Anti-Scammers Become Storm Botnet Victims

capnkr writes "It looks like the efforts of the anti-scammers at sites like 419eater, Scamwarners, Artists Against 419, and possibly others have become the target of the Storm botnet. Spamnation has a post about it, and as of this writing none of the above listed sites are responding. Spamnation reports that CastleCops and other anti-spam forums are being DDoSed as well. Sounds like a massive, concerted effort against the folks who are fighting the good fight. Although I hate it for the owners and admins of the above sites, I think it shows without a doubt that their efforts to 'get back' at the scammers are working."

Slashdotted

Posting the info and having people slashdot the mentioned sites is not going to help them either :)

Re:Slashdotted

To an extent, you are correct. But I got the impression from the Spamnation link (#4) that this has been going on for days. Heck, the Update on that site was dated Sept. 6. We only have n number of users. The Russians (read TFA) have lots and lots (technical term) of botnets and are assumed to be taking revenge on their tormentors. I think this trumps the slashdot effect, but that's just my opinion.

More than just DDoS

At the moment http://www.aa419.org/ [aa419.org] gives me the main pages of my own web server on my laptop

user@my-box:~$ host aa419.org
aa419.org has address 127.0.0.1
aa419.org mail is handled by 5 mail.aa419.org.

Re:More than just DDoS

user@my-box:~$ host aa419.org aa419.org has address 127.0.0.1

Actually this is the SMART thing to do. If they're attacking the hostname of the website, any smart admin would change the DNS record to lower the TTL to update, and update their address to 127.0.0.1. This way the botnet boxes end up attacking themselves. I've done it before. Then once the attack is over you update your A name record to the actual IP.

Re:More than just DDoS

How do you know when the attack is over if they're no longer attacking your machine thanks to the DNS record pointing to 127.0.0.1 ?

How long do you wait ?

I suppose you can try to identify the specific worm that's doing the attack and infect a test machine and watch it. Or if you can reverse engineer it you might be able to find out when the end date is. Beyond that you've effectively taken your entire web site / business offline for an undetermined period of time. I'm not sure it's any better than riding out the attack. The attack could stop and you wouldn't even know it.

Plus, the minute you unplug your network cable or change your DNS records to a machine that doesn't host your web site you've just handed yourself to the attackers. Taking your business offline is *exactly* what they intended to do. And you did it for them.

Re:Russians

Probably because claims to the effect of "all blank are filthy scammers and spammers" are generally considered to be flamebait? Add to that the whole notion of "our cyberspace" and a completely unrealistic proposal (just how do you prevent an entire country from connecting to the internet, anyway?). Yeah, it's flamebait.

Have the bots scared everyone?

Such that no one wants to say any...

craigslist scammers

I screwed with a craigslist scammer this week. It was sorta fun.

http://digitalsushi.com/goraku/fakecheck/story.htm l [digitalsushi.com]

Getting him to mail a check made out to "Pownd Uholot" was entertaining. :)

Re:craigslist scammers

You blew your load too quickly. The comedy comes from pissing them off and seeing how many hoops you can get them to jump through before telling them that you're just fucking with them.

Grey Hat solution

Aside from the legalities, perhaps Grey Hats round the world need to start developing "neuter-viri" (self replicating auto-patchers). These zombified machines have got to be defanged somehow, and fast.

Re:Grey Hat solution

What would this accomplish? The lusers have to be hit hard to start to care about what sort of malware resides on their machines. I would rather see a solution where someone exploits a hole in the Storm control implementation and distributes a disk shredding update to all nodes.

50M dead HDDs would be fun in the oldschool spirit and at the same time would generate enough of fuss for people to start actually caring about security.

Re:Grey Hat solution

There was a great disturbance in the force, it was if 50 million zombies all died as one. Then suddenly they returned in their pristine and un-patched state, and then suddenly update.windows.com went super-nova and imploded into a black hole.

Re:Grey Hat solution

Ah, a plan with no drawbacks... :-)

Battle of the Worms....

I recall reading a quite interesting article on this topic a while ago while doing research for a university seminar I had to hold.
The big crux is that the "worm" needs to show negative behaviour, i.e. exploit it's host bandwith and CPU cycles, at least for a while, to gain sufficient impact to "infect & patch" vulnerable machines. It would turn into a battle of the worms, where "grey" worms attempt to infect as many machines as possible, plug the security holes, seek new machines to "infect and patch" and then, after a while, self-delete themselves - while the "black" worms, attempt almost the same, only that they do not self-delete but instead continue to exploit their host. Most machines that become victims of rootkits or worms are actually patched up once infected, to avoid losing the machine to competing malware.

Re:Grey Hat solution

Someone already did this to counter the Blaster worm. See Welchia [wikipedia.org]. The problem with this one though is that it was flooding networks with ICMP pings, causing more network outages [internetnews.com] than the Blaster worm it was designed to fight.

Going to need a bot-net to take out the bot-net.

Good to know that these sites have been effective; I had always been skeptical of them having any measurable effect. What's the next salvo?

The counter-solution

The counter solution to this is for a big company like Google, Yahoo, Microsoft (yes, Microsoft) should offer either their servers, hosting, bandwidth etc. To these sites that are quite evidently being successful against the scammers. Or at the least they could give the sites some cash injections to buy more capable servers, fatter lines etc.

What next?

Hopefully these guys don't get assassinated.

And just in case any site survives the DDOS attack

The submitter has helpfully provided the links to these sites so Slashdotters can finish the job.

Solution???

Why have I seen several articles on this Storm worm, and yet no one seems concerned with how to remove it from systems?

Is there a scanner and fix available? It does require executing an email attachment, right?

It really shouldn't be called a worm unless it can worm its way in without social engineering...

Almost

* A worm infects without user intervention (e.g. SQL Slammer, which *was* a worm).
* A trojan is a hidden "feature" of some otherwise legitimate software.
* A virus is a program that attaches itself to other files.
* A backdoor gives someone remote control of the machine.
* A botnet is an advanced backdoor where one can control many machines at once, e.g. from an IRC channel. PCs infected by completely different malware can all join the same person's botnet. Conversely, PCs infected by customized versions of the same malware can join different botnets.

The problem is that the media doesn't understand ANY of this and that the categories aren't all mutually exclusive. This is a trojan & backdoor that spreads via dumb users executing attachments they shouldn't.

Re:Solution???

This is exactly how people get infected.

Who the fuck are you, & who the fuck is "Team Fury" ?

Re:Solution???

Problem is, there are just millions and millions of (windows) users who don't bother with the most basic security.

And the solution is for ISPs to cut off any machine that appears to have been compromised, and for ISPs to collectively isolate and cut off other ISPs that allow significant amounts of bad traffic out of their networks.

I'm all for due process, but in cases like this, a real-time response is required and there isn't much doubt whether a machine/network is emitting significant amounts of bad traffic or not. You just have to make people get their own house in order, and if they don't, kick them off the Internet until they do.

Re:Solution???

I got a bunch of those e-card emails several weeks ago. Knowing how my Ubuntu box is configured, I went ahead to see how the exploit works. The link is a very sparce page indicating a video download that will start automatically. If it doesn't, click here. The exploit uses both a script and social engineering. Firefox didn't start an automatic download on Ubuntu, so for grins I clicked the link. I was asked where I wanted to save e-card.exe. This exploit page was common to many e-mails indicating cards from my mother, relative, etc. I thought it interesting there was no information passed to load any kind of customized card like a real e-card. Also highly suspicious is the link was an IP address, not a URL. That move alone gets past filtered DNS services and a hosts file.

By the way, the download in Ubuntu asking where to save it has a cancel button. I didn't download it to get a filesize. Sorry.

I know I am not sending any extra data as part of this bot simply because my network switch sits right under my monitor. There is no unusual traffic here. I think everyone should be constantly monitoring their network traffic.

Maybe MS and Ubuntu can make a traffic monitor that sits on the desktop by default. I know most people would ignore it thinking it is Limewire or Torrent traffic.

Re:Solution???

It is a backdoor trojan, not a worm - largely spread via email .exe attachments, but also installed by at least one other mass mailer worm, W32.Mixor.Q@mm.

http://en.wikipedia.org/wiki/Storm_Worm [wikipedia.org]
http://www.symantec.com/security_response/writeup. jsp?docid=2007-011917-1403-99&tabid=2 [symantec.com]

It's detected and removed by the usual array of anti-virus software (it installs a malicious device service %System%\wincom32.sys, that joins it to the private distributed P2P control network). However, it does also have capability to download additional malicious software, and has changed form several times.

http://www.symantec.com/enterprise/security_respon se/weblog/2007/01/trojanpeacomm_building_a_peert.h tml [symantec.com]
Currently the malware being downloaded is as follows:

game0.exe: A downloader + rootkit component - detected as Trojan.Abwiz.F
game1.exe: Proxy Mail Relay for spam which opens port TCP 25 on the infected machine - detected as W32.Mixor.Q@mm
game2.exe: Mail Harvester which gathers mail addresses on the machine and post them as 1.JPG to a remote server - detected as W32.Mixor.Q@mm
game3.exe: W32.Mixor.Q@mm
game4.exe: It contacts a C&C server to download some configuration file - detected as W32.Mixor.Q@mm

Big deal?

Doesn't that seem like a poor allocation of resources on behalf of the bot net controllers? I mean, how long could a DDOS attack possibly be carried on? A few hours? Maybe a day at most? I can see that, for a retailer, that sort of thing would seriously impact business but if these sites go down for a day, does that really matter?

In addition, implementing a DDOS probably entails some sort of risk. This could be either in terms of having individual machines identified and temporarily disabled or in terms of the risk of getting caught increasing with every illegal act that is committed (although, the risk is probably very small, it's still there).

How do you explain this to the average joe?

I told my oldest son about this botnet yesterday, mentioning that with between 2 million and 20 million CPU's working at any one time, and even that larger figure likely representing only a fraction of the botnet's total capacity, it collectively represented the most powerful supercomputer ever built... and it was effectively under the control of a small group of people with criminal intent - the author, or authors, of the worm. My son responded to me with a great deal of scepticism, first saying that none of these security experts which have made this analysis have any way to estimate what sort of computing power military organizations might have, so saying that it represented the most powerful supercomputer ever was actually a completely meaningless claim, and also, he proclaimed that the story was most probably just hype and over exaggerated. He said that the claim of the most powerful supercomputer ever being controlled by criminals was simply too much to be believable, like the headlines one might see on the front page of the Weekly World News tabloid. He also said that it was ludicrous to see how sending people "penis extension ads" (which is about all he figures a botnet can do) can actually seriously harm anything or anyone.

So this got me to wondering... how much of this actually _is_ something that is of any real concern, and if it really is, how could it be explained to people in such a way that it's not going to sound like some claim from a conspiracy theorist?

Re:How do you explain this to the average joe?

You are underestimating how valuable and powerful distributed computing is, my friend.
It has been used as a distributed MD5 crackers, collisions in SHA-1, and search for extraterrestrial life... (eer... yeah)
Having a gigantic botnet of at least 100,000 computers to unimaginable millions of infected computers that we'll probably ignoring or we are unable to detect, this gives a tremendous asset to a malicious hacker.

It is a very fat milking cow:

1) Crack passwords that it is not considered crackeable in a reasonable amount of time
2) Botnets to attack whoever he wants (at a reasonable price or for a reasonable cause)
3) Millions of Passwords, logins accounts, paypal, amazon, credit card, identity, whatever, stolen.
4) Millions of proxies to hop on and chain hiding the source of a real meticulous attack. 5) Millions of illegal distributed server to host for illegal materials (eg: virii, worms, child pornography)

Etc...

Some movies, some Wikipedia, some angles

This article [wikipedia.org] is a good place to start.

You could also introduce him to the theory behind Bittorrent [wikipedia.org], which is a good demonstration of how many computers each doing a small task, given modest bandwidth, can add up to massive distribution and publication power in short order.

Now, what if some distributed network decided to siphon a gig of illegal or embarrassing materials onto a compromised target machine. Perhaps a politician that is voting the wrong way?

Then ask him, not if the entire banking industry is safe, but if an individual's information (SHA hash collision or private key, but that's not "average Joe" speak) could be subject to a distributed brute force attack [wikipedia.org].

With the growing power of computers making tiny pieces of malware harder and harder to notice (that 1% of processor time is more and more powerful), and malware being able to literally hide files from the user until such time that it chooses to reveal them, it seems like it's only a matter of time before someone with a large enough botnet, and enough imagination, could start attacking individuals and/or siphoning off their money. How you do this is not something I care to discuss, but the black hats (both the actual criminals and the security experts, as an exercise) already have ideas and are working on it. That's why you'll see them periodically calling for stronger encryption (more bits in the keys). If there was no possible threat, they wouldn't be creating and suggesting longer keys. Rootkits [microsoft.com] would not be a concern, if files hidden from the user were always benign (most are).

But all it takes is the wrong person to have the right idea, a breakthrough that changes the assumptions, especially in cryptography. Show him the movie "Sneakers [imdb.com]" if you want to fuel some imagination regarding that. It's crap, but it's also fun and sizes the problem for the average Joe. Assuming that only ethical people work in cryptography is somewhat naive. Assuming that unethical people are not watching the progress of ethical individuals in the field is stupid.

There's nothing to say such solutions and attacks haven't occurred already, but it seems, as your son suggests, unlikely. You can bet if a criminal has figured it out, a little bit of money siphoned off here and there would be almost impossible to detect, especially in an environment where people are unwilling to believe it's even possible. Believe me, if the idea has hit Hollywood [imdb.com], it's old hat. That's exactly how such a criminal would proceed if they had found a way to leverage such distributed computing applications. They would target a distributed network of accounts, one by one, in a way that looked like banking errors (which are numerous and automatically corrected by the bank) and slowly siphon money from the banking industry itself, through compromised individual accounts. No individual would suffer, because of correction processes in the banks, the world's capital reserves would.

Then ask what that money could buy in terms of influence, weapons, elections?

Any compromised machine is a liability to its user. Botnets are a menace to society, and we're lucky all they're (hopefully) being used for is "penis enlargement" ads and DDoS attacks. That's barely scraping the surface of their potential.

If he wants to go on believing that his safety and security are a given, without any effort on his own part, there's little you can do, but anyone with any imagination, who is not in flat out denial, can demonstrate that distributed computing applications have a great deal of power, and that basic security is everyone's concern. It is definitely not good that these ne

Re:How do you explain this to the average joe?

``So this got me to wondering... how much of this actually _is_ something that is of any real concern, and if it really is, how could it be explained to people in such a way that it's not going to sound like some claim from a conspiracy theorist?''

A few days ago, I figured that the great difficulty in explaining this to people who don't know already is that, in the Real World, preposterous conspiracy theories are often false. In fact, much more innocuous ones usually are, too. This is something I figured while actually taking some time away from computer security and traveling through the Real World. In the Real World, you can leave your expensive laptop in your unlocked yacht in an unguarded marina, and then leave thousands of dollars worth of electronics equipment in a restaurant to recharge overnight, and none of it will get stolen.

On the Internet, if your computer is reachable, it will be attacked in a matter of minutes. Any hole that is found in the software you run is likely to get exploited. Most of the email you get is spam sent by exploited Windows machines people have at home. Corporations are watching you, some with orders from the government. You can legitimately wonder _who_ controls your computer. It's not really an exaggeration to say that everything that can go wrong not only will, but has.

It only starts to get _really_ scary when you consider how much of the Real World is actually dependent on computers these days...

fallacious statement

Although I hate it for the owners and admins of the above sites, I think it shows without a doubt that their efforts to 'get back' at the scammers are working.

By that logic, does all the hate mail Fred Phelps get mean that he's on the right track?
Does it mean that all those protesting Bush's speeches validate his argument?
Odd way for the author to phrase it. I don't think there's a cause and effect here. They might be publicly opposed to the spamming and phishing scams, but they fact that they're getting attacked doesn't necessarily mean they're making more than a dent in it.

Solution

Right a piece of code that detects if the storm bot virii are present, then have it format the hard drive. If their computer is putting other computers with real work to do in danger they should be deleted until the administrator learns to use it. Seems harsh but trying to fix a computer thats already infected is almost impossible to do, as they keep changing the virii, so carpet bomb it.

Possible solution: treat computers like a car

Didn't some internet provider at one time threaten or attempt to disconnect customers whose computer were suspected to have spyware or a virus infection? I think more internet provider (errr.. high speed internet providers) should take charge and disconnect computers that are (or might be) part of a large botnet. This brings me to the point that like most people don't have a clue how a car functions under the hood, most people also don't know how a computer functions inside its case. So ignorance should not be an excuse for having a computer that's infected with every virus or malware under the sun which is connected to the internet. If a person had a car that kept causing problems on the road than it would eventually find itself towed away or shoved off the road (much like a computer might be forcefully disconnected from it's internet provider).
Much like the local police or the local transportation dept. might maintain roads and highways, so should the super information highway be maintained by internet providers and various security experts. Ignorance cannot be an excuse! It certainly doesn't work when you're being arrested for vehicular manslaughter. "But officer, I didn't see that old lady crossing the road..."

The choice of targets is significant in itself

I mean, don't they have better things to do with these resources? Seems like the choice of targets tells us a lot about the opportunities - or perhaps lack of opportunities - that this resource (i.e., the Storm botnet) can be put to.

I mean, why not use it to make money? Attacking these sites ain't gonna directly generate any revenue. And one must consider such a resource as having a time value; what is the half life of a bot net anyhow? Is this one, given it's size, likely to be significantly different?

Sure, these scams are easier to pull off it people are uninformed. But how many of the people who are likely to get involved in such scams, upon receipt of these emails, will google first?

size

Is the size of the the Storm network large enough to hold a really big player hostage? Could they eg DDoS Microsoft's update portal? Or Google's homepage? either for ransom or without?

Could they cripple other internet backbone infrastructure stuff, and thereby hold the nation's entire computer infrastructure hostage?
As TFA mentions, a DDoS attack is more expensive for the customer of the botnetters, as is easier to detect and stop at the ISP level, so I wonder if those attacks are really feasible, or if it'd just mean that everyone that's infected loses internet access until they get cleaned up. Which might not be such a bad thing.

But, in short, is the Storm Botnet an actual national security threat? Could a foreign power commission it to do the US computing infrastructure grievous harm; but could it be stopped if the DHS etc took protective action at the ISP level?

Re:size

if the DHS etc took protective action at the ISP level?

Oh please god.... no....

Think of what you're saying! The same group of people who color-code our paranoia, who decide that waterbottles are dangerous, and who advise us to purchase duct tape... you want to turn to them for help securing the Internet? Do you have any idea how painful that would be?

No -- the responsibility here lies with the users and (to some extent) the carriers. If the user's machines are infected, disconnect them. If the carriers detect a large, coordinated traffic pattern, investigate -- and if it's a DDOS attack, block it at the firewall level (before the traffic leaves your network segments.)

Ya DHS are morons

We've got a professor at the university where I work that consults for DHS, one of our student workers is in his class. The misinformation this guy hands out is... legendary. For example, did you know that twisted pair only has a bandwidth of 250kHz and a maximum speed of 4Mbps? Really, it must be true, Dr. DHS said so! Never you mind things like Belden 7852A that is rated up in the 400-600MHz range, what do they know? Smarmy cable manufacturer, Dr. DHS says that's just not true!

Well if you've got people like that advising you, I'm going to guess the technical conclusions you come to are probably not going to be the correct ones.

Slashdotted (*blush*)

Sorry guys, we know your suffering a DDoS attack right now, but we just thought we'd publish links to your sites on Slashdot to compound the issue. Think of it as an experiment to see what effect a massive storm of legitimate traffic will have on an ongoing DDoS attack.

What? Your data center is a molten slag?! Eureka! We'll stop by with marshmallows and weenies.

This is one case where publishing the hyperlinks might have been a bad idea. I wonder how many people are hitting their refresh buttons right now. ;^)

--
Toro

This is not proof

"I think it shows without a doubt that their efforts to 'get back' at the scammers are working."

I'd like to agree with you, but it makes about as much sense as saying that increased violence in Iraq is proof that the US has terrorists on the run.

The scam-baiters may be doing a lot of good, but DDoS attacks against them aren't proof of it.

testing for Storm

is there a way to test or check that people who might be part of the bot net how to see if they have it?

rather than gong on about what it is doing, how about we spread the word on how to stop it one computer at a time.

Hmm..

Would it not be somewhat of an improvement then if services like these would also be massively distributed? Instead of a massive scammer network having a 'force to counter' in the form of a massive anti-scammer network. Surely a p2p/torrent like thing could make this possible?

Wait a minute

"Look, these sites are being DDosed, let's post them on slashdot". Doesn't exactly seem like the best idea ever.

The final straw.

It's time for the community to do something about botnets. Forget ethics, we use whatever means necessary. Government and law enforcement agencies appear unwilling or even technically unable to do anything about it (this is a very important point). What better people to sort out this mess than the community who thought up the IRC protocol and whatnot in the first place? It's time to find these machines, break into them and stop this madness. Will govt only do something when their sites get attacked? Can you say weakening Western-Russian relations?

Feed it a bluepill?

I'm not by any means experienced at modern ASM and low-level stuff; The only instruction set I recognize is 8085. But why wouldn't it be possible to run Windows98 inside something like Bochs, and then just halt the VM and take the keys out of it's memory and order the botnet to self-destruct? Will the worm check for subtle processor state aspects that Bochs misses and not run? That this hasn't been done already implies that I'm missing something...

Spammers at it again.

I remember when this happened against Blue Frog. They were forced to shut their service down due to the DoS attack against them. As soon as the spammers feel threatened by any anti-spam organization they just launch these kind of attacks and shut them down. They seem to easily get away with it. Kind of sad really, there needs to be a fight against spammers on a larger level with Governments and IT corporations getting involved.

Hellooooo Blue Security?

"Those who cannot remember the past are condemned to repeat it."

To put it in other words, why am I not surprised that this happened, after watching Blue Security being obliterated by... guess what, a botnet!

A Proper Punishment

When the Storm Worm writers are caught, they should be publicly beaten to death immediately, as a warning to all who would follow in their footsteps.

It doesn't prove anything...

Except that these sites are annoying enough that the fairly trivial effort to set up a DDOS in retribution feels worthwhile.

Scam baiting is great, and I'm delighted that it's causing some annoyance but thinking of it as anything other than a fun way to wind up someone who deserves it, is just deluding yourself.

Are ISPs doing enough?

As big as a botnet is, it has only 2 main weapons - spam and DoS. To help fix the first problem, why can't ISPs analyse outgoing mail and if spam-like behaviour appears (which shouldn't be hard to detect), do the following: 1. Completely block customer's traffic, except to allow the following: 2. Direct customer to the ISP's download page of links to virus scanning software & updates. 3. Allow customer to tick a box saying "yes I've done a scan, all ok now" and service resumes. 4. If spam behaviour continues, return to step 1. Customer can resume service immediately if they want, but will get pissed off enough with the interruptions to eventually install/scan and/or learn not to run EXEs. DoS attacks could easily be twarted by building an alert network for all ISPs. If a site is attacked, they alert the network and any ISPs seeing traffic going to that site does the same to the customer as above. Block them until they clear the infection. By badgering the end users until they learn, we might see PCs around the world quickly cleaned up. The government could help by providing free antivirus & firewall software too, or at least make them tax exempt.

A way to fight botnets?

What would happen if we organized a "good" botnet that would DDOS the machines on the Storm botnet, rendering them incapable? Obviously participation in the good net would be voluntary.

This is a Criminal Offense - More Than Just DDOS

This is a fight that the IT profession should take on. This is not just about botnet computers or some hired gun to take down websites. This is a FIGHT for the internet. The fight for GOOD or EVIL. If we allow these thugs or criminals to take down websites or hold companies hostage for ransom, then civilization as we know it is at risk. The internet will become the new weapon of terror if it not already being use to that extent. Those who advocate criminal activities on the internet should be sought out and reported to law enforcement. There is glorification or satisfaction that is to be gain. All scams fighting sites are under attacks. These sites are the fight line of defense against cybercrime whether you agreed or disagreed with their methods. We at http://scamfraudalert.com/ [scamfraudalert.com] remain resolute to this FIGHT.

aa419 (partially) up again

And so it seems, aa419.org is up again, albeit only with a few pages so far. I still cannot get their Muguito to run, since it needs to log in somewhere first. Their forums are also down. Anyway, as several have said here, the determination of the scammers only proves that we are doing a good job annoying them. Neat!