Anti-Scammers Become Storm Botnet Victims 207
capnkr writes "It looks like the efforts of the anti-scammers at sites like 419eater, Scamwarners, Artists Against 419, and possibly others have become the target of the Storm botnet.
Spamnation has a post about it, and as of this writing none of the above listed sites are responding. Spamnation reports that CastleCops and other anti-spam forums are being DDoSed as well. Sounds like a massive, concerted effort against the folks who are fighting the good fight.
Although I hate it for the owners and admins of the above sites, I think it shows without a doubt that their efforts to 'get back' at the scammers are working."
Slashdotted (Score:5, Insightful)
Re:Slashdotted (Score:4, Insightful)
More than just DDoS (Score:5, Informative)
Re:More than just DDoS (Score:5, Informative)
Re:More than just DDoS (Score:4, Insightful)
How long do you wait ?
I suppose you can try to identify the specific worm that's doing the attack and infect a test machine and watch it. Or if you can reverse engineer it you might be able to find out when the end date is. Beyond that you've effectively taken your entire web site / business offline for an undetermined period of time. I'm not sure it's any better than riding out the attack. The attack could stop and you wouldn't even know it.
Plus, the minute you unplug your network cable or change your DNS records to a machine that doesn't host your web site you've just handed yourself to the attackers. Taking your business offline is *exactly* what they intended to do. And you did it for them.
Re: (Score:2)
I would surely instruct my botnet to attack IP numbers instead of names (it is faster).
Re: (Score:2, Interesting)
Re: (Score:3, Insightful)
Re: (Score:2, Funny)
Re: (Score:2)
Re:Russians (Score:5, Insightful)
Probably because claims to the effect of "all blank are filthy scammers and spammers" are generally considered to be flamebait? Add to that the whole notion of "our cyberspace" and a completely unrealistic proposal (just how do you prevent an entire country from connecting to the internet, anyway?). Yeah, it's flamebait.
Re: (Score:2)
http://it.slashdot.org/comments.pl?sid=291833&cid
127.0.0.1'd (Score:2, Informative)
Re: (Score:2)
*l* at this point, it's not going to hurt either.
Have the bots scared everyone? (Score:2)
Re: (Score:2)
craigslist scammers (Score:4, Funny)
http://digitalsushi.com/goraku/fakecheck/story.ht
Getting him to mail a check made out to "Pownd Uholot" was entertaining.
Re:craigslist scammers (Score:4, Interesting)
Re: (Score:2)
Comment removed (Score:4, Interesting)
Re: (Score:2, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
Re:Grey Hat solution (Score:4, Interesting)
50M dead HDDs would be fun in the oldschool spirit and at the same time would generate enough of fuss for people to start actually caring about security.
Re:Grey Hat solution (Score:5, Funny)
Re:Grey Hat solution (Score:4, Funny)
Ah, a plan with no drawbacks... :-)
Re: (Score:2)
Battle of the Worms.... (Score:5, Informative)
The big crux is that the "worm" needs to show negative behaviour, i.e. exploit it's host bandwith and CPU cycles, at least for a while, to gain sufficient impact to "infect & patch" vulnerable machines. It would turn into a battle of the worms, where "grey" worms attempt to infect as many machines as possible, plug the security holes, seek new machines to "infect and patch" and then, after a while, self-delete themselves - while the "black" worms, attempt almost the same, only that they do not self-delete but instead continue to exploit their host. Most machines that become victims of rootkits or worms are actually patched up once infected, to avoid losing the machine to competing malware.
Re:Grey Hat solution (Score:5, Informative)
Re: (Score:3, Interesting)
Re: (Score:2, Interesting)
A properly designed counter-worm would not actively seek out targets. Instead, it would patch the system and wait for an infected system to contact it, where it would then spread to that infected system.
This design of counter-worm is ineffective against worms that also patch the system against the vulnerability in question. While I don't know any names, such a design isn't far fetched.
The only way to counter such a worm is to perform active scanning, even if it floods the networks. Of course, a gray hat designer would prefer a flooded network over a botnet - per minimal collateral damage guidelines.
Re: (Score:2)
Free Software Solution. (Score:2)
The defang you are looking for has been provided by the free software community. Unlike the worms themselves, user and vendor action are required for this to work and it's completely legal. Vendor support is growing every day because everyone now realizes the root cause is a costly software monoculture. IBM, HP and Dell now all sell gnu/linux to desktop users. With a little bit of advertising the problem will go away soon.
Re: (Score:2)
So to make it easy:
1) Create or take over Storm botnet
2a) (Optional): dd if=/dev/null of=/dev/hd
Re: (Score:2)
the ONLY way to cause botnets and other infections to be taken seriously is to deprive the lusers of their porn, mp3's and possibly their hardware. a few crispy video cards, region-locked DVD players set to only play japanese DVDs and corrupted documents will force them to but at least basic security
The counter-solution (Score:3, Interesting)
Re: (Score:2)
Re: (Score:3, Interesting)
What on earth makes you think people like Microsoft and Google don't get hit by these people?
I have no data you don't, but I'd be amazed if no-one has ever threatened the richest IT companies in the world with outages if they don't pay up.
Re: (Score:2)
Why do somthing to bring it to Corporation property, what's in it for them other than an increased workload ?
Re: (Score:2)
(Google Reader is working now. Search works, too.)
Re: (Score:2)
Re: (Score:2)
What next? (Score:2)
Solution??? (Score:5, Insightful)
Is there a scanner and fix available? It does require executing an email attachment, right?
It really shouldn't be called a worm unless it can worm its way in without social engineering...
Re: (Score:3, Insightful)
Re:Solution??? (Score:5, Insightful)
Problem is, there are just millions and millions of (windows) users who don't bother with the most basic security.
And the solution is for ISPs to cut off any machine that appears to have been compromised, and for ISPs to collectively isolate and cut off other ISPs that allow significant amounts of bad traffic out of their networks.
I'm all for due process, but in cases like this, a real-time response is required and there isn't much doubt whether a machine/network is emitting significant amounts of bad traffic or not. You just have to make people get their own house in order, and if they don't, kick them off the Internet until they do.
Re: (Score:3, Interesting)
Re: (Score:2)
I'm expecting a waver of emails inviting the reader to "click here [address.ru] to see Vannessa Hudgens's naughty pics, the ones Disney tried to ban..."
Re:Solution??? (Score:4, Interesting)
By the way, the download in Ubuntu asking where to save it has a cancel button. I didn't download it to get a filesize. Sorry.
I know I am not sending any extra data as part of this bot simply because my network switch sits right under my monitor. There is no unusual traffic here. I think everyone should be constantly monitoring their network traffic.
Maybe MS and Ubuntu can make a traffic monitor that sits on the desktop by default. I know most people would ignore it thinking it is Limewire or Torrent traffic.
Re: (Score:2, Interesting)
Re: (Score:2)
I noticed that also, but didn't mention it. Even though every e-mail had an IP address link, all the links were unique, but the content on the resulting pages was identical.
Re: (Score:2)
Re:Solution??? (Score:5, Informative)
http://en.wikipedia.org/wiki/Storm_Worm [wikipedia.org]
http://www.symantec.com/security_response/writeup
It's detected and removed by the usual array of anti-virus software (it installs a malicious device service %System%\wincom32.sys, that joins it to the private distributed P2P control network). However, it does also have capability to download additional malicious software, and has changed form several times.
http://www.symantec.com/enterprise/security_respo
Currently the malware being downloaded is as follows:
game0.exe: A downloader + rootkit component - detected as Trojan.Abwiz.F
game1.exe: Proxy Mail Relay for spam which opens port TCP 25 on the infected machine - detected as W32.Mixor.Q@mm
game2.exe: Mail Harvester which gathers mail addresses on the machine and post them as 1.JPG to a remote server - detected as W32.Mixor.Q@mm
game3.exe: W32.Mixor.Q@mm
game4.exe: It contacts a C&C server to download some configuration file - detected as W32.Mixor.Q@mm
Microsoft "Malicious software removal".... (Score:2)
Maybe.
I mean, this is precisely the sort of thing it's designed for, right?
Almost (Score:4, Informative)
* A trojan is a hidden "feature" of some otherwise legitimate software.
* A virus is a program that attaches itself to other files.
* A backdoor gives someone remote control of the machine.
* A botnet is an advanced backdoor where one can control many machines at once, e.g. from an IRC channel. PCs infected by completely different malware can all join the same person's botnet. Conversely, PCs infected by customized versions of the same malware can join different botnets.
The problem is that the media doesn't understand ANY of this and that the categories aren't all mutually exclusive. This is a trojan & backdoor that spreads via dumb users executing attachments they shouldn't.
Re: (Score:2)
Something like that... (Score:2)
Obviously, if you had adware that injected ads into unrelated programs, it'd be an adware virus, etc. But you can have something that's merely adware without it being a trojan or anything else.
I think I forgot to mention rootkits, a source of recent controver
Re: (Score:2)
Re:Solution??? (Score:5, Insightful)
Who the fuck are you, & who the fuck is "Team Fury" ?
How do you explain this to the average joe? (Score:5, Interesting)
I told my oldest son about this botnet yesterday, mentioning that with between 2 million and 20 million CPU's working at any one time, and even that larger figure likely representing only a fraction of the botnet's total capacity, it collectively represented the most powerful supercomputer ever built... and it was effectively under the control of a small group of people with criminal intent - the author, or authors, of the worm. My son responded to me with a great deal of scepticism, first saying that none of these security experts which have made this analysis have any way to estimate what sort of computing power military organizations might have, so saying that it represented the most powerful supercomputer ever was actually a completely meaningless claim, and also, he proclaimed that the story was most probably just hype and over exaggerated. He said that the claim of the most powerful supercomputer ever being controlled by criminals was simply too much to be believable, like the headlines one might see on the front page of the Weekly World News tabloid. He also said that it was ludicrous to see how sending people "penis extension ads" (which is about all he figures a botnet can do) can actually seriously harm anything or anyone.
So this got me to wondering... how much of this actually _is_ something that is of any real concern, and if it really is, how could it be explained to people in such a way that it's not going to sound like some claim from a conspiracy theorist?
Some movies, some Wikipedia, some angles (Score:5, Insightful)
You could also introduce him to the theory behind Bittorrent [wikipedia.org], which is a good demonstration of how many computers each doing a small task, given modest bandwidth, can add up to massive distribution and publication power in short order.
Now, what if some distributed network decided to siphon a gig of illegal or embarrassing materials onto a compromised target machine. Perhaps a politician that is voting the wrong way?
Then ask him, not if the entire banking industry is safe, but if an individual's information (SHA hash collision or private key, but that's not "average Joe" speak) could be subject to a distributed brute force attack [wikipedia.org].
With the growing power of computers making tiny pieces of malware harder and harder to notice (that 1% of processor time is more and more powerful), and malware being able to literally hide files from the user until such time that it chooses to reveal them, it seems like it's only a matter of time before someone with a large enough botnet, and enough imagination, could start attacking individuals and/or siphoning off their money. How you do this is not something I care to discuss, but the black hats (both the actual criminals and the security experts, as an exercise) already have ideas and are working on it. That's why you'll see them periodically calling for stronger encryption (more bits in the keys). If there was no possible threat, they wouldn't be creating and suggesting longer keys. Rootkits [microsoft.com] would not be a concern, if files hidden from the user were always benign (most are).
But all it takes is the wrong person to have the right idea, a breakthrough that changes the assumptions, especially in cryptography. Show him the movie "Sneakers [imdb.com]" if you want to fuel some imagination regarding that. It's crap, but it's also fun and sizes the problem for the average Joe. Assuming that only ethical people work in cryptography is somewhat naive. Assuming that unethical people are not watching the progress of ethical individuals in the field is stupid.
There's nothing to say such solutions and attacks haven't occurred already, but it seems, as your son suggests, unlikely. You can bet if a criminal has figured it out, a little bit of money siphoned off here and there would be almost impossible to detect, especially in an environment where people are unwilling to believe it's even possible. Believe me, if the idea has hit Hollywood [imdb.com], it's old hat. That's exactly how such a criminal would proceed if they had found a way to leverage such distributed computing applications. They would target a distributed network of accounts, one by one, in a way that looked like banking errors (which are numerous and automatically corrected by the bank) and slowly siphon money from the banking industry itself, through compromised individual accounts. No individual would suffer, because of correction processes in the banks, the world's capital reserves would.
Then ask what that money could buy in terms of influence, weapons, elections?
Any compromised machine is a liability to its user. Botnets are a menace to society, and we're lucky all they're (hopefully) being used for is "penis enlargement" ads and DDoS attacks. That's barely scraping the surface of their potential.
If he wants to go on believing that his safety and security are a given, without any effort on his own part, there's little you can do, but anyone with any imagination, who is not in flat out denial, can demonstrate that distributed computing applications have a great deal of power, and that basic security is everyone's concern. It is definitely not good that these ne
Re: (Score:2)
Re:How do you explain this to the average joe? (Score:5, Insightful)
A few days ago, I figured that the great difficulty in explaining this to people who don't know already is that, in the Real World, preposterous conspiracy theories are often false. In fact, much more innocuous ones usually are, too. This is something I figured while actually taking some time away from computer security and traveling through the Real World. In the Real World, you can leave your expensive laptop in your unlocked yacht in an unguarded marina, and then leave thousands of dollars worth of electronics equipment in a restaurant to recharge overnight, and none of it will get stolen.
On the Internet, if your computer is reachable, it will be attacked in a matter of minutes. Any hole that is found in the software you run is likely to get exploited. Most of the email you get is spam sent by exploited Windows machines people have at home. Corporations are watching you, some with orders from the government. You can legitimately wonder _who_ controls your computer. It's not really an exaggeration to say that everything that can go wrong not only will, but has.
It only starts to get _really_ scary when you consider how much of the Real World is actually dependent on computers these days...
Re: (Score:2)
Re: (Score:2)
Re:How do you explain this to the average joe? (Score:5, Insightful)
It has been used as a distributed MD5 crackers, collisions in SHA-1, and search for extraterrestrial life... (eer... yeah)
Having a gigantic botnet of at least 100,000 computers to unimaginable millions of infected computers that we'll probably ignoring or we are unable to detect, this gives a tremendous asset to a malicious hacker.
It is a very fat milking cow:
1) Crack passwords that it is not considered crackeable in a reasonable amount of time
2) Botnets to attack whoever he wants (at a reasonable price or for a reasonable cause)
3) Millions of Passwords, logins accounts, paypal, amazon, credit card, identity, whatever, stolen.
4) Millions of proxies to hop on and chain hiding the source of a real meticulous attack. 5) Millions of illegal distributed server to host for illegal materials (eg: virii, worms, child pornography)
Etc...
fallacious statement (Score:2)
By that logic, does all the hate mail Fred Phelps get mean that he's on the right track?
Does it mean that all those protesting Bush's speeches validate his argument?
Odd way for the author to phrase it. I don't think there's a cause and effect here. They might be publicly opposed to the spamming and phishing scams, but they fact that they're getting at
Re: (Score:2)
It's a poor analogy. It wouldn't be someone sending hate mail to Fred Phelps. It would be someone putting up posters about the problems with Fred Phelps, and then Phelps setting out to kill the Poster-makers.
Wrong analogy again. A correct analogy would be If those protesting against Bush's speeches
Well, yes, it does. (Score:2)
Re: (Score:2)
I meant that swatting at a gadfly doesn't necessarily mean the gadfly is really successful at hurting their target. Could we see some evidence that the number of scams is going down, or that 419eater.com is causing a remarkable drop? The fact that they're DDoSed doesn't mean that they're anything more than a nuisance, maybe the perpetrators are going for a symbolic strike against a weak opponent
Solution (Score:2, Redundant)
Re: (Score:2)
Yeah ok it's not a good idea, but you have to admit it has a certain appeal in terms of getting people to actually give a shit about their computers.
Possible solution: treat computers like a car (Score:2, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2, Insightful)
Virtually all ISPs do this, its just that what they count as "suspected to have spyware or a virus infection" is pretty lax. Usually the only thing that counts is sending out more than x many emails in a certain time frame. Of course, I would rather have them be lax than be intruding to my system.
Re: (Score:2, Interesting)
We also have intrusion protection at all of our border routers, that scans incoming and outgoing traffic. Our traffic wipes its feet before going out to the internet, if you know what I mean.
We also have a service p
Re: (Score:2)
The choice of targets is significant in itself (Score:2)
I mean, why not use it to make money? Attacking these sites ain't gonna directly generate any revenue. And one must consider such a resource as having a time value; what is the half life of a bot net anyhow? Is this one, given it's size, likely to be significantly different?
It might be a demonstration/test (Score:3, Insightful)
It might be a test or demonstration of the botnet. Like any weapon it needs to be test fired before actual use. The persons controlling this might be trying to kill two birds with one stone - test the botnet, and knock those who taunt you off the air.
size (Score:2, Interesting)
Is the size of the the Storm network large enough to hold a really big player hostage? Could they eg DDoS Microsoft's update portal? Or Google's homepage? either for ransom or without?
Could they cripple other internet backbone infrastructure stuff, and thereby hold the nation's entire computer infrastructure hostage?
As TFA mentions, a DDoS attack is more expensive for the customer of the botnetters, as is easier to detect and stop at the ISP level, so I wonder if those attacks are really feasible, or i
Re:size (Score:5, Insightful)
Oh please god.... no....
Think of what you're saying! The same group of people who color-code our paranoia, who decide that waterbottles are dangerous, and who advise us to purchase duct tape... you want to turn to them for help securing the Internet? Do you have any idea how painful that would be?
No -- the responsibility here lies with the users and (to some extent) the carriers. If the user's machines are infected, disconnect them. If the carriers detect a large, coordinated traffic pattern, investigate -- and if it's a DDOS attack, block it at the firewall level (before the traffic leaves your network segments.)
Ya DHS are morons (Score:4, Interesting)
Well if you've got people like that advising you, I'm going to guess the technical conclusions you come to are probably not going to be the correct ones.
Slashdotted (*blush*) (Score:2)
What? Your data center is a molten slag?! Eureka! We'll stop by with marshmallows and weenies.
This is one case where publishing the hyperlinks might have been a bad idea. I wonder how many people are hitting their refresh buttons right now. ;
This is not proof (Score:3, Insightful)
I'd like to agree with you, but it makes about as much sense as saying that increased violence in Iraq is proof that the US has terrorists on the run.
The scam-baiters may be doing a lot of good, but DDoS attacks against them aren't proof of it.
testing for Storm (Score:2)
rather than gong on about what it is doing, how about we spread the word on how to stop it one computer at a time.
Hmm.. (Score:2)
Wait a minute (Score:2, Redundant)
The final straw. (Score:2, Interesting)
Spammers at it again. (Score:2, Informative)
Hellooooo Blue Security? (Score:2)
To put it in other words, why am I not surprised that this happened, after watching Blue Security being obliterated by... guess what, a botnet!
A Proper Punishment (Score:2)
Re:somebody needs to stop... (Score:4, Informative)
Re: (Score:2)
Re: (Score:2, Interesting)
As for your second point, don't be a troll. All software has bugs, microsoft is no different. If you bothered reading about this at all, you'd realize that most anti-virus products will detect and remove this worm. The people who are running windows without an anti-virus pro
Re:And just in case any site survives the DDOS att (Score:2)
Because we all know we're all to lazy to look for the links ourselves.
Hmm. I'm not actually sure if that's true, sarcastic, funny, or what...
Re:Going to need a bot-net to take out the bot-net (Score:2)
Re: (Score:3, Funny)
I do, usually. But in your case the post-natal variety seems fitting.
Re: (Score:2, Insightful)
Doesn't that seem like a poor allocation of resources on behalf of the bot net controllers? I mean, how long could a DDOS attack possibly be carried on? A few hours? Maybe a day at most? I can see that, for a retailer, that sort of thing would seriously impact business but if these sites go down for a day, does that really matter?
They could have it run for a month or two. With the lack of knowledge of PC users, and the mass-spreading technique, and the fact we have cable infected PCs and now have zombied Verizon FiOS machines, that's some serious bandwidth. This is just a slap on the wrists from the runners of the botnet, perhaps making a point?
Re: (Score:2)
Re: (Score:2)
Interesting to look at it from a different perspective, however. This allocation of resources can be considered a success for these sites, of a kind, in that it's induced the botnet's controllers to direct a massive amount of firepower at a something that will gain them no profit. If they weren't doing this then there would be some genuine extortion victims out there right now. This action on there part suggests that these sites are actually inflicting some pain on the botnet controllers, so it's good PR f