Slashdot Mirror
Zeroing In On the Internet's 'Evil Cities'
We've sometimes seen malware sources broken down by country; now a Dutch study attempts to increase the resolution of that information. An anonymous reader writes with some bits gleaned from the recently published study (PDF): "Seoul is the most criminal city on the Internet, followed by Taipei and Beijing. When the population of the top 20 cities is taking into account, Chelyabinsk , in Russia, tops the list, followed by Buenos Aires and Kuala Lampur. These results were found by researchers from the from the University of Twente and Quarantainenet, a security company from the Netherlands. The researchers also found that analyzing attacks' origin at the city level [Original, in Dutch] instead of country level reveals interesting findings. For example, the U.S. ranked #3 in the list of the most criminal countries for the reporting period, while no major U.S. city was found among the most evil ones, while only one European city was listed among the top 20 cities, but 8 EU countries were among the most criminal. It was also observed that the list of criminal cities remains stable over a period time and that when the attack type is taken into account, 50% of the most evil cities remains the same."
Serious lack of useful information in the linked articles. The summary is longer!
I do not fail; I succeed at finding out what does not work.
Isolate them from the WWW until they clean up their act at the local level. Go get them Google!
FTFP:
In this work, by originated we mean where the attack came from. We do not consider if there
were other hosts controlling the attacking one
So this is not about criminal activity. It is about "which city has the most zombies".
That information is still useful, but not "most evil"
We are in decline, but our banksters still have no match.
The City? Don't make me laugh. GS boys have nastier grub for breakfast.
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
Seoul is likely to be at the top of the list not because it's naturally criminal, but simply because it contains the largest proportion of computers connected to a high speed network. With a large enough botnet it's a bit like a city sized data centre.
In the per capita list, Buenos Aires ranks 2nd, but the city population data they use are wrong. They say Buenos Aires population is 3 million, but that's only Buenos Aires city proper, the whole metro area has an estimated population of about 13 million. So Buenos Aires should rank lower than listed in that study.
Yes, nothing is as simple as a nuclear war. Stupid.
--
make install -not war
Chelyabinsk also has a reputation as being the most contaminated city, with nuclear contamination from Mayak. Now maybe there's a connection..
That's what I do. There's a handful of countries whose IP ranges I've blocked at the firewall. I typically block the mail ports, and redirect web traffic to a "Sorry we're not available in your region" page with a contact form. The reality is that I don't foresee myself selling any products or services into Asia, Russia, or South America. I don't speak their language(s), I can't process their money, and I sure as shit can't litigate if a deal goes wrong, so why expose myself to unnecessary risk ? There are other web sites to choose from, probably better suited to those specific markets than mine could be, I think it's a win-win.
-Billco, Fnarg.com
I could very easily hire a spam group out of any one of these countries to push my malware out for profit but who is really "evil"? The companies in foreign countries that offer the service or the people who hire them? My guess is if we were to follow the money it would lead us to very different places.
Simple means "not complex" (however many quotes enclose "not complex"). Nuclear war is complex any way you slice it.
--
make install -not war
From the article:
After having obtained the IP addresses for the monitoring period, we have mapped
Their geographical location Using Them to GeoPlugin [11]. GeoPlugin is a free online
Which database API uses Maxmind [12] to resolve Internet Geolocation. They Provide
the following data for a Particular address: city, region, area code, dma code, country
name, country code, longitude, latitude, currency code, currency symbol and exchange
rate. For our experiments, we needed only city and country code.
English is not my first language. Corrections and suggestions are welcome.
Seoul, South Korea was #1 on the list, and it may be for reasons other than just generally good Internet connectivity:
It's the home of co.cc, which Google recently blacklisted for being a den of evil.
If it was before the co.cc Google Death Penalty then maybe we should re-run the study in a few weeks.
From Google pulls co.cc subdomains from search, brings our global malware nightmare to an end:
Google classifies [the company behind co.cc] as a "freehost" -- it belongs to a Korean [emphasis added] company...
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
You don't speak the official language of Singapore and Guyana, and the lingua franca of business in India and Malaysia? You seem to do OK writing it though, so I think you're being a bit hard on yourself.
For example, the U.S. ranked #3 in the list of the most criminal countries for the reporting period, while no major U.S. city was found among the most evil ones,
Does this mean the US just has all of it's malware spread evenly between the many major cities? Or are all the compromised machines in rural places like Buttfuck, Indiana?
The paper explains that they used the IP locations to see where the attacks were coming from. If someone in Shanghai has a botnet that includes a bunch of machines on a university campus in Missouri and launches his attacks through that botnet, wouldn't it count as an attack coming from Missouri instead of Shanghai?
I'm not sure I'm comfortable with the methodology of this study. I'm too tired to read it more carefully now, but it looks like it might be making conclusions about "evil cities" that is not really warranted.
You are welcome on my lawn.
Is there a widget that would generate a hosts file to block dangerous locations by clicking on a map? Sorry, that sounds like an iPhone app.
Sorry, but gray text on gray background is making my eyes bleed.
Agreed. Especially since any Russian command center worth nuking would be surrounded with turrets.
A beautiful city! It is home to the world's first three peacetime nuclear disasters. You can read up on the place in the Exile.
Simple means "not complex" (however many quotes enclose "not complex"). Nuclear war is complex any way you slice it.
What is complex about nuclear war? Bombs go bang, humanity goes bye-bye; end of story.
Literally.
Orwell: "In a Time of Universal Deceit, telling the Truth is a Revolutionary Act"
What I think you'll find actually is the cause is more of a cultural thing. I've done no empirical research on this, but I do get a few data point of observations from the large number of Asian grad students we get. I've noticed something that is very common in both Chinese and Korean students:
1) Pirated software is a way of life. The idea of paying for software is just not really an idea they have. They don't see it as wrong in any way, it is just how you do things. Well while the BSA's stuff about viruses is over inflated, it is based in reality. There are plenty of warez sites out there which have infected software. This seems to be particularly true of Chinese sites. Finding one that isn't ridden with viruses is difficult.
2) Virus scanners are just something that isn't considered to be needed on computers. This may be in part because of language barriers. Most of the best virus scanners are Eastern European, and the companies market in English primarily. I have noticed since Qihoo has come to be that more Chinese students have scanners, it in particular. Unfortunately it is a really poor virus scanner (gets a ton of false positives and have poor heuristics and so doesn't deal well with unknown malware) so it doesn't do much good.
3) ISPs that just won't give a shit, at all, about anything. Efforts at contacting Chinese ISPs about problems have never done anything. Most ISPs, if you make them aware of a system causing problems, will take action. Some these days proactively watch their network and shut down problem connections. We've never had any luck with Chinese ISPs. We've even gotten people to translate our message in to Chinese and the response is always "We are not responsible for that IP, please get us the correct IP." They are of course responsible, APNIC confirms it, they just don't care.
I think that is a large reason why areas like this are so very infected. The propensity for not having a scanner and downloading from any random site makes infection much easier, and since ISPs don't seem to care there is little to stem the tide. You combine that with the normal user ignorance of computer security that we see across the world and there you go.
I know people here in the UK who have refused to sell to interested Americans as they then risk being sued in the USA. Not racist.
"Investigated"?!?!
What, it's now illegal to have an opinion?! Jesus-fucking-Christ!
These cities often are in countries shitty governments with little law, and you'd have nowhere to turn if you're ripped off. What's race got to do with it?
This page has a visualized correlation of ssh blacklisted IP's against Cities. It is updated daily. Source is the sshbl.org blacklist.
Current daily winners are Moscow and San Francisco with 17 each.
http://hackertarget.com/ssh-blacklist/
they actually needed to do a study?
Last I heard everyone in SK uses activeX on their websites. You could start by removing that and forcing everyone to upgrade their OS + Browser.
The turrets are the real target. The command center doesn't have any weapons of its own.
Can you be Even More Awesome?!
Uh...yes...if your opinion is racist, it is illegal. You didn't get the memo?
Racism doesn't require intent. You merely have to be white and do something that discriminates against people of color. Blocking entire continents based on the fact that they're not white certainly applies.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
Also, it's not opinions that are illegal. Acting in a racist manner or expressing those opinions in a manner that causes fear or alarm to others is what is illegal.
But why let facts get in the way of a good rant?
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"