Slashdot Mirror
Zeroing In On the Internet's 'Evil Cities'
We've sometimes seen malware sources broken down by country; now a Dutch study attempts to increase the resolution of that information. An anonymous reader writes with some bits gleaned from the recently published study (PDF): "Seoul is the most criminal city on the Internet, followed by Taipei and Beijing. When the population of the top 20 cities is taking into account, Chelyabinsk , in Russia, tops the list, followed by Buenos Aires and Kuala Lampur. These results were found by researchers from the from the University of Twente and Quarantainenet, a security company from the Netherlands. The researchers also found that analyzing attacks' origin at the city level [Original, in Dutch] instead of country level reveals interesting findings. For example, the U.S. ranked #3 in the list of the most criminal countries for the reporting period, while no major U.S. city was found among the most evil ones, while only one European city was listed among the top 20 cities, but 8 EU countries were among the most criminal. It was also observed that the list of criminal cities remains stable over a period time and that when the attack type is taken into account, 50% of the most evil cities remains the same."
So what's the solution here? Should networks serving a primarily North American audience just outright block any traffic from Asian countries, for instance?
Serious lack of useful information in the linked articles. The summary is longer!
I do not fail; I succeed at finding out what does not work.
Isolate them from the WWW until they clean up their act at the local level. Go get them Google!
FTFP:
In this work, by originated we mean where the attack came from. We do not consider if there
were other hosts controlling the attacking one
So this is not about criminal activity. It is about "which city has the most zombies".
That information is still useful, but not "most evil"
We are in decline, but our banksters still have no match.
The City? Don't make me laugh. GS boys have nastier grub for breakfast.
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
Seoul is likely to be at the top of the list not because it's naturally criminal, but simply because it contains the largest proportion of computers connected to a high speed network. With a large enough botnet it's a bit like a city sized data centre.
In the per capita list, Buenos Aires ranks 2nd, but the city population data they use are wrong. They say Buenos Aires population is 3 million, but that's only Buenos Aires city proper, the whole metro area has an estimated population of about 13 million. So Buenos Aires should rank lower than listed in that study.
Not Evil - should be Entrepreneurial-friendly cities or Leading the world in successful small-business startups. Doesn't anyone take basic PR anymore?
For a moment I thought they're calling the city where MAFIAAs are located evil and are nuking it from orbit...
Chelyabinsk also has a reputation as being the most contaminated city, with nuclear contamination from Mayak. Now maybe there's a connection..
How could they possibly determine the origin of the attach without the full cooperation of all ISPs around the world?
I could very easily hire a spam group out of any one of these countries to push my malware out for profit but who is really "evil"? The companies in foreign countries that offer the service or the people who hire them? My guess is if we were to follow the money it would lead us to very different places.
You need to calm down. You're giving all South Americans a very bad image.
I've read his comment several times now, and he didn't mention anything about race. He did list several very significant business, economic and legal barriers to such trade, however. All of those barriers are completely independent of race.
Racism is clearly not at play here. It is blatantly incorrect of you to suggest that it is.
I want a list of large cities where it's impossible to get affordable decent-speed, decent-priced Internet access from a provider that isn't morally "criminal" in some way or other.
Seoul, South Korea was #1 on the list, and it may be for reasons other than just generally good Internet connectivity:
It's the home of co.cc, which Google recently blacklisted for being a den of evil.
If it was before the co.cc Google Death Penalty then maybe we should re-run the study in a few weeks.
From Google pulls co.cc subdomains from search, brings our global malware nightmare to an end:
Google classifies [the company behind co.cc] as a "freehost" -- it belongs to a Korean [emphasis added] company...
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
For example, the U.S. ranked #3 in the list of the most criminal countries for the reporting period, while no major U.S. city was found among the most evil ones,
Does this mean the US just has all of it's malware spread evenly between the many major cities? Or are all the compromised machines in rural places like Buttfuck, Indiana?
Nuke 'em All ... and in plain sight
Let their bodiers burn
Kill their women ... kill their children ... they cannot learn
Only in death will they be
a Silence ... yearn
To their grave ... dumpt them
Till no more and all forgotten
The wind ... inherit thee
I am the wind
--
The paper explains that they used the IP locations to see where the attacks were coming from. If someone in Shanghai has a botnet that includes a bunch of machines on a university campus in Missouri and launches his attacks through that botnet, wouldn't it count as an attack coming from Missouri instead of Shanghai?
I'm not sure I'm comfortable with the methodology of this study. I'm too tired to read it more carefully now, but it looks like it might be making conclusions about "evil cities" that is not really warranted.
You are welcome on my lawn.
See subject line above & this link-> http://www.zdnet.com/blog/ou/s-korean-addiction-to-activex-stalls-vista-adoption/412
APK
P.S.=> Pretty much "says it all" as to WHY what you said, rings true (they love their "ActiveX")
... apk
Evil is not the same as criminal.
Is there a widget that would generate a hosts file to block dangerous locations by clicking on a map? Sorry, that sounds like an iPhone app.
Sorry, but gray text on gray background is making my eyes bleed.
I do it here too, albeit via a Python script that my nephew & I wrote up earlier this year!
Fact is - I was going to alter my deduplication/normalization routine in a Delphi program I wrote for it too years earlier... but Python got ahold of me!
The program was much like MVPS' HOSTMAN program they feature there on mvps.org here in terms of function & design (logic made them the same pretty much & "great minds think alike" lol):
http://www.mvps.org/winhelp2002/hosts.htm
It can do the job, automagically for you too, updates remotely & all iirc!
(However - Because I was using a Delphi app before that one even existed, circa iirc, 2002-2010 timeframe here, because in that timeframe, especially early on, HOSTS files didn't really get much larger than 16k lines or so typically - my algorithm more than "did the job" then, for speed/time constraints of operation & Delphi ROCKS @ strings work natively (but algorithms & datasizes ARE everything (DataStructures courses show you this for instance, on sortations))
Then - the malware problem really "exploded" around late 2004 onwards is why!
Plus, more valid reputable & reliable HOSTS file data sources popped up too, & the data began coming FASTER & around the clock from international sources (valid reputable ones that track botnets & malware sources etc. + bogus servers/sites/hosts-domains for adbanner malicious script & more)...
The data got HUGE in 2008 onwards, & the Delphi app began taking TOO long (2 hrs. on FULL list, much less if I "busted up the data into 48 parts" (was a temp fix I was using, took it down to FAR less), only minutes of time...).
Still too long, especially on an Intel Core I7 920 CPU here!
Until then?
Like I said - The Delphi app (APK Hosts File Grinder 4.0++) did FINE using a "Brute Force" deduplicaiton method (between two list constructs in GUI, & a QuickSort for sortation before that)
However, my nephew was looking to write an app (he's a junior @ RIT in CIS/Comp. Security concentration) & I said, "Heck, you're free to take that idea, & run with it... especially since you're majoring in security related work!"
He did, & came up with the rough prototype (he's good @ regexp, his strength in fact imo)!
Then, I took & ran with adding in threaded timed operations, filtering vs. sites/servers/hosts-domains not to block, filters vs. stray character various HOSTS files makers use (pain in the butt & non-std. between them all), the ability to convert over DNSBL's too, & more "structured coding" using parameter passing functions (lessening the lines for the PyThon interpreter to parse etc./et al too), & more...
Works great - I don't have to lift a finger, it does the work "automagically" for me from a temp copy of the original HOSTS file, filtering it, sorting it alphabetically, deduplicating/normalizing it, & committing it back in the end to the final real HOSTS file itself!
Best part?
Python makes it "write once/run anywhere" portable, & it's an EASY language to pick up on imo!
(I code in roughly, whew, maybe 15 of them since 1982... perhaps this is why I think it's essentially "VB-EZ" to learn (only 2-3 months into it now, & I am only NOW just beginning to appreciate its power, up there with PERL for RegExp abilities (which IS what you need for this, better than VB/Delphi/C++ string handling by far imo, & hosts are basically ALL string processing))).
Anyhow... there you are. Perhaps HOSTSMAN is your answer though! See that mvps.org page for it (it's free as in beer etc.).
OR THE FIREFOX ADDONS FOR IT HAVE SEEN!
You CAN alternately (so you know) use MySQL or Access even, & gather the data YOURSELF (I know of 17 reputable & reliable sources for it, for HOSTS), & do a "SELECT * DISTINCT FROM (fully qualified device/table name)" to do the same though... that's
A beautiful city! It is home to the world's first three peacetime nuclear disasters. You can read up on the place in the Exile.
The Head of Vice for Manukau Counties NZ Police District is known as a terrorist, capo and serial killer by people in Malaysia, Australia, New Zealand and various other countries.
Using NZ Police (NZ Government) funded electronics and businesses, he has attacked 4000 pupils from 3 different schools, various businesses (Banks, F&B etc), and has attempted to repeatedly murder a family of 5 who live in Malaysia.
A bit of history on this serial killer head. Known murders and attempted murders are
1. One Polynesian man who was taken from his home, driven to a farm on a dark and deserted gravel road, and stomped on until he died. They say the deceased's head was deformed.
2. One Polynesian man who was stomped on in a South Auckland housing compound and also died.
3. One Polynesian man who was also stomped on and beaten but lived (using the same technique as the two deceased in 1 and 2 above)
4. One unknown (but likely to be Polynesian and male) person who may or may not have died.
5. Five (5) members of the Chin family who were subjected to numerous attempted murders, rape of daughter, kidnapping of son for slavery, rape of mother, attempted murder of father, rape of maid.
Evil? Evil from which side of the looking glass?
What I think you'll find actually is the cause is more of a cultural thing. I've done no empirical research on this, but I do get a few data point of observations from the large number of Asian grad students we get. I've noticed something that is very common in both Chinese and Korean students:
1) Pirated software is a way of life. The idea of paying for software is just not really an idea they have. They don't see it as wrong in any way, it is just how you do things. Well while the BSA's stuff about viruses is over inflated, it is based in reality. There are plenty of warez sites out there which have infected software. This seems to be particularly true of Chinese sites. Finding one that isn't ridden with viruses is difficult.
2) Virus scanners are just something that isn't considered to be needed on computers. This may be in part because of language barriers. Most of the best virus scanners are Eastern European, and the companies market in English primarily. I have noticed since Qihoo has come to be that more Chinese students have scanners, it in particular. Unfortunately it is a really poor virus scanner (gets a ton of false positives and have poor heuristics and so doesn't deal well with unknown malware) so it doesn't do much good.
3) ISPs that just won't give a shit, at all, about anything. Efforts at contacting Chinese ISPs about problems have never done anything. Most ISPs, if you make them aware of a system causing problems, will take action. Some these days proactively watch their network and shut down problem connections. We've never had any luck with Chinese ISPs. We've even gotten people to translate our message in to Chinese and the response is always "We are not responsible for that IP, please get us the correct IP." They are of course responsible, APNIC confirms it, they just don't care.
I think that is a large reason why areas like this are so very infected. The propensity for not having a scanner and downloading from any random site makes infection much easier, and since ISPs don't seem to care there is little to stem the tide. You combine that with the normal user ignorance of computer security that we see across the world and there you go.
This page has a visualized correlation of ssh blacklisted IP's against Cities. It is updated daily. Source is the sshbl.org blacklist.
Current daily winners are Moscow and San Francisco with 17 each.
http://hackertarget.com/ssh-blacklist/
they actually needed to do a study?
The full paper lists Seoul as having the country code "KP". .kp is the ccTLD for North Korea.
Nuke them from space - it's the only way to be sure.
There are dozens of open proxy servers used by these axis of evil cities in the US. FDC to name but one (actually, thousands). In other words, any such "study" cannot, or at best, does not, take this into the perspective. Seoul? Sure. Peking? Sure. Gainsville? Sure. But you can't rely on these dutch folks to have anything there.
It's only a rank of most hackable cities to where to lunch an attach from,
or an Index of end user stupidity, ranked by city.