Largest Hacking Scam in Canadian History

vieux schnock writes "Police raided several homes across Quebec on Wednesday and arrested 16 people in their investigation, which they say uncovered the largest hacking scam in Canadian history. (...) The hackers collaborated online to attack and take control of as many as one million computers around the world that were not equipped with anti-virus software or firewalls."

Really?

[ImprovGuy (541110)]

Are there that many computers without anti-virus software or firewalls on the Internet?

Re:Really?

[Brian Gordon (987471)]

Are you serious? There are hundreds of millions of PCs in the world (billions?), and the vast majority of them aren't properly secured. Also the vast majority of them have 10 smiley toolbars and take 45 minutes to boot.

Re:

[Divebus (860563)]

I think he was trying to be funny... weren't you, Bill?

Re:

[PrescriptionWarning (932687)]

Yes, there are that many Windows machines on the internet.

Re:Really?

[TheRealMindChild (743925)]

It doesn't even really matter at this point. Let's be honest... the average computer user doesn't know the difference between U2-Somesong.mp3 and U2-SomeSong.exe. It doesn't take much to write an application that would be able to run in a restricted user account... just connect outbound on port 80 for coordination, and for payload delivery. The code would be simple enough that you could change the binary significantly enough that the fingerprinting that virus scanners use are practically worthless.

That doesn't even address the vector of replacing the setup.exe (or equivalent) on, say, an Office 2003 cd posted on thepiratebay. Obviously, the install has to run as admin, so you pretty much know, you are a shoe in for a compromised machine for anyone who tries to install it. And again, it would be such a trivial, simple application, that you could change the attacking binary pretty much at will.

Re:Really?

[GreatBunzinni (642500)]

It doesn't even really matter at this point. Let's be honest... the average computer user doesn't know the difference between U2-Somesong.mp3 and U2-SomeSong.exe.

To make matters worse, some attacks may even occur if you are dealing with safe file types, like a PNG [microsoft.com] or even PDF [softpedia.com]. Some security problems exist due to the user's ignorance or idiocy but "some" isn't exactly the same thing as "all".

Re:Really?

[ultranova (717540)]

To make matters worse, some attacks may even occur if you are dealing with safe file types, like a PNG or even PDF.

There are no safe file types. All files can be viewed as programs meant to run in a specialized virtual machine (the program which is used to open them). For example, a PNG file is a program which, when run, will compute an array of bytes (the image pixels). The same goes to PDF. In this view, since all files are programs, it is in principle possible that any of them could contain code which can result in unexpected behavior of the virtual machine executing them.

Of course some file types are easier to compromize than others, either due to sheer complexity or ambiguity of the specification or because they are Turing complete. However, it is impossible to guarantee that every viewer for any file type is free of defects. Anyone still remember ANSI codes for DOS, which could be embedded to text to change color but also to set macros to keyboard keys when the file was viewed ? And of course SQL injection attacks are based on formatting a text string so it will cause unexpected results, not to mention causing a buffer overflow with an overlong string.

I repeat: there are no safe file types. They all have a potential to contain malicious code, because there is no such thing as data which is not also a program. From a certain point of view, GIMP is simply a very specialized compiler...

Re:Really?

[ultranova (717540)]

Is a text file containing a single line of text followed by a carriage return a program?

It can be. For example:

'; ROLLBACK; UPDATE users SET admin = true WHERE username = 'ultranova'; '

If the virtual machine which handles the username field of Slashdot login form naively passed this string to the database layer without specifically quoting it, this text string would make my account an admin account; well, actually, since I haven't studied Slashdcode, it propably wouldn't, but the point still stands: even text is not an inherently safe data format in all circumstances.

How about the standard input device? When I type at the console keyboard, is that a program feeding into a "virtual machine" created by the console driver?

The virtual machine in this case would be whatever program receives the input. And yes, the text you type is indeed a program being executed by that machine; each time it receives a keypress from you, that keypress instructs it to do something, right ? Even if that something is merely to output the letter (altought a text editor would also store the input internally, of course). And that is what a program is: a list of instructions.

If not, why is a disk device different from another device?

It isn't.

Re:Really?

[CarpetShark (865376)]

That doesn't even address the vector of replacing the setup.exe (or equivalent) on, say, an Office 2003 cd posted on thepiratebay.

Why stop there? Most of the Windows OS torrents are slipstreamed. There's no reason to assume they didn't slipstream a few viruses, bots, and backdoors in there too.

Re:

[by Anonymous Coward]

There's a web of trust on the piratebay with trusted uploaders. Installing an OS or running a keygen from a newbie uploader is virtually guaranteeing you to get a trojan downloader. I've been playing around with a few of the torrents from the piratebay and installing them on a separate vlan at home. It's very enlightening watching all the network traffic when the compromised OS calls home. I am pretty sure this is one of the primary "seeding" vectors for the nu-war storm network. I weekly find new morphed

Re:Really?

[Anne Thwacks (531696)]

the average computer user doesn't know the difference between U2-Somesong.mp3 and U2-SomeSong.exe.

The average user cannot tell there is a difference - because the Windows default is to hide the extension!

It may be criminally insane, but its the default.

Re:

[Bronster (13157)]

Our mx servers have a list of over a million machines which are blocked from talking SMTP to us for three days thanks to past bad behaviour. In a single hour nearly 200,000 of them tried multiple SMTP connection attempts.

Yes, I'd believe those numbers.

Spot the key words

[Silver Sloth (770927)]

The hackers collaborated online to attack and take control of as many as one million computers around the world that were not equipped with anti-virus software or firewalls

Police won't reveal what the information was used for but investigators estimate that the network profited by as much as $45 million.

Hmm... as many as, as much as, or maybe they're inflating the figures to show what macho investigators they are.

Re:Spot the key words

[powerlord (28156)]

Nah, nothing so covert. Its simply that, "as many as", sounds a lot better than, "three computers we know about, but we really have no clue" or "we found 5 million deposited in their bank accounts in the last month, but the accounts have been open for nine months, so who knows how much money they could have collected previously".

Alternatively they probably have a pretty good idea of the ranges involved, but hey, high numbers make a better press release.

Re:

[Otter (3800)]

I dunno -- is a million nodes especially large for a botnet? It seems consistent with the various botnet stories linked here, and quite conservative compared to the usual estimates here of the prevalence of compromised Windows systems (i.e. all of them, if not more).

Re:

[Tony Hoyle (11698)]

1 million machines in a network talking to each other would probably consume more bandwidth in network overhead than useful work. Even instructing 1 million independent machines to do the same thing would take a considerable amount of time/bandwidth (eg. send a spam email to each one plus a list of targets so they can begin spamming... that's a million emails you've got to send - might as well send the spam yourself).

Re:

[Otter (3800)]

At any rate, I was mistaken -- while some of the wilder claims of botnet size are in the millions, realistic estimates put even the largest in the low six figures. So the OP is correct that the figure given here is rather improbable.

Re:

[somersault (912633)]

Why would they be talking to each other rather than just a single controller? Or one of several controllers. IANAbotnetwriter, but I don't really see the need for them to communicate with each other, unless it's through an attempt to obfuscate the original source of a command sent to the network. The internet has several million machines in a network and it seems to do okay for itself.

Re:

[tlhIngan (30335)]

1 million machines in a network talking to each other would probably consume more bandwidth in network overhead than useful work. Even instructing 1 million independent machines to do the same thing would take a considerable amount of time/bandwidth (eg. send a spam email to each one plus a list of targets so they can begin spamming... that's a million emails you've got to send - might as well send the spam yourself).

Except that a good botnet doesn't have to have machines talking to each other. Each comprom

Obligatory:

[powerlord (28156)]

Blame Canada! ... eh?

From TFA:

[Jurily (900488)]

[...] and face charges related to the unauthorized use of computers.

Surely they must mean unauthorized use of other people's computers?

Re:From TFA:

[by Anonymous Coward]

I'd assume you're always authorized to use your own computer.

Then again, in today's climate, maybe not...

Re:From TFA:

[morgan_greywolf (835522)]

I'd assume you're always authorized to use your own computer.

Nope. There are times when I'm not authorized to use my own computer. Just ask my wife! ;)

Hardly the first time Canada has caused problems

[elrous0 (869638)]

Let us not forget Bryan Adams.

Re:Hardly the first time Canada has caused problem

[garett_spencley (193892)]

South Park was playing nice ...

If you REALLY want to hit Canada where it hurts you need to bring up Celine Dion.

Of course they will DENY, DENY, DENY ... but you will have taken a piece of them forever by reminding them of their biggest skeleton they just can't seem to hide no matter how hard they try.

Urgh, I feel dirty for just bringing it up ...

Re:Hardly the first time Canada has caused problem

[i_ate_god (899684)]

As with a lot of our other trash, we simply shipped Celine Dion to America. Now she's your problem, enjoy.

Re:

[elrous0 (869638)]

Well, at least Alanis was hot--except for her live performances (where she always looked like she was having some sort of epileptic seizure).

Profitable

[theshowmecanuck (703852)]

In Canada they will probably server a couple years in prison if that, be forced to eat a Big Mac, and then set free. The judges and the justice system in Canada suck big time.

1) Go to prison for some short time.
2)Then dived 45 million dollars Canadian (now worth more than the US green back... but what isn't these days) by 16.
3) Profit

This time we can fill in the blank(s).

Re:Profitable

[calebt3 (1098475)]

they will probably server a couple years

Someone needs more coffee.

Sounds like advertising.

[TwoToeWilly (1243566)]

This is one way for the anti-virus companies to stay in business.

Eh?

[lbmouse (473316)]

I moved here from Canada and they think I'm slow, but I'm really an über-hacker, Eh?

That summary needs fixing.

[Shados (741919)]

The hackers collaborated online to attack and take control of as many as one million computers around the world that were not up to date with patches and didn't have users with common sense.

There, thats better.

Re:

[zakeria (1031430)]

slight correction: The hackers collaborated online to attack and take control of as many as one million MS Windows computers around the world that were not up to date with patches and didn't have users with common sense.

Re:

[Shados (741919)]

Indeed :) Though an heaily unpatched Linux machine is probably just as easy to take control of. Just less of em out there, haha. (I spent my spare time in college years rooting random Linux servers and changing the text that says "Welcome to blah blah Linux Redhat blah blah" to "Welcome to blah blah Windows ME blah blah....". That was fairly amusing, and harmless to boot.

Re:

[VorpalEdge (967279)]

Common sense? Really? Most people, when they buy their first computer, expect it to "just work." They expect everything to be fine as it is, and for the patches (if they've ever heard of them) to be nice, but unnecessary.

After all, what they were sold is good enough, right? They didn't exactly buy the "turn your computer into a botnet zombie" feature (bad jokes featuring MS aside). They still expect companies to have integrity, and to make products that actually work, and that don't explode when you tu

Re:

[Shados (741919)]

We're in 2008. Even non-software products now get recalled, blow up, fall apart, are defective by design, are made in china (lol), all over the place. Go to Bestbuy and buy a headset at random (close your eyes and pick one), go up, and try it. 9 to 1 that thing will break within 2 weeks, sound will be crap, and it will be barely usuable.

All but the fanciest grocery stores will have expired stuff on the shelves if you look well enough. You have to be selective in what food you pick, make sure to read the exp

Haha

[ViralInfection (1221188)]

From the ages of 17-26.

Wouldn't you say the RCMP is just hunting down script kiddies?

Re:Haha

[necro2607 (771790)]

You're joking, right? Younger people not only have more free time to pursue the motivation to hack & crack, but also tend to have more drive to do so, and less ethical reservations about doing so. You know how a lot of techie guys say "yeah, I used to be into that, but i grew out of it", well, that's generally the case with the vast majority of "hacker types" with malicious intent, except that a fair number of them actually pursue those motivations to a much further extent than others.

I used to hang out in chat rooms with guys who were developing their own exploits in C on netBSD machines they set up on their own, etc. etc.. (mid to late 90s).. They were all in their late teens, average of around 17 or 18 years old, no joke. There were a couple guys in college who were 20 or 21 or so, but really, the teens and early 20s is pretty much the prime time to delve into 'questionable' types of endeavours in the high-tech realm.

Oh, by the way, for a little personal anecdote, I cracked/hacked/obtained/whatever the admin password for our Mac lab in my elementary school when I was 9 years old, in grade 3 or 4 (and got banned from the lab for a while of course). Then again, I used utils I found on the net (a keylogger IIRC), but I still think that required a lot more knowledge and investigation than most 9 year olds are willing to pursue. Actually, I created a custom HyperCard stack that let me execute any program I had on a floppy disk - it just had to match the same type/creator code as any of the programs that were available in At Ease. That's pure hack-mindedness at work, and no outside help was consulted. ;)

Crackers, not hackers (EOM)

[objekt (232270)]

EOM because I don't like NT.

The Unwritten Story...

[Panaqqa (927615)]

These arrests were in Quebec. What they are not telling us is that the arrests were REALLY for not hacking into the boxes using both official languages.

Canadian Prisons

[Detritus (11846)]

Does Canada have any strict regime prisons? It certainly has the geography for it. Why not ship the script kiddies off to a work camp in the middle of nowhere for a few years.

The "$45 million" profit claim is highly unlikely

[Master of Transhuman (597628)]

This sounds like the usual inflation of profit that law enforcement agencies love to do.

Most of the large-scale botnet scams I've heard of don't yield anywhere near that kind of money. The botnet operators maybe pull down $3-10,000 a month renting out the botnets. Even large-scale identify theft rings are reaching for anything like $45 million.

Unless these guys were targeting rich people, I don't see it. And since most of the alleged compromised computers were in South America, I doubt they hit a lot of rich people.

Re:

[techpawn (969834)]

that were not equipped with anti-virus software or firewalls.

Hardware or software firewalls? After XP SP1 the windows "firewall" would count for most users.
Still recommend to install more than the paper tiger at the gate if you get that chance, but, anything is better than nothing for most users yes? If they mean hardware firewalls, I know very few home users that have one...

Re:So which is it?

[by Anonymous Coward]

It's 16 Canadian people, or 14 Americans... it's just the exchange rate.

Re:

[Poltras (680608)]

Or maybe not. Depending on WHEN you ask :)

Re:So which is it?

[Iphtashu Fitz (263795)]

Both.

16 people were arrested.

14 of those 16 were arrested on Wednesday.

Re:

[Iphtashu Fitz (263795)]

If you read it carefully it says that they raided a number of homes on Wednesday and "arrested 16 people in their investigation". It doesn't specifically state that all 16 were arrested on Wednesday, although that's what it implies. It only says "The 14 suspects arrested Wednesday are between the ages of 17 and 26".

I read this as the investigation led to raids on Wednesday that led to 14 arrests. Two others were likely arrested before those raids but still as a result of the same investigation.

Re:

[elrous0 (869638)]

Well, I certainly didn't mean to insult the French Canadian race.

H33Z 4 S00P3R H4X0R!

[Chas (5144)]

Because it makes them look like they actually did something important.

Not enough coffee again.

[ColdWetDog (752185)]

Murderers barely serve jail time up here. Don't hold your breath.

I read it as Moderators ...

For one brief second, I thought there was real justice Up There.

Time to crank the espresso machine up again.