![Spam Spam](http://a.fsdn.com/sd/topics/spam_64.png)
![IT IT](http://a.fsdn.com/sd/topics/it_64.png)
Europe Home to Majority of Zombies 357
Rei writes "According to a recent CipherTrust study, the majority of Zombie PCs reside not in the US or China, but in Europe. Of the European zombies, 2/3 were either in Germany, France, or Britain. The results were released with the announcement of CipherTrust's new ZombieMeter. As a response to previous reports of high zombie activity, the London Action Plan launched Operation Spam Zombies in cooperation with numerous governments around the world."
This might give us a hint ... (Score:5, Funny)
Re:This might give us a hint ... (Score:2, Informative)
That's easy. (Score:2, Funny)
Re:Witches... in England! (Score:3, Funny)
Re:Witches... in England! (Score:2, Funny)
I got better...
This is so obvious. (Score:5, Funny)
Re:This is so obvious. (Score:2, Funny)
Never have I been happier to learn that they were talking about evil spam spewing Windows machines
Re:This is so obvious. (Score:2, Insightful)
Yes, and Shaun of the Dead last year made it even more clear.
Re:This is so obvious. (Score:3, Funny)
I wonder where all the zombie NPCs live?
Re:This is so obvious. (Score:2)
Unbelievable (Score:5, Interesting)
Re:Unbelievable (Score:2)
Re:Unbelievable (Score:2)
(If not by hackers then by the government
Re:"Where" is unimportant (Score:2)
All true zombies are as seen in the "of the Dead" series. Although some current theories show that these zombies are in fact caused by the Solanum virus, conclusive evidence still remains to be seen.
It should be noted that, regardless of your situation, you should not attempt to fight a zombie unless absolutely necessary. Remember, should a zombie outbreak occur near your place of residence you should immediat
Re:"Where" is unimportant (Score:2)
I know you're joking but real zombies are alive. Just ask Clairvius Narcisse [wikipedia.org] - poor guy!
Velcome to Shproket (Score:4, Funny)
Solution... (Score:5, Funny)
Ed: Any zombies out there?
Shaun: Don't say that!
Ed: What?
Shaun: The "zed" word. Don't say it!
Ed: Well... are they any?
Shaun: I don't see any. Maybe it's not as bad as all that.
Shaun: Oh, no wait, there they are.
Re:Solution... (Score:2)
Shaun: Don't say that!
Ed: What?
Shaun: The "zed" word. Don't say it!
Zed's dead, baby. Zed's dead.
Re:Solution... (Score:2)
Re:Solution... (Score:2)
Awesome movie.
"Hey, any of you cunts want a drink?"
rock
Re:Solution... (Score:2)
Re:Solution... (Score:2)
Talk about any excuse to get British film onto the big screen...
Re:Solution... (Score:2)
Re:Solution... (Score:2, Funny)
Thank God (Score:5, Informative)
That isn't what the Zombie Meter says... (Score:5, Informative)
Comment removed (Score:4, Funny)
Re:That isn't what the Zombie Meter says... (Score:2, Insightful)
I thought that the cause of all those zombies rather was a stupid OS from some Redmond company...
Re:That isn't what the Zombie Meter says... (Score:2)
Well, if it is, dont blame me - I posed an "Ask slashdot" question asking how to stop my Win PC being a Zombie, and it was not run. I have not seen any other stories on this topic. I know of at least three machines that are using 100% of available ADSL bandwidth, even when the user has no browser open. However, I have no clue what to do. AdAware and SpyBot s&d are unable to clear the machines. They all have the latest patches.
Re:That isn't what the Zombie Meter says... (Score:2)
First a strong router firewall , basicaly block all ports to the windows box that you dont require (so basicaly only ports 80 and perhaps 20/21 if your require FTP etc) couple this with a software firewall so any outgoing traffic does not leave the computer.
Switch off all unrequired services in windows , there are plenty of guides to this onlinehttp://www.theeldergeek.com/services_guide. h tm [theeldergeek.com] thats one for example which should help stem alot of problems.
and thirdly a good colection
The Remedy (Score:3, Funny)
Time for new SMTP error messages (Score:5, Funny)
Re:Time for new SMTP error messages (Score:2)
Surely that would be:
Recipient address rejected: cleric attempts to turn zombie
Re:Time for new SMTP error messages (Score:2)
550 : Recipient address revoked; cleric commands undead.
LE BRAINS! (Score:2)
I'm surprised there isn't a RBL for zonbies yet (Score:5, Insightful)
I worked at Netcom when we ended up on the RBL. We did not have strong Spam protection; for example, our credit card verifier did not contact the credit card company before giving someone internet access. Even after being placed on the RBL, management was unwilling to expend the resources needed to stop our Spam problem; they thought the RBL would just go away. Meanwhile, the number of people calling or emailing technical support doubled because they could not send mail increased (I helped make some graphs showing the increase in emails to tech support to convince management that this was a real problem). It took months for management to wake up, smell the coffee, and make it harder for spammers to get throw-away accounts on Netcom's network.
(For NANOG regulars at the time: It was I who wrote the "Keman-bot")
A similiar list needs to be set up; if a given ISP has zombies and does not cut off said zombies from the internet, the ISP needs to be blacklisted RBL style. Maybe then management will do something about the zonbie problem--such as cutting of zombie machines from the internet (redirecting all HTTP queries to a "You're a zombie so we cut you off page" for example).
Re:I'm surprised there isn't a RBL for zonbies yet (Score:3, Informative)
- Network usage is the easiest to monitor since it's little more than a script pointing out that a host is attacking other machines over port 445 or connected to port 6667. Just being on IRC or sharing your printer won't set off the scripts since they not only monitor raw traffic but also watch how quickly new connections are being made and
Re:I'm surprised there isn't a RBL for zonbies yet (Score:2)
If its possible for script kiddies to crash CAT scanners by doing port scans from your ISP then:-
1. The person who connected the CAT scanner to the Internet (or any untrusted network) should be sacked.
2.
Re:I'm surprised there isn't a RBL for zonbies yet (Score:2)
It depends on how the TCP/IP stack was implemented
Just about all embedded systems use a BSD derived TCP/IP stack.
And for efficiency some network hardware drivers simply have function pointer arrays indexed by a 'type' fields with no bounds checking. So a packet with a data length one more bytes shorter than the size expec
Re:I'm surprised there isn't a RBL for zonbies yet (Score:2)
The CBL (included in the sblpxbl.spamhaus.org list) lists a lot of viruses/zombies, but it is designed to be corporate safe and not hurt the ISPs themselves.
SPEWS, OTOH, is designed to inflict maximum pain,
How about the spamhaus XBL? (Score:2)
Re:I'm surprised there isn't a RBL for zonbies yet (Score:3, Informative)
There is [spamhaus.org].
duh (Score:5, Interesting)
I was working on the mail server today, and going through logs tracking a clamav/amavis problem.
I started to notice that...one...after...another...the buggers were connecting. We're not even a very big site (just got a bunch of mailing lists). The DNS names were xxx-yyy-zzz-aaa.(something).(insert european country code).
They outnumbered legitimate connections easily 5:1 or more, and the sessions all consisted of:
client: "HELO, I'm in your domain! Here, have some email"
Postfix: "take a flying leap."
client: "HELO, I'm in your domain! Here, have some email"
Postfix: "take a flying leap."
client: "HELO, I'm in your domain! Here, have some email"
Postfix: "take a flying leap."
Every single one would try and send between 3 and 5 messages before finally realizing it wasn't going to work, and disconnecting. It's irritating, because we do actually run a couple of DNS blacklists, but it seems a lot of european systems aren't on them.
When are we going to stop taking the "oh, we'll just filter it" attitude? Feels like all we've accomplished in half a decade is to do spammer's work for them and make users complacent by hiding all this shit from them. It's a classic white elephant problem if I ever saw it...
Re:duh (Score:5, Insightful)
As a safety measure, the IP address has to be reported by X number or percent of the participating Postfix hosts to be considered valid.
Any IP address is added for a short period of time, say 72 hours, so if it's a machine that is hacked and quickly fixed the IP isn't blacklisted forever.
It seems like a distributed, real-time system like this would be effective.
Re:duh (Score:2)
I think that the problem is better solved closer to the zombie, by their ISP cutting them off, and reserve the global solutions targeted at those ISPs who don't appear to be making an effort.
Re:duh (Score:2)
That alone would eliminate 90% of SPAM out there, and place the responsibility squarely on the shoulders of the ISP's to lock down their mail servers and cut off offending accounts.
Re:duh (Score:2)
Frankly, I don't like the idea of having my mail sitting on an ISP's box, pgp or not. I realize that anyone with half a brain and an ounce of adaptability can still intercept, but it makes it just that smidgeon more difficult. Cutting off TCP/25
Re:duh (Score:2)
Re:duh (Score:5, Interesting)
Re:duh (Score:3, Interesting)
Europe Home to Majority of Zombies (Score:2, Funny)
Which explains the smell.
Pfft, old news (Score:5, Funny)
Take some responsibility (Score:4, Interesting)
So too, if you own a computer and want to be part of a community of connected computers, not bothering to inform yourself of how to do that does not excuse your responsibility for whatever damage your computer causes.
So what we do to spam zombies is:
a) block them totally and stop them from causing any more damage
b) send them an email telling them how much it cost to clean up their mess (usualy around $500), and that we will bill them if they do it again
c) only unblock them when they give us their assurance they understand what the future costs may be an will never allow it to happen again
d) permanently disconnect them and bill them the full amount of sysadmin and helpdesk time and materials of they allow it to happen again.
It's a really tough line, sure, we have lost maybe 3 customers as a result in 18 months (average spend per customer is $34 per month), out of 20,000. But it is far, far cheaper that the cost of just letting it happen unchecked.
Re:Take some responsibility (Score:2)
Question: if you've totally blocked thier acces - how do they get the email telling them to clean up their act?
Re:Take some responsibility (Score:4, Interesting)
Truth is that most of us trained full-time IT professionals don't completely know how to keep our systems clean, so you can't expect a user to do so.
It's more like a car causing an accident because somebody sabotaged the breaks. Not every driver is supposed to understand how their car works internally, let alone continuously check every technical detail of it, yet this is what you expect of average computer users.
It's like a war between highly funded, heavily armed, well trained green-berets and ordinary civilians; you think it's a fair fight?
Re:Take some responsibility (Score:2)
Re:Take some responsibility (Score:3, Interesting)
the 6th sense (Score:5, Funny)
Crowe: In your dreams?
Cole shakes his head
Crowe: While you're awake?
Cole nods
Crowe: Dead people like in graves and coffins?
Cole:
Crowe: How often do you see them?
Cole: everytime I go to Europe, (pause) they're everywhere...
Hooray for the Internet (Score:5, Funny)
well, duh. (Score:2)
zergs (Score:3, Funny)
Re:zergs (Score:2)
No guns in a lot of it. Scottland wants to outlaw swords. Some doctors in England want to outlaw long, pointy chef's knives (no, I'm really not kidding)...
that leaves two options:
The fish-slap dance (a la Monty Python)
OR
Cricket Bats and records =]
Re:zergs (Score:2)
Why should you be kidding? Chef's knives are hardly playthings. They're extremely sharp and can be put into a vital organ and do fatal damage with minimal effort.
Even successfully putting up an arm to defend yourself against an uncoordinated attack could see an artery severed or a couple of fingers lost.
I'm not a medical expert, but at close range I'd give an even chance to surviving an attack from
Re:zergs (Score:2)
Re:zergs (Score:3, Funny)
British hooligans.
Just tell them the zombies are from the 'other' team and the matter is sealed.
Re:zergs (Score:2)
flawed study (Score:3, Interesting)
"Using a tool that can track zombie machines, CipherTrust found that 26 per cent of them were hosted in European countries, with most of them in Germany (six per cent), France (five per cent) and the UK (three per cent)."
so now the article establied that the *most* infected country is Germany, with is 6%. now the immediate next paragraph:
"The company's ZombieMeter found that hackers were hijacking around 172,009 computers every day. Approximately 20 per cent of those machines were based in the United States, and 15 per cent were found in China. CipherTrust did not provide details of where the attackers resided."
and US account for TWENTY percent compare to Germany's SIX percent. Even China's FIFTEEN percent is higher. I don't mind it do a country by country comparation, or even a continent by continent. I wonder what's the overall percentange if you really compare it continent to continent. I wonder what's the overall percentage of Americas, Europe, and Asia is...
but IMHO grouping Europe all together and compare it against nations like US and China is just wrong.
wrong example. (Score:2)
if group A is 30% big and group B 70%, group B is bigger.
if group A is growing at a rate of 50% and B at 10%, A eventually will get bigger.
since your quote doesn't mention growth in the EU you just can't compare them based on growth.
Re:flawed study (Score:2)
And at least in Germany almost(*) every home user gets a dynamic ip adress (usually disconnected after 24 hours),
so it is also very likely that the same zombie machine shows up more than once in that statistic.
(*) I think most ISPs don't offer them or only as part of higher priced business subscriptions.
And I'd wager those few people who go through all the trouble and pay extra for a static address for whatever reason
are probably more knowledgable a
no wonder! (Score:2)
Re:no wonder! (Score:2)
so... (Score:2)
Shocking that
http://www.ciphertrust.com/resources/statistics/i
Event hough the statistics infact disagree with the report..
I think we have some odd reporting here , IT should be that may saw the largest rise in Zombie PCs in Europe .
I for one ... (Score:3, Funny)
Irrelevant (Score:2)
Maybe their next study is going to point out that the majority of torjaned systems run Windows XP?
Don't say the "zed" word! (Score:2)
Well, of course. Just ask Shaun [imdb.com] about them!
Proportions of Zombies (Score:3, Informative)
China has a population of about 1.3 billion. The USA has a population of about 295 million. South Korea has a population of approximately 48 million, less than a fifth that of the US, and under 1/20th that of China, yet it has about half the number of zombies of the US.
Proportionally South Korea is by far the worst offender on the list.
How difficult is it to keep your OS up to date and run virus scanners?
The "May Top 10" chart on CipherTrust's web site of course features the "European Union", yet on the same list we see Germany, France, UK and Spain, all member states of the EU.
not rocket science (Score:5, Interesting)
Assuming the same level of spread of Internet access, the EU should have 1.5 times more zombies than the USA.
The site mentioned in the article shows that in May, EU had 1320985 zombies and the USA had 964020. That means the EU has 1.37 times the zombies of the USA, despite having 1.5 times more people.
In 2004, Internet usage rates were at 47% in EU and 52% in the USA.
Conclusion: the zombie rates don't vary between USA and Europe. Population, on the other hand, does vary. Therefore, you can expect the EU to continue to have more zombies than the USA. Also, as China's and India's internet usage grows, they will probably pull ahead in the stats.
Disclaimer: The numbers were pulled from various sites online using Google for searching. If someone has conflicting figures one way or the other, I wouldn't be surprised.
I have the the knowledge of protection (Score:2)
http://www.amazon.com/exec/obidos/tg/detail/-/140
Stupid ... Europe is not a country (Score:3, Interesting)
U.S. - 20%
Germany - 6%
France - 5%
U.K. - 3%
Only by lumping everyone together as "Europe" are they able to claim that the majority of zombies are not located in the U.S. Even though I live in the U.S., I find this article totally stupid.
Re:Stupid ... Europe is not a country (Score:2)
Re:Stupid ... Europe is not a country (Score:2)
Well, the EU does. [eu.int] (note: link is a PDF)
There's many more instances on the EU's statistical website. It seems they REALLY like grouping all their data together so they can be viewed as an industrial competitor to the US and Japan.
Lies, damn lies and statistics. (Score:2)
Re:Should we block the zombies? (Score:2)
Re:Should we block the zombies? (Score:2)
Please do not photograph the Zombies.... It will only make them angry.
Re:isn't surprising (Score:2, Insightful)
Re:isn't surprising (Score:2)
you're either very retarded or a very subtle troll. the "EU hating MS" non sequitur and the AC posting leads me to believe you're a troll.
nice try though. you even bagged a few mods on crack.
Re:isn't surprising (Score:2, Informative)
That being sa
Re:Why is this so? (Score:5, Insightful)
Re:Why is this so? (Score:2)
the big email providers like hotmail and yahoo already scan for viruses (gmail doesnt scan for viruses AFAIK, it just throws away anything potentially executable)
That alone would stop most sources of infection for the newbie (unless its been compromised by a hacker, its unlikely that any respectable website is going to be
Re:Why is this so? (Score:2)
Many new viruses are not recognized by virus scanners and get passed over by them. A lot of spreading can be done in the many hours between when a virus is reported, a definition for it created, and the email virus scanners machines updating with the new definition list.
Do not open files that are sent to you by emai
Re:Why is this so? (Score:2)
Re:Zombies...? (Score:4, Funny)
Re:anything named "operation" anything is propagan (Score:2)
anything named "operation" anything is propaganda
Yeah, cos Operation Overlord [wikipedia.org] really sucked didnt it!
You left out someone... (Score:2)
As nations crack down on the free exchange of information of all sorts you can expect this type of activity to rise. It's called "creating plausible deniability." Not everyone knows the details of how the internet works, but everyone knows if you have sub7 on your machine and you're caught doing things your government might frown on, you've at least got a chance o
Re:If Europeans are Zombies (Score:2)
Re:Old news... (Score:2)
What European Union? It's falling apart as we speak.
Re:action (Score:2)
Re:National pride confused? (Score:2)
Re:That's Surprisnig... (Score:2)
Re:Understand now? (Score:3, Funny)