that will get you what you need faster and thus a) reduce your own work load and headaches and b) end up with a happier customer for a prompt job completion. (aka they'll think you're the shit and come back again if they need something else, every business out there, legal or otherwise, needs return customers)
Come on, these guys are doing highly illegal, highly technical, very high problem solving ability oriented tasks for a living. You think they haven't been doing this for, oh, over a decade now? Thats about how dated my information is... I think its a safe bet to assume its still going on.
even app signing wouldn't work, it would ahve to be open enough to allow small outfits to produce code, and would need to allow dev to test run their code prior to the app signing. Both of those are holes, whats to stop a hacker from making a legit app and then using the same cert on both it and the malware?
*nix without admin rights, and their home dir mounted no_exec with backup taken every 6 hours, admined by dell/HP/etc. No way to install a new app, and no way to run something from the home dir, problem solved.
All of the above was encrypted with a Quad ROT-13 method. Unauthorized decryption is in violation of the DMCA.
*nix without admin rights, and their home dir mounted no_exec with backup taken every 6 hours, admined by dell/HP/etc. No way to install a new app, and no way to run something from the home dir, problem solved.
I guess we need to add the criteria of 'user needs to be productive'.
You can do that in Windows as well, by the way. GPOs and NTFS permissions are wonderful little toys.
HX Stocks rose today, as they aquired Zues.
I am Bennett Haselton! I am Bennett Haselton!
I'd be up for disconnecting them from the matrix.
It's already being done on fractions of a cent in arbitrage between the closes and opens of various stock and currency markets. All legitimate trades, mind you.
Go back and look at the Societe Generale incident from 2008. And that guy was just working with Excel macros!!
I scream. You scream. I assume that means we're both acquainted with the problem. We proceed.
SlappyBastard wrote:
That's absolute nonsense (unless you're going to use a definition of 'wealth' gamed to mean 'something created in arbitrage'). It's easily proved wrong by simple thought experiments. If I make a chair, I am wealthier by one chair. It doesn't matter whether or not anyone else is willing to pay for the chair. You may be able to argue that if I need something I can't make for myself that the financial system I have to rely on to get has arbitrage as an integral component. I might have to agree with that simply because barter of goods and professional services is taxable by the IRS, but the IRS will only accept money, not goods and services to pay the subsequent taxes.
We are making Toyota responsible for all the incidents, and possible future incidents with their acceleration issues, aren't we? Why not hold microsoft responible for their own products too?
You mean other than the fact that the EULA you agree to when using Windows says that Microsoft disclaims all warranties and Toyota has no such contractual agreement with purchasers of their car? And before you go on about being able to ignore that and claiming EULAs are unenforceable (which is a common slashdot meme but it is wrong) then you would have to say that any such disclaimers in FOSS software would be null and void too thus opening them up to being held responsible for any bugs in their software.
The concept seems sound and trades are not uncommon in the cracker world but this is not the problem. - "How do you know that your system is secure?" - "Aaaa, I have an antivirus and broadband router that is handling my Internet connection. That should keep me safe" - "Ok. And why are there all those ports opened on your router?" - "Well, I'm forwarding everything through it in order to be able to play _______" (Insert game name here) - "I see. Ok." An antivirus and a firewall will not help you if you are stupid enough to open the latest XXX e-mail that knocks on the door of your never-updated Outlook Express or if your password is 123456.
Just the Programmer P.O.V.
Why?
Dilbert RSS feed
We can't even prove that our critical, lower-level embedded software (aerospace, health-related, etc) is bug-free
Car braking software...
Hey, I just launched a new BotNet on 127.0.0.1 so if anyone wants to
****** CARRIER LOST *******
Place nail here >+
Whoa, whoa, hold on there a minute!
The botnet is "just about the same" as a stolen gun, a stolen axe, stolen lockpicks, etc. Generic tools have no inherent moral dimension; lockpicks can be used to save a baby locked in a burning building, an axe can be used to build a house for a homeless person, a gun can be used to defend against criminals or to hunt for food.
A tool only has the moral dimensions the tool user imposes upon it by the circumstances of its creation, ownership and use.
The botnets are created from unwillingly compelled zombies; they exist as a continuous theft of resources from the zombie owners. Therefore they are not "just about the same" as my gun, my axe, or a set of lock picks.
Why? They can set up their own repositories, and the software would warn user about updates. They don't have to rely on distros' repositories.
It's true that they would have to make multiple packages, but that's not exactly astrophysics, and can easily be automated in the build process. And the repository itself is usually little more than an HTTP server with a particular directory layout.
Dilbert RSS feed