Slashdot Mirror
Are Computer Crooks Renting Out Your PC?
An anonymous reader writes "Brian Krebs recently posted an interesting piece looking at an invite-only service marketed on shadowy underground forums that lets crooks 'rent' or 'buy' access to individual botted PCs that can be used to tunnel traffic. The story looks at the mechanics of renting out bots, and the author traces some of the infected systems back to real businesses. From the post: 'The Limited; Santiam Memorial Hospital in Stayton, Ore.; Salem, Mass. based North Shore Medical Center; marketing communications firm McCann-Erickson Worldwide; and the Greater Reno-Tahoe Economic Development Authority.'"
No. I'm so busy surfing /. that I don't have any spare CPU cycles to rent out.
Are Computer Crooks Renting Out Your PC?
No, I don't run windows and I set it up right.
Windows Vista was not that bloated. Microsoft was just monetizing spare CPU cycles on the Russian Black Market.
vi +
Tinfoil hats on.
If you outlaw renting computer bots only criminals will rent computer bots. ...profit
The news on computer security is usually relentlessly bad. It is nice to see an instance where the economic realities of non-targeted attacks make the bad guys slightly more vulnerable. Even if our antivirus overlords are pitifully incapable of keeping us from getting 0wn3d, which seems to be the case, they are in a fairly good position to monitor the 'underground' marketplace and reduce the value of compromised PCs. That won't save the strategically valuable targets; but anything that reduces the rental value of Joe Broadband's horribly compromised porn box is good for Joe, and for the internet generally.
>Santiam Memorial Hospital in Stayton, Ore.
I used to provide tech support for doctors offices and hospitals and I can tell you for a fact that their computer security ranges from "bad" to "OMFG!!". Seriously, there were places I wanted to take a shower after leaving because their workstations were so riddled with spyware and trojans.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Well not so cheap, Call me and we can discuss terms. If you're a crook, I don't want to know, OK? Oh, and I do run windows, and its set up right, just sose ya know...
I would expect just like policemen have contacts in the criminal underworld, I would assume security researchers would do the same thing.
And thus the irony of the ISC^2 code of conduct is finally revealed:
It doesn't take a genious to realize that you keep your friends close and your enemies closer
Santiam Memorial Hospital in Stayton, Ore.
I used to provide tech support for doctors offices and hospitals and I can tell you for a fact that their computer security ranges from "bad" to "OMFG!!".
That happens for several reasons:
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Why would I go out of my way to use an OS that takes extra work to secure?
Because you want it to use for 3D design, music/film production etc.
For their sake... I still run a PIII with W2K.
Mostly random stuff.
Since the ***AA's campaign was so effective... How about CUAA... Computer Users Associatlion of America
The deal is, every computer joins this association, and grants the organization the right to sue on their behalf, to collect damages resulting from malware, in exchange for a percentage of the damages awarded.
Once enough computer users join this association, the association goes after anyone making or distributing malware. (Including infected websites)
Using **AA-style tactics, sending threatening letters to the ISPs of servers propagating malware, etc..
It's more like they're squatting, renters at least give some cash back!
I wish I was a neutron bomb, for once I could go off...
also some vendor hardware / systems block windows updates / are setup so they can't be installed / the vendor has to do the admin work on them.
If Brian Krebs can figure out that The Securities Group LLC, The Limited; Santiam Memorial Hospital, North Shore Medical Center; McCann-Erickson Worldwide; and the Greater Reno-Tahoe Economic Development Authority are part of a botnet, then the ISPs used by those companies can do the same. Which points out the real problem with spam, malware and botnets: ISPs refuse to lift a finger to secure their networks.
Every person or business identified as being part of a botnet should be notified that their Internet access is being terminated immediately and will not be restored until they fix the problem.
See subject-line, & then figures/facts from SECUNIA.COM:
(Especially vs. this statement quoted from you next below)
"Actually it is window's fault that it's insecure by design." - by 1s44c (552956) on Sunday April 10, @05:20PM (#35776068)
In fact, I'll show you that Microsoft's ENTIRE ARRAY/FULL GAMUT of development for business (Office Suite, Database Server, Internet Server, Internet Browser, & Development Studio/IDE + Windows 7 itself) has LESS THAN 3x++ the known security issues, unpatched, that Linux 2.6, kernel only mind you, has - &, that # on Linux is more, & goes "up, Up, UP & AWAY...", especially once you toss on the rest of what comes with a Linux distro (e.g./i.e.-> Webbrowsers, GUI shells, Windows managers, & far more)...
---
Vulnerability Report: Microsoft Windows 7: (04/10/2011)
http://secunia.com/advisories/product/27467/?task=advisories
Unpatched 10% (6 of 59 Secunia advisories)
---
AND, of those 6 vulnerabilities, yes... 3 are "remote". HOWEVER, they're:
1.) In subsystems (like FAX) NOT installed "by default" (means I don't use it here & most others won't either...)
2.) Have valid & EASY work-arounds (e.g. - mhtml bug & Ms' "FIX IT Tool" for it, gui easy...)
3.) Are caused/utilized by faulty 3rd party apps (e.g., & of ALL things? Apple stuff uses a known bugged API in Visual Studio, see above, triggers one, ITunes another, iirc, etc. but no other apps are KNOWN to - go figure, eh?).
4.) PLUS, "MS 'Patch Tuesday'" is only 2 days away now, actually less, & is patching 64 problems across ALL of their wares (meaning the holes here on Windows are soon just a bad memory too, not that they are, because they have easy & valid work-arounds for a lot of them!)
I.E.-> "NO PROBLEMO!"
---
Vulnerability Report: Microsoft Office 2010: (04/10/2011)
http://secunia.com/advisories/product/30529/?task=advisories
Unpatched 0% (0 of 4 Secunia advisories)
---
Vulnerability Report: Microsoft SQL Server 2008: (04/10/2011)
http://secunia.com/advisories/product/21744/
Unpatched 0% (0 of 4 Secunia advisories)
---
Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (04/10/2011)
http://secunia.com/advisories/product/17543/
Unpatched 0% (0 of 6 Secunia advisories)
---
Vulnerability Report: Microsoft Visual Studio 2010:(04/10/2011)
http://secunia.com/advisories/product/30853/?task=advisories
Unpatched 17% (1 of 6 Secunia advisories)
(The single 1 here also, like Windows 7 above, has an EASY work-around, & thus? Again, "NO PROBLEMO"!)
---
Vulnerability Report: Microsoft Internet Explorer 9.x:
(04/10/2011)
http://secunia.com/advisories/product/34591/
Unpatched 0% (0 of 0 Secunia advisories)
---
Well - "Read 'em & WEEP", /.'s "Pro-*NIX crew"... & "argue w/ the #'s" & good luck: You'll NEED it!
APK
P.S.=> NOW - Here's Linux's "latest/greatest", next below... (complete with a REMOTE EXPLOIT TOO, no less, in the "ROSE" subsystem):
---
Vulnerability Report: Linux Kernel 2.6.x: (04/10/2011)
http://secunia.com/advisories/product/2719/?task=advisories
Unpatched 7% (19 of 259 Secunia advisories)
--
Example I worked at Wachovia in Atlanta for 3 years, the password on every pc was just wachovia and a number so to log in admin access on all the boxes was username: wachovia password: wachovia1 or wachovia2 or wachovia3 and so on and so forth. All these pc's were seperate xp boxes and there was really no restrictive access, they rely mainly on "dumb employees" that know no better. Hell there are 2 boxes to this day I can still remote desktop into from anywhere... talk about sad state of affairs
That's the more common problem.
There I said it. Cut the balls off enough of these people who treat millions of people's important personal property like a plaything and maybe they'll start having second thoughts. I'm tired of it being so easy to reach out an fuck with something that at this point is so critical to most individuals daily lives. And while we can blame MS and the user, lets not forget who the real culprit is. The time and money and IT frustration that results from the work of these assholes is immeasurable.
You don't see criminals thinking they can walk down the street and then try to break into every single house in a city and then squat in every one that has an unlocked door. I don't know why anyone ever thought it was ok to do the equivalent in the digital domain. I blame not strong enough penalties at the start of pc hacking. If we had started with fingers we probably wouldn't have ever even had to go to balls. But here we are so I vote, balls.
Can you tell I had to deal with with someone's malware infested pc who had no backup recently?
If you wanna get rich, you know that payback is a bitch
There is a .NET plugin, it's called Silverlight, available for Windows and Mac OS X, plus it's basically what you have to use to write WP7 apps.
SSC
Silverlight includes a subset of .NET, it doesn't require a framework to be installed. Installing the .NET framework does not put you at risk for web attacks. As for Silverlight I haven't heard of a single drive-by attack.
.NET to write applications but if anything it is safer than Win32 applications due to using managed code. .NET in no way should be lumped in with Java when it comes to security. Don't smear .NET with Java's problems.
As for WP7 you don't need
What does it say about Linux, which is responsible for nine out of every ten pieces of spam that arrives at my Inbox?
Why do you say (i.e., what evidence do you have) that 90% of spam you receive is generated by Linux?
"I don't know, therefore Aliens" Wafflebox1
Guess what, I wrote a keylogger and send it to the dev team, every time when the game patches and installed, the thing will also install. Everytime we encounter a perpertual cheater will turn on the keylogger, colect all his infomation, and fight him back by loggin in to his facebook account and do shit.
I don't know about how things are (not) done in South America, but in the US and Europe is highly illegal.
"I don't know, therefore Aliens" Wafflebox1
I have a Mac.
Now before you punish-mod me into oblivion; let me explain:
I just happened to look at my security logs about a week ago, and there has been a steady (and I DO mean steady!) stream of ne'er-do-wells banging on my ssh port (yes, I use port 22. Call me smug).
The logfiles (that only went back to January, mind you) had SO many login attempts that I literally couldn't email them to a friend due to a 15 MB email attachment limit!
I gave up trying to convert the logs to PDF at 6,000+ pages (!!!) Not one successful login, other than my own. And there were dictionary attacks, Kerebos Attacks, attempts at root, some sort of attack to try and get Mach to spit out SOMETHING; you name it; people (bots) tried. And tried. And tried.
So yes, I feel a bit smug at this point.
Contrast with my friend's Dell running fully-patched XP SP3, with TWO firewall/AV packages running: Opened up an RDC port: BLAM!!! Hosed in a few days with some horrible thing that is completely and utterly un-killable. Keeps spawning SVCHOST.EXE processes, and the quicker you try to eradicate them, the more aggressively it spawns more! Never seen anything like it. No choice to "wipe and reload".
Ick.
fucker