Slashdot Mirror
Microsoft Remotely Deleted Tor From Windows Machines To Stop Botnet
An anonymous reader writes "Microsoft remotely deleted old versions of Tor anonymizing software from Windows machines to prevent them from being exploited by Sefnit, a botnet that spread through the Tor network. It's unclear how many machines were affected, but the total number of computers on the Tor network ballooned from 1 million to 5.5 million as Sefnit spread. 'By October, the Tor network had dropped two million users thanks to Sefnit clients that had been axed. No one, not even the Tor developers themselves, knew how Microsoft had gone on a silent offensive against such a big opponent and won a decisive battle,' the Daily Dot reported. In a blog post, Microsoft claimed it views Tor as a 'good application,' but leaving it installed presented a severe threat to the infected machines."
Who knew?
No one, not even the Tor developers themselves, knew how Microsoft had gone on a silent offensive against such a big opponent and won a decisive battle
It seems pretty obvious - the people who's machine had Tor removed didn't know it was installed and weren't using it to begin with. When MS removed it, they didn't notice or complain.
unless your worth billions of dollars
Windows Update has doubled as Windows Remote Administration for years.
By using an unconventional method to exploit Windows, the hackers unwittingly forced Microsoft to show a hand few knew it had: The ability to remotely remove progams en masse from peopleâ(TM)s computers, without them even knowing it.
Maybe the next virus needs to remove Windows from all of those machines.
There is always the possibility it could have been executed through the security patch subsystem. It has the capacity to execute scripts/executables.
Upcoming: MS deletes Firefox, saying it was used to infect millions of computers.
there's no "killswitch" it just got added to the definitions for removal. nothing to see here.
Good security move by Microsoft. We don't know exactly how the rogue applications were eliminated, but good chance it was Microsoft Security Essentials. This was the equivalent of Symantec and McAfee removing a virus only difference was it was Microsoft this time.
Malicious software removal tool.
While the intention was definitely good, I personally would not want to use a machine that the could be remotely accessed in such a mannter.
True, something like anti-virus software self-updating and removing a threat would be acceptable to most users. But this is more akin buying a car and discovering the manufacturer has a master key and a representative can come over and drive it around whenever he/she wants, and it's fully legal and you can't do anything about it.
In the end, for better or for worse, I think it's important that we actually own the devices we buy and pay for. Cases like this, and similar ones with Kindles and mobile devices remotely being accessed and modified or used to spy on us, are strong evidence that we do not. (I know that this particular case is not a big deal in of itself, but the fact that Microsoft can do what it did is not good news.)
Every month's update includes an updated "malicious software" remover. Normal people who have their machines auto-update would get it automatically, and *if* the corrupted Tor wasn't hiding its existence in some way, it could be found and removed. That would be a legitimate use of the trust customers put in MS (as with other antivirus providers). If it turns out there's a backdoor, the way Amazon removed books from peoples' Kindles, then the entire Windows infrastructure would be unsafe.
Exactly how does Microsoft gain access and remove software? Well I guess that means Microsoft has complete control of other people PCs. What kind of F@#$%^ up nightmare is this?
A classic Example of someone trying to point the finger when there is nothing to point at. You removed my botnet nad now i'm mad. STFU. Save your complaining for legitimate problems.
I don't want ANYBODY going into my computer. That's no different than breaking into my house, and stealing.
FUCK MICROSOFT
Removes malicious software, that just happens to use Tor.
Come on /., you can do better than this.
Or only those on infected machines? And was this removal targeted only at the botnet-installed Tor client (TFA seems to imply this).
If this was the case, then good for them (Microsoft). Although they could have been a bit more open about their removal with the Tor developers, so as to reassure them that they were not attacking Tor. And to get feedback on anything that could cause a false positive and removal.
Have gnu, will travel.
Isn't it illegal to secretly infiltrate a computer system and remove legal software from it?
Do a simple and clean install, saving personal docs and with the right payload (like WhicheverOfficeFork, video player, music player, etc). Do it with one of the XP/IE lookalike themes... the "victim" would only wonder why their PC suddenly started performing well.
no harm, no foul?
If we look BEYOND the misleading headline, we will understand that when a TROJAN illegally and secretly installs software n a user's machine, it does so in a way that will leave a clear signature. So, a trojan that installs Tor, for instance, will do so in a way that minimises visibility of the app to users. Microsoft can and SHOULD (if a user is willingly using a Microsoft anti-trojan tool) attempt to identify apps that have been illegitimately installed, even if the app itself can ordinarily be a legitimate user install, and remove that app.
If the user did NOT consent for app X to be placed on their machine, there can be no controversy if a user activated Microsoft security product removes X without explicit user permission.
Now if Microsoft DARED to remove copies of Tor that a user had explicitly installed, the situation would be a very, very different one. So why are the owners of Slashdot trying to imply something that isn't true? And don't give me crap that it is the fault of the authors of the original article. When Slashdot promotes a story, the content of that story (and the misleading Slashdot summary) are Slashdot's responsibility.
you would realize how silly you look here.
You: "hi. come on in! Welcome to my home. Have a seat, make yourself comfortable...... WHAT THE FUCK? HOW DID YOU GET IN MY HOUSE??"
How is this different form apt-get upgrade or dist-upgrade?
This incident was discussed in the 30c3 talk on Tor. Roger Dingledine stated that Microsoft removed the botnet, but left Tor installed. Therefore the headline that Microsoft deleted Tor is not correct. You can watch the video here: http://www.youtube.com/watch?v=CJNxbpbHA-I
Of course the only difference between malware and legitimate software or other content is the intent, which the tool obviously cannot detect. Therefore any tool that can be used to remove malicious software can also be used to remove legal software or other content.
The Tao of math: The numbers you can count are not the real numbers.
so Microsoft removes a virus with there removal tool and somehow they did a bad thing. and removed the infected version of tor not the new ones.
Microsoft remotely deleted a characteristic version of Tor and other maliciously installed software which a botnet had installed from Windows machines to stop said botnet, just as it does for all kinds of malicious software via its (get this) Malicious Software Removal tool (which regularly appears in Windows Update) and/or Microsoft Security Essentials, which you, the user, gave it permission to do.
...but it didn't fit*.
*in length or in terms of agenda.
systemd is Roko's Basilisk.
Ok Attorneys: Could this qualify for a class action suit to shut them down forever and burn them to the ground?
---- Booth was a patriot ----
No one spoke out since it didn't effect them...
---- Booth was a patriot ----
So much effort defending Windows against Linux using cost of ownership as argument and this proves that Microsoft is still owning the Windows you "bought".
If we could just implement a script on slashdot to mute or auto-downmod users who post comments which clearly indicate both ignorance and not having read the article, maybe we could clean the site up.
power to uninstall is also the power to install
Jacob Appelbaum and Roger Dingledine talked about this at the 30c3 conference last December. Here's a link to the video: https://www.youtube.com/watch?v=CJNxbpbHA-I They talk about this around the 39:55 mark. Basically they weren't thrilled about microsoft doing such a thing, but on the other hand if the attack had been malicious it would have taken down the entire TOR network.
They did it the right way. Good job.
Well, I don't really detect sarcasm, and same for troll detection, yet I have a hard time accepting these as real questions, but what the hell....
According to TFA, the botnet was mining bitcoins for the two botnet 'herders'.
'Doing anything bad?'
1.) Taking control away from the PC's owner and covertly installing malware
2.) Using significant amounts of energy at the owners expense without agreement
3.) Tor network users jumped from approx. 1 million users, to over 5 million users when this botnet went online. I imagine that would have the opposite effect of 'making Tor faster for everyone'
4.) In some cases, clogging and disrupting users networks
In other words, not doing anything good, and a whole lot of bad.
This is one time that Microsoft was acting responsibly, and did the right thing, IMHO.
The Microsoft anti-malware tools worked as designed, although a bit more proactive than the normal reactive incident.
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
Except the fuckers crashed my machine when they pushed out the update. I click reboot and walk away, system may hang for hours because an application, usually M$ application has a fucking modal open asking me if I really want to close it. Windows Update sends the reboot, the fucker is going to reboot. Exactly the opposite needs to be true. When I say reboot, especially as an admin, I expect the fucking system to reboot. When M$ says reboot, I expect the machine to ask permission.
Very true. If Microsoft decided that, say, *any* copy of Tor was malicious, or anything listed on Sourceforge . . . . Or any .iso with a name that matches a movie . .
WTF kind of story is this?
BREAKING NEWS: AV software removes threat!
If this story were about ClamWIN it would all be w00t open source FTW!
But apparently a free MS product did its job - boo, hiss, etc
Show me a machine that has Firefox installed by malware without the user's consent, and I'll show you a machine that should have Firefox removed.
Now there are only nine hundred ninety nine millions, nine hundred ninety nine thousand and nine hundred ninety nine failures to fix on windows.
Try TAILS Linux.
Should have focused on POS machines at Target. This headline is just a ruse to let the MS huggers hide the biggest malware heist in history. Unpatched windows running on cash registers?
I used to run an active, unlimited TOR exit node on my office PC during non-work hours, that is until for some unknown reason our office had our Skype account blocked - I called Skype, my network provider, everyone trying to figure why we couldn't access Skype at all from any of the computers on our office network (we have a fixed IP which could have added to the problem). I read some threads on the Skype forums that this has happened to several people - apparently once Microsoft integrated Skype over the last year, anyone running an Exit Node was blacklisted. Note that we got any kind of notification, just a banned IP, they would not even confirm we were banned. I shut down my Exit Node and about 2 weeks later Skype returned. Not exactly what I call a positive treatment for a so called "good application."
Microsoft antivirus program removes a virus. Slashdot collectively goes retarded. News at 11.
Microsoft has been silently removing malware from users' computers for years now. What do you think the Windows Malicious Software Removal Tool does? The only new thing here is that this particular piece of malware contained an otherwise-legitimate open-source component, which Microsoft decided to remove as well. I believe there's nothing wrong with that decision since it's been used as part of the malware and for malicious purposes. In this case the decision is even more justified since having Tor installed, even without the original malware, can have consequences to the user, such as a substantial drop in available bandwidth. Even then, Microsoft made sure that they only remove instances of Tor installed by the malware and not copies that users knowingly installed so I really see no problem here. When Microsoft decides to remove Firefox or VLC or any other open-source stuff just because it competes with their products, please inform me and I'll ditch Windows altogether. Until then, I'll keep the Windows MRT installed and updated.
We use that application for official business, and Microsoft arrogently thinks it's okay for them to control what is install on OUR system? that WE paid for?
Somebody is likely going to make a military response against them, and it will be M$ fault.
Someone on Slashdot doesn't know what the hell they are talking about! what a surprise! :P
No offense..but..if you are using Microsoft wares for security checks then you are either gullible or just plain ol' stupid.