Slashdot Log In
Top Botnets Control Some 1 Million Hijacked Computers
Posted by
Zonk
on Thu Apr 10, 2008 03:00 PM
from the not-many-linux dept.
from the not-many-linux dept.
Puskas writes "Joe Stewart is the director of malware research at SecureWorks, and presented a dire view of the current botnet landscape at the RSA conference this week. He conducted a survey of the top spamming 'nets, extrapolating their size from the volume of emails that flow across the internet. By his calculations, the top 11 networks control just over a million machines, hitting inboxes with some 100 billion messages a day. 'The botnet at the top of the chart is Srizbi. According to Stewart, this botnet — which also goes by the names "Cbeplay" and "Exchanger" — has an estimated 315,000 bots and can blast out 60 billion messages a day.
While it may not have gotten the publicity that Storm has during the last year, it's built around a much more substantial collection of hijacked computers, said Stewart. In comparison, Storm's botnet counts just 85,000 machines, only 35,000 of which are set up to send spam. Storm, in fact, is No. 5 on Stewart's list.'"
Related Stories
Submission: Top botnets control 1M hijacked computers by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Let's see some truthful tagging (Score:3, Informative)
Re: (Score:3, Interesting)
Compromised Linux machines are an integral part of the botnet. [softpedia.com]
No technology can replace determined stupidity... or just plain arrogance.
But... you are INVINCIBLE!, right?
Re:Let's see some truthful tagging (Score:4, Funny)
Parent
Re:Let's see some truthful tagging (Score:5, Insightful)
That's the same reason NIMDA went after Apache, Slammer hit LAMPs... Oh, wait, they didn't.
Parent
Re:Let's see some truthful tagging (Score:5, Informative)
'Tis no mere canard or straw man. Simple economies of scale keep the Macs out of the botnets - not Cupertino prowess.
Microsoft is Swiss Cheese, that's wrapped in foil.
Apple is Swiss Cheese labeled as "Ementhaler" - believing that the luxury branding will ward off serious scrutiny, but leaving those holes exposed.
Lo! http://www.news.com/8301-13579_3-9905095-37.html [news.com]
It's like this every [washingtonpost.com] year [news.com]. Apple leaves vulnerabilities wide enough to drive a truck through, and I've lost count of the number of these things given away as prizes to the cracking teams.
Apple patch the OS like Microsoft used to, before Slammer. The ususal culprits? QuickTime and Safari.
The guys who cracked the MacBook Air need only have coupled this with the DNS flaw in AT&T customer TwoWire routers, and a very bad situation would exist in the wild. Not trivial - but not too difficult. The hard part was finding the flaw - now it's an exercise for the Kid33z. If there were an economically feasible number of Macs to do this, you can bet it would be crime syndicates and not kids - and you'd have a happy, Apple botnet.
Parent
Re: (Score:3)
Overlooking the fact that Emmental (where Emmenthaler is made) is already in Switzerland and has been for some time, I wonder how many Mac users, when feeling a bit peckish, will turn to cheesy commestibles?
And of those that do enjoy the fermented curd, how many would rather a bit of Cheddar, or Tilsit or even something like a Wensleydale to Emmenthaler? Seems
Re: (Score:3, Funny)
Re: (Score:3, Informative)
And Since it's based off FreeBSD, there are really easy ways to harden the OS against exploits, like with any unix or unix-a-like OS variant. (like chflag aka chattr on linux)
and if you REALLY want to harden an apple system there is Darwin.
I mean, at least someone with some common sense can add a nice layer of security for apple without adding anything more than a replacement for safari and removing quicktime.
For windows secu
Re: (Score:3, Informative)
Windows and Linux have market share that is on the same order of magnitude, in the server market place.
Windows may have just below 90% market share in the home user space, but how many home users have high bandwidth upload capability? Cable broadband providers block server ports upstream for home users and ADSL providers provide asynchronous bandwidth, broad download skinny upload, as well as blocking server ports upstream.
Because of this the target for spammers is the server space. There are a lot of p
How do I tell...? (Score:5, Interesting)
I don't necessarily trust that a clean-virus scan means a whole lot.
What's the best way to make this determination?
Re:How do I tell...? (Score:5, Informative)
Parent
Re:How do I tell...? (Score:5, Funny)
If this either seems to drastic or fails to do the trick, just squirt a syringe full of penicillin directly into the power supply while the computer is running, that should help.
Parent
Re: (Score:3, Informative)
http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx [microsoft.com]
A rootkit can hide its activity, so this isn't as good as a firewall, but it is easier, and you'll at least be able to figure out if you have a non-rootkit infection.
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
Re:How do I tell...? (Score:5, Insightful)
Not even Linux boxes are safe from hacking. [softpedia.com]
An anti-virus scan is totally worthless. In fact, most systems slow your machine down so badly that they're worse than useless. Norton slows your machine down by thousands of percent! [codinghorror.com]
Let's be honest here. In my lifetime, I've spent less than $100 (one hundred dollars) on my security systems. That gives me a D-Link firewall, Avast!, and Spybot. The hackers have access to the same materials. If they want to write a program that gets around my meager defences, then they can. I live only by my obscurity, enhanced by my slight tweaks to my firewall. (Dropping pings, blocking port 113, etc.) As far as a passive scan goes, I don't exist. I simply wouldn't survive a concentrated attack.
That's probably okay, though - it's like when I lock up my bike. I have a kryptonite U-lock that I put through both wheels and the frame. I also take the seat with me and remove all the shiny bits. (It also has a VHF transmitter, but that's another story.) It would take someone with a plasma torch two or three seconds to cut the bike rack and put my bike into a truck. However, that's not worth your average meth-headed bike thief's time. It's easier for him to take another bike that's not as secure. If a dedicated professional wants my bike, then he's going to get it.
The major problem with Windows is that when you take your machine home and plug it in, it can be easily compromised. The same is true with a lot of commercial-grade routers with firewalls. The default settings leave a lot to be desired. Your firewall still sort of works, but you're not getting the same level of protection that you'd get by changing some settings. Just two days ago, we had an article about the 2-wire security holes, showing that a large percentage of IDSN home users in North America are wholly unprotected against external attacks.
So why do we have what we have? It's simple. We have a lot of programs written by people who simply do not understand security issues. Windows, for example, is perfectly stable until you start to put 3rd-party software on it. Then it starts to crash because the memory is being used in two or more different ways. Take a look at some of the snippets on thedailywtf to see what sort of quality work you end up with when you have people who "can program" and can't understand basic math (if you work unpaid overtime, that's you.) writing important code for important systems.
What's required to fix it is a wholesale change in CPU architecture along with mandatory licencing and regulation for anyone who wants to program anything in any language and sell it. (If you put up a dividing wall in your house, you can get the supplies at Home Depot and DIY. If you want to sell a wall-building service to the public, you have to be licenced.)
Only once we take programming as seriously as we take bridge construction and land surveying will we start to see safer computing.
Parent
Re:How do I tell...? (Score:4, Insightful)
Parent
Re:How do I tell...? (Score:5, Insightful)
"What's required to fix it is a wholesale change in CPU architecture along with mandatory licencing and regulation for anyone who wants to program anything in any language and sell it. (If you put up a dividing wall in your house, you can get the supplies at Home Depot and DIY. If you want to sell a wall-building service to the public, you have to be licenced.)
Only once we take programming as seriously as we take bridge construction and land surveying will we start to see safer computing."
Such suggestions are worse than the problem. Suggesting that people should need a licence to program and comparing it to bridge builders and surveyors is like suggesting people should have to get a licence to walk, just like they need a licence to drive a car.
Parent
Re:How do I tell...? (Score:4, Informative)
As a smart software developer, you know not to trust a box that may be untrustworthy. You packets leave the untrusted box and must pass elsewhere where they can be monitored. Do you monitor your router traffic? That's number 1. Windows Updates may cause unexpected traffic, but the addresses will let you know if it's outgoing spam or request for updates from Microsoft.
For example my recent URL's from my router log show the following..
192.168.1.81 168.143.175.215 www
192.168.1.81 74.125.47.164 www Google
192.168.1.81 210.50.7.243 www Doubleclick --- I'm going to have to add this to my hosts file..
192.168.1.81 8.14.216.9 www
192.168.1.81 74.125.47.164 www Google
192.168.1.81 203.34.47.165 www IDG publications
192.168.1.81 210.50.7.243 www Doubleclick
192.168.1.81 210.247.196.12 www www.facilitatedigital.com/
192.168.1.81 217.20.16.80 www
192.168.1.81 209.27.52.115 www Doubleclick
192.168.1.81 66.35.250.151 www Slashdot
192.168.1.81 209.62.176.153 www Doubleclick
192.168.1.81 74.125.47.164 www Google
192.168.1.81 74.125.47.103 www Google
It's all WWW traffic and no unexpected port 25 traffic. A simple Linksys router can give you this information. Take the addresses given and plug them in to the URL bar in your browser to see if there is any unexpected traffic. Don't trust a possibly owned machine. Go upstream and look at the traffic. Most routers will log some incomming and outgoing traffic. Check it once in a while. You machine might be clean, but the kids may have problems. The kids are at school so all recent traffic is mine. If my wife's desktop was spewing traffic, I would see the traffic from another machine's IP address.
And yes, that is my real IP address for today. I'm glad media sentry isn't in the list.
Parent
Re: (Score:3, Interesting)
Sadly there's no wa
Re: (Score:2, Insightful)
Re:How do I tell...? (Score:4, Informative)
If you think you're immune just because you're running Linux, then you're part of the problem.
You're just as bad as someone with an unpatched HP-branded WinXP system fresh from Office Depot.
Parent
Re: (Score:3, Informative)
format c:
THAT is what people should type if you really want them to get hit.
Why don't the ISPs do something? (Score:5, Interesting)
Re: (Score:2)
Block outgoing TCP port 25 at ISP border routers! (Score:2, Insightful)
Of course, the botnets would then be rewritten to try to discover the mail server the PC normally uses and try to use it instead. But is ISPs enforced SMTP authentication to send, it would make it more difficult. Even if the botnets got past all that, it would now be easier to track down exactly who has the infected computer.
Of cours
Re:Block outgoing TCP port 25 at ISP border router (Score:4, Informative)
I have a legitimate right to send SMTP from my machine - and I do so. I also run an SMTP server at home - have since 1993, when I got off of uucp.
I have never been an open relay, and access is passwd. I already have assholes at AT&T blacklisting me for no reason - and suffering their ridiculous petition process to get off their RBL.
This is the Internet. A collection of networks. ISPs are not cops, nor should they be. When you mandate this on common carriers, they become something else - and any slim protections we still have remaining will be long gone.
Parent
Re: (Score:3, Interesting)
You can't even sensibly put something like that into law. How? What do you have to do to secure your machine? How are you supposed to be responsible for it? What's to be considered "justifiable expense" when it comes to security (i.e. what do you require from a user)? Do you wa
My wife's notebook is one of them (Score:5, Interesting)
Re: (Score:2)
Re:My wife's notebook is one of them (Score:4, Funny)
Parent
Repair is not an option (Score:5, Insightful)
Once you know the PC is compromised you cannot get it back to a known good state. The best you can hope for with the various utilities is to get it workable enough to offload your data, build your recovery media and record your settings. You're actually better off removing the hdd to an external enclosure and installing fresh on a new one. You could then scan the removable device before carefully recovering the data from it. The worst possible thing you could do is eliminate the visible problems and pretend that means you have a good PC on which to do work.
What is pwned cannot be unpwned. Reinstall. Somewhere in my journal may be some helpful instructions for getting the reinstall done without becoming compromised in the process. You're not the first (or the ten thosandth) person here this has happened to.
Somebody else here will have suggested you try Linux by now, or Apple. There are no Linux or Apple botnets so they don't have this problem. The do have security vulnerabilities too, but compromising one of them is a retail, rather than a wholesale, endeavor and so less fruitful for the botmasters.
Parent
Hmmm.... (Score:5, Funny)
Be that as it may, "Kraken" is a superb name (as is "Damballa" itself.). "Bobic", "Oderoor" and "Bobax" sound like open-source CMSs. "Cotmonger" sounds like a word Bart Simpson would use when suddenly breaking into a unfunny Cockney accent for no reason.
I had a botnet once (Score:5, Funny)
This is a job for goons (Score:5, Insightful)
The industry is going at this all wrong. There are only a few players left, and they're all crooks. We need a consortium of companies with spam problems to hire Kroll [kroll.com], Blackwater [blackwaterusa.com], or one of the other big international security companies to deal with the people behind the problem.
If 5% of the money spent on dealing with spam went into finding the people behind it and making them go away, the problem would go away.
Re: (Score:3, Interesting)
Re: (Score:2)
Seriously though, if you manage to stop these top spammers, then before you say, "Good riddance," new players will take up their space. If there's opportunity in this space, people will keep coming. There's no way you can get rid of spammers by stopping a handful of people
Simple answer... (Score:3, Informative)
Why? (Score:3, Interesting)
Why does spam work? Who are these stupid people and why do they click? Also, if you get 80 spam a day for the same fake product, why would pick one at random and say, "der, I think I'll go buy this!"
Can someone please tell me why?
I wish some news reporter would send out a billion spam but then, instead of taking money from the people who click, contact them and do an interview. I want to know who these people are and what the hell they are thinking.
Re:Why? (Score:5, Insightful)
So of that 1,000,000 spam you sent, only 100 had to be actually bought for you to turn a big buck. (1-100th of 1%)
Do the math, that's why it works. Spam works due to cheap volume. Anything works if you can have cheap volume.
Parent
Most users run as root and open all attachments (Score:3, Insightful)
1) Run as root, administrator, or some other super-trusted user account and completely disregard security
2) Open anything they receive in email. I've even had some users do a Save-As giving the file the correct extension to be runnable!
These are a result of fundamental flaws in the design of Windows, Unix, et al. Most operating systems assume that all programs should have the ability to do whatever the user can do. In other words, programs are as trusted as the user account they run under.
Given people's experiences with OS X's admin dialogs or Vista's UAC, I'm not sure changing this assumption will lead to more security either. Most users, when presented with a dialog box, will immediately press whatever button is required to dismiss the dialog without reading it.
Even if the default is cancel, the first time they hit "naked ladies.jpg.exe", get a warning, and dismiss it they'll just figure they did something wrong and open it again, choosing the other option this time.
I'm not sure what the solution is.
Botnets-spam (Score:3, Interesting)
Interesting approach to spam. (Score:3, Interesting)
A friend of mine is investigating an interesting approach to spam.
From this article it quite clear that chasing the source of the spam is quite pointless.
His research is into tracking the destination.
Spams only make sense if they can make some money from it. This means the payload(content) must lead
someplace with a URL to order, a URL with adds, or a phone number for orders.
His blog is at:
http://spamdirect.blogspot.com/ [blogspot.com]
I have to push him to post some of the more interesting stuff he has discussed in E-Mails with me.
One very odd note.
My domain unmailable.com get's no spam!
without any filters and addresses even posted publicly there is just no spam to it.
I think they must remove any mail reference to unmailable assuming it must not be a real domain.
Re:Take away their licenses (Score:5, Insightful)
If Windows weren't so dominant an OS then botnets would operate on other systems as well (or in its place). It's a question of ROI, nothing else.
That said, it's also not a question of an "offending operating system." It's a question of uninformed (or incompetent, or both) users. If they can't be trusted to not double-click on an xxxxx.jpg.exe file in an email, they are likely to have problems with identity theft and other non-Windows-exclusive security issues. Rather than taking away Windows, these users need to receive training in basic computer security.
Using Windows is NOT a privilege, by the way. If the user paid for it, they have a right to use it.
Cutting off internet and then asking for demonstration that... they've bought a Mac? Will this be demonstrated using ninja magic? A photo via mail?
I can't tell whether you're a Windows elitist, a Mac fanboy, or just plain mental.
Parent
Re:Take away their licenses (Score:5, Insightful)
Yes, they'll have other security-related problems, so I won't dispute that users are a huge part of the problem. BUT: Windows really is a special case. Give a clueless user another OS, and they will run malware or otherwise join botnets far less often, and not because of ROI or what platforms that malware authors choose to target. Outside of Windows, most naive users do not know how to even deliberately execute an email attachment. They wouldn't just have to click on xxxx.jpg.exe; they'd have to save it and chmod +x it first, since (AFAIK) no email clients go to extra trouble to help users execute malware.
Windows and its applications have an unusual amount of "support" for running malware. (Executable-by-default is just one feature; there's also autorun, ActiveX, and fuck-knows-what-else.) These are technical (not marketshare-related) "features" of the platform, which most other OS creators have not elected to implement. Windows would be attractive to malware authors even if it had a small marketshare, because the platform is malware-friendly.
Parent
Re: (Score:3, Funny)
Re:Take away their licenses (Score:4, Insightful)
Parent
Re: (Score:3, Interesting)
My home ISP just started outbound blocking traffic from DSL customers to port 25 a few days ago, which has stirred up some controversy [lowyat.net]. Maybe I'm just imagining things, but I believe my connection has been faster since then. We're always suffering from bandwidth problems (the downside of being on the end of a very long cable across the Pacific) so anything that eliminates our share of 100
Re: (Score:2)
You really want ISPs making these decisions? Perhaps you are suggesting some new governmental agency decides when and where to summarily terminate someone's connection?
Freedom should not be sacrificed so trivially.
Re:Just a thought... (Score:4, Interesting)
Parent