Storm Worm Strikes Back at Security Pros 371
alphadogg writes "The Storm worm, which some say is the world's biggest botnet despite waning in recent months, is now fighting back against security researchers that seek to destroy it and has them running scared, conference attendees in NYC heard this week. The worm can figure out which users are trying to probe its command-and-control servers, and it retaliates by launching DDoS attacks against them, shutting down their Internet access for days, says an IBM architect."
In soviet russia... (Score:5, Funny)
Re:In soviet russia... (Score:4, Funny)
Oddly, this firewall entry:
Date: 10/25 00:27:30 Name: spp_portscan: portscan status from 66.35.250.150: 13 connections across 1 hosts: TCP(13), UDP(0)
Priority: n/a Type: n/a
IP info: n/a:n/a -> n/a:n/a
References: none found
Led to:
[someone@somebox ~]$ host 66.35.250.150
150.250.35.66.in-addr.arpa is an alias for 150.0/24.250.35.66.in-addr.arpa.
150.0/24.250.35.66.in-addr.arpa domain name pointer slashdot.org.
[someone@somebox ~]$ whois 66.35.250.150
[Querying whois.arin.net]
[whois.arin.net]
Savvis SAVVIS (NET-66-35-192-0-1)
66.35.192.0 - 66.35.255.255
VA Software SAVV-S234813-4 (NET-66-35-250-0-1)
66.35.250.0 - 66.35.250.255
# ARIN WHOIS database, last updated 2007-10-23 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
Contact the users (Score:3, Funny)
or install GNU/Linux.
Re: (Score:3, Informative)
http://it.slashdot.org/article.pl?sid=07/10/05/1234217 [slashdot.org]
Re:Contact the users (Score:5, Interesting)
Re:Contact the users (Score:5, Informative)
I see a lot of these all the time, they seem to be cycling through a list of names. At the moment they are trying account names like 'root', 'linux', 'admin', 'test', 'testftp', 'webmaster' etc. and user names like 'melissa', 'danny', 'nicholson' etc.
I don't think this means that they added a SSH back door, just that they have enough compute resources to try hundreds of combinations of likely names and passwords in the hope they get lucky.
Re: (Score:2)
Re:Contact the users (Score:4, Informative)
just in case they might eventually get lucky...
Re: (Score:2, Interesting)
Re:Contact the users (Score:5, Informative)
Yep, mea cupla :-(
Not keeping up with my sys-admin duties.
I've seen this kind of thing in the logs for quite a while, but not at this level (1000's of attempts in a day). I hadn't noticed the increasing rate. A case of familiarity breeds contempt, "yep, seen those before .. not much can do about them" without really checking how often they happen.
I remember when I first saw them appearing I contacted my ISP, and their reaction was much the same "yep, thats what happens when you connect a box to the net". I offered to pass on the IP addresses but they weren't interested. I got the impression they see thing kind of thing all the time.
What do people suggest I do with the IP addresses of hosts doing the scanning ? Is it worth checking the whois information and contacting the sys admin or abuse email address if there is one ?
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Re:Contact the users (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Cutting off users when they don't know that they have been infected may mean diverting them onto an isolated subnet with nothing but one web page that says: "Your system has been infected. Install and/or replace it and contact (the ISP's) technical support to restore access".
Comment removed (Score:5, Interesting)
Re: (Score:2)
Re: (Score:3, Insightful)
Not having any customers.
You're the type of person who gets looked at by their boss and told "This code is terrible, it is unbelievably user-unfriendly, and it barely even accomplishes the task required because you have implemented so many hoops that people have to jump over just to get anything done"
to which you respond:
"Well we should start requiring all of our receptionists to have degrees in computer science from now on!"
FAIL!
If you make your system so "secure" t
Re:Contact the users (Score:5, Funny)
Re:Contact the users (Score:5, Funny)
Well, it would have to sound professional and reputable. Let me see if I can write a quick draft for you:
Dear Sir,
Based on the recommendation made to me by a reputable official of the abuse sector of a Major South African Internet Service Provider who guaranteed me of your reliability and trustworthiness in business dealings, I wish to entrust important information with you believing that it will be of our mutual benefit; this has to be highly confidential. If I may introduce myself, I am Dr Ben Oguejiofor of the Nigerian Network Operations Centre. I was the former Director of Projects and engineering in the Nigerian Army; I retired recently after Nigeria was pwned by the Storm worm. I wish to crave your indulgence in this business relationship that I will like to establish with you...
I tried and failed (Score:5, Interesting)
So I went and gathered the IP addresses of infected machines. I aggregated them and grouped them to the corresponding ISPs, complete with timestamp (just in case they use dynamic IP addresses and thus need them to contact the corresponding users), then I sent out a mail to 10 different ISPs, just as some kind of test.
The result:
5 didn't reply at all.
2 replied that they are "looking into the issue". I guess they're learning the list by heart 'cause after a month now, still no further reply.
One replied with the question whether I try to infect their system and how I dare to say that their users might do something illegal (talk about knowledge).
One replied that they can't do jack because I could just as well have forged that list to mess with their users and they don't care.
Only a single ISP actually thought the matter is important enough to contact me with a request for more information and whether they can do something proactively.
One.
The smallest one, btw. With 20 infected machines (compared to a few 100 with the biggest one, one of the first group that didn't even care enough to reply).
You can't win this way. ISPs don't care at all, at least until the botnet starts using more bandwidth than their torrent leechers. It would mean work for them, what's worse, it means their customers bother their call center with angry calls and maybe even questions how to clean their machines and maybe they even cancel their service over it. In short, taking things like this serious costs them money but doesn't get them anything, so they won't do it.
Re:I tried and failed (Score:5, Interesting)
Re:Contact the users (Score:4, Funny)
Re:Contact the users (Score:4, Insightful)
Is it... (Score:4, Funny)
Multi cellular (Score:3, Interesting)
In other words we have changed roles. Instead of us being the host and them being t
Re: (Score:3, Funny)
The Latest Bond Script (Score:5, Funny)
Cats: Good evening, Mr. Bond, I was just hitting up some 3 am Taco Bell for fourth meal
Bond: *wheezes at the site of his archnemisis* Cats! I should have known it was you! You won't get away with this diabolical scheme!
Cats: Oh won't I, Mr. Bond? I have all of the world's computers trapped to do my bidding. What would you say if I told you I could bring any website to its knees with a DDOS attack? I noticed you have an apache http server running, Mr. Bond. Perhaps sharing pictures with your loved ones!? Well, I hope a billion attempts to access those images won't
Bond: My GOD! You've gone mad with power, Cats. You're a madman! You'll never get away with this. How do you even keep your franken net in check? What happens when it turns on you?
Cats: Oh, I think I will, Mr. Bond, Caribbean law is quite kind when it comes to orchestrating botnets. Prepare to say goodnight. Good luck making your raiding schedule, I hope you won't miss those 50 DKP!
*Bond's screen slows to a crawl as he rushes to turn off Apache*
Bond: Nooooooooooo!
Re: (Score:2, Funny)
Cats: How are you gentlemen!! All your base are belong to us!!
Re: (Score:2)
Re:The Latest Bond Script (Score:5, Insightful)
Who really knows (Score:4, Insightful)
Re:Who really knows (Score:5, Insightful)
Re:Who really knows (Score:4, Insightful)
Re: (Score:3, Interesting)
Re:Who really knows (Score:5, Insightful)
I only need to make sure I keep my copy of Stevens and Rago in a good shape till there.
Re:Who really knows (Score:5, Insightful)
Now try to explain why the day after January 19th 2038 will be December 13th 1901.
Re:Who really knows (Score:4, Funny)
Time travel WORKS!
Re:Who really knows (Score:5, Interesting)
We're facing a huge network here with the capability to strike a single target. It's not that any of those machines are actually a threat to any kind of server. It's the fact that there are thousands (I think millions is a wee bit exaggerated, but we're certainly facing a number in the upper 5 digits or lower 6).
The threat isn't so much to a single server or a single corporation, the threat actually touches international borders (pardon the pun). We're talking something here that threatens the infrastructure of the internet itself.
The reason why the internet doesn't collapse under its own weight is that nobody uses the bandwidth fully all the time, and there isn't a single target node everyone wants to connect to. Now imagine exactly that happens. Everyone (or let's say one out of 10 machines) on the net goes full bandwidth on one target.
The problem isn't so much that this target is dead due to a DDoS. That's a given. The problem is that the backbone gets under serious stress. And that's where not only the single server but the whole infrastructure of the net around it comes under pressure. Not long ago, Denmark had a network blackout. I think it's no longer a secret what was the reason.
What's worse is that the whole mess seems to be nothing more than a test balloon. When you look at the way this is distributed and worked, you notice that it is by far not what could be considered an "all out" attempt at infecting. It's more a rather limited effort, with days and sometimes weeks between the launch of new infections, and very, very few "real" DDoS attacks, mostly defensive. Very few offensive attacks have been launched so far.
That's what worries me.
Wait a minute... (Score:5, Funny)
Re:Wait a minute... (Score:4, Informative)
Re: (Score:3, Informative)
Now *then* we'd see a storm (Score:5, Interesting)
Even though I think this idea is basically wrong, I'm intrigued by the potential consequences.
There's a lot of these computers out there, which is the whole point. If every one was subject to seizure, computer security would immediately become part of popular conversation. Helluva social storm, probably.
Re:Now *then* we'd see a storm (Score:4, Interesting)
What so wrong about it? If my car is pumping out noxious fumes then the state takes away my license. Thus people maintain their emissions. Or if I park by as hydrant I get a ticket. I dont see why computers should be immune from this kind of policing.
Re: (Score:3, Insightful)
Governments are not interested in computer crime. They don't investigate it, they don't prosecute it (unless it's against them directly).
Re: (Score:2)
Re:Wait a minute... (Score:4, Informative)
Re: (Score:2)
Re: (Score:3, Funny)
telent console.storm.net ... sheesh.
Re:Wait a minute... Isn't this the plot of The Mat (Score:5, Funny)
October 24th 2007 Skynet became self aware (Score:2)
I saw the Terminator in all those California fires (Score:2)
Re: (Score:2)
Hello, Congress... (Score:3, Funny)
Re: (Score:2)
Running scared? (Score:5, Funny)
Wait a minute (Score:3)
Didn't I just hear that the Storm worm was slowing to a crawl [slashdot.org]?
Re: (Score:2, Informative)
Re:Wait a minute (Score:4, Interesting)
a) Something big changed and 10 million Windows users suddenly wised up and cleaned up their compromised systems.
b) The people behind Storm have made it harder to detect so we only think that there are fewer compromised systems.
Sounds ripe for abuse (Score:5, Interesting)
Re:Sounds ripe for abuse (Score:4, Informative)
Unless the dev's think long and hard on how to attack it and work in ways to avoid it I doubt they put that feature in.
Re: (Score:2)
Old news (Score:2, Interesting)
Easy lesson for those thinking of doing research: Remember to have a machine dedicated to the task of tal
This pro ain't afraid, come on Stormbot, bring it. (Score:5, Funny)
Counter-DOS (Score:5, Interesting)
You theoretically would not need a comparable number of targets to attackers - just enough to lower the magnitude of the counter attack to the point where you could get acceptable results. You could also have targets that 'play dead' in some ways so the attackers can't fix on a minimum magnitude to counter attack with, and instead have to throw zombies until the target stops moving, where the target just gets right back up after playing dead. That way, the window you have before you 'play dead' might be used to get relatively clear results.
Just one guy's idea.
Ryan Fenton
Re:Counter-DOS (Score:5, Funny)
Re: (Score:2)
Re:Counter-DOS (Score:5, Interesting)
Not particularly likely to happen, but we can all dream, can't we?
Re: (Score:2)
Of course it would. Those guys are very good at finding the real sources of problems.
*knock knock*
"Yes?"
"Mr. Quietust? Of QMT Productions? We have information here showing that you employed a major bot-net to organize an ongoing DDoS attack against UUNET. Are you going to confess that you are the maste
Ponders ... (Score:3, Interesting)
Re: (Score:2)
Re:Ponders ... (Score:5, Funny)
Re: (Score:2)
Old news (Score:2)
Booby trap (Score:2)
Use this against them. (Score:5, Insightful)
Naieve (Score:4, Insightful)
Sure, you can find who is DDoS'ing you. You can then call the ISP/hosting company and complain. If they are in the US they will likely as not just tell you to get a court order. Outside the US they will laugh and suggest you bribe them. Either way, it is their customer's right to operate in whatever manner they choose. If they are presented with a valid court order from a court in their jurisdiction, they will quickly and efficiently comply. Otherwise, your complaint will go in the bit bucket.
Mostly the problem is that to a lot of ISPs their customer (and the revenue from that customer) is a whole lot more important than the negative effects their customer is having. Also, the customer may be Daddy and Sonny is the one causing all the trouble. Why would anyone want to offend bill-paying Daddy by cutting off service?
The problem here is that regardless of the problem - a botnet infested computer, a script kiddy trying to break in, or some other mischief - if you let it go, it gets worse. Every time a script kiddy gets to feel that rush of excitement at breaking to some computer somewhere without any consequences they get bolder. In the US it is not really possible to go after them until they run up at least $25,000 in damages. Because of this, you never hear about the high schooler getting in trouble because they defaced a web site. Instead you hear about someone after many years of mischief and mayhem who is being accused of causing $12,000,000 in damages computed in some creative manner to get the FBI's attention. There is never a thought of stopping this when the cost to everyone is minimal. Minimal doesn't get the FBI involved and local law enforcement is utterly clueless.
Nobody is really going to get taken down for this unless they do something incredibly stupid. Sure, you can find an IP address but you can't get the customer unless the ISP wants to cooperate. Can you get a court order for the ISP to identify the owner of the account? Probably not without at least $25,000 in damages that you can claim. Even then all you have found is an infected computer that the owner doesn't know anything about.
Viagra Spam (Score:2)
Sounds like the beginning of... (Score:4, Funny)
Re: (Score:2)
Good luck Mr Bond.
Re: (Score:2)
Sure. Then the folks running the botnet identify you based on your DOS'd IP number, find out what your real IP numbers are, and crush you there.
At least, that's what would happen if I were running it.
Re:oh yeah, so scared (Score:5, Insightful)
Something tells me that your method won't work against Storm. This is due to the fact that if you tried such a stunt, it wouldn't be your PC that would be DoS'd, it would be the ISP's local NOC you were using to connect to the internet. If you forced a new DHCP reservation (all that an unplug/plugin does), you'd end up with another IP address (if the DHCP server ever responded to your request) sitting on the same hardware that is being DoS'd by Storm.
What is needed to fight a botnet of this size is a distributed probe net, where if one node is taken out by the botnet, the rest of the cloud keeps on probing it. After all, even a large botnet can only DoS so many locations at a time.
A better solution might be to spoof the IP addresses of other members of the botnet, thereby making it DoS itself into submission.
Re: (Score:2)
Re: (Score:2)
However, say a hobbiest...or someone one with a great deal of time could do it :)
I'm too busy with all the fires and such in San Diego, maybe next week.
Re: (Score:2)
Re:Kung Fu Style? (Score:4, Interesting)
Re: (Score:2)
Perhaps people who are probing, should spoof their address to match another command and control unit.
Is it even possible to spoof another server's ip address across the internet and get return packets? I would think you would need to pwn the server you would theoretically spoof and then probe from there.
In fact, after reading through http://www.securityfocus.com/infocus/1674 [securityfocus.com], it looks like you can send packets, but never get any responses, which may or may not be good enough to trigger a DoS against that server -- unless the admin just whitelists those ips.
Re:Kung Fu Style? (Score:5, Funny)
No, you cannot establish a tcp or any other connection masquerading as someone else. Care to guess why?
Re: (Score:2)
Spoofing is mostly a dead art because TCP uses sequence numbers on packets now and those numbers are pretty near truly random. Mitnik style attacks won't work anymore because of this.
While you may not be able to establish a connection, you could still possibly trigger the c&c server to target another c&c server if just trying to connect to a certain port would trigger it. A simple SYN packet sent to the proper port with a forged source address would set it off...
Re: (Score:3, Informative)
Re: (Score:2)
Re:Kung Fu Style? (Score:4, Funny)
Re: (Score:2)
Way to get your priorities straight.
Re: (Score:2)
Re:A very simple solution. (Score:4, Insightful)
Stop reading/watching Faux News et al. and get your damn facts straight.
People should be able to call themselves a hacker without fear of reprisal, for it's the hackers who will inevitably find many of the flaws in the world that the corporate greedmongers want hidden. I mean who do you think are the people finding all of the buffer overflows, protocol mistakes, etc in services you use on a daily basis? If hackers went away companies could easily get away with insecure practices and billing like however they feel like.
It's the people who stop questioning how the world works that should get a bitchslap upside the head.
Re:A very simple solution. (Score:5, Insightful)
string Hackers="hardware hobbyists"
string Crackers="Saltines, safe-crackers, computer-criminals"
...
Hackers="computer-criminals";
Crackers="Saltines";
Re:A very simple solution. (Score:5, Funny)
Bookmark of cradle the desklamp, or coffee door bird the bubble wrap. Airport barcode of lunch train.
Football.
Re:A very simple solution. (Score:5, Insightful)
Well, the death penalty has certainly stopped people from committing murder in the United States. I think you're on to something.
Re: (Score:3)
What the fuck are you talking about?
Re: (Score:2)