Slashdot Mirror
Cleaning Up Botnets Takes Years, May Never Be Completed
Once a botnet has taken root in a large pool of computers, truly expunging it from them may be a forlorn hope. That, writes itwbennett, is: the finding of researchers in the Netherlands who analyzed the efforts of the Conficker Working Group to stop the botnet and find its creators. Seven years later, there are still about 1 million computers around the world infected with the Conficker malware despite the years-long cleanup effort. 'These people that remain infected — they might remain infected forever,' said Hadi Asghari, assistant professor at Delft University of Technology in the Netherlands. The research paper will be presented next week at the 24th USENIX Security Symposium in Washington, D.C.
(And "Post-Mortem of a Zombie" is an exciting way to title a paper.)
Golly Gee! Neither will garbage collection... Let's just let it pile up, eventually it will collapse by its own mass.
“He’s not deformed, he’s just drunk!”
Eventually each one of these computers will be powered down.
Hopefully before the end of human civilization.
Deny internet access to infected units, will clean up faster than you think.
So your solution is just to get rid of all personal computers.
Maybe it would go faster if the people running these things were hunted down and killed.
well before 10 years is up.
Not much of a problem to be infected after the C&C servers are down?
Reading comprehension, bro. Read it again.
Honestly, if this is a problem ... let ISPs basically block anybody who is still sending out packets with this crap.
If your machine is a threat to the rest of us, cutting you off from the the internet might get your attention.
This way when you call your ISP and say the intertubes are broken they can see the flag on your account which says "banished" and tell you to fix your PC, or stay off the internet.
But let's not pretend Linux, Android, or Apple haven't had similar problems.
The problem with botnets is people might not even know they're infected. Aggressively disconnecting from the internet might actually achieve something.
Lost at C:>. Found at C.
Yeah, but half those infected machines/networks are probably critical infrastructure like dams and nuclear plants. You know, the kind of software from vendors that won't warranty it if you install antivirus... I'm looking at you Rockwell Automation.
"I have never let my schooling interfere with my education." - Mark Twain
Sorry, too many false positives would result, and on top of that, anybody with 'undesirable' content will be accused of being a 'threat'.
“He’s not deformed, he’s just drunk!”
I'm really impressed that so many modern computers are lasting so long and that so many people are using them. Use it up, make it do, or do without is a good policy for things that aren't mission critical
If your reading comprehension can't mature past literal face value, implied equivalents and other subtleties will elude you.
Not that I necessarily endorse GP's snark or not.
If your critical infrastructure for your dam and nuclear plant is sending stuff out to the internet, you likely have bigger problems.
However, I won't disagree with your point about vendors being impediments to security.
Lost at C:>. Found at C.
Honestly, if this is a problem ... let ISPs basically block anybody who is still sending out packets with this crap.
Botnet wranglers will just update the binaries to change the signature of packets or addresses of CC servers. Shutting out botted devices in a piecemeal manner won't have an impact on the attempted eradication.
... they might remain infected forever ...
Nothing lasts forever: The infected computers will eventually cease to function. It would have been more accurate (and less of an inflammatory panic reaction) to suggest that the infected computers might remain infected for the remainder of their active life.
In fairness, many AV engines are total crap and are notorious for interfering and breaking all kinds of software.
Good. Antivirus is a tiger repellent rock. Too many fools in this industry following ineffective "best practices" to mitigate insecure architecture decisions instead of designing procedures/systems which are inherently secure.
If your workflow depends on poking holes in the firewall that is a failure of capital investment in infrastructure. The bean counters won't appropriate the $$$ to buy the necessary equipment to do things properly so people end up forced to co-mingle their high-risk activities with their high-value infrastructure. The results are as predictable as putting the condoms next to the insulin needles at the pharmacy, banning socks and shoes, and then giving away methadone at the front door.
Don't act surprised when someone steps on an HIV infected needle. Having a "Sharps" container only reduces the frequency of the occurrence.
There is a band around the model - the difference between actual and model. I suspect when that band overlaps with zero, not the model overlaps with zero, then the physics of the infection might transition to zero. This gives a way to estimate a "expected horizon" for nations and infections when the model fundamentally excludes zero.
What I tghink is a shame is that we do not go after the REAL resposible people. /. and now they don't anymore. So the real reason is Digg. Why do they want to blow up nuclear plants? I don't know, but that is the question we should REALLY ask Digg: have they stopping wanting to blow up nuclear plants?
These systems have all a systemn admin that maintains them. These all used to read
Don't fight for your country, if your country does not fight for you.
Actually, there are billions more Linux machines than Windows - mostly cell phones and routers. Most every Windows desktop machine has a dinky little Linux router on the floor amongst the dust bunnies and most of those billions of Linux machines are not infected with crapware. The crapware problem really is due to the bad design of Windows.
A future in which everyone has a mobile botstick infected with hundreds if not thousands of pieces of malware that they will never know about because they are just going to buy another phone in a year or two.
The news article claimed that researchers had control over the botnet, but the research paper implies otherwise, simply that the control network was rendered inaccessible.
Did Conficker have something to prevent a takeover, such as using a public key signature to verify update code?
If they were able to inject a popup window informing the user of the infection, surely disinfection rates would have been much higher. The research paper says that millions of users bought phony security software via Conficker, so they'd likely respond to a popup invitation.
... well if bennett says its true, then we should all believe it.
I thought it said "Cleaning Up Bennetts Takes Years, May Never Be Completed". I chuckled for a moment, then I thought, wait "Bennetts"? There's more than one? Cue the horror movie scream.
Honestly, if this is a problem ... let ISPs basically block anybody who is still sending out packets with this crap
You haven't thought through the slippery slope of handing Comcast this power. Your idea is bad.
I hate when people use the term "Slippery slope" WHILE COMMITTING the 'slippery-slope fallacy'
Isn't this why we have Internet Cleanup Day?
Really, why is it so hard for everybody in the world to just take one day out of the year to shut down all of their systems, wipe the hard drives and re-install everything from the installation media?
Um, how will they do that without Internet access?
No sig today...
Shocking that someone reading a tech news website could actually sustain this belief. Go look up the percentage of Webs servers that are Windows, and reformulate your argument. We can wait.
So the only ones infected are the ones who don't run or keep their PCs up to date correct? Just like the Yahoo Flash exploit, wouldn't antivirus software be blocking that exploit as it is not a new exploit? what about people who don't run Flash with the default setting? i don't allow flash to save any data i don't let sites save data in it and so on.
Jack of all trades,master of none
Hyperbole like "forever" has no place in a professional treatment of the situation. May take a decade or two though.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
it's pretty simple, if you are coughing up blood, you dont go to work and then infect your coworkers with ebola. why should we allow computers that are doing the same thing to come to the internet? people mostly dont know they are infected, so injecting a little HTML into served pages that will help them disinfect their computer would be a good start. if it's been a week and they are still infected, it's time to serve them pages only on how to disinfect their machine and close any unrelated ports.
there is no need for this bullshit to continue.
Anons need not reply. Questions end with a question mark.
Zzz, so says the guy that is oblivious to the fact that said routers were just vulnerable to shellshock++ and can easily be corralled into dosnets etc.
If your SCADA machinery is plugged into the Public Internet, you got way bigger problems than whether or not it's a bot...
Quo usque tandem abutere, Nimbus, patientia nostra?
Unless the ISP is going to disconnect every single compromised device on their network at once, which will lead to a bunch of angry customers, they will have no hope of eradicating the botnet.
ROFL, from the article:
Sometimes, it was hard for ISPs to help consumers clean up their infected computers. Asghari said he spoke to one ISP that contacted the same customer 36 times in an effort to get rid of Conficker.
“Every time the customer would say I’ve cleaned it up, but the infection would return,” he said.
...instead of "going after" the infection, you go after the humans that deployed it.
Recognize the MASSIVE damage/vulnerability these people are exploiting, and the threat it poses to our modern society. Act accordingly.
When you have them arrested, randomly decimate them.
If they are arrested a 2nd time for the same offense, they will be the first in line to be decimated.
I suspect that botnet attacks would decrease.
-Styopa
Calm down Rush!
APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
FREE & adds speed, security, + reliability, doing more with less, more efficiently vs. browser addons & locally installed DNS servers @ home + fixes DNS' redirect security issues - obtaining its data vs. online threats & adbanner blocking from 10 reputable sites in the security community!
* :)
MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus per this VERY recent testing of them all http://www.av-test.org/en/news...
&
It's GUARANTEED safe & clean per it being checked by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...
+
In its 32-bit model also https://www.virustotal.com/en/...
---
"The premise is quite simple: Take something designed by nature & reprogram it to make it work for the body rather than against it..." - Dr. Alice Krippen: "I am legend"...
APK
P.S.=> By "yours truly" - "The Lord of Hosts" so-to-speak:
PERTINENT QUOTE/EXCERPT:
"The image this title brings to mind is of a mighty military commander, one who can at a mere word summon rank upon rank of protective power" from https://answers.yahoo.com/ques... & THAT WORD = hosts!
(Accept NO substitutes!)
...apk
However, I won't disagree with your point about vendors being impediments to security.
It's not just vendors, unfortunately. We very recently had to deal with a customer using outsourced IT. A particular computer could connect to our SSL web site because of an "Untrusted certificate" error in MS-IE. After spending some time diagnosing the problem we came to realize that the machine had been installed from the Windows XP Service Pack 1 CD and Windows Updates had been disabled so it hadn't been getting Root Certificate Updates or anything else since at least 2004. Their outsourced IT department refused to allow Windows Updates to be run on it.
distrowatch.com
have a great day.
This is not about "implied equivalents" because there is no way you could possibly conclude that getting rid of Windows means getting rid of all computers running Windows. My best guess is that if GGP was a technically literate person, he would not make such attempt at joking because he'd know it would not be funny because it has no connection to reality. The only conclusion you could possibly come to is that GGP was serious and his erroneous views needed to be corrected.
"Run, Forrest: RUN!!!" vs. a fair challenge http://news.slashdot.org/comme...
APK
P.S.=> Keep on shooting your blowhard done nothing in computing mouth off gweihir - I'll be RIGHT THERE AGAIN to expose your crap yet again (have fun with the shame you'll have to publicly endure here & YOU STARTED IT WITH ME YOU USELESS TROLLING LOSER WITH NO SKILLS BUT LOTS OF MERE "TALK", lmao)... apk