Slashdot Log In
Bot Infestations Reach Nearly 1.2M
Posted by
CowboyNeal
on Thu Mar 22, 2007 08:47 PM
from the worried-inboxes-everywhere dept.
from the worried-inboxes-everywhere dept.
mengel writes "According to the folks at SecurityFocus the number of bot-infested systems has surged to nearly 1.2 million. This after a
big drop in December when lots of people replaced/upgraded
systems. Time to upgrade your spam filtering software, the onslaught is coming."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Tweaking liability laws (Score:5, Insightful)
Re:Tweaking liability laws (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
ISPs should immediately pull the plug too on infested machines to limit damages.
There's no reason to let innocent bystanders to suffer from the criminal neglect of some.
Re:Tweaking liability laws (Score:5, Interesting)
Parent
Re:Tweaking liability laws (Score:5, Interesting)
An alternative would be instead of cutting them off completely, offer them an antivirus solution. Although I hate them, this is what companies like AOL and NetZero are doing.
B.
Parent
Re:Tweaking liability laws (Score:4, Interesting)
To be honest with you, I _would_ use that ISP versus one that doesn't dump the garbage traffic. I consider that a damn nice feature.
Parent
Re:Tweaking liability laws (Score:4, Interesting)
All over Japan, I have found, they are blocking outgoing port 25 and it's annoying as hell but I understand why they do it.
Parent
Re: (Score:2)
Re: (Score:2)
Re:Open Source Virus Protection (Score:4, Insightful)
I don't look at automated breaches of security as any special case. A security breach is a security breach. Crack attempts, spyware, adware, malware, viruses, trogans, blah blah... it's all the same problem: stopping unauthorised code running on your machine.
If my mail client has a bug that allows remote code execution, the mail client is faulty and must be patched. If my browser has a bug that allows a remote site to snatch files off my local filesystem, then my browser is faulty as must be patched. If I, FSM forbid, stupidly download and run some malicious application then I am faulty and must be "patched".
I have all non-essential services turned off, I run a firewall, I keep all my applications up to date with security patches, and I only install software from my distribution's repositry.
I don't care how much money they are making for some big security companies, these "anti-virus" applications that people are so obsessed with running on windows are just an ambulance at the bottom of the cliff.
There is something fundamentally flawed with the idea of waiting until your security has already been breached and then trying to clean up after the fact. Once it's breached that's it, game over - reformat, reinstall O/S, and replace data with last known good backup.
Parent
Re:Tweaking liability laws (Score:5, Funny)
Parent
Re: (Score:2)
-jcr
Re: (Score:2)
Re: (Score:3, Insightful)
You would think the legal case could also be made to hold Microsoft liable for stolen personal information, illegal charges to credit cards, raided bank accounts, etc., when known but unpatched (i.e. no patch available) exploits to their software allow people's computers to be compromised.
Re: (Score:2)
Re:Tweaking liability laws (Score:5, Insightful)
But if you have a car which injures people because the manufacturer put in lousy breaks, lousy locks, lousy steering etc, then the car manufacturer is in trouble, right?
Whilst I agree with you, the liability laws need changing, "reasonable" attempts at securing a Windows PC (eg: using antivirus software) have proven to be a waste of time, so the onus should be on the manufacturer.
Parent
Re: (Score:2, Interesting)
Re: (Score:2)
This would provide about three warnings that a compromised machine is being used to spam (and I've cleaned a few of these in my time as a freelance computer geek)...
Re: (Score:2)
So who wants to write a script?
Re:Tweaking liability laws (Score:4, Interesting)
RIAA/MPAA do not have any idea of technology. They would rather sue you (unwitting hosed guy) rather than sick the Secret Service on bot writers.
Good luck trying to explain child porn to a jury by stating that your XP was compromised....
Parent
Re:Tweaking liability laws (Score:4, Funny)
Parent
Re: (Score:2)
Re:Tweaking liability laws (Score:5, Insightful)
There are hundreds, perhaps thousands, of known spammers in the US. (See the ROKSO list, eg.) Barely a handful are ever prosecuted. One or two have been sentenced, trumpeted here as a victory against spammers, but really showing that being caught and punished for deliberate spamming is a very rare event. Considering that, what could a "negligent" spammer get?
ISPs can easily detect and cut off spam spewing robots. They have the right to do so in their TOS, but are just too complacent or perhaps concerned they'd have to deal with hundreds of clueless users complaining about it.
Parent
Hmmm.... (Score:5, Funny)
Re:Hmmm.... (Score:5, Funny)
Parent
Must be linux (Score:2)
http://it.slashdot.org/article.pl?sid=07/03/22/21
Re: (Score:2)
Re: (Score:3, Funny)
* Keep It Spamming Stupid!
All those bots must be coming from (Score:5, Funny)
Forget the spam filters... (Score:3, Insightful)
I, For One... (Score:3, Funny)
Re:I, For One... (Score:5, Funny)
translation: Imagine a beowolf cluster of those!
Parent
How does this sqauare with Vint Cerf's speech? (Score:2)
Re: (Score:2)
You should know that 87% of all statistics are just plain made up.
Re: (Score:2)
But my spam is way down from the Dec/Jan peak (Score:3, Interesting)
ISPs take action? (Score:2)
Battle is now greylisting versus IP address spread (Score:4, Interesting)
IMO, the real battle here is caused by greylisting. Greylisting plus a honeypot database of fake email addresses is clearly the most effective, automatic, general-purpose anti-spam mechanism to come along. Spammers are starting to feel the pinch (even though lots of people are still struggling with old-fashioned "filtering" mechanisms, and are still easy and fun targets).
The spammers who are starting to take on greylisting are doing so by two main mechanisms: massive distribution across IP address space, and direct use of infected PC MTAs.
The IP address spread is fairly simple to understand. If you have 100,000 zombie PCs with 100,000 IP addresses, then clearly you can send 100,000 pieces of spam without ever using the same IP address twice. That makes the honeypot database of greylisting useless, since I rely on waiting to see a given IP address send email to a known "bogus" email address to correctly identify that IP address as a spammer (in the short term, at least).
The direct use of infected PC MTAs is more difficult. If the zombie PC can programmatically use the unspecting owner's own ISP MTA to send the spam, then it becomes very difficult to distinguish that spam from real mail send from a real person (just as botnet click fraud is very difficult for Google to do anything about without also discounting some "real" clicks).
To respond to the massive distributed IP address spammer, I think a drastic increase in bogus email addresses would help, so that they have to transmit to 10 or 100 times more addresses in order to hope to reach the same # of real people. It's easier for website owners to create more bogus email addresses than it is for the spammers to infect more PCs. You basically always "drop" mail sent to a bogus address so that the spammer is convinced it went through and is getting to a "real" person (and probably even sells that address to other spammers as "verified").
That would push the spammers squarely into focussing on using the infected owner's own ISP's MTA for transmission, giving those ISPs an ever-increasing workload of bogus mail to send. Sorry, but that's where this war is headed anyway: to the point where ISPs will start charging customers to disinfect their PCs once they've been identified as botnet spam transmitters.
I'm going to start slowly increasing my spamming of spammer address databases today (e.g., by injecting more hidden text email addresses onto websites). Note that this is not a "solution" to spam (so please don't post that cute little form :-).
This is just an effort to push the problem where I think it's going to end up eventually anyway: on the backs of ISPs that have not yet come to view infected customer PCs as "their" problem yet.
Re:Battle is now greylisting versus IP address spr (Score:5, Interesting)
That isn't greylisting at all (though it is useful against spam).
Greylisting is giving a "new" incoming SMTP connection a 400-series error message the first time they try to send email to you. A 400-series error means a temporary problem - please try again. When they try a second time they try to send email, you accept.
Since all legitimate email servers will retry when they get a 400-series error, a legitimate message will go through, at a cost of a time delay.
However, most spammers don't bother retrying (although some do), so you can block a lot of spam with greylisting, with very little bandwidth or CPU cost.
Parent
"systems" euphemism (Score:3, Insightful)
are bot-infested PCs running MS Windows. They make life hell for the rest of
us.
An easy fix (Score:5, Insightful)
I'll go one better. Cut the fucking thing off the net until the user fixes the problem.
I fail to see why it seems to hard to detect these things. When an ISP sees a machine go from sending out 4 or 5 emails a day to spitting out thousands of emails every hour, it should be obvious there's a problem.
Also, close the damn mail ports off. If a customer wants to host their own email server at home, fine...but make them call in and request that the port be opened. And make it clear that if their machine gets owned, they get cut off and fined before access will be reconnected.
And finally, spam has been a problem for years...how come the MTAs haven't been rewritten to not allow header forging, etc, in all that time? Isn't this supposed to be one of the big advantages of open source and open protocols?
Re:An easy fix (Score:5, Insightful)
Most users are not technically sophisticated to do anything, even if they were told that their computers were affected.
Computers and the internet are far too prevalent today to simply cut somebody off because their boxes were compromised. If you must, blame the manufacturers for designing systems that can so easily be taken over by bots and viruses.
Most people don't really care, because to them the computer is just like the TV or the microwave - a tool that lets them do something. If the tool gets messed up and causes problems because of something, they can't be held responsible because face it, they have no clue whatsoever. If you are designing a system that you think even an idiot can use, then make sure that it is idiot-proof.
But companies want to sell $OS to your grandma, but do not want to take responsibility for what happens when things go to hell. If you are selling something to grandma, make it grandma-proof. She will open attachments, she will not have a clue about what's out there on the web -- if you are selling her a tool, make sure that it is protected against the mistakes she most likely will make.
Somehow, in the software industry, it is considered acceptable to call the users idiots and let go. Now here's the thing -- even some of the very smart people have trouble using computers simply because it is not their thing. Not everybody can be a computer geek, and nor should they expected to be.
If anything, the software manufacturers should be held responsible. Stop blaming the users already, please.
Parent
Re: (Score:3, Insightful)
I agree with parent.
I also want to point out that the automotive industry went through a similar period about 35 years ago, when new cars were required to have pre-installed seat belts. It is now generally accepted that seatbelts, airbags, and less visible things like collapsing steering columns and controlled crumpling are GOOD THINGS TO HAVE IN A CAR. But at the time these were introduced, the sometimes strong argument against them was that none of these things were necessary for a well trained driver.
Re:An easy fix (Score:4, Insightful)
Sure, the software manufacturers have some fault in this. But ignorance from the user doesn't help.
I would propose the following to an ISP:
1. Firewall the infestation from the internet
2. Give the user access to the mailserver to *download mail only*
3. Redirect all browsing attempts to a local server that serves step-by-step guides and ready-packaged tools to remove any virus infections/malware. Put up a helpful "send us a mail if these instructions doesn't help" form and leave any phone no. clearly visible.
Parent
Re: (Score:3, Informative)
I fail to see why it seems to hard to detect these things. When an ISP sees a machine go from sending out 4 or 5 emails a day to spitting out thousands of emails every hour, it should be obvious there's a problem.
Also, close the damn mail ports off. If a customer wants to host their own email server at home, fine...but make them call in and request that the port be opened. And make it clear that if their machine gets owned, they get cut off and fined before access will be reconnected.
You can't look at these as two separate issues.
Currently, most ISPs are not monitoring what you send out on port 25. They have no technical means to do so, and acquiring that ability would be prohibitively expensive. ISPs can monitor what you send out through their SMTP relay server (most don't analyze the patterns proactively, but they can review the logs when they get a complaint) but generally botnets don't relay through the ISP's server.
But you're absolutely right about ISPs blocking outgoing access
Re: (Score:3, Interesting)
This is exactly what we do. The rule at our company is simple. 3 strike policy, and your out. If you send out a shitload of spam, etc we suspend the account. They then call in and bitch, we explain the situation and how they can resolve it by setting up a firewall, anti-virus software, etc. Or, refer them to a local computer tech to reinstall the OS, etc. If it happens again, strike 2. We inform them that they ha
How's Vista doing on this? (Score:4, Interesting)
The big question: how many infected systems are running Vista? If there are a significant number of infected Vista systems, Microsoft blew it again. (Remember, Microsoft said that Windows 95 was going to fix security. Then Windows XP was going to fix security. Then Vista...)
On the other hand, if Vista systems aren't being turned into zombies, we may be at the beginning of the end.
Spammers have had to resort to more and more desperate efforts to keep spamming. In the late 1990s, spammers could just buy a big pipe and start sending. That's dead. Then there was spamming through open relays. That's essentially dead. There used to be a significant amount of "legitimate spam". That was killed by the combination of CAN-SPAM and spam filters - if it comes from a known spam source, it gets deleted, and if the sender lies about the source, they've committed a felony. China finally cracked down on "bulletproof hosting". (There are some "bulletproof hosting" outfits left [bullet-pro...osting.com], but most are gone and some of the remaining ones may be sting operations.) Zombies are about the only way left to spam in bulk. And note how few different spams there are. The number of actual spammers left isn't that large. It's small enough for law enforcement to target.
If the zombie problem can be cracked, which ought to be possible, spamming may drop to a minor problem.
Re: (Score:2)
No broadband router? Go buy one. They're free (after rebate, of course!)
Re:Computer bots (Score:5, Funny)
There are 3 things to look for.
1 Is it running Windows?
2 Is it connected to the Internet?
3 Has it been on for more than 20 minutes?
Parent
Re: (Score:3, Interesting)