Deconstructing a Pump-and-Dump Spam Botnet 382
Behind the Front writes "eWeek has teamed up with Joe Stewart, a senior security researcher at SecureWorks in Atlanta, to show the inner working of a massive botnet that is responsible for the recent surge of 'pump and dump' spam. It's a detailed picture of how these sleazy operations work and why they're so hard to shut down. Sobering numbers: 70,000 infected machines capable of pumping out a billion messages a day, virtually all of them for penis enlargement and stock scams. Excellent graphics, too, including one chart that shows that Windows XP Service Pack 2 is hosting nearly half the attacked machines."
Filter (Score:4, Insightful)
Re:Filter (Score:2, Insightful)
Re:Filter (Score:3, Insightful)
Re:Filter (Score:5, Insightful)
I thought I paid for IP access. Deliberate port blocking by my ISP is blocking services I pay for.
IP access means IP access, it does mean port 80 web surfing only. Any steps toward that are plain wrong.
I agree it is a wild world out there but it is a problem of weak clients. The service provider should be blind unless a client is affecting network performance beyond their paid for slice. Then the client should be totally blocked.
Re:Filter (Score:3, Informative)
Re:Filter (Score:4, Interesting)
Something similar would work fine. Block port 25 to SMTP by default and have a web config utility to change it. If you really wanted, you could set it up to email the user if they tried accessing port 25 when it was blocked ("You might be trying to get past this firewall. Or, you might have a virus. Here's how you can find out, and here's how you can disable it if you need . . . ")
Re:Filter (Score:5, Funny)
I like that idea. Virus tries sending out 10,000 emails, user gets 10,000 emails saying "You might have a virus....".
Re:Filter (Score:4, Insightful)
Are you one of those imbeciles at Belgacom or something? Because they implemented the same cretinous strategy (without any advance warning, I may add) as you're suggesting.
Re:Filter (Score:2)
1) It's used by MUAs to pass mail to some sort of parent system for delivery.
2) It's used by MTAs to pass mail around between themselves - typically passing from the originator's MTA to the recipient's MTA.
If the first function was switched to a different port number (i.e. not 25) and made authenticated, then port 25 could be blocked by default for dial-up-style users without inconveniencing anyone. They would still be able to use any MTA with which they had an arrangement (subscription, work server, etc.) to take their mail for delivery but bots wouldn't be able to spew vast amounts of mail out by direct SMTP connection.
The distinction is a bit like that between a DNS query sent from a client to a resolving host, and the recursive DNS query sent from the resolving host to its peers in the DNS pool.
Please think about this before responding with vitriol.
Cheers,
John
Re:Filter (Score:3, Informative)
It's been done. Port 587 is used for non-secure client-to-server SMTP already. Some ISP's allow port 587 passthrough but block 25. Personally, I think that sucks, and I'll summarily dump any ISP that blocks 25, if only because I need access to port 25 for things like testing clients' servers sometimes.
-b.
Re:Filter (Score:2)
Re:Filter (Score:3, Insightful)
No, just block port 25 to all servers other than the ISPs for dynamic IP addresses.
Some ISP's do this. And this is reason I can't set up a SPF record for my domain. All my parents outgoing email would fail and their ISP (AT&T) doesn't publish any SPF records (and what if they change ISP's, something they have been talking about doing). Considering they are on dail-up, buying a static IP is out of the question. Getting AT&T to unblock them is impossible (I've tried).
Re:Filter (Score:3, Insightful)
> dynamic IP addresses. If they do not want to use their ISPs
> mail server, they can purchase a static IP, or set up a proxy
> with a different port.
I did purchase a static IP and pay for it on the monthly bill. Yet half of my outgoing email is still returned as "rejected for possible spam".
Maybe your provider keeps "static" IPS separate from "dynamic IPs". Mine appearently doesn't (just assigns me one of his IPs as static). Or the RBLs are too ignorant to learn about static and dynamic IP ranges of smaller countries like the one I live in (Spain, Europe).
So, go ahead and do whatever you want on your own server. But please DO NOT encourage other people to block so-called "dynamic" IPs, because this blocks most non-US static IPs as well.
I mean, that's like blocking asian senders. Quite efficient, unless you are asian abroad and want read your friends mail.
Marc
Re:Filter (Score:3, Insightful)
Re:Filter (Score:2)
you are missing the point (Score:3, Insightful)
Re:Filter (Score:5, Insightful)
As Heinlein said, the answer to any question beginning with "Why don't they..." is "money". Presumably the ISPs figure you'll just take your business and your bot-infested computer elsewhere. But maybe if a few major ISPs got together and agreed to all do it, they'd cut off enough spam to make their customer bases happier, and attract back those customers who gave up in frustration.
Re:Filter (Score:2, Troll)
While I think ISPs should be able to do anything they want with the connections they sell, as long as they are up front about the terms, I will gravitate toward the ones who meddle less.
Re:Filter (Score:3, Interesting)
Re:Filter (Score:3, Interesting)
You're better off trying to force rate limit outgoing email, keep state on your clients, and trying to cut off outgoing SMTP for abusive hosts. However, you would then be monitoring traffic, and that might not work out so well, either.
Re:Filter (Score:2)
Isn't similar approach used to prevent spamming message board and other online communities? Basically there are sensible natural limits for a human-generated messages to be written and sent. Even if bots adapt and start mimicking human behavior, we still get at least a little offload and spammers get to have more work to do and worse statistical odds against them.
You are right that we can never win completely, but we can make things a little more bearable.
Re:Filter (Score:4, Insightful)
Re:Filter (Score:2)
That's likely a big part of the reason big ISPs fail to monitor for botlike traffic, they are too cheap. Last night I had to call AT&T about an email sending and usenet authentication issue affecting my wife. I first had to hurdle the tech support in India with a pretty hard to understand accent who didn't know what usenet was. I was finally escalated to a guy in Texas with another heavy accent, but at least I could understand the Texas drawl! They haven't yet solved the usenet issue but at least they were able to understand it and duplicate it.
These ISPs are trying to save money by using India to provide support to their US customers, no wonder they are trying to save money on monitoring for bots and excessive spamming by their customers. The funny thing is they have to spend money to block spam for their customers, but they spend none stopping it from being sent. And they don't get paid for the extra bandwidth used by the botnets.
They are the cause of the botnets success at causing chaos on the internet. If they would act in a reasonable reputable way and monitor that traffic, cut off infected accounts and demand their customers avoid running bots for Russian spam gangs it would go far toward reducing the spam in the world.
outbound email only on request (Score:3, Interesting)
I'd have a web-page for my customers so they can click things such as:
Outgoing Email:
[x] web based [turn on port 80/443]
[x] through remote-login [turn on remote-login ports]
[x] through us [turn on mail ports, restrict to our servers]
[ ] through another server: ______ (specify list of outgoing mail servers)
[ ] through any server
+-- [x] check here to turn this off after 7 days (recommended)
x's show defaults.
Checking the last two would bring up the relevant sections of the AUP/TOS as a reminder of the strict "no spamming" and "we will suspend outgoing mail and charge you cleanup fees if your machine is taken over" clauses.
Re:outbound email only on request (Score:3, Funny)
Re:Filter (Score:2)
If their computer stops sending port 25 mail for 15 minutes (or perhaps they click a button on the webpage saying "I've fixed it"), then they're unblocked until they send excessive mail again. This is more work than the brute force approach of just blocking the port, but I think it is better for the internet in the long run. It also allows people who want to avoid their ISPs dog slow mail server (8-12 hours to process an email?!?) an option.
Re:Filter (Score:2)
8-12 hours?! Sounds like someone put an internet in your tubes! Back the truck up!
Hasn't worked for me (Score:3, Funny)
Fortunately, I should have significantly more money to invest shortly, as soon as I get a rather large sum from a new online friend and business associate and new friend, Mr. Emmanuel Obi from Africa, of all places.
Re:Hasn't worked for me (Score:2, Insightful)
Shorting won't work... (Score:4, Informative)
Re:Hasn't worked for me (Score:3, Interesting)
Infection vs Market Share (Score:4, Insightful)
Re:Infection vs Market Share (Score:2)
Re:Infection vs Market Share (Score:2)
Re:Infection vs Market Share (Score:3, Insightful)
I think the OS X, Linux, FreeBSD "I am invulnerable because of OS I run, I don't need security updates or basic sense of security" will cause problems soon just like phishing.
Re:Infection vs Market Share (Score:2)
Where does phishtank keep stats on webserver used and OS its run on? I didn't see that data anywhere on their site. Are you going to netcraft and looking up all 1,429 online phishing websites? If so, do you have a breakdown by OS and webserver?
Re:Infection vs Market Share (Score:2)
In fact, you can freely use their database to do such research yourself, that philosophy of the site make us "work for free" as everything is open and available to public/developers.
You can verify phishes and you will figure the deal with outdated kernels/php and false sense of security.
Re:Infection vs Market Share (Score:2, Insightful)
-matthew
Re:Infection vs Market Share (Score:2)
If you use the netcraft, they of course run outdated kernel and apache with easy to guess passwords (I assume the pwd part)
Whoever got the largest marketshare gets attacked, it is not a "Windows" excuse/apology of course.
That was a bad picture (Score:5, Funny)
Rebuild the email protocol (Score:5, Insightful)
Re:Rebuild the email protocol (Score:5, Funny)
(x) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Re:Rebuild the email protocol (Score:5, Insightful)
Thank you for being a wimp.
Re:Rebuild the email protocol (Score:3, Interesting)
(hint) (x) Huge existing investment in cars
Re:Rebuild the email protocol (Score:3, Insightful)
Thank you for being a wimp.
Re:Rebuild the email protocol (Score:2, Insightful)
Re:Rebuild the email protocol (Score:4, Funny)
( ) Nope, you're wrong
Re:Rebuild the email protocol (Score:2)
Whilst I agree in spirit, the single problem with email now is that you have no way of knowing if a sender really is who they say they are. I can send an email to you which claims to be from Steve Ballmer and you have no way of knowing 100% if it's real or not.
I'm not sure how this would be solved with a redesign either. The only way I can think of doing it is to have a mandatory digital signature attached to the email, so you can lookup exactly who signed it and prosecute/disable signature if spam. If someone sends an email with an invalid signature, it gets rejected by the mailserver. Downside is that you need a central body to supply these signatures. Verisign perhaps? This would then mean a charge for anyone who wanted to use email, but that might be a good thing. Once you have an organisation though, you have corruption, and spammers will find a way to infiltrate this.
There's also the issue of getting serious momentum going. I could set up a company, and broker a deal with Versign or someone to supply and keep a lookup database of digital signatures. A few geeks will sign up and set their mailservers to reject all mail that doesn't come with a valid signature. Thing is, they'd have to get a lot of major e-tailors to sign up to this as well, otherwise every time I buy something from Amazon, and they want to talk to me about it, I'll have no idea.
Just kicking ideas around. :)
Re:Rebuild the email protocol (Score:2)
The main problem is that you would need to get everyone to get on board with it all at once.
However, I don't see why companies do this internally as it is.
For internal communication you should be using a secure system and anything external just gets put in a different mailbox or system. Still... Its a great deal of work.
Re:Rebuild the email protocol (Score:3, Interesting)
I think the opposite is true. If people have the option of trying the New, Improved, Secure Email without abandoning their current routine, a gradual transition might have a fighting chance. Lots of people with traditional phones also have SIP and VoIP and such. Heck, with a bit of finesse, new protocol plugins could be integrated into existing mail clients.
Digital signatures could come in dual-varieties: Authority-issued and self-issued. Clients would only download headers & sigs, then decide what bodies to download via sig policy. By default, a client would accept mail signed with an authority-issued sig automatically, but would accept self-issued ones only if the recipient whitelists the sender. Outbound message bodies from unknown sources (self-issued & not whitelisted) would have to sit on the originating outbound server and wait, pending certificate acceptance. Unknown sources would have low connection quotas; upon a flood of sig packets or a large distribution from an unknown source, intermediate servers would refuse connections from that source pending a positive sig disposition.
Domain Keys Identified Mail (Score:2)
It is time to rebuild the email protocol.
We may have to settle for working on a fix. The industry isn't going to replace such an entrenched protocol easily, even if that may be the best solution.
A large part of the problem is lack of a good, entrenched E-mail Authenication [wikipedia.org] standard. The IETF's Domain Keys Identified Mail [dkim.org] is working on fixing this, but that will take a while. DKIM is pretty much the standardization of Yahoo's DomainKeys protocol. [yahoo.com]
My guess, is that we will have to wait at least a year before DKIM comes out with any type of RFC document. At least some of the big players including Yahoo and Google will support this protocol right off the bat. Hence it should have a good chance at solving the current lack of any email authentication.
Of course we know the spammers will adapt as well...
thats okay, but how to detect this infection? (Score:4, Insightful)
If you have to ask... (Score:2)
Steps:
1) Get rid of XP. If you're going to run Windows, then run Server 2003. Try to get your company to pay for it if you can.
2) Don't disable the "MSIE Enhanced Security Configuration", whatever you do.
3) Use Firefox or Opera, never use IE, unless absolutely necessary (Windows Update)
4) Always run as a limited user. Never as a user with Administrator access. Right-click on installers and say "Run as... The Following User: Administrator" to install them.
5) Get yourself all of the SysInternals tools you can get your hands on. This can help you monitor file, registry and process access to look for unexpected behavior. Always check online to see if something is "normal" though before taking action, you don't want to kill your system accidentally.
5a) Software that requires administrator privledges to run iss probably not worth using anyway. You can special case essential software by using "Run as..." or by giving your user permissions on key files that it can't access. Use RegMon and FileMon in SysInternals to determine what the application is trying to access and give your user (or the Users group) the appropriate permissions on those files/registry keys.
6) Don't use software you haven't heard of. Free software is usually okay if it's open source, or you can independantly verify its reputation as safe and without adware or malware. Most $30 and below shareware you find through quick google searches is garbage and usually a malware vector, don't buy it.
7) Don't use Outlook to open mail. Never open unexpected attachments. Always turn off HTML email support and use plain text viewing instead.
8) Get a virus scanner. Don't use the home versions of McAfee or Symantec, they're garbage. The Norton PC suites are garbage too. Personally I use Symantec Corporate. You should try AVG, BitDefender, or F-Prot. The free versions are decent.
9) Install and periodically run SpyBot Search and Destroy.
10) Don't bother with a 3rd party firewall. Use the builtin windows firewall, or an external device. Learn how to properly use them.
11) Investigate Windows OneCare offerings. I haven't used them, but I hear they are okay. It's a service though, so pony up the cash.
This is what you have to do to protect yourself in Windows. It's no wonder people have issues.
Re:thats okay, but how to detect this infection? (Score:3, Informative)
I'm glad I run my own mail server (Score:3, Informative)
Hit the nail right between the eyes. (Score:5, Insightful)
1. Someone comes up with a defense mechanism that works well.
2. It works so well that more people use it.
3. It becomes popular enough for the bad guys to beat, so they do.
4. The defense becomes useless, forcing someone to come up with a new defense.
5. Goto 1.
greylisting+dnsblocking f0r teh win. (Score:2, Interesting)
Except greylisting+dnsblocking, for which there is no defense.
If everyone greylisted, spamming operations would slow down to a crawl. If the go full speed, then the only sites which will accept their spam (or better, to escape detection, temporarily reject it after DATA) are spamtraps, which means the rest of the world becomes instantly unavailable because of dnsblocking.
If they have to slow down.. well, we win.
It's just beautiful.
Re:Hit the nail right between the eyes. (Score:3, Interesting)
Although you may be right that the bad guys will eventually beat it, in the meantime, there are significant waiting periods involved which will likely slowdown the penetration of the spam. This penetration rate is what makes spam profitable. It basically forces servers to build up trust between each other similar to how people build trust with each other... i.e. "I've worked with this person before on this project, so I can believe in him/her" or "I've never worked with this person on this project, so I'll treat them with suspicion until he/she has proven her/himself"
Re:I'm glad I run my own mail server (Score:2)
eweek confirms it: Linux and Mac are dying! (Score:5, Funny)
Re:eweek confirms it: Linux and Mac are dying! (Score:3, Funny)
Re:eweek confirms it: Linux and Mac are dying! (Score:2)
Re:eweek confirms it: Linux and Mac are dying! (Score:2)
Re:eweek confirms it: Linux and Mac are dying! (Score:2)
Re:eweek confirms it: Linux and Mac are dying! (Score:5, Insightful)
Windows 95 (Score:4, Funny)
C'mon (Score:3, Insightful)
As a proud user of Kubuntu, I can relate to
99.95% Windows (Score:2)
According to their chart, 99.95% of the systems on the botnet run Windows in some form. Unless all other desktop operating systems only have .05% combined market share, maybe there is a correlation between the security of Windows and the botnet problem.
Re:C'mon (Score:4, Insightful)
If these bots have control over 'the most secure Windows yet' [com.com], then that is worthy of note.
Mark
PS Yes, I know the link is from 2004 - but they've not released anything since, so it must still be true, right?
Re:C'mon (Score:2)
Probably the bigger reason for this specific case is that the spam-thru trojan doesn't run on anything other than a windows! So the stupid people trying to compare it the infection rate of any other OS is very, very *stupid*.
Re:C'mon (Score:2)
Programs should be installed system-wide by an administrator (you?), and from a trusted source (signed apt repositories).
This is a huge difference with Windows and its security model. By default on Windows, all ".exe/.vbs/etc" files are executable.
Re:C'mon (Score:2)
No
I'm just surprised that those spams still ... (Score:4, Insightful)
Which leads me to wonder about the folks who actually believe that those penis enlargement pills work.
And as far as the "pump and dump" spam goes, are there folks who beleive those spams? Or are they of the mindset of the "greater sucker"? Meaning, if I buy this stock now, after this spam circulates, there will be others who buy this shit stock and push up the price allowing me to make money.
Yeah, I know the guy who originates the "buy" recomendation is hoping for everyone to buy the stock, but what makes some of the recipients think they'll make out?
Re:I'm just surprised that those spams still ... (Score:3, Interesting)
There are plenty of idiots out there with access to both internet and credit cards. Really.
And a lot of them also think that if someone has your email, they must know you from somewhere.
When I worked at a brokerage firm, people used to call me and ask for advice (which I couldn't give, not being licensed) on how much to invest in whatever stock they got emailed that day.
Okay, so now there are statistics..... (Score:3, Interesting)
Right now, the later is more the case. If MS had to upgrade or recall all XP products, it would cause a large harm to the economy, not just MS's bottom line. Think of what would have to be spent on the upgrades or change outs?
Too many people have invested in MS products to just shut it down, and just like England won't wake up one morning and start driving on the right side of the road, MS products will remain in service. (I'm not trying to imply that the left side is the incorrect one, just illustrating the size of the problem)
Reports like this do seem to show MS in a very bad light, but how it gets fixed will be even more interesting. When government types want to show they are doing something about spam, will they do anything to make MS responsible, or make MS fix it? Probably not, so the real answer to spam, or answers, is to implement measures that do not rely on the end user, or the end user's OS to fix it.
IMO, This means that ISP's are going to have to sandbox segments of their networks to throttle spam, and that cost will be passed on to consumers, or possibly will be borne by the ISP for bragging rights about having less spam than any other ISP, in much the same way that the Bell companies used to do advertising about what they are spending to improve services for consumers.
This also leaves me with a suspicion about the marketing team for Vista? How better to fix XP SP2 than to upgrade to Vista?
Re:Okay, so now there are statistics..... (Score:2)
In order to make it acceptable, an ISP could start by dealing out points first (adding or subtracting, like traffic violations cause points to be taken off your license in some countries). They could give positive rewards for not sending spam and eventually charge people when they do send spam.
I don't see any other way, because people just don't learn if it's for free.
Simon
nmap? (Score:2, Interesting)
i mean i use nmap, and other portscanners myself but the OS detection
is just a sane guess and far from perfect
I also wonder what the 0.05 % of other OS'es are because i do think
this malware is written on the win32 api, so i rather guess these were inconclusive
OS fingerprinting and/or *Nix systems running a virtual machine or
if this is possible (i'm not trying to troll here)
And if this is possible i do want to know what kind of measures the users of these non conclusive
Os fingerprinting scans used because
Anyone has some tips about this in particular
How do i fool commonly used portscanners etc
Re:nmap? (Score:2, Informative)
It's amazing how complex pump and dump schemes are (Score:3, Interesting)
As much as I think they are scum for doing so, you have to admit that was pretty creative....
how effective is it? (Score:2)
-Rick
Re:how effective is it? (Score:2)
Re:how effective is it? (Score:3, Informative)
Just to reiterate what these scum are doing:
1. Buy some really cheap stock at a really cheap price.
2. Hype it to victims.
3. Sell it to victims at inflated prices. Pocket the profit.
4. Victims are now stuck with a worthless stock that they can only sell at a large loss.
They usually work for the pump and dumper. Everybody else gets screwed. That's why it's a scam.
The companies are real, and you can look them up on NASDAQ [nasdaq.com] or Pink Sheets [slashdot.org]. I've looked a few of them up, and they all show an enormous spike in trading, a big spike in price, then a rapid fall.
While there are ways to make money on declining stock value ("short selling"), you can't do it with the stocks these filth are hyping.
...laura
Re:how effective is it? (Score:3, Informative)
What is the Top500 ranking? (Score:2, Interesting)
Thad
How many of the 70,000 are elderly? (Score:3, Interesting)
I recently helped an elderly neighbor secure her computer (I was paid for this service, and I make sure I do get paid every time I get called over for help) by installing some good firewall and anti-virus programs (as well as setting up Firefox and Thunderbird for their primary browsers. When I ran a virus scan on her computer (I installed AVG, as her McAfee subscription had expired), I found several viruses and malware programs on there, all of which I removed, which came with games she downloaded (stuff like mahjong and solitaire). I regret not writing down what viruses she had gotten infected with, so I could find out what she did.
I did the same thing on my grandmother's computer as well (when she was alive), and odds are there are a lot of seniors who are online and engage in a lot of bad habits that we know are bad - including running IE with minimal protections, opening strange attachments, and so forth. This is not a new problem, and, frankly, a problem that only education (or getting 75% of seniors to switch to Mac OS or Linux) can fix.Short positions (Score:2)
govt action (Score:2)
Re:govt action (Score:2)
How do these bots spread? (Score:2)
Exploits in the OS? (why arent ISPs blocking ports like MS-RPC and MS file sharing (things that shouldnt be going out over the internet anyway) for example)?
Is there something the SEC can do? (perhaps finding the people who buy the stock, pay the spammers to send the spams, sit back and watch whilst their stock becomes a lot more valuable and then proceed to sell it all. (IANAL or a stockbroker but I dont think you can buy/own stock without at least some way to tell who you are).
Re:How do these bots spread? (Score:3, Interesting)
Another factor is that most of the very cautious folks I deal with have a real simple solution - no attachments, period. ISP's cannot implement something like that. They can block executable attachments, but that isn't really effective any longer. From what I understand most of this doesn't really fall into the "virus" or "worm" category but is instead human-installed. Dumb person clicked on the link or attachment. Blocking all instances of this would be pretty tough without having major impact.
Why would the SEC care? There is no fraud here. Nobody is getting hurt, except those people buying stock and expecting to make a quick profit. They don't make their quick profit and maybe lose money. If you play with the stock market like that you are going to lose money. Period. It isn't the government's job to keep you from doing stupid things with your money.
Subject (Score:4, Insightful)
Where's law enforcement on this? (Score:4, Interesting)
Those guys shouldn't be that hard to find with enough law enforcement effort. Get a credit card from a cooperating bank. Put a trace on it. Buy some Viagra from a spam. Watch where the money goes, which is probably some bank in a high-crime country. Visit the bank and talk to them. Threaten to have their abilty to process credit cards cut off. Pry the actual payee out of them. Discover that it's another intermediary and start over.
This is what we pay the FBI for. This is why the FBI has field offices outside the US. This is why the Financial Crimes Information Network [fincen.gov] exists.
The FBI's Internet-related criminal enforcement [fbi.gov] unit has gotten soft. They sit up in Baltimore and send out child pornography, then go after the people they've entrapped. The process is even mostly automated [fbi.gov] now. That's an easy way to get their stats up, and fits the Bush administration's "regulate sex, not business" mindset, but doesn't solve crimes that have victims. Something to push on after Jan. 20, when the Democrats take Congress and can start asking hard questions of the executive branch.
Re:Where's law enforcement on this? (Score:3, Interesting)
The FBI has an office in Moscow [usembassy.gov]. And smaller offices in most of the capitals of the former Soviet sphere, including Bucharest, Kiev, Prague, and Tbilisi. They have to work through the local authorities, which they routinely do, with moderate success.
Re:Class action against Microsoft (Score:3, Insightful)
You can point your finger all you want at the maintenance worker who didn't read the warnings in GIANT PRINT - but Boeing was still sued and paid.
Boeing was not being irresponsible. I do not think the same can be said of Microsoft because many of the security problems have been pointed out CONSTANTLY since before 1995.
Re:Class action against Microsoft (Score:3, Insightful)
"Thats crazy... that's like going after P2P admins for users sharing illegal content. It would never fly."
It's not like that at all, but that's due to a distinction that's apparently too fine for some people.
Take a look at your favorite torrent tracker. Unless it's legaltorrents or something of its ilk, you know they set it up to capitalize on the huge demand for pirated material (and to make ad money off same), you know most of the traffic is pirated material, and you know that the admin knows this. Running a tracker with the belief that you will simply be able to tell the authorities that you're "not responsible for your users" might make perfect sense to a 14-year-old, but they're often unaware of a crucible in the legal profession known as "the laugh test." If it has the proper locomotion, vocalizations, and behavior, smart people don't need to be told that it's a duck.
Now, it might be funny and all to say that yes, Microsoft really does sell XP primarily for the purpose of running botnets and sending spam, but again, you, I, and everybody else know that it's simply not true. Again, the laugh test prevails.
Re:How can we compete? (Score:2)
Something runs invisibly in the background, auto updates (with out informing the user) etc etc etc.
Now infect as many computers as you can (And ofcourse have it propigate itself).
There yah go, we have solved the malware problem!
Note: I don't ACTUALY endorse this idea. I don't believe in the ends justifying the means. Personaly I think that computer manufacturers/MS (and MS has been doing this, and I am glad that they have) should step up to the problem. I also think that our education system should step up and educate users (aka, the general population) about basic computer security.
Re:How can we compete? (Score:2)
Seeing the complexity of a botnet like this is scary. The people responsible for this kind of thing are intelligent, always evolving and don't care about any of the repercussions of their actions.
Yeah, but you should see the security guys... way smarter.
It seems that any proposed solution we can come up with to combat spam will just be worked around shortly after it is implemented.
That depends upon the nature of the solution. This is not an unsolvable problem. It is mostly a matter of motivation.
The software uses proxy servers to avoid blacklisting bot IP addresses, harvests email addresses from the infected machines and randomly changes images used in image-based spam to throw off anti-spam technologies. The people behind this are clever. How can we compete effectively?
Two days ago a large number of enterprises and ISPs were handed a signature that lets them find and monitor this trojan on their networks. I can pull up a list of infected hosts for a class A right now. The problem is the effort needed to fix all these machines and make them harder to compromise in the first place. That begins with fixing Windows.
Now don't get me wrong. Windows is not that much worse than average for trojan detection and containment. But, most other OS's don't have much of a problem with them, so they aren't really driven to implement solutions that might inconvenience them in other ways. Also, some of the UI choices in Windows are very poor and make creating a real solution harder. Make no mistake, this is a security problem with a very large user interaction component. The normal half-assed UIs MS creates won't cut it. MS should have implemented a system to mitigate this problem in 2000 at the latest. They haven't because they are not motivated to do so. It just doesn't cost them many sales.
My solution to this problem is simple. Use the free market to motivate the creation of several solutions and let the best one win. Just enforce the antitrust laws against MS and break them into several companies forbidden from any unmonitored communication or collusion. At least two companies should have complete rights to the Windows source code and IP. Greed will take care of the rest. The one to give customers what they want will get a lot more sales and since interoperability will no longer be a lock-in mechanism other OS's like Linux, OS X, and newcomers will be able to take market share as well. This will not only spur innovative solutions to this problem, but it will shatter the monoculture that makes exploiting huge numbers of machines with one hole so easy.
This will happen about the time our electoral process is reformed and the legalized bribes in the form of campaign contributions and lobbying are declared treason and punishable by death for both the politician and lobbyist. That is to say, this will probably never happen.
Re:I don't think you get it (Score:3, Interesting)
The problem isn't "Windows is insecure", the problem is that people are given a general-purpose computing instrument and they want a web & email appliance.
Sort of. People want a little more than the web and e-mail. They want word processing, games, and maybe a few other applications. But OS's are not designed to meet the needs of the common user, and they should be set up with defaults that make sense.
Most of this stuff is not installed because of security exposures in that allow stealh installations because of exposures in email readers and web browsers. It is installed the same way the user would install any other "desired" program.
Actually, the majority of infections are the result of worms that have no user interaction, but this particular threat is a trojan. Trojan's can be mitigated but it requires more finely grained security, a better UI, and better defaults. For the average user, no program not pre-instaled should have access to send mail or access your e-mail address book without the user specifically enabling that behavior.
They user just doesn't know they don't want it.
The user does want it. People want to run untrusted executables. They want to open random, untrusted data. The problem is that Windows does not properly tell them what is data and does not let them easily run untrusted programs in a restricted sandbox. Ask the average user if double clicking on "nekkidladies.jpg" lets something send thousands of e-mails from their computer. Most think it can't. Most think nekkidladies.jpg.exe should be shown as a program instead of data. Most think even if it is a program it should not be able to send e-mail without the OS telling them that is what it is doing and giving them the option to stop it. This is the failure of the Windows. It should restrict these behaviors by default for unsigned/verified applications downloaded from the internet.
Solution? Give people appliances not general-purpose computers.
It won't work. People want to run random programs and games and whatnot. The solution is not to remove functionality, but to restrict functionality by default and present options to the user with real information and a well made GUI. People should have a choice of e-mail clients, but at the same time they should be given a choice whenever a program they install wants to start sending e-mail. "Program 'Verious 2.7' wants to access your e-mail address book and send e-mail messages (stop it from accessing my addresses and sending mail)(let it access his data and send mail once)(Let it access my addresses and send mail always)(Advanced options)."
The average user can understand that and make reasonable choices. OS's need to be coded to give them that info and that granularity of choices with a good UI.
Re:where does it end? (Score:2)
Think of all the computer users out there who did nothing more than purchase a brand new PC in order to use it exactly for its "intended purposes". (writing school papers, getting on the Internet to read web sites and do email, and play a few games) The fact that they get hijacked and serve as part of a bot-net while being used as-advertised means the fault doesn't lie with the end-user!
Put yourself in the shoes of "Joe User" for a moment, if you will. You know nothing about software programming. You simply purchased your new Dell/HP/IBM/Acer/whatever because it was recommended to you as a "good computer", and your kid's school said they needed one for homework assignments. Now, you're looking at being charged with a crime for not properly securing a flawed Microsoft OS against someone's botnet?? What would constitute "properly securing" the machine, anyway? In court, you'd certainly be able to argue that this amounts to a demand you start a new career as a software developer and get hired at Microsoft, or else you can't comply!
Re:where does it end? (Score:3, Insightful)
So a law that mandated safe computing clearly would not be out of the question, and would not be "blaming" those computer users who did nothing more than purchase a brand new PC in order to use it for its intended purposes.