Slashdot Log In
New Mega-Botnet Discovered
Posted by
samzenpus
on Wed Apr 22, 2009 06:48 PM
from the we're-gonna-need-a-bigger-internet dept.
from the we're-gonna-need-a-bigger-internet dept.
yahoi writes "According to the DarkReading article, 'Researchers have discovered a major botnet operating out of the Ukraine that has infected 1.9 million machines, including large corporate and government PCs mainly in the US. The botnet, which appears to be larger than the infamous Storm botnet was in its heyday, has infected machines from some 77 government-owned domains — 51 of which are in the US government. Researchers from Finjan who found the botnet say it's controlled by six individuals, and includes machines in major banks.'"
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Can Help? (Score:5, Funny)
Maybe this isn't such a bad thing after all.
Re: (Score:3, Interesting)
Maybe this isn't such a bad thing after all.
Maybe it'll finally open the government's eyes to protecting their networks. They are generally in really bad shape. There are some exceptional sysadmins out there, but they are often hogtied by anti-security regulations and expectations.
Re: (Score:3, Insightful)
It won't open eyes. It will encourage laws like the DMCA to sweep the problems under the rug. Security through obscurity doesn't work in the long haul, but in the short run, it is great.
I can see Draconian laws being passed banning ownership of "hacking tools" (debuggers come to mind) that might catch some clueless script kiddie from some junior high school, whom is promptly made an example with, having adult felony Federal charges pressed. However, the people in Elbonia will still be running their botne
Re:Can Help? (Score:5, Interesting)
Maybe it'll finally open the government's eyes to protecting their networks.
Oh, they realize it. There is a big push to have a standard [nist.gov] secure desktop to all of the Fed's computer. The standard is good. It does everything that you'd expect for a secure desktop. Restriction of services, and admin accounts, and blocking Active X controls. Lock down the ability to connect to Windows share willy-nilly. Make sure that all the patches to software are installed in a timely fashion. (IE: Conflicker should not be infecting Federal machines, if they were following these guidelines, they would have had the patch deployed in 10 days) And the best part is (in theory anyway, I have yet to see it actually happen) that if a software vendor wants to be on GSA, they need to certify that their application can run without admin rights. And if they don't they need to document exactly why.
The problem? It was supposed to be implemented February of 20088. And outside of a few big pilot programs, nobody has the thing 100% implemented yet.
Part of the problem is that if you implement everything, you're practically guaranteed to not be able to work in your environment, so one must find and document the exceptions. If you have a crappy network/desktop practices to begin with, you'll be screwed in your deployment. Our practices were good to begin with, scoring 80% compliance, and it didn't take much to get to 90%, but that last 3% to be in the green is proving to be a killer.
There are some exceptional sysadmins out there, but they are often hogtied by anti-security regulations and expectations.
The regulations generally aren't the problem (Though just last month it was announced that Entrust encrypted email is no longer acceptable to send PII through. You have to use an encrypted USB thumbdrive. And not just any drive, A Kanagaroo drive. No BlackBox Data Travellers, no IronKeys, just these colorful Kanagroo drives, so sometimes the regs don't make sense), it's the expectations. I'm always told that "The company (I work for a subcontractor to the feds) will do everything that they can to make sure that we meet Cyber's needs". Which is great until somebody with enough political clout is inconvenienced. Fortionatly, this is becoming more and more rare, as the Feds have been backing our decisions.
Support from software vendors also suck: "It works for us, why don't you give them admin rights, that'll fix it?" Uh, not just no, HELL NO
Parent
Re:Can Help? (Score:5, Insightful)
How so? Network security in this context doesn't mean setting up a firewall and calling it a day, it means layered security of the entire network, including all the devices attached to it.
In the case of a trojan payload, properly patched machines along with restricted user accounts help quite a bit.
Parent
Re: (Score:3, Insightful)
> In the case of a trojan payload, properly patched machines
> along with restricted user accounts help quite a bit.
So why does the XP installer first create an Administrator account and then prompts you to create a "user" account, which ALSO has (to have) administrative access??
There's a few million infections right there...
Re:Can Help? (Score:5, Insightful)
> In the case of a trojan payload, properly patched machines > along with restricted user accounts help quite a bit.
So why does the XP installer first create an Administrator account and then prompts you to create a "user" account, which ALSO has (to have) administrative access??
There's a few million infections right there...
We're not talking about home users, we're talking about sys admins who should know better than to allow this when they configure users in their domains; and when they mass-prepare their workstation images.
Parent
Re:Can Help? (Score:4, Insightful)
Required for what exactly? There are probably government computers that legitimately need access to the internets.
Parent
Re:Can Help? (Score:5, Informative)
Why would a competent sysadmin even design a network hooked to the general internet to begin with if security is an absolute must?
... maybe because of Internet banking? Risk, cost or convenience, pick two.
Parent
Re:DingDingDing! (Score:5, Informative)
The data was not lost from military systems, it was obtained by crackers who penetrated military contractor's commercial systems. Yes, that leads to a whole bunch of questions and is not by any means an absolution of the military's IT security. But your statement does not match the facts.
Parent
Re:DingDingDing! (Score:5, Informative)
Parent
Re:Can Help? (Score:5, Insightful)
Parent
Re:Can Help? (Score:5, Insightful)
Cue the response of the typical /. user:
Too bad you forgot to turn off images and just got pwned by the 0 day buffer overflow the hackers discovered in libjpeg.
Parent
Re:Can Help? (Score:5, Funny)
Lynx to the rescue! Lynx should be the only browser allowed on secure networks. Hehe.
Parent
Re:Can Help? (Score:5, Funny)
Lynx to the rescue! Lynx should be the only browser allowed on secure networks. Hehe.
Too bad you just got owned by the buffer overflow the hackers found in the VT100 emulator library.
Parent
Re:Can Help? (Score:5, Funny)
Wow! I'm glad I have Windows!
Parent
Re:Can Help? (Score:5, Insightful)
Parent
Re: (Score:3, Informative)
Re:Can Help? (Score:5, Insightful)
Ever notice that 99% of trojan and virus attacks require user intervention?
Social Engineering is the primary attack risk to a computer network once basic protection measures are taken (firewall, AV, and current updates), because users are the primary vulnerability. That's why it is usually worth the trouble to simply give the user bare minimum rights to their machines. It helps limit the damage they can cause.
This is, however, inconvenient, and so is not done universally. There are even reasons not to do it that are sound, though requiring any kind of security generally makes low user rights a necessity.
Parent
Re:Can Help? (Score:4, Informative)
This is true in windows too. Remember Storm? It was created with simple .exe files, not any exploits. I believe they just mass emailed 'greetingcard.exe.' Grandma ran it. Thats all it takes. It blows my mind mail servers are sending out executable to people in this day and age.
A computer is just as secure as its operator.
Parent
Re:Can Help? (Score:5, Interesting)
Let me take you back in time to when most computers were embedded systems. The program ran from ROM (or EEPROM) and could not be changed at all without physically switching out the non-volatile memory - in-system programming was a rarity. Moreover, many processor architectures had entirely separate executable and data spaces - you couldn't actually write to the executable memory, so even if it was flash or battery-backed static RAM, it wouldn't work. Thus no matter how corrupt the data became, it could only crash the software or make it misbehave; to restore operation you'd simply reset the CPU and everything would return to normal!
In contrast, the x86 usually boots the OS into RAM, even shadowing the BIOS into RAM (because it's faster), and it's possible to scribble all over executable code space - the obvious example being to overflow stack space to execute unauthorised code. The NX bit was added relatively recently to ameliorate these problems.
Sparc architecture has been more resilient to attack too, partly because of its relative obscurity, but mainly due to its relative immunity to stack smashing.
Parent
Big PC's!!! (Score:5, Funny)
large corporate and government PCs
So small ones are mostly safe.
Re: (Score:3, Funny)
Duh. Small PCs make small packets, which are far less likely to clog the tubes.
My question is, since when is 1.9 million PCs a megabotnet?
A botnet by definition needs at least four PCs (since otherwise it's a botpoint, botlinesegment, or bottriangle -- you can hardly catch fish with a "net" without cross-segments, which you need at least four nodes to make). So a megabotnet needs (1 million)*4 == 4 million PCs.
Sheesh.
Re: (Score:3, Funny)
Actually it's 4194304
Re:Big PC's!!! (Score:5, Funny)
Wouldn't that be a mebibotnet.
Mebibotnet, Mebibotnet... Now that just rolls off the tongue!
Parent
Re: (Score:3, Funny)
That was a complete tongue-in-cheek post...
Wish I could *whoosh* the moderator(s).
Re:Big PC's!!! (Score:4, Funny)
>My question is, since when is 1.9 million PCs a megabotnet?
Look sonny, in my day, we had to carry our megabotnets uphill both ways, in the snow, and we didn't complain, and the master nodes sent out instructions with punch cards that were sent via carrier pigeon. A million computers was something we doubted any deity could create, but we were wrong. I don't think I have to tell you to get off my lawn. Wait, you're still there? GET OFF MY F*CKING LAWN. Damn kids.
Parent
Need I say more? (Score:5, Interesting)
From the article:
Around 45 percent of the bots are in the U.S., and the machines are Windows XP.
On the other hand:
Nearly 80 percent run Internet Explorer; 15 percent, Firefox; 3 percent, Opera; and 1 percent Safari
What else does one expect? Since it is an infection spread through trojans on legitimate sites and XP the target, what can we expect the browser to do?
In the end, we might see all browsers running completely sandboxed on demand, that is: no interaction with the rest of the system; a 'browse-only' kiosk.
Re:FTP? (Score:5, Interesting)
Then what would people use to download and upload files? Would FTP come back into style?
I already use a program called SandBoxie after seeing it mentioned on /.
You can either allow files to escape the sandbox on a case by case basis or setup default allows wherever you like.
And as a general comment, it's terribly easy to allow files into a sandbox, like when you want to upload something, but not allow any changes out.
P.S. FTP server/client software has terrible security. Even the most popular ones, which have been around for over a decade, still get hit with remote exploits.
Parent
Re: (Score:3, Interesting)
File Transfer Protocol has been around since the early 1970s, and while most servers/clients FTP implementations have a history of exploits, their weakness is due not necessarily because of the exploits but rather because of the way the FTP protocol transfers information. FTP communication includes not only the transfer of files but also the transfer of authentication parameters. All this information is transferred in clear text. Clear text is also the way http transfer information/files. You can think
Re: (Score:3, Interesting)
As you may guess, I am aware of the consequences. Though it seems to make sense in many cases, when everything any anything that one downloads is just for rendering the site.
Would FTP come back into style?
I, actually, hope not. Not FTP. But maybe a new system where users click some 'I want to download this file' button and get the content via an e-mail? Oh, wait, that's only slightly better than FTP.
Still, yes, a separate channel for file transfer outside of that box, not using any http could be safer.
Re:FTP? (Score:4, Insightful)
But maybe a new system where users click some 'I want to download this file' button and get the content via an e-mail?
Right, because uninformed people opening attachments don't cause enough problems already...
Parent
Re:Need I say more? (Score:4, Interesting)
If browsers become completely sandboxed, you might see botnets living in the browser's CPU/filesystem space that are active in the background
Sure. To me that's like in those cyber-cafés where the whole machine is riddled with crapware at the end of the day; when it will be wiped and receive a clean install from an image over the network. When the browser shuts down, all those botnets are gone. Assume, that history and cache are likewise. 'Kiosk', as I wrote.
Assuming sandbox is what it is supposed to be, we would see transient botnets. Which in itself would be a great improvement to the current resident ones.
Parent
Quick! (Score:5, Funny)
Re:Quick! (Score:5, Funny)
Parent
Re:Quick! (Score:5, Funny)
Parent
One of four malware tools to find it... (Score:5, Insightful)
I think it's great that they find this kind of stuff but at the same time I have some misgivings about how they don't do much to point the public in the right direction as far as finding out if they're infected or what they can do to remedy the situation. It seems that a lot of security articles are lean on providing the details about helping yourself to a more secure system.
So where's some real info? (Score:4, Insightful)
Blurred screen shots, off-handed mention of files and sites...
Why not at least release specifics so that we can avoid these sites?(or at least get them to clean up their act)? Why not give us details about the actual filenames and so on?
Or at least give us details on the actual control application and the files it is paid to infect the computers with so that we can avoid them.
Articles like this annoy me because they accomplish nothing constructive.
Parent
no definite article needed (Score:5, Informative)
New Mega-Botnet! (Score:5, Funny)
Now with more Bot to boost your immune system!
Clean up botnets (Score:5, Insightful)
Re: (Score:3, Funny)
> The big papers detailing botnets never provide enough details to know
> if *I* screwed up the internet.
You did and we'll never forgive you! :-)
Re:Clean up botnets (Score:4, Funny)
I am on it, you see I have this great product called Antivirus 2009, don't worry, I have sent out over 2 billion emails detailing its advantages to people.
Also, I have these pills...
Parent
Virus devastates millions of complacent idiots (Score:4, Funny)
A computer worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is posing a growing threat to users blitheringly stupid enough [today.com] to still think Windows is not ridiculously and unfixably insecure by design.
Despite many years' warnings that Microsoft regards security as a marketing problem and has only ever done the absolute minimum it can get away with, millions of users who click on any rubbish they see in the hope of pictures of female tennis stars having wardrobe malfunctions still fail to believe that taking Windows out on the Internet is like standing bent over in the street in downtown Gomorrah, naked, arse greased up and carrying a flashing neon sign saying "COME AND GET IT."
Microsoft cannot believe people have not applied the patch for the problem, just because they keep trying to use Windows Genuine Advantage to break legally-bought systems. "Don't they trust us?" sobbed marketing marketer Steve Ballmer.
Millions of smug Mac users and the four hundred smug Linux users pointed and laughed, having long given up trying to convince their Windows-using friends to see sense. "There's a reason the Unix system on Mac OS X is called Darwin," said appallingly smug Mac user Arty Phagge.
"It can't be stupid if everyone else runs it," said Windows user Joe Beleaguered, who had lost all his email, business files, MP3s and porn again. "Macs cost more than Windows PCs."
"Yes," said Phagge. "Yes, they do."
Ubuntu Linux developer Hiram Nerdboy frantically tried to get our attention about something or other, but we can't say we care.
Wow (Score:4, Insightful)
Only six? (Score:4, Funny)
Researchers from Finjan who found the botnet say it's controlled by six individuals,
We should be able to shut this one down with one clip in a .45.
what of the ISP's (Score:4, Insightful)
What of the ISP's that host these botnets. Many of these botnets are used to spew spam. If they do then this is easily detected and IMHO the ISP uplink in question should simply pull the plug and advise their client that it looks as if their toilet is broken because there sure seems to be a lot of sh*t coming from them.
I know my ISP does this. I know because they have phoned me and I had to advise them its not my OpenBSD servers generating spew, but another of their clients on the subnet. We found it fairly quickly.
I've heard so many excuses. Some involve excuses it would breach service agreements. So lets look at that one. How many end users write service agreement contracts? How many end users even read them? I think the answer here is obvious. Pretty much anything reasonable can be written into the contracts so that sort of excuse doesn't hold much water.
The obvious answer is the ISP's in question actually might make money carrying this spew. They certainly made money when they provided connectivity to known spammers. They also make money when they charge extra for static IP's. Note that a static IP makes it much easier to trace and quarantine a bot.
If we want these problems to go away then one way to address the issue is to look at issues of an accessory either before or after the fact.
Let me provide an example. If someone digs a big hole in the road and someone else drives in and wreaks their car and many kills some people in the process, then the excuse of "I didn't know a car could fall into a hole" or "I didn't think anyone would drive their car down this road at night" or any other excuse that might be dreamed up is not likely going to carry much weight. If someone sees the hole and ignores it using the excuse that "Well, its not my hole", then that excuse also is not likely to hold much weight.
An ISP hosting infected machines should be just as liable as the client who owns it. Many of these botnets reveal themselves. We need to start asking for accountability.
Consider people like Conrad Black. Last I heard he's in jail. That is accountability. Any excuses he and his lawyers might have dreamed up didn't carry much weight.
Here is another example. In the movie called "Nuremburg", Alec Baldwin asks in one scene if "anyone in this country accepts responsibility for anything?". I think this says an awful lot. Only one person seemed to be responsible for the killing of millions.
So in this story we have over 1 million bots discovered and apparently 6 perpetrators and how many are responsible? These bots are identified, now what? I've had more than 50,000 bots attack my servers. Can I call the cops? If I provide IP addresses does anyone pull a plug?
We need to think on this.
Re: (Score:3, Insightful)
Why are you blaming the US government for (a) defects in software they didn't write; and (b) a malicious botnet created and operated by someone else? The only reason the US government is being singled out in this article is because it makes the story more sensational, which means more eyeballs, which means more ad revenue.
Re:is it really this bad? (Score:5, Interesting)
I think it is more widespread. I'll take my local bank as an example. I stop by to make a deposit, I notice the teller minimizing her facebook page as I glanced at the screen.
I am shocked that a bank would allow any www access on a machine that has direct access to accounts. Dollars to donuts there is some form of malware on that machine, or already throughout their network.
It was my belief that competent IT would only allow the necessary Intranet infrastructure to run the banks applications. But I would bet their policies get changed by ignorant management that are sold on 'security' appliances and software to protect themselves while granting www access.
Parent
Re:Security stupidity... (Score:4, Interesting)
Parent