Slashdot Mirror
Storm Botnet Returns As Part of New Year's Attacks
Trailrunner7 writes "A new spam campaign that appeared shortly before the New Year is part of a new effort by the crew behind the Storm/Waledac botnet and is using some rather elementary tactics — in combination with fast-flux — to attempt to compromise unsuspecting users. The new attack emerged late last week and is fronted by a fairly lame spam campaign that is sending millions of emails that appear to be holiday e-cards, one of the older and more threadbare techniques in this particular game. According to an analysis of the attack by the researchers at the Shadowserver Foundation, victims who click on the link in the email are directed to one of a number of compromised domains, which then redirect the user to another page that displays a message asking the user to download a fake Flash player. This, of course, installs a piece of malware on the victim's machine."
the victim's machine
So it installs flash?
One year per infected computer. HARD LABOR, not some wimpy country club prison. Assuming it can proved that there was malicious intent.
Can my karma get any worse than bad? Let's find out!
Unsuspecting of the fact that their brain has died and yet they are somehow still alive.
I can, be it barely, see how some computer users unsuspectingly bought one with Windows pre-installed but how unsuspecting are the companies that did this installation on all of their products?
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
...one of the older and more threadbare techniques in this particular game.
Criminals don't care how old it is, but rather how successful it is. Please try to remember that, people. Technology doesn't have to be new or complicated to be useful, and deriding it because it is older is telling of a lack of experience with the thing. Spam will continue to be effective because it only costs a few dollars to register a domain, a little bit less to setup a distribution point, and once you have a few compromised hosts, it pays for itself -- and then some.
#fuckbeta #iamslashdot #dicemustdie
From: Joe User (sksj3838lsk@reallywarmmail.com)
To: You
Subject: Bunny
Attachment: bunnyhop.exe
Hey check out this cool bunny, it hops around the screen and follows your mouse pointer, it sometimes hides behind windows! Just double-click on the attachement.
Bye!
Joe
one of the older and more threadbare techniques
If it works, expect them to use it.
Funnyhacks - Wierd, unusual, and fun hacks
country club prison is better then letting rapists out to make room for a hacker.
> asking the user to download a fake Flash player...
If people want to install flash it's pretty clear where you get it from. Why would anyone trust a random web site that says, "Here, this is a flash player. No, really! Install it, would you please?"
Hell, that attack would work against Linux, or a Mac. The ONLY fix I can see for the problems facing the internet is for people to become a little bit less idiotic.
If someone came up to you on the street, you have no idea who they are, never seen them before, and they say, "Hey, how about letting me use some of your property!" nobody is going to be stupid enough to do it. Well, almost nobody. So why if you add, "... with a computer" to the end, do people suddenly lose any and all ability to think?
That's what we've got to fix. Until we do, spam and botnets will always be a problem. No OS can be secure enough to protect against the person it's supposed to be serving.
This is something i've been thinking about for years. I want to do a mass mailout to all employees at all our clients (with the managers permission of course) in almost exactly the same way as this virus does, except instead of actually installing malicious software it keeps track of how many people click the link, and of those, how many then proceed to download the software. Far easier to send each manager a report of "x of your employees would now be infected if this was a real virus" (i'd probably not put individual employees names on there) than to fix the damage caused by viruses.
Time to get coding I guess...
It's more like an invitation to attack yourself.
MAYBE I feel sorry for the elderly or disabled who for whatever reason want an e-card from an unspecified friend, but why wouldn't they ask themselves why a FRIEND would send you a link to a site that requires you to install something to see a dumb-ass picture. My 76 yr old tech-disabled mother wouldn't buy into that crap.
I disagree. I can protect my friends and family from rapists by giving them guns.
Protection against these malware authors proves much more difficult.
Besides, they were dressing like whores, anyway.
Ok, maybe its not fair. Maybe it is, but the truth is that the email clients and the web browsers are installing this crap on peoples machines. Without the programs to go out and make the tcpip connections, that shit would stay on their compromised boxes. Since the current click-to-proceed systems are currently -not- working, the ante should be upped and make it impossible to use these client programs to hurt the boxes they reside on.
I am talking about making it -impossible- to save a file that can run as a program. Either in zip form or in real form. No click through, no nuthin. If the consumers want to download a -program- then only their anti-virus package should be able to do that. At that point, the anti-virus program takes responsibility for the behaviour of the downloaded content.
Firefox, chrome, thunderbird, explorer, whatever. These packages are RESPONSIBLE for injecting unsafe content onto systems without an immune system. Like someone throwing manure at someone with no immune system. Or feeding peanuts to someone known to have that allergy.
I am saying that the only safe way to download content to boxes now is to use the anti-virus programs as a download/installation agent. And we have to hold the agent responsible.
If you can't download without the anti-virus, how do you download the antivirus?
Do we really want to give a process huge control over what your system can or can not do? Its not the browser's fault. Its the user's fault. *NIX has a 'runnable' bit - which prevents programs with that bit set to 0 from running. Its still the user who flicks it on. Does this protect against social attacks like this one? Nope. Neither would "THIS PROGRAM WANTS YOU TO INSTALL" - because you're expecting that.
You can't blame the browsers. You can only blame the users.
Uh... (1) Outlook won't directly run an executable attachment anyway. (2) Browsers won't either without raising a huge warning. (3) Browsers already scan downloads with the installed AV if present.
"the ante should be upped and make it impossible to use these client programs to hurt the boxes they reside on." - by Marrow (195242) on Sunday January 02, @07:59PM (#34740466)
Sure: It's called a custom HOSTS file! If leolati.com is within that file, blocked off in 1 of 3 ways thus (don't use the part in parenthesis after "leolati.com" though in each one):
---
127.0.0.1 leolati.com (largest & slowest of the 3, + has a "loopback operation")
0.0.0.0 leolati.com (less large/slow than the above, but has no loopback operation)
0 leolati.com (less compatible than the 2 above, has no loopback operation, & is fastest/smallest)
NOTE: 127.0.0.1 & 0.0.0.0 work on EVERY OS that has a BSD based IP Stack (pretty much ALL of them), but 0 only works afaik on Windows 2000 SP#2 & above, XP, Server 2003...
---
Once those sites are "blocked off" thus? It IS impossible for client programs, ANY WEBBOUND ONES, to hurt the boxes they reside on (because again, IF/WHEN you cannot get to those sites? You can't be harmed by them - very simple & you don't even have to turn off javascript, because you never get hit by the scripts those sites try to use to compromise your system with either (per the article quote -> "the pages to which the user is redirected are using obfuscated JavaScript and exploits to try to install the malicious file on the victim's machine.")).
---
"I am talking about making it -impossible- to save a file that can run as a program. Either in zip form or in real form. No click through, no nuthin." - by Marrow (195242) on Sunday January 02, @07:59PM (#34740466)
See the above - again: IF/WHEN YOU CANNOT REACH THE leolati.com SERVER THIS IS BEING SERVED UP FROM? You won't be able to be victimized by ANYTHING SAID SERVER TRIES...
---
"If the consumers want to download a -program- then only their anti-virus package should be able to do that. At that point, the anti-virus program takes responsibility for the behaviour of the downloaded content." - by Marrow (195242) on Sunday January 02, @07:59PM (#34740466)
You don't NEED an antivirus/antispyware program to do that for you... see above!
---
"Firefox, chrome, thunderbird, explorer, whatever." - by Marrow (195242) on Sunday January 02, @07:59PM (#34740466)
HOSTS files cover them, and any email programs too (since this attack comes in the form of spam mails via "greeting cards for the holidays" etc.) - any webbound program is protected by HOSTS files!
---
"These packages are RESPONSIBLE for injecting unsafe content onto systems without an immune system." - by Marrow (195242) on Sunday January 02, @07:59PM (#34740466)
You have your "immune system" above... &, it's GUARANTEED to work!
---
"Like someone throwing manure at someone with no immune system. Or feeding peanuts to someone known to have that allergy." - by Marrow (195242) on Sunday January 02, @07:59PM (#34740466)
I'll do you 1 better: How about doing what I said above, because you can't eat peanuts from a dish when you can't even SEE THE "DISH" (server that has the 'poison peanuts' in it, in other words), and you can have an allergy all day long, as long as you don't even SEE/come in contact with, the offending material (and basically, HOSTS can do that for you, when you "block out" the place the "allergen" comes from, period).
---
"I am saying that the only safe way to download content to boxes now is to use the anti-virus programs as a download/installation agent. And we have to hold the agent responsible." - by Marrow (195242) on Sunday January 02, @07:59PM (#34740466)
It's NOT "the only way" though... see the above: Hosts files provide another way, and QUITE POSSIBLY, a superior way (if
Great idea.
So someone like me, who doesn't run antivirus, because I've never been infected, ever, in over 20 years, can never actually download anything, because the antivirus software that's not on my machine is the only program allowed to download anything?
Antivirus software is not for surfing the Internet. Antivirus software is for scanning for and removing viruses.
Browsers are for surfing the Internet.
Why should you move functionality from where it makes sense, to where it doesn't? From there, it's just a short step to unmaintainable spaghetti code.
"City hall" in German is "Rathaus" Kinda explains a few things......
And I can protect my friends from viruses but giving them linux. :)
Protection against these malware authors proves to be rather simple.
"To prevent this day from getting any worse, I'll just read ERROR as GOOD THING" 1GJU8xLuDKDxEs4KLf8fAGyptoDsqvEsBT
Warning - ignore the poster quoted above - APK is an infamous, banned, abusive, stalking, mentally deranged, troll - who refuses to take his medication, as part of his condition is the delusion that "he knows better than the doctors"
At best his proposed cure for "everything" is a partial, weak solution, requiring constant prescient maintenance *with* admin/root access - a 14+MB ineffectual solutions that *might* have been of some, immeasurably small, use in 1995.
Away with you foul troll, back to cross-linking to your many aliases, fake references, and your bullshit "developer" status, and stalking the polite and blameless.
You are the only compelling argument for the government censoring the internet.
See my subject-line above. When you can come back, on topic, and technically disprove anything I stated above, then, you'd actually be on topic, like you're supposed to be, and you'd actually have posted something worth reading.
As to partial weak solution? Ok - I'll let the words of others here, speak for me, instead:
---
"Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago." - by TestedDoughnut (1324447) on Monday December 13, @12:18AM (#34532122)
FROM http://tech.slashdot.org/comments.pl?sid=1907528&cid=34532122
---
Same here too, & I can produce more like that if anyone wants them... mvps.org's forums is a place that can do far more than I can mind you, also.
---
"Warning - ignore the poster quoted above - APK is an infamous, banned, abusive, stalking, mentally deranged, troll - who refuses to take his medication, as part of his condition is the delusion that "he knows better than the doctors" - by damaged_sectors (1690438) on Sunday January 02, @11:39PM (#34741154)
When you get your PHD in psychiatry, plus a license to practice it, each to your name along with a formally admistered examination of my mental state given in professional surroundings?
Then?
Then, you can get back to us then with your "snap-prognosis" there, Dr. Quack - the "/. 'Sidewalk Psychiatrist"/Professor Wannabe PHD act - because then @ least, it wouldn't be one of your own "delusions of grandeur"...
(And again, you're off topic & trolling)
---
"Away with you foul troll, back to cross-linking to your many aliases, fake references, and your bullshit "developer" status, and stalking the polite and blameless." - by damaged_sectors (1690438) on Sunday January 02, @11:39PM (#34741154)
You have the nerve to call ME a "troll"? LOL - look at the post of yours I am quoting from, for Pete's sake! Some nerve...
(& anything I've ever posted about myself is just fact in things I've managed to do over time in the computer sciences arena (& obviously things you've never managed to accomplish yourself)).
---
"At best his proposed cure for "everything" is a partial, weak solution, requiring constant prescient maintenance *with* admin/root access - a 14+MB ineffectual solutions that *might* have been of some, immeasurably small, use in 1995." - by damaged_sectors (1690438) on Sunday January 02, @11:39PM (#34741154)
So what - it only takes less than a minute to:
---
1.) Download an updated HOSTS file from reputable/reliable sources
2.) Copy it over your existing HOSTS file
---
Done!
UAC is easy enough to override via the click of a button to do so, & you're done (in my case, as of literally 2 minutes ago? I am 100% GUARANTEED PROTECTED VS. 920,296 KNOWN MALICIOUS SITES/SERVERS HERE - are you??)
---
"You are the only compelling argument for the government censoring the internet." - by damaged_sectors (1690438) on Sunday January 02, @11:39PM (#34741154)
Look, whatever medication it is you are supposed to be taking (what with all your wannabe medical advice above, etc., lol)? You had best start taking it again, ok?
APK
P.S.=> You sound like you need it, or something like it, if the best you have here is some tasteless attempt @ adhominem attack (attacking myself, rather than any technical points I made in my post you replied to)... apk
Yeah, but maybe one day they'll want to actually use their computer.
And until it remains so, this is going to be going on constantly.
expandfairuse.org
Great idea.
I agree, so does my Security Gateway.
Antivirus software is not for surfing the Internet. Antivirus software is for scanning for and removing viruses.
1. My "anti-virus" scans all inbound Internet data -- ergo, I use it while I'm surfing the web.
2. Antivirus software can not be used to remove viruses. How is an antivirus running on a root-kitted system supposed to remove the rootkit? How can you ever be 100% sure that your infected system really is disinfected without scanning from another untainted OS and/or machine? Once you're infected, it's wipe & re-image time...
P.S. Modern bot-nets run silently -- You could be infected right now & not know it. My gateway alerts me to suspicious network activity...
Why should you move functionality from where it makes sense, to where it doesn't?
I can update just the gateway and all machines behind it benefit, instead of having all the machines install new AV signatures.
Granted, I primarily use Linux, but I have several Windows boxes I use for compatibility testing. It's a pain to keep them all up to date (even with VMs & disk images), or to scan them all via net-boot or boot CD periodically. I can avoid the entire mess if I scan all inbound data.
From there, it's just a short step to unmaintainable spaghetti code.
I disagree... It doesn't have to be spaghetti code (really a moot point: No matter how pristine and elegant the code is, it's always one developer away from becoming spaghetti code).
Considering that the alternatives are praying to $deity that MS will patch your systems before they're infected, or keeping a large, invasive, processor intensive AV software suite up to date & running on each machine, I think an external real-time network AV is an elegant solution.
(If performance is needed I place my Fedora system or Game Console in the DMZ).
It'll take me all of 5 minutes (and 10 dollars) to register 'leolati1.com' and bypass your host file tinkering. Once you adapt from that - I can go with 'leolati2' or letters, or random numbers at the end.
Blacklists don't work. Especially not when its blacklisting an internet domain which can be replaced very quickly.
"It'll take me all of 5 minutes (and 10 dollars) to register 'leolati1.com' and bypass your host file tinkering. Once you adapt from that - I can go with 'leolati2' or letters, or random numbers at the end." - by Haedrian (1676506) on Monday January 03, @06:57AM (#34742512)
And it'll take me all of 30 seconds to add them to my hosts file, updating it (while you wasted many minutes AND YOUR MONEY)...
How's that suit you?
---
"Blacklists don't work." - by Haedrian (1676506) on Monday January 03, @06:57AM (#34742512)
This gent, along with myself, disagree with you:
---
"Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago." - by TestedDoughnut (1324447) on Monday December 13, @12:18AM (#34532122)
FROM http://tech.slashdot.org/comments.pl?sid=1907528&cid=34532122
---
So much for your "opinions" haedrian.
(You're already outnumbered here, 2:1, by folks like TestedDonut and myself, who tell the truth (unlike yourself)).
APK
P.S.=> Go back to making your malware, because only a malware maker would try to state the outright b.s. you just have... apk
Especially in the 1st 3 URLs below:
---
http://slashdot.org/comments.pl?sid=1930156&cid=34734160
http://slashdot.org/comments.pl?sid=1930330&cid=34737526
http://it.slashdot.org/comments.pl?sid=1916240&cid=34612834
http://mobile.slashdot.org/comments.pl?sid=1930156&cid=34719276
http://slashdot.org/comments.pl?sid=1930330&cid=34737308
http://it.slashdot.org/comments.pl?sid=1916240&cid=34647708
---
(ROTFLMAO!)
I seriously wouldn't listen to "pwufessuh haiwypheet" guys, he's only an ITT Tech student.
You've also got to consider the fact that hairyfeet here is a tech that makes his living off of others' misfortunes online, and if malware removal (a big part of his day no doubt) is non-sequitur & a thing of the past? Well, where is hairyfeet going to make his income from??
It's not in hairyfeet, or other "techies"' truly 'best interests' to have you cleaned & fortified so you cannot get malware (otherwise, again, they won't make as much monies).
Think about it...
His "solutions" in antivirus/antispyware aren't perfect, & the url's above show anyone that much.
He also isn't telling you there is far more you can do for the working concept of "layered security" either, than just his "solutions" (which again, are shown to be IMPERFECT in the url's above), funny that, eh? Not.
"Your claims have been been shown as worthless dozens of times by people whose opinions I find worthy of respect." - by damaged_sectors (1690438) on Monday January 03, @06:23PM (#34748892)
Where's that? Show us! Good luck - THAT never happened here, not once... in fact, I'd like to see WHERE you got your information from, & specifically, on this forums!
Show us that much...
---
"You vs. Bruce Schneier? I don't think so." - by damaged_sectors (1690438) on Monday January 03, @06:23PM (#34748892)
First of all, are you he? No!
Secondly?? I'd take him on, on HOSTS files & layered security's effectiveness, ANY DAY OF THE WEEK!
---
"Have you ever managed to convince anyone that you're not a raving loon?" - by damaged_sectors (1690438) on Monday January 03, @06:23PM (#34748892)
Plenty of people, thing is, have YOU done the same? LOL, judging from your "foaming at the mouth" rants & adhominem attacks of myself?? I doubt it.
APK
P.S.=> Again, if ALL YOU HAVE, is your adhominem attacks, & unsubstantiated claims (see above @ the top of this post)? You've got NOTHING... period! And, you KNOW it... apk
Antivirus software is not for surfing the Internet. Antivirus software is for scanning for and removing viruses.
1. My "anti-virus" scans all inbound Internet data -- ergo, I use it while I'm surfing the web.
2. Antivirus software can not be used to remove viruses. How is an antivirus running on a root-kitted system supposed to remove the rootkit?
It's not. But nowhere in my post did I say it's for removing viruses that have already infected the machine it's running on.
It's for removing viruses from email, removing viruses from network traffic, removing viruses from USB drives, etc,etc. For crappy viruses, it can also remove them from the currently running system. However, you're right; root-kitted machines cannot generally be cleaned by A/V running in the infected environment.
However, this is all semantic bullshit, and largely irrelevant to my original point, which was this:
There's a big difference between:
a) downloading something with your browser, and your A/V saying "Wait a minute while I check that."
and
b) wanting to download something, so your browser says "I can't do this," then says to your A/V software "Hey...download this URL for me, here's a bunch of cookies you might need, session ID, and all sorts of POST data, and you'd better include this referrer URL, or you might get banned. Oh.....can you let me know when you've got that downloaded, so I can tell the user that it's done?"
"City hall" in German is "Rathaus" Kinda explains a few things......