Slashdot Log In
Storm Worm Botnet "Cracked Wide Open"
Journal written by Lars T. (470328) and posted by
timothy
on Sun Jan 11, 2009 03:26 PM
from the after-honeynets-let's-try-bugzappers dept.
from the after-honeynets-let's-try-bugzappers dept.
Heise Security reports that a 'team of researchers from Bonn University and RWTH Aachen University have analysed the notorious Storm Worm botnet, and concluded it certainly isn't as invulnerable as it once seemed. Quite the reverse, for in theory it can be rapidly eliminated using software developed and at least partially disclosed by Georg Wicherski, Tillmann Werner, Felix Leder and Mark Schlösser. However it seems in practice the elimination process would fall foul of the law.'
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
so what? (Score:5, Insightful)
However it seems in practice the elimination process would fall foul of the law.
I'm sure I'm not alone when I say, "So?"
So you are sued and lose your house. (Score:5, Insightful)
That's the problem.
The criminals do not care because they were criminals to begin with. This affects the people who are not criminals but who want to clean up the mess made by the criminals.
Now, if the various governments could/would authorize their law enforcement agencies to use this method ...
Parent
Re:So you are sued and lose your house. (Score:5, Insightful)
"Now, if the various governments could/would authorize their law enforcement agencies to use this method ..."
That is the worst idea I have heard all week.
Parent
Re:So you are sued and lose your house. (Score:5, Funny)
Just require a warrant from some level of federal judge.
Things might not work great at first, but the whole warrant system works pretty well, and it would provide a framework for preventing abuse and overuse.
Parent
Re:So you are sued and lose your house. (Score:5, Interesting)
Yeah, but it's an international problem. A guy from F-secure in Finland has been calling for the formation of an "internetpol" for exactly these reasons. I think he's right because otherwise international net crime will continue unabated, since nobody is in charge of combating it. An international body designed to coordinate .crime policing efforts is sorely needed.
Parent
Re:about 16 years late (Score:4, Insightful)
If more people were using software written by another guy from Finland 16 years ago, there would be no W32 crime wave and we would not need super cracker cops authorized to violate your privacy.
Right, there would be a Linux crime wave instead. Linux doesn't prevent users from running trojans or force them to get their operating system patched.
Parent
Re:So you are sued and lose your house. (Score:5, Insightful)
up until it crosses national borders then yes it does. But if the guy running the show is in a country without extradition then it is useless. Warrants assume everyone is following similar laws and there is an agency that can police all affected areas equally.
however If an American warrant was being served against a French botnet controller, even with a treaty they still would let him stay free if he didn't harm any french computer users.
Governments are like children, no one else can play in their sandbox, or with their toys.
Parent
Re:So you are sued and lose your house. (Score:5, Insightful)
Parent
I would say that it should be. (Score:5, Interesting)
I would say that it should be. Why waste time and effort trying to find crackers who will only be replaced by different crackers in different countries if you do manage to prosecute them?
Remove the zombies in your country and the zombie problem is pretty much solved.
But to accomplish that, you need to be able to automate the process and perform it remotely. There just are not enough resources to handle each computer individually.
Parent
Re:So you are sued and lose your house. (Score:5, Insightful)
No Kidding! The problem with such laws (any laws) in most countries, is that they are open to interpretation. This is why we have courts. Which means, that allowing any government agency the right to access 3rd party computers for any reason sets a very, very dangerous precedent which can be exploited by the more fascist politicians in the world.
We've already seen the UK Governing Regime try to find ways of accessing the public's computers whenever they see fit, and without any court warrant. There is no sane way to allow this kind of exception, without running the risk of opening the door to further Government inspection of your computer, if they decide to exploit precedent.
Be very careful with vigilantism. Especially when a government agency is the vigilante. It WILL be exploited for other reasons.
Parent
Re:So you are sued and lose your house. (Score:5, Interesting)
Yeah, but if you do that then the botnet will be patched against the specific takedown code before it makes it through congressional committee.
What probably should happen is that some major world government (US, EU?) should decide that the botnet is a major headache and a threat to national security. Then the info warfare devision of the military would prepare a suitable script that would only disable the bots (perhaps installing a security patch on the way out to prevent reinfection).
Then they just do it. The operation would be classified and launched in a way that would be extremely difficult to trace.
All the pundits on the internet would cry about how horrible an action it was (though nobody would complain about the 95% reduction in spam). However, everybody would blame their favorite love-to-hate government (China, the US, France, whatever :)), while the folks in on the classified operation in the Netherlands laugh every time they get to work. And if by some miracle somebody actually figures out where it came from (large governments could just inject packets on any random telecom line, and even route them through tor if they want), what is anybody going to do about it? Launch a war on Belgium for ridding the world of spam? Levy economic sanctions for saving every company with an email server millions every year.
Big governments kill people all the time in the interest of public safety and security. What's the worse that could happen - a few million home PCs lock up from a poorly-designed script? That could already happen any day if one of Storm's owners makes a mistake.
I'm not big on government trespass on private property. However, if somebody's row home catches on fire and the owner refuses to let in those responsible for putting out the fire, then the police will simply put them in cuffs and let the firemen axe open the door. They might not do it for a single family home, but they'd not let a block go up in flames because some guy refused to cooperate.
If you want to be really nice about it then just put a public service annocement on TV stating that in the coming month the government is going to wipe out the Storm botnet, and that anybody who doesn't like the idea of having the government clean up their PC should opt out by removing their computer from the botnet in the next seven days...
Parent
Re: (Score:3, Funny)
Just curious. What was the one of the previous week??
Re:So you are sued and lose your house. (Score:4, Insightful)
Following the rules is what makes them the good guys, though.
Parent
Re:so what? (Score:5, Insightful)
Not only is it a problem of breaking the law, but there's the problem of "cleaning gone wrong". What if the cleaning program fouls a hospital's computers? Or fouls up some other important infrastructure. Do you want to be the guy standing next to the enter key in that event?
Obviously, infrastructure should be configured and secured against such problems, but it's pretty clear that that assumption is false and dangerous. Just a few months ago a trio of London hospitals [theregister.co.uk] went down because of an infection. Granted it was mostly the administrative side that went down, but that still costs a crap load. And what if it's not just the administrative side of say a power distribution grid that shits its self because of some unforeseeable problem with the cleaning worm?
I sure wouldn't want to be the guy responsible for that. There's also the threat that the cleaning will go wrong in completely unexpected ways causing even worse network disruption. If this option is pursued, those that have the magic bullet would probably want to get some sort of pledge of amnesty from their governments to protect them from prosecution in the event that they cause damage.
Parent
Re: (Score:3, Insightful)
Just wondering why they don't just post the cleaning executables, and then talk to the local media about their fix for the botnet, and include the URL to the cleaning executable? Invite the public to run it for free. Then convince the media to post their story as a video on their own website (not youtube or anywhere that can be faked).
It won't get everyone, but it'll start. And then users can pass the story around by word of mouth to extend it to others. Hopefully they'll get media in other countries/la
Re:so what? (Score:5, Interesting)
What if the cleaning program fouls a hospital's computers? Or fouls up some other important infrastructure. Do you want to be the guy standing next to the enter key in that event?
It seems to me that a computer participating in a botnet is already a threat to the public. If "cleaning gone wrong" fouls a computer that's already infected, that's really just 'collateral damage'. If it happens to be a hospitals computers, well, I'd say the real problem was the hospital trusting critical infra-structure to software that's insecure. If a hospital is really dumb enough to put infra-structure that could harm someones life on a network connected to the internet, I'd say that's criminal negligence.
I really do think we've hit the point where the people with the vulnerable computers need to start taking SOME of the blame here and stop acting as if they're all just innocent bystanders. There's certainly plenty of blame to go around. (Oh, and the software producers can sure take some of the blame as well).
Parent
Re:so what? (Score:5, Insightful)
Your post is not unlike the difference between, say, a clueless person using inappropiate analogies, and the proof that car analogies hardly ever make any sense.
Seriously, all this crap is blown way out of proportion. Firetrucks. Car-Bombs. My ass...
If they have a tool to eliminate a large botnet then, by all means, do it. Stop crying for attention in the press, just run the damn counter-worm or release the source-code so the scriptkiddies can fragment the worm into insignificance.
If that wipes out the worm: Great!
If that bricks all infected machines: Well, still better than what we had before.
There's no need to worry about collateral damage. Critical, life-supporting systems are not participating in storm. The worst that can happen is that a lot of computer illiterate people will have a "broken PC" over night and will have to ask their "PC guy" to fix it. This is a "risk" that we should be willing to take...
Parent
Re:so what? (Score:5, Insightful)
If it screws up uninfected machines and networks, oh well, umm whoops?
If there are actually critical, life-supporting systems affected, damn, I guess we can't say sorry to the dead, perhaps send a nice e-mail to their grieving families?
There are plenty of scenarios in which the cure is far more catastrophic than the botnet. We should not be reckless or rash in implementing a solution. When taking on something that utilises the worlds stupidity I think we should keep Murphys law foremost in mind.
Parent
Re:so what? (Score:5, Insightful)
Man, how paranoid can you even be. That's FUD and nonsense!
Repeat after me: Any system that could be negatively affected by a counter-worm is already at the mercy of the STORM operators today, right now, in this minute!
If a STORM operator willy-nilly decides to push a broken update to the botnet, or to perform an expensive attack that makes some of the machines break down then your imaginary life-supporting systems will go down right there, today, in 5 minutes, or tomorrow afternoon.
Nonsense.
Oh my, do you honestly believe that the heart-lung machine at your hospital is connected to the internet? Or that your nuclear power plant is running on Windows XP? Let me assure you: They are not. And if someone in the world truly misdesigned a critical system in a way that could be affected by a windows worm then we'd better be grateful for the learning expirience that they'll inevitably get (with or without a counter-worm). Or would you really want them to get away with that? Do you really think it'd be good idea to let them get into the habit of building critical stuff upon "cheap" Microsoft infrastructure?
Even if your nonsensical assumptions were correct: I'd still much prefer to have one powerplant melt down today due to a counter-worm than to have hundreds of powerplants running on vulnerable systems in 30 years because hey, "nothing ever happened".
Parent
Re:Me too (Score:4, Insightful)
Well, the Storm net depends on deniability. Whoever is directing the zombies, they needn't reveal anything about themselves to the botnet, or connect from a particular place The command just needs to find its way into the wild.
Naturally, the cure is going to have to exploit the same dynamic. If we're as careful as the botnet designers were, retribution would be basically impossible.
Parent
Re:Me too (Score:5, Interesting)
I know it's terrible form to reply to one's own post, but let me just come out and suggest it:
A collaborative, and perfectly anonymous or pseudonymous code project.
Wicherski, Werner, Leder and SchlÃsser must be protected from punishment for their fine work for the good of humanity. So, informed by their disclosures, I say an open source counter-worm ought to be developed from scratch. To protect those working on it, the collaboration model would have to be a little bit 4channy.
The downside to anonymity (As our good friend the Obama/Library/Poop guy shows us) is that it means people don't have to act accountably. There would probably be tons of ebil coders, seeing a wide-deployment worm accepting code contributions, trying to sneak their own obfuscated backdoors into the code.
But the upside to a system like this is transparency. There are still plenty of eyes on the code, and plenty of coders to call shenanigans on one another.
Whadda ya say?
Parent
Re:Me too (Score:5, Insightful)
In the mean time, the vulnerability has been revealed to those who run the Storm botnet and I bet they're already working to deploy a patch that'll make it inneffective.
Parent
Law? (Score:5, Funny)
Who cares about laws? I mean, the criminals don't, the government doesn't care, is anyone still clinging to this outdated model of a coexistance standard?
Re:Law? (Score:5, Insightful)
Who cares about laws? I mean, the criminals don't, the government doesn't care, is anyone still clinging to this outdated model of a coexistance standard?
Yes. Governments.
Parent
Re:Law? (Score:5, Interesting)
Vigilantism is the result of when the government cannot protect the citizen from something that it's reasonable to believe they should be protected from. It's usually due to the problem of balance between making things illegal and restricting reasonable fredom.
But in this case it's more toward the issue of the problem not being within the government's charter, or that the government simply does not have the structure (laws, with teeth) required to protect the citizen.
I'm not a fan of vigilantism in general, but there are times when I approve of it. I'd personally love it if someone would infiltrate the botnets and inject a command to brick (but not erase) every computer that's infected, as a measure to protect millions of innocent people.
Imagine the city you live in, where 15% of the cars parked on the curbs have the keys in the ignition. And there's a growing problem in the city of kids going on joy rides and trashing cars and property and even killing people. But the car owners don't want to bother with the problem and don't care unless their car gets trashed, and don't wany anyone telling them what to do with their car. I'd lead the effort to walk the blocks, looking for cars with keys in the ignition, and hiding them somewhere in their car. Don't like it? Quit leaving your keys in the ignition. yes, it may violate a right of yours, but by your extending your liberty it's violating the rights of others to a larger degree.
Parent
Re:Law? (Score:4, Interesting)
Who cares about laws? I mean, the criminals don't, the government doesn't care, is anyone still clinging to this outdated model of a coexistance standard?
Both companies and universities who have security researchers on their staff care about laws and more than that the risk of lawsuits. When the network security company I worked for had the ability to shut down several botnets we consulted with our primary council and decided it was not worth risking the company to lawsuits from people whose zombies could be shut down or lose data. The publicity would have been nice, but there are always people looking to cash in. Instead, we collaborate with law enforcement a few times and gave them the ability to shut them down if they wanted to (at least one government did hut down a botnet we handed them the keys to).
A shorter answer would be, the researchers care about laws because they want to keep their jobs and not go broke or go to prison.
Parent
Partially disclosed? (Score:5, Interesting)
They should just publish their code. Let the individual hackers decide what to do with it...
Re:Partially disclosed? (Score:5, Funny)
Parent
Re:Partially disclosed? (Score:5, Informative)
They should just publish their code.
They did.
The Full Disclosure link contains the source code of their program.
Parent
Re:Partially disclosed? (Score:5, Informative)
Actually, it's base64, but you are basically correct.
The tarball contains the following contents:
Makefile
autorun.c
autorun.h
cmdsrv.c
cmdsrv.h
disinfect.c
disinfect.h
hash.c
hash.h
httpsrv.c
httpsrv.h
install.c
install.h
libz.a
message.c
message.h
nbcache.c
nbcache.h
overnet.c
overnet.h
pini.c
pini.h
queue.c
queue.h
routing.c
routing.h
stormfucker.c
stormfucker.h
zconf.h
zlib.h
The reason why it is "partially disclosed" is because portions of the code have been patched as to make it inoperative. However, all the necessary exposition is there, and by reading the source you can get a pretty good idea of what it is doing.
Parent
Depends ... (Score:4, Insightful)
However it seems in practice the elimination process would fall foul of the law.
Whose law?
Re:Depends ... (Score:4, Interesting)
Using this background knowledge, they were able to develop their own client, which links itself into the peer-to-peer structure of a Storm Worm network in such a way that queries from other drones, looking for new command servers, can be reliably routed to it. That enables it to divert drones to a new server. The second step was to analyse the protocol for passing commands. The researchers were astonished to find that the server doesn't have to authenticate itself to clients, so using their knowledge they were able to direct drones to a simple server. The latter could then issue commands to the test Storm worm drones in the laboratory so that, for example, they downloaded a specific program from a server, perhaps a special cleaning program, and ran it. The students then went on to write such a program.
Seems like the method involves the server communicating with the client - which could be considered "hacking" and thus be problematic.
Especially here in Germany where even possessing nmap is a crime.
Parent
WWBD? (Score:5, Funny)
Re: (Score:3, Funny)
Forget Batman! What would Yagami Light do?
If the fix works. . . (Score:5, Interesting)
Question (Score:4, Insightful)
Some people run some botnet ops from some countries with some loose laws to gain some protection.
Is it not as easy to dismantle a freaking botnet from there?
Just more whack-a-mole (Score:5, Insightful)
If you want to stop the botnet, you need to remove its incentive. The botnet operates not for someones jollies, but because it is profitable to have a botnet. If you remove the profit motive the botnet will self-disassemble over time.
Re:Just more whack-a-mole (Score:5, Insightful)
If you want to stop the botnet, you need to remove its incentive. The botnet operates not for someones jollies, but because it is profitable to have a botnet. If you remove the profit motive the botnet will self-disassemble over time.
And how do you propose we do that? Spam is profitable even when only one in 10,000 people respond to them, so how do you stop something like that? People have been building better and better spam filters for years, and more and more effort has been spent on educating people about the various scams, and yet spam is STILL profitable enough to illegally hack thousands of computers in order to send it out.
Saying all we have to do to stop botnets forever is remove the profit motive is like saying all we have to do to stop drug smuggling or illegal immigration or home burglaries is to stop the profit motive. Sounds simple, but virtually impossible in practice.
Parent
Re:Just more whack-a-mole (Score:5, Insightful)
Spam is profitable even when only one in 10,000 people respond to them
Spam makes for an excellent case study in the problem, more on that in a moment.
People have been building better and better spam filters for years
Filters will never solve the spam problem. I have said that before, and I will continue to say it until people start to realize the reality of the situation.
Build better filters, and spammers will send better spam.
You have to remove the profit motive.
And a fair portion of botnet activity is spam-driven or spam-propagating. So if we work on the spam problem, the botnet problem will diminish.
And there is one angle in particular that is available for stopping spam:
If you look at spam messages, you'll see that the vast majority of them ask you to go to domains that are on the order of days old, and seldom remain up for more than a few weeks. This is because registration of domains is too easy, with too little liability anywhere along the way.
Spamming and spamvertised domains are registered at a bewildering rate 24/7. And most of them are registered with bogus information to boot. We need a few things to hinder this
If the virtual storefronts selling the v!@gr@ are shut down promptly, and proper impediments are put in place to hinder their creation, spam will become less profitable. The owners of the spamvertised domains can only afford to pay the spammers for their services as long as they are still selling products.
Parent
Re:Just more whack-a-mole (Score:4, Insightful)
Could you explain what you mean by removing the profit motive? Though I may be missing something, I think that you might be oversimplifying things here.
I'm not really sure that it's any more realistic to try and make spamming unprofitable than it would be to make any other successful form of marketing unprofitable, let alone one that is almost free.
We could just as easily say that the solution to stopping welfare abuse would be to remove the financial incentive to doing so... but without actually suggesting anything useful to come to that end, it's a pretty useless comment.
Parent
Re:Just more whack-a-mole (Score:5, Funny)
If you want to stop the botnet, you need to remove its incentive. The botnet operates not for someones jollies, but because it is profitable to have a botnet. If you remove the profit motive the botnet will self-disassemble over time.
By Jove, I think you've got it! All we need to do is remove the incentive and crime just fades away! I wonder why nobody's thought of that before.
Parent
Re:Just more whack-a-mole (Score:4, Funny)
Don't be silly. If they read SLashdot, they certainly aren't going to have RTFA, so how are they going to know what the vulnerabilities actually *are*?
Parent
Re:Pfft... (Score:5, Funny)
The guys found the "cure" of Storm Worm are university students. They did the research using the university's facilities. They have to follow the university's regulations and everything they do is pretty open to the public. Should they just triggered the switch and take over, the university may find itself in legal trouble.
Unless one of them happens to be Batman.
Parent
Re:Pfft... (Score:5, Funny)
Parent
Re: (Score:3, Insightful)
While OS X, Linux and others are inherently more secure than an unpatched Windows, the user is still the weakest part of the whole setup.
Wait until we get enough dumb users who install all sorts of shit onto their computers. Granted, the numbers will be much lower than machines which can get infected without any interaction by its owner, but we WILL get users dumb enough to type their password to install "stupid program XYZ" from unknown sources.
Re:I am glad I use a Mac (Score:5, Insightful)
While OS X, Linux and others are inherently more secure than an unpatched Windows, the user is still the weakest part of the whole setup.
I disagree. Users are a weak link, but currently not the weakest and there is a lot that can be done before modifying users becomes practical.
Wait until we get enough dumb users who install all sorts of shit onto their computers. Granted, the numbers will be much lower than machines which can get infected without any interaction by its owner, but we WILL get users dumb enough to type their password to install "stupid program XYZ" from unknown sources.
Most users have the expectation that installing a program is not the same thing as giving someone else complete control of their computer and the ability to send as many e-mail messages in the background as they desire. This expectation is not met. Most users who install software use many different mechanisms for such installation, some of which do require users to type in their password. Because of this, why would users not type in their password when installing a program?
My basic point is just that we need to fix operating systems and make them relatively secure, consistent, and understandable to users as well as make sure they don't reward unsafe behavior. People interested in making computers and the internet more secure have plenty of room to make improvements. The problem is, they don't have the motivation. The solution is effective enforcement of antitrust laws. Return competition and capitalism to the market and the problem will solve itself in short order.
Parent
Re: (Score:3, Informative)
Re: (Score:3, Informative)
base64 decoding gives a bzipped tarball, decompress with your favorite utility.
HOWEVER, it it obviously windows-specific, uses the win32 API to install itself and - I think - replicate the storm code in-place.
Re:Screw the law. (Score:4, Interesting)
You don't want to go there. The law is the one that says someone installing software on your computer without your permission is illegal. In your zeal to stop the Storm botnet, do you want to make it legal for the Storm botnet runners to break into your computer and install their software? That's what you'll be doing.
Parent
Re:Screw the law. (Score:5, Insightful)
Because we don't need to. The botnet software is readily detectable. Simple solution: require ISPs to warn users if their machines are found to be infected and, if no action is taken (ie. not cleaned up and the user doesn't contact the ISP to discuss it) in a reasonable timeframe, suspend their network access.
If you're driving with a car that's spraying oil all over the road, dropping pieces off and generally posing a hazard to other drivers, the police will cheerfully ticket you and impound the car. They don't try to fix the car, they take it off the road and leave what to do next up to the owner. I fail to see why a similar approach can't be applied (other than "But then they won't be able to use the Internet!", to which I reply "Well, yes, that's kind of the point.").
Parent