Slashdot Log In
FBI Releases Results of Operation Bot Roast
Posted by
ScuttleMonkey
on Wed Jun 13, 2007 12:57 PM
from the notification-flagged-as-spam-and-deleted dept.
from the notification-flagged-as-spam-and-deleted dept.
coondoggie writes to tell us that the FBI has released the findings of their recent botnet study and have identified over 1 million botnet crime victims. "The FBI is working with industry partners, including the Computer Emergency Response Team Coordination Center at Carnegie Mellon University, to notify the victim owners of the computers. Microsoft and the Botnet Task Force have also helped out the FBI. Through this process the FBI may uncover additional incidents in which botnets have been used to facilitate other criminal activity, the FBI said in a statement.Bots are widely recognized as one of the top scourges of the industry. Gartner predicts that by year-end 75% of enterprises 'will be infected with undetected, financially motivated, targeted malware that evaded traditional perimeter and host defenses.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Skip the spammy site (Score:5, Informative)
and go straight to the source
http://www.fbi.gov/pressrel/pressrel07/botnet0613
Re: (Score:2, Funny)
The debate has moved on (Score:3, Interesting)
A few months back a botnet herder in Europe went down for running ONE 1.5 million seated botnet. The global botnet infection numbers are therefore in the tens to hundreds of millions of infected machines. Forget about wh
And here come the phishers.... (Score:5, Insightful)
Parent
Re:And here come the phishers.... (Score:5, Informative)
There have already been tons of viral messages from these two domains over the past few years. One of the big Windows worms ("Slammer," if I recall correctly) was often mailed out with an fbi.gov From address. Forging irs.gov messages is common among phishers.
Parent
Re:And here come the phishers.... (Score:4, Informative)
Parent
If it wasn't for spam and advertisers.. (Score:4, Interesting)
That's easy to do. (Score:3)
Simply find the block containing that IP address and then find the ISP controlling that block.
Now, whether the ISP is going to spend any time (time == money) on dealing with the problem is the next issue.
RFC 1491: you CAN get an email for an IP (Score:2)
I thought I knew what I was doing too (Score:5, Interesting)
Then a few months back I get word from my credit card company that someone had hacked into my account online (using my username and password), changed my billing address to someplace in NJ, then proceeded to try to charge a bunch of stuff on the account (luckily the CC company caught on to them and locked it down). I couldn't figure out how they did it.
Then a few months after that, I started to notice my computer acting strange. My router would be showing HEAVY activity even when I wasn't doing anything and Windows wasn't downloading updates. Eventually, I realized that someone must had botted my computer (still don't know exactly what they were up to, but I'm sure it involved sending out letters from an innocent Nigerian official just wanting people to help him transfer some money). That's how they got my account info for my credit card.
Anyway. I wiped the whole system clean (even tried out Linux for a while, but didn't care for it) and now the problem is gone. But it still makes me nervous as Hell. What drives me crazy is that I can't figure out how they did it. But, as a hacker friend once said: If it's on a network, it can be hacked--period.
Parent
Re:I thought I knew what I was doing too (Score:5, Funny)
"I accidentally got my girlfriend pregnant by pulling out too late. After giving the kid up for adoption, we tried using a condom, but I didn't care for it, so now I'm back to pulling out, and hoping she doesn't get pregnant, because I really don't know what happened the first time."
Parent
Found your problem (Score:4, Informative)
It's right here.
That's a good start. If you're going to insist on using Windows, wiping and reinstalling on a regular basis is a must. I recommend at least annually. More often if you use Yahoo search, flash games or shareware. If you use AOL or MSN and chat or IRC, you may as well boot from the Windows install CD each day.
Getting it set up the way you like it, and creating an "image" file of that setup with Symantec Ghost or something like it makes the process a lot less painful.
Or you could try actually solving the problem [ubuntu.com], but I note from your post you don't care for that answer for some non-specified reason.
If you do ecommerce from a platform you know to be insecure, don't expect everyone here to lobby for legal solutions to your technical problem.
Parent
Why not shut them down? (Score:4, Insightful)
And then a follow up with negligence-related charges for those who refused to give a f**k maybe?
Rgds
Damon
Or another approach. (Score:2)
First off, put them on their own network. Sure, this might clue the Zombie Master that something's happening, but maybe not.
Then, monitor the inbound/outbound traffic. If they're doing things like sending spam, block it. A DDoS attack? Block it.
Then work backwards to find the sites controlling the zombies.
It would probably be a LOT cheaper to do it that way tha
Re: (Score:3, Insightful)
I'd love it if ISPs would set snares for bot-infested computers, and technologically it's not hard: nobody at home-66-99-11-22.comcast.net should ever be forwarding packets from any external networks, let alone a hundred random networks a second. And some ISPs do trap that traffic and block it. But apart from DDoS attacks, what constitutes "legitimate" from "illegitimate" traffic? Connecting on odd ports to distant machines? That's how the
Think globally, act locally. (Score:4, Insightful)
And
There isn't any way to shut down all of the zombies. But our government CAN act to shut down the zombies here.
First off, there is NOTHING stopping our FBI from contacting law enforcement agencies in Russia or China. They may not help, but then again, they may help.
Then, you track the traffic back from that machine. And from the next machine. And from the next machine.
Simple. The commands have to come from somewhere. You can monitor all inbound and outbound connections. That will tell you what machines that machine is communicating with. You just keep checking each of those to see whether the trail continues or ends.
A lot. So?
Do we stop arresting criminals just because other criminals will perform the same crimes?
Not really. There's no reason why it would take more than a week. If the zombies are not receiving commands, then they're not sending spam or doing DDoS attacks. In which case, the problem is already solved.
If they are receiving commands, then you've just gotten another link. Maybe more than one link.
In the meantime, the ISP's are limiting the damage caused by those zombies.
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
The problem is, there'll probably be too many jurisdictions involved. What happens when the controlling computer is in China, Russia, etc.
Did you read the article? The three people cited as running massive botnets all lived in the United States.
From the FBI press release [fbi.gov] cited above: "To date, the following subjects have been charged or arrested in this operation with computer fraud and abuse in violation of Title 18 USC 1030, including:
My conspiracy theory (Score:5, Interesting)
B. It would do the NSA no good to listen to everything without filtering out the 99.999% which is irrelevant. Ergo, they must have pattern filters.
C. Botnets must be a big part of the filtered traffic.
D. NSA must be aware of botnets, their patterns, their control channels, their zombie elements.
E. Yet botnets continue.
F. The NSA must want them to continue unmolested.
The NSA knows how botnets work, and could hijack them at any time. The only reason to do so is to keep them in reserve for their own use.
I suggest the NSA would hijack botnets for counterattack if the US nets were attacked by another country.
That's my conspiracy theory, I hope you like it.
Parent
Re: (Score:3, Informative)
direct them to a site that they are now blocked from reaching, hmmm.
I know you would un-block that 1 site, but then hackers patch to block that 1 patch...
One got past our firewall also (email attachment actually) the ISP (Qwest) sent us a automated warning letter that we were about to get kicked, I did have it fixed before the letter was received. Imagine how difficult for a admin to track while all traffic is block
seems low (Score:3, Insightful)
how many computer users dont patch/update their computers or use a very old version? how many of those wouldnt know if they were infected or have an infected computer as it is?
Re: (Score:3, Interesting)
only 1 million victims?? i do believe there are far more than 1 million addresses in these scumbags mailing lists. *everyone* who's gotten spam out of one of these botnets is (also) a victim... not just the poor saps who got winjacked(tm).
They didn't say that's *all* the zombies (Score:3, Insightful)
Of course, busting the operators also means there'll be some thousands of zombies out there who are waiting for Master to tell them what to do next, and some of them may get explo
Phishing opportunity (Score:2)
Warn the kids and wake the neighbors. Be suspicious of any e-mail posing as the FBI and wanting a response by clicking an URL, fbi.gov or otherwise.
Solution (Score:4, Funny)
Your computer has been determined to be infected by a malicious program that gives control to another person. Please double-click on the link to find out how to get your computer disinfected.
FBI
No. Really.
Re:Solution (Score:5, Funny)
Parent
Re: (Score:2, Funny)
"Gartner predicts that by year-end 75% of enterprises 'will be infected with undetected, financially motivated, targeted malware that evaded traditional perimeter and host defenses.'"
Dear computer owner:
The computer industry has been determines to be infected by malicious 'analysts' who make a living out of regurgitating the same old news every year. God forbid they actually do something constructive for a change.
Re: (Score:3, Interesting)
Re: (Score:2)
But i've heard that you have to download it from those shady Pirate 2 Pirate networks, so its probably a virus!
"Victims" ? (Score:2, Interesting)
Who is the real victim here?
RIAA? (Score:2)
A botnet is a collection of compromised computers under the remote command and control of a criminal "botherder." Most owners of the compromised computers are unknowing and unwitting victims. They have unintentionally allowed unauthorized access and use of their computers as a vehicle to facilitate other crimes, such as identity theft, denial of service attacks, phishing, click fraud, and the mass distribution of spam and spyware.
Hmm... I didn't realize that the FBI was investigating the RIAA an
Accountability (Score:2)
Likewise, if i leave a completely unprotected winbox up on the internet and it gets rooted, should Microsoft be held responsible (which seems to be what some of you think)?
In both cases harm has been caus
Re: (Score:2)
In your car analogy, the owner reasonably believed that when the car wasn't running, it wouldn't go anywhere and a THIRD PARTY pushed the car such that it rolled down the hill.
Ordinary users THINK that their machines aren't vulnerable and thus do nothing, which in and of itself isn't a problem until someone else breaks in and turns them into bots.
Re: (Score:2)
better?
The mechanisms to prevent your computer from getting rooted are in place. People just don't use them.
Yes, and never forget Gartner predicted... (Score:4, Interesting)
I just did some Googling on things like "bad Gartner predictions" and "missed Gartner predictions" or '"Gartner predictions" scorecard' hoping that someone had tried to keep tabs on them, but found to my disappointment virtually no relevant hits. Everyone discusses them in the months after they're released, nobody seems to check back even as recently as a year.
Of course, with predictions like these for 2002 [gartner.com]... "During 2002, leading-edge businesses will exploit application integration to generate business innovation...." how the heck would anyone ever figure out whether or not it was fulfilled?
I can't believe people pay Gartner for this stuff.
Re: (Score:2)
I can't believe people pay Gartner for this stuff.
Heh, pick up a copy of anything by Tom Peters or his ilk. People who buy those books also pay money for Gartner analysis reports. At least Tom Peters came right out and said that he had no idea what he was talking about [fastcompany.com] when he wrote his first book. I think it's going to take a lot of people screaming "The analysts have no clothes!" (clues?) before people start questioning Gartner, though.
Microsoft Windows, please stand up (Score:2, Informative)
When the monopoly is finally busted, I guess it will no longer be implicit that "We're talking about Windows, of course."
It's good to see the FBI getting a clue. (Score:3, Interesting)
That they are looking into the problem is a good start. Gmen reading are advised to consult with the Honeynet Project [honeynet.org] and regard vector vendor "help" with suspicion. It would also be nice to see them call a spade a spade and abandon the false OS neutrality that keeps them for doing so. This is a Windows problem and the relative risks should be published. Otherwise they are lying to us and keeping information we can all use locked away. Most importantly, though, they need to clean their own house.
Re:It's good to see the FBI getting a clue. (Score:5, Insightful)
I don't know what "the relative risks" means, but since none of my Windows machines are in a botnet, and there are millions and millions of them that are not, this is not a Windows problem. It's a basic user education problem. Windows may have more attack vectors than other OSes, but that doesn't mean they are not known or are impossible to avoid. Simple common sense goes a long way. People get infected with botware because they download things they shouldn't or don't bother to keep their machines up to date by turning on automatic updates so they don't have to worry about anything.
If you think one chmod +x is an insurmountable obstacle to turning your shiny Linux or OS X box into a bot, remember that people get infected by executables in password protected ZIP files and that all of the most massively distributed worms have all required significant user intervention to propagate. Maybe one of these days you'll inherit 800 million completely clueless users, and maybe then you'll call it a "Linux problem"?
Parent
Re: (Score:3, Interesting)
Q8 Bots
Q8bot is a very small bot, consisting of only 926 lines of C-code. And it has one additional noteworthiness: It's written for Unix/Linux systems. It implements all common features of a bot: Dynamic updating via HTTP-downloads, various DDoS-attacks (e.g. SYN-flood and UDP-flood), execution of arbitrary commands, and many more. In the version we have captured, spreaders are missing. But presumably versions of th
The advice they are giving home users. (Score:2)
The advice given to home users [us-cert.gov] (and this [cert.org]) is clearly Windows specific, even though Windows is not mentioned. They go through the usual laundry list of things which are failing corporate users, firewalls, "patches", anti-virus and so on and so forth. Way down in the glossary is a mention of "Linux" linked to the "webopedia" [cert.org].
As I said before, these are important first steps. The information presented may be useful to novice computer users, but it's incomplete because it does not include some of the most
Problem between keyboard and chair (Score:3, Insightful)
I would like to suggest that, whatever operating system we put on the desktop for the average person, there be some initiative to educate them in best practices computing, even if only for the 4-10 common tasks (email, websurfing, games, mp3s, pr0n, quicken, word processing) they will use. I volunteer to design and write the curriculum if there's some rational initiative to get it out there to the human herd.
Are They Allowed To Do This? (Score:5, Funny)
Not Sure what's Worse (Score:4, Funny)
Re: (Score:2, Funny)
Re:Botnet (Score:4, Interesting)
All the windows boxes dissapear, so the bot-lovers would start targeting linux and OSX.
Don't think that just because there isn't a very active threat against those platforms doesn't mean that one isn't possible.
Parent
Re: (Score:2)
Re: (Score:3, Insightful)
Re:Botnet (Score:5, Insightful)
Windows was ubiquitous long before botnets became a problem.
Botnets became a problem as full-time internet access by unsophisticated home users became more ubiquitous, and Windows was the primary target because it was the main OS used by the targeted users. If there had been a Mac OS or Linux monoculture instead, people would have been tricked into install malicious software on those platforms instead.
Parent
Re: (Score:2)
Let's blame the internet!