Slashdot Log In
The NYT on the Proliferation of Botnets
Posted by
Zonk
on Sat Jan 06, 2007 08:40 PM
from the we-live-in-interesting-times dept.
from the we-live-in-interesting-times dept.
ThinkComp writes "The New York Times has a up a story on the proliferation of botnets. The article cites a number of security researchers who paint a depressing picture of the state of internet security, and concludes with the suggestion that for home users, buying a new 'updated' PC may be the only real solution. Unfortunately, as most of us know, given the number of outstanding flaws in software and the ingenuity of malicious software authors, that might not even help."
Related Stories
[+]
NYT Security Tip - Choose Non-Microsoft Products 298 comments
Giorgio Maone writes "The New York Times article 'Tips for Protecting the Home Computer' follows a story we recently discussed about the proliferation of botnets, and contains some statements which may sound quite unusual from mainstream press, especially if targeted to home users: 'Using a non-Windows-based PC may be one defense against these programs, known as malware ... Alternative browsers, like Firefox and Opera, may insulate users ... NoScript, a plug-in utility, can limit the ability of remote programs to run potentially damaging programs on your PC'."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Well, that's sorta backwards (Score:3, Insightful)
running under Linux (win4lin) and behind a paranoid
firewall is safer than XP or Vista.
Alas, not as safe as an unpached RH9, mind you,
but still safer than Vista (;-))
--dave
Re:Well, that's sorta backwards (Score:4, Insightful)
but still safer than Vista (;-))
You say this with what evidence?
Vista hasn't even been released to the public yet and the only versions people have seen are unfinished betas and a very few corporate users who have started playing with the new RTM Enterprise. You know you're on Slashdot when a product that isn't even out yet has already been relegated to the insecure/unsafe/junk software category.
However, I see you have that little winky smiley thing at the end of your post. Does that mean you're just kidding and it's all a joke? Or are you serious, but going under the guise of joking so if somebody calls you out on your statement you can just say "whoosh!"? Emoticons are stupid--better for people to say what they mean and stick with that.
Parent
Re:Well, that's sorta backwards (Score:5, Interesting)
Parent
Re:Well, that's sorta backwards (Score:4)
I bet most slashdotters aren't even aware of DEP or using Run As to actually take away rights from a process in XP, so if a bunch IT geeks like /. don't know how to keep XP secure, then neither will users. XP has its share of security problems, but by and large the majority of them are caused by ignorance. The only way to really combat ignorance is to remind them "This is dangerous!" every time they do something risky. I would rather Vista err on the side of caution w/ UAC. The time lost clicking "Allow" all the time is less than the time lost having to restore a compromised machine.
As for the rest of your comment, I agree completely. Cheers.
Parent
Re: (Score:2)
Look at it logically and focus your efforts. (Score:5, Insightful)
#1. Worms - if you don't have any open ports, then you're pretty much immune to worms (unless they can crack basic TCP/IP operations). Ubuntu ships BY DEFAULT with no open ports. Windows ships with lots of open ports. Change that behaviour and you've solved an entire CLASS of attacks.
#2. Viruses - an infected program infects other programs, but does not otherwise change those programs. This is not very common now.
#3. Trojans - this is the biggest current threat. And there is no real way to remove it 100%, but it CAN be limited (again, look at Ubuntu). This is primarily a social engineering attack. You have to convince the user to run an app or open a message that will exploit a flaw in their email app (and so forth).
So, why aren't we seeing a focus on the biggest security issue?
Why hasn't Microsoft released a bootable CD so you can run the anti-virus/spyware/adware stuff easier? Clean up the junk AND patch the vulnerabilities in Outlook. Even if it means turning off some of the functionality.
If you cannot do it securely, then you should not do it.
Parent
Re: (Score:3, Informative)
Firewalling them is not the same as closing them. (Score:5, Insightful)
Nope. There are still lots of ports open, it's just that Microsoft put a firewall on the system, too.
The problem still exists. But now there is a wrapper obscuring it that you have to get through. That isn't solving the problem. That's just attempting to hide it.
And exploits have been found for Microsoft's firewall. Which demonstrates the problem with not solving it at the lowest level.
I can put an Ubuntu machine with a default install onto the Internet without any firewall and still be safe from worms.
I cannot do that with WinXP (or Win2K or Win9x or WinNT). If you aren't solving the problem at the lowest level, you're not really solving it. You're just hiding it.
Parent
Re:Firewalling them is not the same as closing the (Score:4, Informative)
Parent
Re: (Score:3, Interesting)
Firewalls are bandaids, there is no replacement for well written, secure code.
Re: (Score:3, Interesting)
Capitol Punishment (Score:5, Funny)
O.K.,O.K. maybe just corporal punishment
Re: (Score:2)
Re: (Score:3, Funny)
Make Microsoft liable (Score:5, Insightful)
If you sell me a chain saw, and I ignore the instructions and cut off my hand, it's my own damn fault. If I ignore morality and criminality and cut off my spouse's head, it's still my own damn fault. But if the chainsaw goes off on its own power, while I'm sleeping, and slices and dices the whole damn town, it's your fault for selling me such a product, especially if you manufactured it with the knowledge that it could, in certain not-uncommon circumstances, do exactly that.
Re: (Score:3, Interesting)
And what if it's a GPL'd chainsaw that you made in college, put on the internet for people to copy and use if they want, but never took the time to test thoroughly?
Re:Make Microsoft liable (Score:5, Insightful)
Ever been part of the warez scene on IRC?
I'm assuming you haven't, so I'll explain. That system is entirely trust based, and self-regulating. If a file ever comes from anyone which has a virus or anything else suspect included, the source of the file immediately gets ostracised, at least as a source, and most likely in terms of download access as well, since the system is based on reciprocal trade. Wrong, I hear you say...what about cracks coming from warez *web* sites or p2p nets which have malware? Said malware would likely be put into the archives by the webmasters of those sites themselves...the upstream cracking groups would NOT be doing it, because there are a lot of people in the warez food chain who are not going to want to receive/propogate known malicious files. ANY group which includes files for compromising a system with a release has just destroyed its' ability to subsequently release files that people will trust at any point in the future. Ditto for eMule files that have nasties in them...they get intercepted/recreated downstream. That is part of the entire reason why nets like eMule use the sorts of file hashing systems that they do; if you know the hash of a particular group's release, you can download said release and get entirely clean warez.
Ditto with any moron who was going to be dumb enough to try and write GPL licensed malware...they'd gain a horrible reputation very, very quickly. The other thing is, anyone who is sufficiently interested in doing the wrong thing as to be writing malware in the first place is not going to care about licensing it unless they are exceptionally stupid...which malware authors generally aren't. Sociopathic and deserving of being used as live shark bait, yes. Stupid, no.
Accidental bugs which lead to buffer overflows and such are different. They are unavoidable, and people know that...despite the best of developer intentions, occasionally they happen. As such, although the author of said bug will not risk ostracision for authoring it, in most cases (at least if the program in question has more than half a dozen or so users) it gets patched very quickly.
Parent
Re: (Score:2)
Hey, yank the network cord and yo
Re:Make Microsoft liable (Score:5, Funny)
Hans Reiser, is that you?
Parent
Re: (Score:2)
Re: (Score:3, Insightful)
This psychotic-chainsaw-with-artificial-intelligence analogy is one of the dumbest things I've ever heard. Maybe the author of that post is really so ignorant about computers that he believes them capable of free-thought and action. If he is, I feel sorry for him. The people who modded him up, though, should know better. Computers require programming or user input, or both. Either way, they only do what SOMEONE ELSE has told them
Buying a new computer won't help you (Score:2, Insightful)
The people offering this "advice" have got to be idiots. True, it might cost more to pay someone else to de-own your PC and train you on how to avoid problems in the future than the cost of replacing the hardware. That doesn't mean that educating yourself isn't the right answer though. What does buying a new machine do to make you more secure? Buy a $400 brand spankin' new bottom of the line Dell, throw it up on the net, and get owned in under 20 minutes.
Re: (Score:3, Insightful)
Buying a new computer won't help you unless you know how to secure it and maintain it.
I'm guessing the poster thought that was the advice based on the closing anecdote. In it someone ran into trouble because their current PC was a botnet client. They weren't running the security software provided by their ISP because it overwhelmed their PC, and were buying a new one that was powerful enough to run all of the anti-virus/firewall/etc. protection they need.
You don't need to be a security guru, but you
Not quite.... (Score:5, Insightful)
Ummm, most Mac OS X users don't have to know anything about TCP/IP or NAT, etc. Of course, they have an OS that has security built in at a very low level, not tacked on as an after thought. Windows, at least through XP, is still based on the notion that it wants to make it easy to connect to everything and everyone. As such, it's pretty open and malware takes advantage of that. OS X and the various *nix distros start at the other end of the spectrum where things are locked down unless you open them up (although OS X has more opened up than, say Ubuntu and various other linii).
As others have posted, if Windows shipped with all ports closed except those that were really needed, then the user wouldn't need to worry about all these things. They wouldn't be opening a port until they needed it for some specific application and then that application could explain the dangers, if any to having the port open. It's basically a compromise between ease of use and security. Microsoft chose to maintain it's ease of use model from the pre-internet days, when everything was local and has tried to add security on top. It just doesn't work that well.
So, the real choice is, it seems, that if you want a Windows pc, then you need to learn about TCP/IP, NAT, firewalls, etc. On the otherhand, if you just want to use your computer, either buy a Mac or put a secure Linux, like Ubuntu, on your pc. (I just use Ubuntu as an example, there are others, too)
Parent
Re:Not quite.... (Score:4, Interesting)
I cannot believe people are still saying this. How many stories about botnets do we have to have on Slashdot before people realise that UNIX is not secure either.
Look. The vast majority of this crap comes in via browser exploits these days. Running malicious attachments etc is not such a favoured technique anymore. There is nothing in UNIX that stops applications from being written in an insecure fashion, there is nothing in UNIX that stops apps hooking each other to hell and back (which is largely what these bots are doing when they steal data), there is nothing in UNIX that even makes it hard to install a rootkit. Just phish the password out of the user, or wait until an authentication dialog appears and overlay your own, or wait until a privilege escalation attack is found (new ones appear all the time). But as you don't need root to steal data, send spam, display popup ads or any of the other things bots do this is really just a nice-to-have bonus, it's not essential.
The fundamental architecture of Windows NT is no different to UNIX these days. They are both seriously flawed because they are based on a threat model from the 70s, when the world of computing was totally different. Having an administrator user and also a "regular" user who are really the same person is a nasty hack that doesn't solve the problems at all. Apple don't have the answers ... have you seen how easy it is to suck SSL protected form data out of Safari? Neither does the Linux community. SELinux has gone down the route of totally static policy, which is fine for servers but worthless for desktops.
MacOS and Linux are statistically insignificant, but if people keep recommending them as a "solution" then soon they won't be and then we'll find, oh look, it's just as easy to create Mac botnets as it is Windows botnets. What little trust is left in computer security people will then be gone.
The fact is, residential computing is fucked. Utterly, utterly fucked. The guy quoted by the NYT is right, the war was already lost a long time ago, and people keep pretending it wasn't. The war was lost when the computing community decided that user based DAC security models could stop malicious software. They can't, they don't, and they never will so please stop saying MacOS or Linux are somehow inherantly better, when they aren't! They are at best temporary band-aids.
Parent
Re:Not quite.... (Score:4, Informative)
Really? Every XP box has hidden files shares turned on automatically. There isn't anyway to turn them off without resorting to executing a batch file after Windows starts. If you are relying on the Window's firewall for security, it is only providing a false sense of security, at best. There have been numerous tech articles against it (yes, it is better than nothing, but it isn't a full firewall).
Many malware rely on open ports to do their dirty work (connecting to IRC is just such an example). Several Linux distros have all ports disabled, other than those needed for actual use. OS X has most ports disabled. Even with the Windows firewall, there are many ports that are open, because otherwise, all the "neat" things Microsoft has touted you can do won't work. The problem is, that they are open whether you do those neat things or not and they don't show as an open threat because Microsoft wants them to be open.
Try it for yourself. There are many security websites that you can hit that will "test" your pc and tell you what is at risk with the default Windows settings. In short, the default Microsoft security settings may stop the kid down the block, but they won't stop the real hacker any more than copy protection does on CDs. At best, it just makes it a little less convenient.
Parent
An easy answer (Score:5, Insightful)
Any traffic that isn't specifically requested by the user is blocked. You manually open and close ports as you need them.
Oh, right, that would break most authenticity checks to combat "piracy", and totally botch most advertising on the net, and set us back to the early 90s. BTW - sign me up.
Re: (Score:3, Insightful)
Well .... No, not exactly ... unfortunately.
New PC (Score:5, Insightful)
Re: (Score:2)
This story brought to you via the botnet which tookover the NYT.
The root of the problem is responsibility (Score:5, Insightful)
The core of the problem is responsibility, or a lack thereof.
Vendors aren't responsible for the results of the flaws in their programs. Worse, they aren't responsible for deliberate design decisions that make it impossible to secure systems. I make an analogy to automobiles. Auto makers aren't generally liable for defects in cars, unless the source of the defect goes beyond a simple mistake or defective part, but they are responsible for repairing those defects and can be sued if they refuse to do so. And they're liable for design decisions they make. Witness the Ford Pinto. The current state of software liability is akin to Ford claiming that, because they had a valid business reason for building the gas tank on the Pinto the way they did (it was cheaper, thus let them price the car cheaper), they cannot be held liable for the fires that happened as a direct result of their decision. The courts slapped Ford around for making that claim, why are software vendors not treated the same? I can live without strict liability for software flaws, but lack of liability for design decisions that directly lead to security problems is probably the biggest reason we still have problems.
And users aren't held responsible for their use of a computer. They treat it as some sort of plug-and-play device like a television or a radio: plug it in, turn it on and stop thinking about it. A computer isn't an appliance, you can't just ignore it after initial set-up. Again, cars make a good analogy. You can't just ignore a car's maintenance after you buy it, you need to put new tires, new brakes and such on it regularly. And car owners get held liable if they don't. If you wore your brakes out so they don't work anymore and didn't get them serviced, when you rear-end someone because you don't have any brakes you will be held responsible by the courts and the insurance. If you're running on bald tires because you don't think you should have to check and change anything, you're going to get ticketed by the cops at some point for unsafe mechanical condition and the car's registration will get suspended until you fix the problem. Sure it's a hassle and expense to keep maintaining all those things about a car that need maintained, but we don't accept that as an excuse for someone not maintaining them and causing damage or injury to others as a result. So why do we let computer users off the hook when they say "But I don't know anything about computers!".
Software vendors and computer users need to grow up. They've been both acting like spoiled 5-year-olds who were running in the house after being told not to, knocked over the china cabinet and broke everything in it, and now that Mom and Dad are standing there they're whining that they shouldn't have to own up to it and take their punishment. No dice.
Re: (Score:2)
Because the "damage" they cause is very small, and virtual in nature (an annoyance at most.)
when they say "But I don't know anything about computers!"
Because 100% of the lawmakers are firmly in this category?
Re: (Score:3, Informative)
I don't know, I see the basic advice about security everywhere I look. You can't go to any security-related Web site, or even Microsoft's site, without hearing the basic common-sense rules I learned from other people in the BBS community back 25 years ago when I was in high school. Don't install software from sources you don't know and trust. Don't use software that downloads and runs stuff from external sources automatically. Put a hardware router with a firewall between your computer and the Internet. E-m
Yes! Buy a new PC... (Score:3, Insightful)
and sell your old one cheap.
Just the other day I bought an older Dell that "wouldn't boot" for $15, sans hard drive. An hour of hacking around inside, and I was able to get it going. It's a little old, but it'll make a nice LiveCD tester.
Consumers are getting raped by MS and Dell, but they're not going to learn, so might as well take advantage.
Re: (Score:3, Interesting)
"Same old," Arthur says. "How's the writing thing going?"
"Harder than I expected," I say. "But thank God for computers. I can't imagine typing this all out on a typewriter."
"Computers are great," Arthur says. "Until they go wrong."
"Ain't that the truth."
"My old computer was so infested with porn I had to throw it out," Arthur says.
"No way," I reply, taking a sip from my martini.
"I'm not kidding."
"Couldn't you reformat the h
Doesn't advise getting a new PC for everyone (Score:2)
Did anyone really expect a middle-aged, non-techie to think "Gosh, I should finally install Linux with a lightweight window manager!"
New PC isn't going to help... (Score:2, Insightful)
Push for Windows CDs (Score:5, Insightful)
Heck, a 700MB USB flash drive isn't expensive now. They should build read only flash drives with windows into the box, and put an option to run a reinstall in the bios. Solder it in so no one will steal it.
It's the least they could do, considering. I mean, Windows compes preinstalled on almost every PC sold, and there are a zillion pirate copies of Windows floating around on the net, so hardly anyone needs to steal it, and anyone who wants to steal it can. But legitimate users are screwed when they have problems because they don't get CDs, because giving them CDs would encourage piracy. And, I suspect, because it's good for business if people trapped in a monopoly have to buy extra computers to solve this problem.
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
I had suspected that my Windows 2000 installation may have been compromised in some way so I wanted to reinstall it. Unfortunately, it took me several days to find one of my two original installation CDs. I found both of them, then I remembered that they were both Windows 2000 upgrade disks, so I will also need to find either my Windows 98 disk, my Windows ME disk or one of my two Windows NT 4.0 disks, none of which I could find. So I couldn't reinstall Windows. If that had been Linux I would have just
Bullshit: Just turn off services. (Score:4, Informative)
I really, really don't get it. It's not that hard to keep a Windows box safe. I do understand how grandma can screw up, but I just do not buy the rubbish that every Windows machine gets compromised in five minutes.
People talk about "open ports." To me, that's right up there with "oh no! My IP address is visible!" paranoia. It's just not how computers work! Worms don't somehow jump into your computer through magic holes called "ports:" They exploit bugs in services.
So, disable all the services you don't need. Get rid of the blasted Windows filesharing cruft. Shoot the scripting host. Turn off the remote desktop crap. Look through all the services, and just clean all that junk out. If you don't have idiot programs running that worms can fool into executing arbitrary code or otherwise misbehaving, you're ok! Then connect to the 'net and install the latest updates. In the time it takes you to do that, nobody will jump up through your NIC and give your computer gonorrea.
A firewall is a safety net, and it makes perfect sense in, say, a production IT department to have as many safety nets and backups as you can. But a properly-configured machine, without exploitable crap running, shouldn't strictly need it, and I really think that a competent personal user can easily stay safe.
As for the "security software" the article speaks of: Though an up-to-date antivirus is a decent idea, most software firewalls and other pieces of security software really just operate something like modern-day politicians, keeping users alarmed so as to justify their own existance. "Someone is trying to HACK you!" they scream, as an innocent ICMP ping request arrives at your computer. Pfft. Save your CPU cycles and just don't be a fool!
And without a single use of "hacker" (Score:3, Insightful)
how come no mention of DDOS? (Score:3, Insightful)
is it because the issue is outside the scope of the article or am i hopelessly behind the times and that's not really a problem anymore for some reason i'm not aware of?
Re: (Score:3, Interesting)
Welchia (Score:4, Interesting)
Parent
Re: (Score:2, Interesting)
Re: (Score:3, Funny)
Paycheck? They get screensavers. Just take a popular screensaver, write a hostile wrapper, and upload it to your scum site. If antivirus software removes your malware, some users will even reinstall it.
Re: (Score:2, Interesting)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
yup that's right in windows Admin isn't trusted enough to look at a users files, so next time the user tries to get tricky: