Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Security IT

FBI Releases Results of Operation Bot Roast 189

Posted by ScuttleMonkey
from the notification-flagged-as-spam-and-deleted dept.
coondoggie writes to tell us that the FBI has released the findings of their recent botnet study and have identified over 1 million botnet crime victims. "The FBI is working with industry partners, including the Computer Emergency Response Team Coordination Center at Carnegie Mellon University, to notify the victim owners of the computers. Microsoft and the Botnet Task Force have also helped out the FBI. Through this process the FBI may uncover additional incidents in which botnets have been used to facilitate other criminal activity, the FBI said in a statement.Bots are widely recognized as one of the top scourges of the industry. Gartner predicts that by year-end 75% of enterprises 'will be infected with undetected, financially motivated, targeted malware that evaded traditional perimeter and host defenses.'"
This discussion has been archived. No new comments can be posted.

FBI Releases Results of Operation Bot Roast

Comments Filter:
  • Skip the spammy site (Score:5, Informative)

    by Anonymous Coward on Wednesday June 13, 2007 @12:59PM (#19494457)

    and go straight to the source
    http://www.fbi.gov/pressrel/pressrel07/botnet06130 7.htm [fbi.gov]
    • Re: (Score:2, Funny)

      by easyTree (1042254)

      The majority of victims are not even aware that their computer has been compromised or their personal information exploited,
      Indeedy, I seem to recall, a while back, 'hearing' of someone running an xdcc server on an fbi box..
      • by RedToad (972413)
        Having scanned through the entries in this topic, I see it has moved on from the tired old "bash Microsoft" and "extol Linux" rot. Then there are a few suggestions about how to track botnets and shut them down. The FBI 1 million infections number has been quoted as a US-centric benchmark.

        A few months back a botnet herder in Europe went down for running ONE 1.5 million seated botnet. The global botnet infection numbers are therefore in the tens to hundreds of millions of infected machines. Forget about wh
    • by HTH NE1 (675604) on Wednesday June 13, 2007 @01:10PM (#19494641)
      Anyone else think this will start a new wave of phishing where botnet controllers send e-mail messages out forged as coming from FBI.gov to people telling them their machines are infected with bots (linking to the URL in parent) and that they need to install the program attached to the e-mail that is claimed to remove the offending software but in fact turns your machine into another zombie?
      • by yuna49 (905461) on Wednesday June 13, 2007 @02:35PM (#19495935)
        It wouldn't get too far in our mail system. We don't accept mail with From addresses in fbi.gov or irs.gov unless they originate on those agencies own servers. Mail coming from a server in rr.com claiming to be "From: fixyourcomputer@fbi.gov" is going to be dropped on the floor.

        There have already been tons of viral messages from these two domains over the past few years. One of the big Windows worms ("Slammer," if I recall correctly) was often mailed out with an fbi.gov From address. Forging irs.gov messages is common among phishers.
        • by bob_herrick (784633) <bob.herrickNO@SPAMgmail.com> on Wednesday June 13, 2007 @03:04PM (#19496459)
          FTFA

          The FBI will not contact you online and request your personal information so be wary of fraud schemes that request this type of information, especially via unsolicited emails. To report fraudulent activity or financial scams, contact the nearest FBI office or police department, and file a complaint online with the Internet Crime Complaint Center, www.ic3.gov.
          • by HTH NE1 (675604)

            FTFA

            The FBI will not contact you online and request your personal information
            But you don't need to provide any personal information to install a trojan.
        • Basically, what the parent is talking about is SPF - Sender Policy Framework [openspf.org]
          • by yuna49 (905461)
            In our case, we instituted these rules for fbi.gov and irs.gov long before SPF came into being, but yes, SPF would help alleviate this problem nowadays.
          • by Intron (870560)
            Nope, no spf on fbi.gov or irs.gov.

            dig -t TXT fbi.gov
            QUERY: 1, ANSWER: 0

            dig -t TXT irs.gov
            QUERY: 1, ANSWER: 0
            • I didn't say those hosts had SPF records, what I was saying is that what the parent is doing is basically a simple form of SPF.

              And yes, they should have those records. There are naysayers about SPF's effectiveness with valid arguments, but I think the "big fish" on the Internet should have records on their hosts.
            • by yuna49 (905461)
              Not too long ago one of our clients was unable to receive mail from some fellow attorneys in the IRS. Turns out that their outbound server not only doesn't have an SPF record, it didn't even have reverse DNS resolution configured! So all the mail from the attorney at the IRS was blocked by our irs.gov rule. I now have a special whitelisting rule for the subnet in which that server resides.

              I was impressed by the level of incompetence displayed here. Hell, some major email services like AOL won't usually
        • We don't accept mail with From addresses in fbi.gov or irs.gov unless they originate on those agencies own servers.
          Well, based on the report, it is entirely possible that the messages WILL originate on those agencies' own servers.
      • Usually it's pretending to be from Microsoft or AOL or your ISP or McAfee (though some of the mail I get claiming to be from McAfee is because I'm using a different anti-virus product at home this year :-) So the FBI is another authority that scammers can tell the gullible that they're working for.


        If enough different authorities get forged, maybe the gullible will believe them less often...

      • by Adam9 (93947)
        FWIW, here's the email I received from Microsoft with certain information removed.

        -----BEGIN PGP SIGNED MESSAGE-----
        Hash: SHA512

        VIA EMAIL:

        Date: --- May 2007

        URL address: IRC://----/#----

        Dear Sir or Madam,

        Microsoft Corporation has received information that a host/domain name registered to/by your company is acting as an IRC server controlling a network of computers compromised with an unauthorized backdoor, commonly referred to as a 'botnet'. Botnets are often controlled in violation of criminal laws and co
  • by QuantumG (50515) <qg@biodome.org> on Wednesday June 13, 2007 @01:03PM (#19494535) Homepage Journal
    There would be an RFC for getting an email address for an ip address and it wouldn't take an expert to figure out how to contact the right person when you see a machine doing something it shouldn't.

    • Every IP address belongs to a block that has been assigned to some ISP.

      Simply find the block containing that IP address and then find the ISP controlling that block.

      Now, whether the ISP is going to spend any time (time == money) on dealing with the problem is the next issue.
    • IPs resolve by WHOIS if they have been properly SWIPed.
    • by elrous0 (869638) * on Wednesday June 13, 2007 @02:12PM (#19495603)
      I thought of myself as an expert until a few months ago. I have good antivirus/malware software, only use Firefox, never do stupid things like opening attachments with executable extensions, etc. Hell, I even have a wired network in my house to protect against wardrivers.

      Then a few months back I get word from my credit card company that someone had hacked into my account online (using my username and password), changed my billing address to someplace in NJ, then proceeded to try to charge a bunch of stuff on the account (luckily the CC company caught on to them and locked it down). I couldn't figure out how they did it.

      Then a few months after that, I started to notice my computer acting strange. My router would be showing HEAVY activity even when I wasn't doing anything and Windows wasn't downloading updates. Eventually, I realized that someone must had botted my computer (still don't know exactly what they were up to, but I'm sure it involved sending out letters from an innocent Nigerian official just wanting people to help him transfer some money). That's how they got my account info for my credit card.

      Anyway. I wiped the whole system clean (even tried out Linux for a while, but didn't care for it) and now the problem is gone. But it still makes me nervous as Hell. What drives me crazy is that I can't figure out how they did it. But, as a hacker friend once said: If it's on a network, it can be hacked--period.

      • Oohh, oooh, analogy time!

        "I accidentally got my girlfriend pregnant by pulling out too late. After giving the kid up for adoption, we tried using a condom, but I didn't care for it, so now I'm back to pulling out, and hoping she doesn't get pregnant, because I really don't know what happened the first time."
      • Found your problem (Score:4, Informative)

        by symbolset (646467) on Wednesday June 13, 2007 @04:15PM (#19497601) Journal

        ... and Windows wasn't ...

        It's right here.

        ... I wiped the whole system clean ...

        That's a good start. If you're going to insist on using Windows, wiping and reinstalling on a regular basis is a must. I recommend at least annually. More often if you use Yahoo search, flash games or shareware. If you use AOL or MSN and chat or IRC, you may as well boot from the Windows install CD each day.

        Getting it set up the way you like it, and creating an "image" file of that setup with Symantec Ghost or something like it makes the process a lot less painful.

        Or you could try actually solving the problem [ubuntu.com], but I note from your post you don't care for that answer for some non-specified reason.

        If you do ecommerce from a platform you know to be insecure, don't expect everyone here to lobby for legal solutions to your technical problem.

        • If you're going to insist on using Windows, wiping and reinstalling on a regular basis is a must.

          From TFA

          Microsoft and the Botnet Task Force have also helped out the FBI.
          It's nice to see Microsoft hasn't taken sides on this issue. They're helping the FBI too.
      • by Intron (870560)
        What mail client do you use?

        As the magic 8-ball says: "Outlook not so good"
      • Yup, seems the only thing to do is to keep your data on another physical / logical drive and reinstall frequently.

        I do it once a month.

        Slipstreamed and updated DVDs (keep up to date by using a Linux partition / virtual machine) ease the pain.

        Oh, a decent firewall (not M$) helps too... You'll (probably) spot the nasty stuff trying to get out.

        Before the 'use a virtual machine to surf' fanboys jump all over me - yeah, I do that too...
      • You didnt whipe your computer when you found out your online bank account was hacked. wow.

        This is why there will always be botnets out there. People like the parent that just dont care.

      • only use Firefox

        Do you use NoScript? There have been some Firefox vulnerabilities of late, and everything has zero-days in it.

        You also don't mention your firewall/NAT setup. I assume you know one doesn't run a Windows machine naked on the Internet.

      • by camperslo (704715)
        Many reasonably well managed Windows machines still get hit. It is also possible to be infected with something not detected by standard antivirus programs, or by something that does not currently show any obvious side-effects. To lower risk as far as possible, avoid using any Windows machines for browsing or accessing any internet applications.

        If you must access the internet from a machine on the same network as a Windows computer, consider doing so only from one running another OS. Use of browser plugin
  • by DamonHD (794830) <d@hd.org> on Wednesday June 13, 2007 @01:03PM (#19494555) Homepage
    I would have thought that a nice call from the FBI to the CxOs of the main appropriate ISPs and a selection of those users on the fastest connections (ie with the most capacity to be damaging) would have a salutary effect.

    And then a follow up with negligence-related charges for those who refused to give a f**k maybe?

    Rgds

    Damon
    • Since the FBI can identify the machines to the ISP, it should be simple for the ISP and FBI to work together to track traffic to/from those machines.

      First off, put them on their own network. Sure, this might clue the Zombie Master that something's happening, but maybe not.

      Then, monitor the inbound/outbound traffic. If they're doing things like sending spam, block it. A DDoS attack? Block it.

      Then work backwards to find the sites controlling the zombies.

      It would probably be a LOT cheaper to do it that way tha
      • Re: (Score:3, Insightful)

        by plover (150551) *
        The problem with this approach is it's borderline vigilantism.

        I'd love it if ISPs would set snares for bot-infested computers, and technologically it's not hard: nobody at home-66-99-11-22.comcast.net should ever be forwarding packets from any external networks, let alone a hundred random networks a second. And some ISPs do trap that traffic and block it. But apart from DDoS attacks, what constitutes "legitimate" from "illegitimate" traffic? Connecting on odd ports to distant machines? That's how the

    • My conspiracy theory (Score:5, Interesting)

      by A nonymous Coward (7548) * on Wednesday June 13, 2007 @02:08PM (#19495543)
      A. Everyone "knows" that the NSA is doing its utmost to listen to all internet traffic.

      B. It would do the NSA no good to listen to everything without filtering out the 99.999% which is irrelevant. Ergo, they must have pattern filters.

      C. Botnets must be a big part of the filtered traffic.

      D. NSA must be aware of botnets, their patterns, their control channels, their zombie elements.

      E. Yet botnets continue.

      F. The NSA must want them to continue unmolested.

      The NSA knows how botnets work, and could hijack them at any time. The only reason to do so is to keep them in reserve for their own use.

      I suggest the NSA would hijack botnets for counterattack if the US nets were attacked by another country.

      That's my conspiracy theory, I hope you like it.
      • Maybe the NSA systems are part of a botnet too!
        • OMG I hadn't thought of that .... one botnet to rule them all. Or maybe all the botnets got together to share the NSA botnet so none of them could take over all the others.

          Criminy thsi is skk k kk ary.
        • by rthille (8526)
          Yeah, from what I've seen of day-to-day Government competency, I'd imagine most of the NSA machines are part of botnets.
      • D. NSA must be aware of botnets, their patterns, their control channels, their zombie elements.

        E. Yet botnets continue.


        The NSA has neither the jurisdiction nor capability to stop domestic botnets. And they're not going to be helping the overseas folks fer nuthin'.
    • by Nikker (749551)
      Once I think the cost of having a Government employee call, track and note every member of a bot-net this size, I start to think that it might be cheaper to subsidize a firewall/router.

  • seems low (Score:3, Insightful)

    by wizardforce (1005805) on Wednesday June 13, 2007 @01:04PM (#19494565) Journal
    1 million in botnets/[100 million?] in at least the US so that works out to about 1% by crude estimation so does anyone else think these numbers are a bit low? especially since

    Google's Ghost in the Browser study looked at over 4.5 million Web pages, and found that 10% of them were capable of activating malicious codes and 16% were suspected to contain codes that might be a threat to computers.

    how many computer users dont patch/update their computers or use a very old version? how many of those wouldnt know if they were infected or have an infected computer as it is?
    • Re: (Score:3, Interesting)

      by sdnoob (917382)
      "over 1 million botnet crime victims."

      only 1 million victims?? i do believe there are far more than 1 million addresses in these scumbags mailing lists. *everyone* who's gotten spam out of one of these botnets is (also) a victim... not just the poor saps who got winjacked(tm).
    • They said they'd found a million of the things - they weren't claiming to have caught all the zombies in the country or world. It's a good start, especially if they can get them cleaned up and watch for attempts at re-infecting them. It may be the low-hanging fruit, and they busted a couple of the zombie operators, which is good.

      Of course, busting the operators also means there'll be some thousands of zombies out there who are waiting for Master to tell them what to do next, and some of them may get explo

  • Who knows how the FBI will contact these victims, but by announcing that they will be contacting them, I foresee numerous phishing attempts from fbi.com (a blank site, last I checked).


    Warn the kids and wake the neighbors. Be suspicious of any e-mail posing as the FBI and wanting a response by clicking an URL, fbi.gov or otherwise.

  • Solution (Score:4, Funny)

    by LoyalOpposition (168041) on Wednesday June 13, 2007 @01:10PM (#19494649)
    Dear Computer Owner,

                Your computer has been determined to be infected by a malicious program that gives control to another person. Please double-click on the link to find out how to get your computer disinfected.

    FBI

    No. Really.
    • Re:Solution (Score:5, Funny)

      by Novotny (718987) on Wednesday June 13, 2007 @01:15PM (#19494729)
      Where's the link? How can I click it if there's no link?
    • Re: (Score:2, Funny)

      "Gartner predicts that by year-end 75% of enterprises 'will be infected with undetected, financially motivated, targeted malware that evaded traditional perimeter and host defenses.'"

      Dear computer owner:

      The computer industry has been determines to be infected by malicious 'analysts' who make a living out of regurgitating the same old news every year. God forbid they actually do something constructive for a change.

    • Re: (Score:3, Interesting)

      by mr100percent (57156)
      This brings up a serious question, what would the FBI recommend to disinfect the machines? AdAware? Windows Defender? Norton?
      • by blhack (921171)
        there is a tool i have heard of called "lunix" or something like that that is supposed to do that job.

        But i've heard that you have to download it from those shady Pirate 2 Pirate networks, so its probably a virus!
      • by zCyl (14362)

        This brings up a serious question, what would the FBI recommend to disinfect the machines? AdAware? Windows Defender? Norton?

        Thermite.
      • what would the FBI recommend to disinfect the machines? AdAware? Windows Defender? Norton?

        You can't disinfect a Windows machine with any reliability. Zero the drive, re-install, update offline, and reinstall all your apps and data. Repeat as necessary.
      • by dodobh (65811)
        This [openbsd.org]
  • "Victims" ? (Score:2, Interesting)

    by Anonymous Coward
    Is the victim the person whose computer is serving spam, or the person whose computer is receiving spam?

    Who is the real victim here?
  • From TFA:

    A botnet is a collection of compromised computers under the remote command and control of a criminal "botherder." Most owners of the compromised computers are unknowing and unwitting victims. They have unintentionally allowed unauthorized access and use of their computers as a vehicle to facilitate other crimes, such as identity theft, denial of service attacks, phishing, click fraud, and the mass distribution of spam and spyware.

    Hmm... I didn't realize that the FBI was investigating the RIAA an

  • I have said it before here, and i will say it again. People really need to be held accountable for what damage is caused by their ignorance. If my car comes flying through your bedroom window at 30 miles an hour because I parked it at the top of a hill in neutral, should General Motors be responsible? No.

    Likewise, if i leave a completely unprotected winbox up on the internet and it gets rooted, should Microsoft be held responsible (which seems to be what some of you think)?

    In both cases harm has been caus
    • by swb (14022)
      What you leave out in your analogy is that bots are the result of third-party malicious action.

      In your car analogy, the owner reasonably believed that when the car wasn't running, it wouldn't go anywhere and a THIRD PARTY pushed the car such that it rolled down the hill.

      Ordinary users THINK that their machines aren't vulnerable and thus do nothing, which in and of itself isn't a problem until someone else breaks in and turns them into bots.

      • by blhack (921171)

        In your car analogy, the owner reasonably believed that when the car wasn't running, it wouldn't go anywhere and a THIRD PARTY pushed the car such that it rolled down the hill.
        True. I suppose that the analogy could be changed to say: "if i leave my doors unlocked, and my house gets robbed, is it the contractor that installed the locks fault?"

        better?

        The mechanisms to prevent your computer from getting rooted are in place. People just don't use them.
        • by kalirion (728907)
          True. I suppose that the analogy could be changed to say: "if i leave my doors unlocked, and my house gets robbed, is it the contractor that installed the locks fault?"

          better?


          Quite often it's more like "If I have a standard lock on my front door and a burglar bumped [wikipedia.org] it, is it the fault of the contractor for installing an insecure lock? What if the lock company issued a recall on the locks because of said insecurity?
    • by Orlando (12257)
      If my car comes flying through your bedroom window at 30 miles an hour because I parked it at the top of a hill in neutral, should General Motors be responsible?

      I don't agree that this is a fair analogy. A more appropriate analogy would be that General Motors sells you a car that you believe to be the most up to date, leading model, only for it to be stolen the next day by some 14 year old oik who knows that he can open the rear passenger door just by tapping on the lock with a screw driver.

      I am fed up wit
  • by dpbsmith (263124) on Wednesday June 13, 2007 @01:29PM (#19494943) Homepage
    ...that OS/2 would be the dominant operating system by, IIRC, 1993 or thereabouts.

    I just did some Googling on things like "bad Gartner predictions" and "missed Gartner predictions" or '"Gartner predictions" scorecard' hoping that someone had tried to keep tabs on them, but found to my disappointment virtually no relevant hits. Everyone discusses them in the months after they're released, nobody seems to check back even as recently as a year.

    Of course, with predictions like these for 2002 [gartner.com]... "During 2002, leading-edge businesses will exploit application integration to generate business innovation...." how the heck would anyone ever figure out whether or not it was fulfilled?

    I can't believe people pay Gartner for this stuff.

    • I can't believe people pay Gartner for this stuff.

      Heh, pick up a copy of anything by Tom Peters or his ilk. People who buy those books also pay money for Gartner analysis reports. At least Tom Peters came right out and said that he had no idea what he was talking about [fastcompany.com] when he wrote his first book. I think it's going to take a lot of people screaming "The analysts have no clothes!" (clues?) before people start questioning Gartner, though.

      • I have discovered a fantastic, accurate way to predict future trends in information technology. The basic principle is to find a Gartner quote on the subject matter in question and then take the opposite viewpoint. You will find that you are correct on average 98.724% of the time, which in such a fast-moving industry is a pretty good score.

        On the flip side, you have to (grudgingly) admire them for making a successful enterprise funded exclusively by PHBs.
    • by PPH (736903)

      I can't believe people pay Gartner for this stuff.

      They almost have to. Its a CYA tactic. If you do something stupid and you don't have a Gartner recommendation to back you up, you catch the blame. If you can back it up with a report, you can blame it on their bad advice.


      I used to love the Gartner (and other analysts) material. I could always find something to back up my decisions.

  • It's amazing people still write headlines and article summaries without mentioning the enabling technology in question.

    When the monopoly is finally busted, I guess it will no longer be implicit that "We're talking about Windows, of course."
    • Yeah man, M$ is so slow at sending out patches, and even if they do make the patch, it doesn't mean people are going to download them. If they had just created it right from the start, they wouldn't have to do the crappy whack-a-mole. When is M$ going to fix their OS? Oh, 5 months ago? Oops...
  • by twitter (104583) on Wednesday June 13, 2007 @01:39PM (#19495093) Homepage Journal

    That they are looking into the problem is a good start. Gmen reading are advised to consult with the Honeynet Project [honeynet.org] and regard vector vendor "help" with suspicion. It would also be nice to see them call a spade a spade and abandon the false OS neutrality that keeps them for doing so. This is a Windows problem and the relative risks should be published. Otherwise they are lying to us and keeping information we can all use locked away. Most importantly, though, they need to clean their own house.

    • by dedazo (737510) on Wednesday June 13, 2007 @01:49PM (#19495229) Journal

      This is a Windows problem and the relative risks should be published.

      I don't know what "the relative risks" means, but since none of my Windows machines are in a botnet, and there are millions and millions of them that are not, this is not a Windows problem. It's a basic user education problem. Windows may have more attack vectors than other OSes, but that doesn't mean they are not known or are impossible to avoid. Simple common sense goes a long way. People get infected with botware because they download things they shouldn't or don't bother to keep their machines up to date by turning on automatic updates so they don't have to worry about anything.

      If you think one chmod +x is an insurmountable obstacle to turning your shiny Linux or OS X box into a bot, remember that people get infected by executables in password protected ZIP files and that all of the most massively distributed worms have all required significant user intervention to propagate. Maybe one of these days you'll inherit 800 million completely clueless users, and maybe then you'll call it a "Linux problem"?

      • As far as you know ... none of my Windows machines are in a botnet ;-)
    • The advice given to home users [us-cert.gov] (and this [cert.org]) is clearly Windows specific, even though Windows is not mentioned. They go through the usual laundry list of things which are failing corporate users, firewalls, "patches", anti-virus and so on and so forth. Way down in the glossary is a mention of "Linux" linked to the "webopedia" [cert.org].

      As I said before, these are important first steps. The information presented may be useful to novice computer users, but it's incomplete because it does not include some of the most

  • by athloi (1075845) on Wednesday June 13, 2007 @02:05PM (#19495483) Homepage Journal
    While I am fond of the users I support, I find it takes a lot of education to get them to stop falling for the most common scams: funny email attachments, phishing, and phone calls asking for their credit card numbers. They're not stupid people. They're just a little clueless and disconnected from a world that, quite frankly, bores and intimidates them.

    I would like to suggest that, whatever operating system we put on the desktop for the average person, there be some initiative to educate them in best practices computing, even if only for the 4-10 common tasks (email, websurfing, games, mp3s, pr0n, quicken, word processing) they will use. I volunteer to design and write the curriculum if there's some rational initiative to get it out there to the human herd.
  • by Bob9113 (14996) on Wednesday June 13, 2007 @02:34PM (#19495919) Homepage
    Is the FBI allowed to do this? Did they get special dispensation from the RIAA and MPAA to work on a project that appears to be completely unrelated to copyright infringement?
  • Gartner predicts that by year-end 75% of enterprises 'will be infected with undetected, financially motivated, targeted malware that evaded traditional perimeter and host defenses.'"

    I think they are full of it, I am willing to bet with a linux box jacked into a mirrored port in the core that I can find bots and malware on more like 95% or better of windows based enterprises. There is not a network I have looked
    at in the last two years that is not owned, botted etc in some fashion.
  • by MrCopilot (871878) on Wednesday June 13, 2007 @03:25PM (#19496789) Homepage Journal
    Finding out that my PC has been Zombified, Or the FBi informing me they found my PC zombified.
  • Once you are a member of a botnet, you have been compromised and could be sharing your music files and never even know it..

    Hear that RIAA? Millions of people .. Millions.

Memory fault -- brain fried

Working...