Slashdot Mirror
Microsoft Looks To Courts For Botnet Takedowns
angry tapir writes "Microsoft has seen a dramatic drop in the number of computers infected with Waledac, a piece of malicious software affiliated with a botnet that was once responsible for a massive amount of spam. In the second quarter of this year, the company cleaned only 29,816 computers infected with Waledac, down from 83,580 computers in the first quarter of the year. The drop in the number of infected machines shows the success of the legal action Microsoft took earlier in the year, according to the company."
The courts are not going to make the software secure.
Help stamp out iliturcy.
So Microsoft has found that using lawyers and courts is a more effective way for them to combat malware and botnets than building good security into their products.
Why am I not surprised?
On a related matter, I am starting to see more reports of the possibility of malware in the Linux ecosystem. So far it is mostly a matter of an increase in security patches for Ubuntu and Debian apps, to fix vulnerabilities that no one has managed as yet to exploit to any significant degree. So its not really an issue, simply a minor annoyance that I've been saying okay to more automated updates in the last month or so than I was seeing this time last year.
Will
...Courts look for Botnets to take down Microsoft.
Now, if you'll excuse me, I have backups to corrupt.
While few would defend botnets, this legal technique will certainly be applied to other types of domains-- p2p, freenet, proxy, dissident, and whistleblower sites. In fact, I predict such attacks will hurt wikileaks and p2p sites more easily than botnets, because botnets don't have to have a small number of memorable domain names (they're not directly controlled by random humans). Ultimately, all of these "undesirable" types of programs/sites will work around the DNS crackdowns. But this will give even more of an edge to those who already hold nearly all the power-- corporations and governments. Really, they seem to be saying that if your domain could be used for something illegal, it can be taken away from you via rubber stamp before it's even involved.
I'm kind of surprised Microsoft would say something like this, but at the same time, I'm really not. I guess they are looking at it through the eyes of George Washington and not the consumer, that's why they'll just sue people into compliance. But what's going to happen when they can't sue people because malware propagates itself far more quickly than Microsoft can detect its origin? Why not take the initiative and build more secure products instead of dealing with the problem after Conficker 2 is already globally widespread,
So hopefully, they will pass to remove all malicious and infected machines from the internet forever, and i'm sure it wouldn't take much to get the Evil Microsoft infected and scrubbed off...Then Unix takes over, and the internet world will find peace! eh...forget peace, but really get rid of Microsoft already!!!
Before people bleat about this being about poor MS security do remember how many dumb folks there are out there. Lots of attacks come from dumb folks using things like Bittorrent and then executing something that they really shouldn't do without having decent virus protection on their machine.
So good on Microsoft for doing this, yes they also need to clean up their security act, which they have been doing, but also coping with the dumb people who buy their products is a decent thing to do.
An Eye for an Eye will make the whole world blind - Gandhi
I don't know if it's the story or the report that's full of holes, but this makes no causal sense whatsoever.
Notwithstanding the basic "correlation does not equal causality" tenet, where is the connection between the forcible shutting-down of botnet-controlling domains, and the botnets themselves? A p2p-vectored botnet's growth has nothing to do with the purposes for which that botnet is employed.
Furthermore, stating that "the company cleaned fewer machines" is not equivalent to stating "their are fewer machines infected." Frankly I'm not going to trawl through MS's Biannual Security Report or whatever (and thanks for not linking it, pcworld), but either the report or the story is woefully lacking in certain key details. It might all be true, but merely saying as much isn't going to garner much karma.
Meta will eat itself
haven't RTFA but a drop in the number of machines MS have cleaned =! a drop in the number of infected machines.
For once Microsoft is using its legal muscle for a good cause.
I'm shocked.
Even as a mainly Linux user, I completely agree with the above comments.
Software is complicated & all of it has bugs & security holes - Linux, OS X, Windows, whatever...
Microsoft's worst mistake was believing their own marketing that sent out the message that you don't have to know much about computers to be completely secure when using one - it is the same mistake Apple are currently making.
There are people out here using Windows (myself included) who don't see any viruses, trojans or rootkits on Windows because we keep patches up to date, use good virus & malware scanners, don't trust emails & attachments from people we don't know, & don't go trying to get all our software for free from torrent sites.
We use the same Windows OSes that people with infected PCs use, therefore the only thing separating the two is knowledge, experience & common sense. Period.
I don't necessarily like the fact that Microsoft is using the court system for this because then some public money will be used in the process - but something *DOES* need to be done & I'm all for people being kicked off of their Internet connections until they get off their backsides & clean their PCs.
Gentoo Linux - another day, another USE flag.
What microsoft fails to understand, is that the people operating these malware networks are not large slow monolithic corporations, just because a piece of malware which was common a few months ago is now dying out doesn't mean the problem is gone, it just means that the authors of that malware have moved on to their latest creations...
After all, why would you continue pushing an old piece of malware which has been reverse engineered and is detectable by every anti malware program out there, when you can write something new that will have a new window of opportunity before anything can detect it.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Without reading TFA, I can imagine that Microsoft is suing on the grounds that it should have the copyright on malware. There have actually been similar patents that MS has taken out before. I wouldn't be too surprised.
There are 10 commandments: 01)Thou shalt love the Lord Thy God 10)Thou shalt love thy neighbour as thyself.Matt22:34-40
Is Linux "immune" to malscripted webpages on malicious sites with say, harmful javascript in them? How about bogus ad banners that have harmful javascript in them, is Linux "immune" to that also??
You sure that in this case:
"Linux could have problems, but the security holes found are much harder to exploit due to the way everything is set up by default, and how the system is used. A lot of Windows security problems have been "as designed"." - by unapersson (38207) on Thursday October 14, @05:06AM (#33891268) Homepage
?
I mean, here are some examples:
1.) Linux has its root/superuser/admin usage "turned off" (meaning you cannot logon as root) by default, so you have to use a SUDO. Well, Windows has its equivalent in UAC (except windows users CAN login as Administrator, but, they are NOT setup that way by default... whereas afaik? You cannot logon to Linux as ROOT itself).
2.) Penguins here keep "trumpeting" that their software is ONLY AVAILABLE via rpm/apt-get/yum (repositories) and yet there ARE other sources of Linux wares, not just via repositories (so who are they trying to fool here?)... just as their are in Windows from "shareware/freeware" oriented websites.
3.) Windows has its regular "Patch Tuesday", every 2nd Tuesday of a month - Linux has its regular checks for security & other updates also (and I see this happen quite a LOT on Linux, in fact, I was up to 51 replacements for security patches alone iirc, and in ONLY 1 month's usage of KUbuntu 10.4.1 in fact, before I went to KUbuntu 10.10 recently) - BOTH need and do get patches for security, regularly, so it's not like Linux is "immune to hacks/cracks"!
Now - the ONLY REAL REASON Windows is attacked so much?
The only reason Windows machines are more attacked is because more people use them, and, they use them for things like banking transactions from home OR shopping via credit card online. This alone makes them the MOST attractive target for botnet makers (or, any malware maker/malicious scripted page online etc./et al).
I.E.-> Thieves online are NO DIFFERENT from thieves in the real world. For example, pickpockets do NOT go where there are little to no people, they hit trainstations, subways, malls or any place large amounts of folks gather. The same holds true online, and where do the MOST folks "gather"? On Windows.
(Going back now to my init. question above I started this with: I mean, nobody can tell me that a malscripted website page or maliciously scripted banner ad couldn't be tailored to attacks Macs or Linux rigs, because javascript works on them and their webbrowsers too, which are the same as the ones used on Windows for the most part (the "big 4" in IE, FireFox, and Opera or Chrome) and they use javascript and keep it turned on, by default, in Linux too!).
See the first question in my init. reply and answer it please. I will restate it here again for the record in fact:
"Is Linux "immune" to malscripted webpages on malicious sites with say, harmful javascript in them? How about bogus ad banners that have harmful javascript in them, is Linux "immune" to that also??" - by Anonymous Coward on Thursday October 14, @08:55AM (#33892258)
Now - You can mod me down troll all you like but it won't change the fact that what I suspect to be true "upsets the 'penguinista'" here - and that is that a malscripted ad banner OR webpage can affect Linux just the same as it can windows... and where do MOST attacks on Windows occur nowadays? Thru apps like HTML + scripted emails, OR, webbrowsers with scripting enabled and not restricted!
So, modding me down as "TROLL" (when my post was initially modded up as INSIGHTFUL, and it shows because it has "0 troll" as my score, rather than "-1 troll" as it would if it were never modded up at all)?
LOL, after all: It doesn't make you "Pro-*NIX" dorks any better and it shows you evading answering a simple question as well. Maybe you avoid answering this question, and instead MOD ME DOWN, because it IS the truth, eh? Probably.
I mean, lol, attempting to hide a truth by modding a post down? Poor job boys, very poor.
No the problem is with Windows OS design. MS forgot or never knew one of the basic designs in a networked OS. Users can only work in user space. A user cannot write to the system files. A user's account may get infected but not the machine on Linux/UNIX/OSX. An easy clean. Any software that needs Administrator access to run (like a lot of MS software) is NOT secure and badly written. Until MS changes and follows these rules of a networked OS it will always be open to whatever you throw at it. Lets face it MS and all their partners like you spending money on fixing their broken shit.