Slashdot Mirror
FBI Takes Out $14M DNS Malware Operation
coondoggie writes "U.S. law enforcement today said it had smashed what it called a massive, sophisticated Internet fraud scheme that injected malware in more than four million computers in over 100 countries while generating $14 million in illegitimate income. Of the computers infected with malware, at least 500,000 were in the United States, including computers belonging to U.S. government agencies, such as NASA."
Posted from one of the bots.
Sometimes you just gotta hand it to 'em
It would be interesting to see the breakdown of the operating systems the infected computers were running.
That's like claiming the interception of one bale of weed at the Mexican Border is a Major Interdiction.
Still, glad they're doing something. Every little bit helps.
A feeling of having made the same mistake before: Deja Foobar
The FBI managed to stop MAFIAA from passing PROTECT-IP?
I'm not a lawyer, but I play one on the Internet. Blog
Oh wait, so it's not about Skype?
Nothing to say here... move along
It would be interesting to see the breakdown of the operating systems the infected computers were running.
Ah, we're all about socializing the externalities for the corporations these days. How much of this bill do you think Microsoft will pick up? How about 'none' so they have no real incentive to secure their products?
Heck, it justifies a larger FBI, so they'll probably give them a metal for being so cooperative.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
you put an infected machine on the internet, and your connection is disabled until you have clearly demonstrated that you have fixed the problem.
I used to advocate a messaging system whereby _anybody_ could send a (PGP) signed 'disable' message to an IP address to get the machine turned off at the router. Whether this message got propagated or acted upon would depend on the level of trust in the signer - not unlike BGP. In today's NAT world it might need to be a bit more complex than I'd thought about in the 90s.
But I fear the time has passed for Internet governance to do this without the government barging in, and then it would be too tempting to shut down he political opposition, 'terrists' or the like.
It's possible to run a safe Windows machine, although it takes more knowledge than it does for iOS or Linux say.
I doubt it. There was a story yesterday that 60% of malware found in the wild has no AV-software coverage.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
...because there are now 4 million pre-compromised systems in the field. It's a certainty that they are now all attractive targets for anyone clever enough to detect them and acquire control of them. I think chances are quite good that as you're reading this, more than one person/group is attempting that very thing. They'll probably succeed. And when they do, they'll use yet another C&C mechanism to organize them, harness them, and get on to whatever mischief they choose.
Seen in that context, this announcement is just a PR exercise. It has no real significance.
Congratulations! The Botnet operators thought $3.50 (for them) was worth more than (probability you noticed a problem) * (all the effort and money it would take you to fix it.) Of course, if you're a typical botnet zombie host, the effort and cost were $0, plus a bit extra because your PC is running slower, but hey, you had lots of bogomips to spare.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
This is good on Lion and Snow Leopard AFAIK: networksetup -getdnsservers Ethernet Wi-Fi
This command has extensive help: networksetup -help
I use networksetup every day. I have numerous makefile targets that change my network settings based on my location. I'm a a road warrior changing networks frequently and using a VPN and ssh to connect to the corporate network.
"Mit der Dummheit kaempfen Goetter selbst vergebens." - Schiller
"U.S. law enforcement today said it had smashed what it called a massive, sophisticated Internet fraud scheme that injected malware in more than four million computers in over 100 countries while generating $14 million in illegitimate income. Of the computers infected with malware, at least 500,000 were in the United States, including computers belonging to U.S. government agencies, such as NASA".
Did any of these malware infested 'computers` run Microsoft Windows?
Don't you have to be running Linux to have BogoMIPS?
Wouldn't these machines likely be running a different operating system?
Cheers
I read the link but it didn't mention OSX.
Let me guess, a Windows turfer? Because you misled people into thinking it was OSX, and added 'Linux' compliment on to get votes.
Instructions for apple are on page 4 half way down. Did you fail reading in high school?
FBI code named Magic Lantern (botnet) eeek!
All cows eat grass!
I doubt it. There was a story yesterday that 60% of malware found in the wild has no AV-software coverage.
Why should that be a surprise? AV software is installed on every vulnerable PC sold and even without updates it mostly protects against all the old threats. Even after that there is a pretty good chance it's infernal nagging for a credit card will get an updated AV installed, with or without a CC. The "mindshare" has been built, everybody believes that Windows must have anti-virus.
But, as has been said repeatedly the AV industry is reactive (though they are starting to try to solve the HARD problem of being intelligently proactive) so all an attacker has to do is make sure that the initial infection vector is obscure. If the initial infection disables the AV it can then download anything; including corpses of old viruses to blame and new updates to run with. The result is that the initial infecting agent will probably no longer exist on the machine, either the botnet will have been upgraded to the most recent version, which isn't yet on the the AV list, or the initial infector will be hidden away to try and stop it getting on the lists at all.
When I consider it, if I was in "the business", I'd be trying pretty hard to keep information out of the hands of the AV "white hats" and it wouldn't really be difficult, I'd just have to keep changing things to keep one step ahead.
http://en.wikipedia.org/wiki/BonziBUDDY
If it's packaged nicely....
DNS Abuse Resistance Education and MacRuff, the Router Crime Dog.
Article mentions that the criminals were estonians, but when I read the local news, yes I am from Estonia, I realized that all of them were actually russians. They just happen to have citizenship of Estonia.
well, they are estonians. that they just happen to have estonian nationality on their papers makes it so. and one russian.
or if you take another stance you might as well go around running and shouting that linus is swedish.
world was created 5 seconds before this post as it is.
Finally doing some good in the world, keep it up, feels good to the rest of us.
Interfering in the free market.
To have a right to do a thing is not at all the same as to be right in doing it
Some ISPs do this, they'll redirect all webpages to a warning page if mass spammings are detected from your connection.
"When information is power, privacy is freedom" - Jah-Wren Ryel