Slashdot Mirror


Microsoft Disrupts Nitol Botnet

hypnosec writes "Having procured permission from the U.S. District Court for the Eastern District of Virginia, Microsoft's Digital Crimes Unit managed to disrupt more than 500 different strains of malware in a bid to slow down the threats posed by the Nitol botnet. Microsoft, through an operation codenamed b70 (PDF), discovered Chinese retailers were involved in selling computers with a pirated version of Windows loaded with malware. Microsoft believes the malware could have entered the supply chain at any point, for the simple reason that a computer travels among companies that transport and resell the computer. The Windows 8 maker carried out a study focused on the Nitol botnet, through which it found nearly 20 percent of all the PCs that were purchased through insecure Chinese supply chains were infected with malware."

92 comments

  1. Who? by ISoldat53 · · Score: 3, Insightful

    I couldn't find in the article who was importing, selling or reselling the affected machines. They mention one individual but not his company.

    1. Re:Who? by Hazel+Bergeron · · Score: 0, Troll

      In brief, Microsoft wanted to demonstrate that puppies die when you buy an unauthorised copy of Windows.

      It doesn't matter who was doing it - what matters is that the US government needed to help this downtrodden altruist get its cut.

    2. Re:Who? by jason.sweet · · Score: 4, Informative

      According to the article and summary, someone is installing the malware before selling the computer. How can an OS defend against that? Is that Clippy supposed to pop up and ask "You look like a bad guy! Are you sure you want to install this software?"

    3. Re:Who? by Anonymous Coward · · Score: 0

      > Maybe they can also clearly tell their users that they need to learn a few basics to avoid being at-risk. Is all of that really so unrealistic?

      Someone clearly never had to train end-users here. I've had people you couldn't train how to switch between two windows on their desktop, even with a person next to them showing how things work they simply couldn't comprehend you could be running two programs at one. And you think a software vendor can magically teach end-users somehow not to download and install anything that pops up and ask them to install.

    4. Re:Who? by Stan92057 · · Score: 1

      Thats all you got out of the article?? "The Windows 8 maker" Your fanboyism is showing.

      --
      Jack of all trades,master of none
    5. Re:Who? by thexile · · Score: 0

      I find your idea intriguing and hope to send to sign up for your newsletter.

  2. Can you imagine... by gavron · · Score: 0, Flamebait

    If only back in 1998 when Microsoft knew that Windows 95 was open to all malware,
    if they'd modified their thinking.

    Instead of "let's make it so Win3.1 software can run on all our machines" and "Let's
    make it so Win95 can run on all our machines" and propagating that so EVEN THE
    Win2K (NT) kernel was vulnerable... ...they could have used a real security model, locked down the system, and there
    would be no malware, no virus, no antivirus, no UEFI, no nothing today.

    If there is one company that MADE A CONSCIOUS DECISION to let malware live
    so that old software [you know, like your restaurant's point-of-sale system] run on
    W95,W98, WME, W2K, Vista, 8, etc., and because of that decision the world is
    overrun with malware, malware writers, mafias of malware writers, bitcoin thieves,
    credit card thieves, wire-transfer thieves... that one company COULD HAVE made
    a difference.

    But they chose not to.

    So today they "disrupted" (nonsense word) a botnet? That's good. Even if they
    ELIMINATED the ENTIRE botnet, it's just one of many.

    Useless. Microsoft.

    E

    1. Re:Can you imagine... by Hazel+Bergeron · · Score: 2

      used a real security model, locked down the system, and there would be no malware, no virus, no antivirus, no UEFI, no nothing today.

      And a pony in perpetual motion. Never forget that.

    2. Re:Can you imagine... by ZiakII · · Score: 2, Insightful

      they could have used a real security model, locked down the system, and there would be no malware, no virus, no antivirus, no UEFI, no nothing today.

      o boy..... what did I just read? I don't know whether to laugh or actually sigh that you somehow actually somehow believe that drivel that you posted.

    3. Re:Can you imagine... by KingMotley · · Score: 2

      Totally. And only if the auto industry had implemented perpetual motion devices in cars today, then we'd no longer have to buy oil from the middle east.

    4. Re:Can you imagine... by Anonymous Coward · · Score: 0

      used a real security model, locked down the system, and there would be no malware, no virus, no antivirus, no UEFI, no nothing today.

      And a pony in perpetual motion. Never forget that.

      I was Handicapper General, you know what I would do? Chimes. Chimes on Thursdays... FOREVER!

    5. Re:Can you imagine... by Anonymous Coward · · Score: 0

      Totally. And only if the auto industry had implemented perpetual motion devices in cars today, then we'd no longer have to buy oil from the middle east.

      I have a plan so we will never ever need to import oil ever again.

      if we can make liposuction procedures cheap and affordable then we can extract the excess fat from all the overweight, obese and morbidly obese Americans. from there it would be easy to convert the extracted lard to biodiesel. then just drive cars with TDI style engines and viola! - cheap, EXTREMELY ABUNDANT energy with no dependence on the middle east.

      of course there is one flaw in the plan. the overweight always have excuses why it's not their fault that they eat more calories than they burn. they might get more creative and start coming up with excuses for why they couldn't be bothered to undergo liposuction. perhaps it could be made mandatory? or maybe tax credits could incentivize it? i am open to ideas of course.

    6. Re:Can you imagine... by geekoid · · Score: 2

      They are slipping the virus into the OS instillation disk, how exactly would a "locked down system" stop that? No system can stop that.

      "So today they "disrupted" (nonsense word) a botnet? "
      what? disrupted isn't a nonsense word, in fact in this case, it's appropriate.

      You might want to study the botnet ecology.

      --
      The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
    7. Re:Can you imagine... by mcgrew · · Score: 1

      If only back in 1998 when Microsoft knew that Windows 95 was open to all malware, if they'd modified their thinking.

      Instead of "let's make it so Win3.1 software can run on all our machines" and "Let's make it so Win95 can run on all our machines" and ropagating that so EVEN THE Win2K (NT) kernel was vulnerable... ...they could have used a real security model, locked down the system, and there
      would be no malware, no virus, no antivirus, no UEFI, no nothing today.

      Locking down the system means no new software. The problem wasn't backwards compatibility, it was lack of anyone there knowing anything about security. In 1995 nobody envisioned computers being in everyone's home and connected to the internet. Back then, a PC was a single-user device on its own or a local network.

      The problem was their laziness and short-sighted stinginess; the OSes were so bug-ridden you could get infected simply by visiting the wrong web page. Any computer can be trojaned, but only MS has made an OS that can get infected by visiting a web site or opening an email. It was simply sloppy programming. Happily, W7 seems stable and reasonably secure; of course you can get a trojan; any OS can, and there's no way of eliminating trojans short of making a computer completely locked down so the user can't install or upgrade anything, or educating users. MS' biggest mistakes were releasing buggy code and not educating users.

    8. Re:Can you imagine... by Dogtanian · · Score: 0

      In 1995 nobody envisioned computers being in everyone's home and connected to the internet. Back then, a PC was a single-user device on its own or a local network.

      Wrong- the Internet was already starting to break into the public consciousness by 1994, with a mainstream-oriented news/analysis programme about it on British TV by the middle of the year, and mainstream magazines such as this one coming out shortly afterwards.

      Windows 95 came out in late 1995, by which time the Internet was becoming quite well-known about; the man on the street had probably heard about it, even if most non-geeks didn't have net access yet. MS hoped they could corral users into using their proprietary MSN service instead, and didn't even include a browser (i.e. IE!) with the first release of W95, nor even include TCP/IP in the default networking setup. Whether this was an intentional move to divert attention away from the Internet and into their own walled garden service (and the belief that this could be done), a genuine underestimation of the Internet or simply an afterthought, they were still clearly thinking about online services when W95 launched, even if that service wasn't the Internet.

      --
      "Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
    9. Re:Can you imagine... by Urza9814 · · Score: 1

      of course there is one flaw in the plan. the overweight always have excuses why it's not their fault that they eat more calories than they burn. they might get more creative and start coming up with excuses for why they couldn't be bothered to undergo liposuction. perhaps it could be made mandatory? or maybe tax credits could incentivize it? i am open to ideas of course.

      REALLY? THAT's the problem you see with this plan??? Seriously???

      Obviously the companies that are then selling this extracted fat will provide a free tub of ice cream for every 20 pounds "donated". Or a bag of Doritos.

  3. Re:20% vs. 100% by Anonymous Coward · · Score: 0

    Mister, you are walking the fine line between flame bait and accurate and informative information. I am so conflicted.

  4. trivial to counter the domain takedown by Anonymous Coward · · Score: 0

    Just use a server MS doesn't control, and isn't in the US.

    1. Re:trivial to counter the domain takedown by Trilkin · · Score: 1

      Oh yeah?

      You think location matters if people with enough money on the line care enough? Please.

      --
      Nobody cares what the CAPTCHA for your post was.
  5. Re:20% vs. 100% by Anonymous Coward · · Score: 0

    I would have to disagree. It sounds like you have a perfectly fine OS but you happened to install some Adobe products.

  6. "The Windows 8 maker" by Zibodiz · · Score: 0, Offtopic

    The Windows 8 maker

    ...did they really need to point that out? It has no bearing on the story whatsoever.

    1. Re:"The Windows 8 maker" by Anonymous Coward · · Score: 0

      I agree totally which is while I'll get modded Offtopic also.

      Ubuntu, the company that continues to hemorage Shuttleworth's money, announced today the release of Ubuntu Butt Rape. Lead software engineer Blake Lovetoy, the software engineer with the golden locks and dreamy mouth, spoke of the new features, "Yes, we included a giant 18" dildo with this release and we're very excited about it. You'll enjoy raping your butt while trying to install this in an enterprise environment. While you're trying to make it work for one of your salespeople you'll notice them carrying around an iPad and accomplishing in 10 seconds what you've spent 18 months trying to make work and slide a few more inches in. Take it bitch, you're a leader in the Linux Revolution!"

      Linux is the Windows 8 maker, ironic hug?

  7. Stole a domain? by Anonymous Coward · · Score: 1, Interesting

    If I'm reading it right, they took down the botnet by having a US court take it's domain, was that a Chinese owned (.org) domain? I'm all for shutting down botnets, but to me it looks like they said to a US court that XYZ in that other country did something I didn't like, can I take control of their foreign website? I'd hate to see this be used against legitimate foriegn sites.

  8. Re:Agreed - he's a "Pro-*NIX" moron... apk by Hazel+Bergeron · · Score: 5, Funny

    apk, I have the "utmost respect" for people regardless of their "background", as such...

    but I have a question => as follows:

    Could you please tell me why your posts: * are written like this *

    HB

    With lots of paragraphs comprising long sentences & punctuation! and the occasional bit of emphasis? ... it reminds me of a friend I had who was "recovering" from a drug addiction and he would go off on these long and somewhat incoherent rambles ...

    He wasn't "stupid" <= by any stretch of the imagination but you could tell that he was having trouble sorting out thoughts (or at least expressing them (etc.))!

    Anyway, it is a simple question: why do you write with this style?

    It gives me this feeling like when I sit next to the guy on the bus who clearly can't cope very well and you know he's harmless but you wonder exactly what made him like this and you want to ask him but you are worried he might get attached and * well you know * next thing you'll be inviting him to your house and it's hard to be a good HOST (if you know what I mean)..

    ... hb

  9. Does the word "preinstalled" mean anything to you? by Anonymous Coward · · Score: 0

    Hate to feed a troll but if ever there was a case where you can't blame MS, it's this. The malware was PREINSTALLED. You could do this with any operating system. Any system could be hacked so the process won't be displayed. You'd have to keep an eye out for suspicious network traffic to figure it out.

  10. Re:20% vs. 100% by Krojack · · Score: 3, Funny

    Knock on wood, I haven't seen a BSOD on any of my Win7 installs yet and I've been running it for about 2.5 years. Also what bloat? Honestly there isn't any on a good install. Unless you're installing a Server version with every service possible on what will be used as a workstation, there isn't any bloat with a fresh install. Now on the other hand, if you install any Symantec products such as Nortan Antivirus, yeah you're screwed then with bloat.

    Maybe you have some hardware problems? Buying those cheap Chinese computer parts maybe?

  11. Re:Small correction by Krojack · · Score: 1

    Not 20% of all windows PCs. 20% of all the PCs that were purchased through unsecure Chinese supply chain. Read the entire line you quoted next time.

  12. Re:20% vs. 100% by Bigbutt · · Score: 2

    Pretty regularly, almost daily in fact. But it's the crappy AMD drivers, not Windows that's the culprit.

    [John]

    --
    Shit better not happen!
  13. In other news by Anonymous Coward · · Score: 0

    - Armadillos question leper colony over recent outbreaks
    - Rats riot in town over use of plague victims in warfare, demand protection for their fleas
    - Man promoted to county Showers Inspector for realizing he was the one giving everyone foot fungus and seeming concerned

    It's a rare case of literarily correct irony. Let's cherish it.

  14. Linux ad by ThatsNotPudding · · Score: 1

    Newspapers landing on the front porch with headlines of this story.

    Voice-over: "This is why you should have a right to buy a computer without an OS."

  15. Re:Agreed - he's a "Pro-*NIX" moron... apk by Anonymous Coward · · Score: 0

    Didn't VMS have ACL's before NT existed?

    David Cutler went to Microsoft from DEC and many VMS design features found their way into the NT kernel. The use of 32 priority levels is often cited as an example.

  16. Re:Small correction by Anonymous Coward · · Score: 0

    Pause the Startrek and re-read the post. Read it again until you see your error.

  17. Kill Festi next, please by Anonymous Coward · · Score: 0
  18. Re:Agreed - he's a "Pro-*NIX" moron... apk by mcgrew · · Score: 2

    Anyway, it is a simple question: why do you write with this style?

    I don't know, but can only hypothesize that he's a teenager trying to look "kewl". He doesn't realise how ignorant and foolish it makes him look.

  19. Re:Small correction by Anonymous Coward · · Score: 0

    Pause the Startrek

    I understand the individual words, but put together in this manner they have a meaning I don't understand.

  20. Re:"Eat your words", troll (you FAIL)... apk by Hazel+Bergeron · · Score: 1

    ACL's which MAC is basically an analog of

    P.S. => ++ACL is an anagram of MAC.

  21. Corporation does law enforcement? by Anonymous Coward · · Score: 1

    Am I the only person who is worried about a corporation taking over "cyber" issues as a law enforcement agency? I know there are loopholes that let MS act on behalf of the federal government (I saw an explanation of this once, but don't remember the details), but now MS is a world-wide law enforcement agency taking down anyone and everyone they want to? They've been convicted of a monopoly, funded the SCO legal actions, and are virulently anti-free software. And they've just released Windows 8, which takes computers a step away from general-purpose computing into a model where MS approves all apps and licenses software developers. On top of this, they get plenary multi-national legal powers? This doesn't pass the smell test.

    1. Re:Corporation does law enforcement? by Anonymous Coward · · Score: 0

      Yes, you're the only person that doesn't realize the point of the story is that the guy selling computers in the back alley isn't going to give you a virus-free system. Dude, way to self promote yourself by taking a little bit of information out of context. Want free software from M$ all you have to do is go to their download site. I'm sure you'd react better if someone was counterfeiting your OS, installing malware on it, and then you foot the bill for 200 million Chinese complaints about the performance of their system (which is spending all its time sending out Viagra spam).

  22. Re:20% vs. 100% by mcgrew · · Score: 3, Funny

    Also what bloat?

    Ah, the inexperience of youth. I haven't seen a program or OS in twenty years that wasn't bloated. There was bloat even back in the DOS days -- I had a program I wrote and ran on a 16k computer. I rewrote it in Clipper, and the 16k program, after it compiled, was over 400k. That is bloat!

    I wrote a battle tanks game on a 4k Sinclair computer (in hand-assembled machine code since there was no assembler) that took maybe 500 bytes. There is a Windows version that is nearly identical in gameplay and features to the one I wrote, except it's in color (the Sinclair had no color) and it's 4 megs -- a thousand times as big as the one I wrote. If that's not bloat, I don't know what is.

    However, ALL of today's OSes and apps are bloated. Even damned web pages are bloated! It isn't just MS, it's the times themselves.

  23. Botnet article, PDF link by symbolset · · Score: 1

    Some things never change.

    --
    Help stamp out iliturcy.
  24. 20% seems low by Rincewind42 · · Score: 1

    Living in China I see that pirated versions of Microsoft Windows and Office, are the norm not the exception. It is actually difficult to buy the legit software. I remember hunting all over several cities looking for a real Windows 7 CD when it first came out to no avail. If you want the real software, there are only a few PC suppliers who ship with it pre installed. Small local dealers will use pirated software. But the problem is exacerbated because of peoples love for the familiar. Most people in China still like windows XP. I have seen new machines arrive with Windows 7 installed only to see the owner take it to a shop and have a pirated Windows XP installed instead.

    The story also missed that while the pirated Windows comes pre-installed with malware, it also it comes pre installed with antivirus and firewalls that have been modified to ignore/allow the malware.

    1. Re:20% seems low by Anonymous Coward · · Score: 0

      Yes, it *sometimes* comes preinstalled with AV you mean. 360 (the AV you're referring to) failed to clean Nitol off the infected boxes even though it reported they were clean. Also, after 360 paching was run it left half a dozen vulnerabilities unpatched on these machines which allowed unauthenticated remote code execution.

      360 is not the story here - so no, the story didn't miss anything and in the Nitol case it didn't matter whether it was there or not; it didn't clean it.

    2. Re:20% seems low by Anonymous Coward · · Score: 0

      Oh, also it was 20% infected not 20% were counterfeit.

  25. In my day by anilg · · Score: 1

    16K? Luxury!

    The Babbage machine was the only true computer without bloat.

    --
    http://dilemma.gulecha.org - My philospohical short film.
    1. Re:In my day by mcgrew · · Score: 1

      16K? Luxury!

      Compared to the Altair, yes it was. IINM that one had 256 bytes total memory.

  26. Correct, reposting (bogus downmods) by Anonymous Coward · · Score: 0

    Tons of accurate data on that account (discussed it before) -> http://yro.slashdot.org/comments.pl?sid=3115271&cid=41327417

  27. Bogus downmods can't hide your FAIL, Hazel by Anonymous Coward · · Score: 0

    Here -> http://yro.slashdot.org/comments.pl?sid=3115271&cid=41325809

    * ROTFLMAO!

    (QUESTION - How do your words taste now that you must eat them, flavored with the "bitter taste of SELF-DEFEAT" & spiced with your FOOT IN YOUR MOUTH?)

    APK

    P.S.=> One thing I absolutely LOVE is making a "writing style troll" like Hazel Bergeron "eat his words" by using literally 100's of my upward modded posts that utterly TRASH their "critiques" with ease, and yes, FACTS!

    ... apk