Forgot your password?
typodupeerror
Worms Security

Storm Worm Rising 218

Posted by CmdrTaco
from the goggles-do-nothing dept.
The Storm worm has been an increasing problem in the last few months, but a change in tactics may mean something big is going to happen. The article discusses a bit of back story about the worm, including the somewhat frightening numbers about the millions of spam emails carrying the worm payload. They estimate between a quarter and a million infected systems usable for spam or DDOS attacks.
This discussion has been archived. No new comments can be posted.

Storm Worm Rising

Comments Filter:
  • by IndieKid (1061106) on Wednesday August 08, 2007 @11:37AM (#20157299) Journal

    They estimate between a quarter and a million infected systems usable for spam or DDOS attacks.
    0.25 to 1,000,000 is a pretty large range.

    Seriously though, how does one go about estimating these numbers? Is it something as simple as an estimate of what proportion of infected e-mails are expected to result in an infected desktop? I doubt that would give a very accurate figure.
    • 250,000. Quarter of a million. Typo.
      • by Slarty (11126)
        Speaking of typos, I find it funny that the crack editorial staff of Network World managed to let a typo slip through in the *2nd word* of the article. All fear "the swifly spiking onslaught of the Storm Worm!"
        • Re: (Score:2, Funny)

          by Qzukk (229616)
          All fear "the swifly spiking onslaught of the Storm Worm!"

          It's product placement for Swiffer dusters, able to swifly swiff up dust, viruses and worms.
      • VOOOOOOOOOOOOOSH
    • by strongmace (890237) on Wednesday August 08, 2007 @11:48AM (#20157511)
      Article says how they are calculated:

      "Joe Stewart, senior security researcher at managed security company SecureWorks, at the Black Hat conference. .....

      From the number of infected machines he's found, Stewart estimates that the Storm botnet could comprise anywhere from 250,000 to 1 million infected computers. And that raises questions, along with eyebrows. "
      • Re: (Score:2, Insightful)

        by IndieKid (1061106)
        Yeah I just read that. If 20 million e-mails (according to Joe Stewart in the article) have been found and he estimates that 250k to 1m machines are infected, that implies that somewhere between 1 in 20 and 1 in 80 of the machines he's looked at are infected. I'm assuming somewhere in the middle is what he actually discovered before applying a margin of error - so 1 in 50. I wonder how many machines he actually checked? 50? 500? Were these machines known to have received the e-mail or just random machines?
    • by httptech (5553) on Wednesday August 08, 2007 @11:56AM (#20157627) Homepage
      The estimate is based on the number of unique IPs we've seen attacking networks we monitor, coupled with our knowledge of how the Storm botnet works. We've seen up to 100,000 bots sending the attack (the ecard spam) in a single day. Storm is a multi-tiered botnet, meaning that not all the bots are tasked with sending the emails. Some are supernodes (first-tier), designed to serve up the ecard executables via HTTP and facilitate communication between the regular (second-tier) nodes. Another factor is that some second-tier nodes will never be seen attacking, since they may be behind firewalls that block port 25 outbound or at an ISP that is doing SMTP blocking, so they may be part of the botnet but difficult to count.

      In reality, the only source that can give you a precise count for the Storm botnet is the Storm controller - and he/she's not talking. So we do the best we can at estimating its size given the data available.
      • by Anonymous Coward
        ...until software companies are forced to include normal consumer warranties (as in suitable for purpose, ability to access the internet with better security out of the box) and until individual zombie owners can get charged with "maintaining an attractive nuisance". The software sellers don't give a crap, as they have zero liability because of their ridiculous EULA and because the law let's them get away with it, and big corporations are scared to sue the 800 lb gorilla over this issue obviously-buncha pan
    • Seriously though, how does one go about estimating these numbers?
      • 1. Roll 2D6
      • 2. Take the number rolled, and multiply it times the number of worm messages that have arrived in your inbox.
      • 3. If your computer is actually infected, square the result.
      • 4. Play a game of Solitare
      • 5. Add your final score to the result
      • 6. Divide the result by your Boss's vigilance.
      • 7. Make a saving throw against discovery, and multiply the result by 1000
      • 8. Round up to the nearest 100,000
      • 9. Publish
      • 10. Profit!
      Lower bounds are trickier as they will require you to actually care about what you're doing.
    • Re: (Score:3, Funny)

      by Fnord666 (889225)

      Seriously though, how does one go about estimating these numbers?
      Simple really. Just call Microsoft and ask how many systems are running their OS.
  • by athloi (1075845) on Wednesday August 08, 2007 @11:39AM (#20157357) Homepage Journal
    If they can't find a way to reach customers and get them fixes for the rampant insecurity of these machines that are compromised. The silent majority of customers are getting frustrated with this sham of a performance [chron.com], and while saner heads recognize that Redmond does a lot right and some wrong, the emotional response is going to shove them out of dominance in operating systems. Maybe that's why they're better on spacy Web3.x "cloud" and "distributed OS" technologies instead of what made them big, which was getting things done the hard way consistently.
    • by khasim (1285) <brandioch.conner@gmail.com> on Wednesday August 08, 2007 @11:49AM (#20157533)
      No. "The silent majority" believe that this is the way computers just "work".

      They've been shown that in countless movies and TV shows and by "experts" on the news.

      They're the ones you see claiming that Linux and Mac's will have the "same problems" as their market share increases.

      With all the past outbreaks on Windows machines, anyone who wanted to migrate has already started their migration. This won't change anything for anyone else.
      • by NickFortune (613926) on Wednesday August 08, 2007 @12:03PM (#20157721) Homepage Journal

        No. "The silent majority" believe that this is the way computers just "work".

        More accurate, perhaps, to say that they think this is just the way computers don't work.

        There was a program on last week where they had a collection of self proclaimed grumpy old women listing things they hated about computers - and you know what? Every single complaint was not about computers per se, but about Microsoft software.

        There's got to be an opportunity in there somewhere for the FOSS movement. Imagine if we could convince the "I hate computers" brigade that what they mainly hate is Microsoft ...

        With all the past outbreaks on Windows machines, anyone who wanted to migrate has already started their migration. This won't change anything for anyone else.

        That's just silly. People have different convincer strategies. If nothing else, there are people out there who still haven't heard that there's an alternative. There's a lot of meat left on that bone.

        • by lymond01 (314120)
          With all the past outbreaks on Windows machines, anyone who wanted to migrate has already started their migration. This won't change anything for anyone else.

          Response: That's just silly. People have different convincer strategies. If nothing else, there are people out there who still haven't heard that there's an alternative. There's a lot of meat left on that bone.

          True. I'd say the long, dark tunnel from XP to Vista has a few side corridors.
      • No. "The silent majority" believe that this is the way computers just "work". They've been shown that in countless movies and TV shows and by "experts" on the news. They're the ones you see claiming that Linux and Mac's will have the "same problems" as their market share increases. With all the past outbreaks on Windows machines, anyone who wanted to migrate has already started their migration. This won't change anything for anyone else.

        I don't think that's quite the case any more. Many of the people

      • Re: (Score:3, Funny)

        by Mr. Flibble (12943)

        With all the past outbreaks on Windows machines, anyone who wanted to migrate has already started their migration. This won't change anything for anyone else.

        Well, it is changing it for me! I got an ecard from "friend" and I downloaded the exe on my iMac, and it won't work. I could not see the card. I tried again on my Red Hat Enterprise 4 server, and even after chmod +x *AND* running as root with X windows going, the card would not open.

        That is the last straw for me! I can't get cards from my "friend". I a

      • by Stefanwulf (1032430) on Wednesday August 08, 2007 @02:10PM (#20159781)

        They're the ones you see claiming that Linux and Mac's will have the "same problems" as their market share increases.
        Out of curiosity, what aspects of the OSX/BSD and Linux architectures are going to stop:
        • An uneducated user from executing a binary file they download from a URL they are given
        • A process that user is running from executing further code with that user's privileges
        • That user's processes from making outbound TCP/UDP connections
        • That user's processes from accessing an SMTP server to send emails
        • A user from configuring a process to run on logging in
        By my thinking, that's really all that's needed for a botnet to work on a given platform. I am certainly ignorant of many details regarding the BSD/Linux kernels and I stand ready to be corrected, but I believe I've seen all those things happening individually as part of day to day user life on my linux box.
    • by jpop32 (596022) on Wednesday August 08, 2007 @01:24PM (#20159077)
      If they can't find a way to reach customers and get them fixes for the rampant insecurity of these machines that are compromised.

      WTF are you talking about? RTFA, please. If you actually did that before funboying around, you'd notice that the program in question is not a worm at all, but a trojan. User has to manually run the attachment, probably clicking through a couple of dialogs practically begging him not to. But, since the user really, really _wants_ to see the cute kittens, or a naked celebrity, or whatever the trojan claims to be, trojan will be run. No OS can defend against the user being a sucker.

      So, move along, please. Your tirade is totally off topic here.

    • Microsoft's recent thing about "the cloud" might have something to do with their recent purchase of FrontBridge [google.co.uk], an "in-the-cloud" traffic filtering company. (Note the 'E' word is in the titles of most of those articles though it's not in the search...)
  • by AKAImBatman (238306) <akaimbatman@NosPAm.gmail.com> on Wednesday August 08, 2007 @11:40AM (#20157379) Homepage Journal
    I remember freaking out 10 years ago every time I saw someone running that cutesy little "fireworks display" email attachment. Despite my best efforts, I couldn't get the users to stop unzipping and opening it*. Glad to see that things haven't changed much.

    SNAFU (Situation Normal: All F***ed Up)

    * Before I get 10 million suggestions for a decade-past issue, yes we did find more effective ways of blocking it.
  • by tttonyyy (726776) on Wednesday August 08, 2007 @11:40AM (#20157385) Homepage Journal
    Now I've got your attention worm style, click this link for more information:

    http://en.wikipedia.org/wiki/Storm_Worm [wikipedia.org]
    • by neo8750 (566137)
      So where is this naked teen? and why do i not see her nakedness attacking her director? Aww crap not again...
    • by Gazzonyx (982402) on Wednesday August 08, 2007 @12:30PM (#20158147)

      Now I've got your attention worm style, click this link for more information:

      http://en.wikipedia.org/wiki/Storm_Worm [wikipedia.org]
      I'm interested in something from that wikipedia article; it mentions that the source code to storm specifically avoids infecting Windows Server 2003 boxes. Anyone know why the author would go out of his way to not hit 2K3 boxes?


      Perhaps to avoid infecting government servers (and upping the ante, if he got caught)? That's the only thing I could think of. I'm sure there's a very logical reason, but I have no idea what it might be.

      • by necro2607 (771790)
        Anyone know why the author would go out of his way to not hit 2K3 boxes? ... I'm sure there's a very logical reason, but I have no idea what it might be.

        Well, all "windows server reliability" jokes aside, it could just be that the author's code had some issues running as expected on the 2003 server machines (due to some behaviour in that version of the OS as opposed to other versions), that perhaps he/she didn't feel like debugging or figuring out.
      • Re: (Score:3, Insightful)

        by anilg (961244)
        My best guess is related to the way security companies work (the pay-per-problem model).

        The companies that care enough about their security issues are those with critical servers, and many of these use win 2K3.

        Storm affecting these boxes would mean quicker detection of the virus, and lesser migration. Without these (and with users who dont update anti-virus signatures very regularly), the virus has a greater potential of spreading. Of course, the author didn't imagine Storm would be this popular, and that t
  • worth worrying about (Score:4, Interesting)

    by esconsult1 (203878) on Wednesday August 08, 2007 @11:41AM (#20157393) Homepage Journal
    As the publisher of two fairly popular websites, this is something to worry about. Recently all our sites spread across a few dedicated servers in one data center were down. Not because of a direct DDOS attack, but because of a peripheral attack which swamped the network infrastructure at the center. Really, if these guys decided to do more frequent DDOS attacks, anyone could be a target and calling the FBI is cold comfort since in the meantime your sites are down and out.
    • Catalyst for change? (Score:4, Interesting)

      by khasim (1285) <brandioch.conner@gmail.com> on Wednesday August 08, 2007 @12:02PM (#20157719)
      Let's look at DDoS attacks.

      #1. Spoofed IP addresses - not that common anymore. It used to be that you'd tie up a machine by having it send replies to machines that did not initiate the connection. There is a simple solution to this. Anyone assigned a block of IP addresses has to make sure that all outbound traffic references IP addresses on that block.

      #2. Thousands of machines eating up your bandwidth - the most common type now. This is where the zombie army each makes continued requests of your machine. For webservers, they can request a page over and over and over until they use up all your bandwidth and legitimate visitors cannot get through. This is more difficult to fix. It can partially be handled by blocking the range of addresses that host the zombies. Such as Comcast and Verizon and so forth. There are more complicated attacks. Such has sending half a request.

      There's not much that can be done with #2 until a law gets passed saying that the person paying for the Internet connection is responsible for $X of clean-up charges. Then people will have a financial incentive to look at more secure systems.
      • by neo8750 (566137)

        here's not much that can be done with #2 until a law gets passed saying that the person paying for the Internet connection is responsible for $X of clean-up charges. Then people will have a financial incentive to look at more secure systems.

        I wonder how grandma and grandpa will feel when get a letter in the mail to discover that there internet they use to only check mails from the kids/grandkids has been hijacked by a worm that they never heard about and now have to pay fines to cover damages. I mean oth

        • I wonder how grandma and grandpa will feel when get a letter in the mail to discover that there internet they use to only check mails from the kids/grandkids has been hijacked by a worm that they never heard about and now have to pay fines to cover damages. I mean other then the whole aww factor this plan will work.

          Why wait?

          Why not take a few pro-active measures? Such as emailing all your clients with the new rules and offering to assist them in evaluating their systems ... automatically?

          hell i personally c

          • by neo8750 (566137)

            I wonder how grandma and grandpa will feel when get a letter in the mail to discover that there internet they use to only check mails from the kids/grandkids has been hijacked by a worm that they never heard about and now have to pay fines to cover damages. I mean other then the whole aww factor this plan will work.

            Why wait?

            I never said it shouldn't be put into affect i said really only problem is the whole "aww poor them" factor and we know that can be looked over easily especially when you slap them

        • by jpop32 (596022)
          I wonder how grandma and grandpa will feel when get a letter in the mail to discover that there internet they use to only check mails from the kids/grandkids has been hijacked by a worm that they never heard about and now have to pay fines to cover damages.

          Well, maybe they will then realise that a computer can be a nuisance for others, and learn to treat it as such. Owning a computer is a responsibilty.

          I am in favour of some form of punishment for zombied computers for some time now. You would be fined with
      • There's not much that can be done with #2 until a law gets passed saying that the person paying for the Internet connection is responsible for $X of clean-up charges. Then people will have a financial incentive to look at more secure systems.

        people do not take responsibility for their anything that involves computers. evar. people don't take responsibility for their actions on the computer (i did not delete it! the computer just ate it!), they don't take responsibility for the computer itself (how does

      • by Leto-II (1509)

        #1. Spoofed IP addresses - not that common anymore. It used to be that you'd tie up a machine by having it send replies to machines that did not initiate the connection. There is a simple solution to this. Anyone assigned a block of IP addresses has to make sure that all outbound traffic references IP addresses on that block.

        There might be a simple solution to #1, namely ingress/egress filtering as you suggest, but its not very effective unless deployed nearly everywhere. Anywhere that doesn't use filtering can be used to basically spoof anywhere. Plus, according to results from the Spoofer Project at MIT [mit.edu], even those networks where there is some level of ingress/egress filtering are able to spoof large amounts of IP addresses. Note the percentages in those results are percentages for hosts which do encounter some filtering.

  • More information (Score:5, Informative)

    by apachetoolbox (456499) on Wednesday August 08, 2007 @11:42AM (#20157419) Homepage
    http://en.wikipedia.org/wiki/Storm_Worm [wikipedia.org]

    ...names ranging from "postcard.exe" to "Flash Postcard.exe,"...

    Shouldn't everyone be blocking .exe attackments at the MTA? Also look for a service running called wincom32 on infected machines.
    • NO! (Score:5, Insightful)

      by everphilski (877346) on Wednesday August 08, 2007 @11:47AM (#20157491) Journal
      Shouldn't everyone be blocking .exe attackments at the MTA?

      NO! It's annoying enough that Google rapes through my .zip files looking for .exe's.

      If I'm working on a c++ program at work and zip it up and gmail it home (lock the computer while it uploads) and forget to 'make clean' ... I don't get my code. I know its nitpicky and a make clean or a thumb drive will cure my problems but I'm forgetful which tend to preclude both.
      • Re:NO! (Score:4, Interesting)

        by dr_strang (32799) on Wednesday August 08, 2007 @11:55AM (#20157611)
        Try password protecting your zip file.
        • Re:NO! (Score:4, Informative)

          by dark-br (473115) on Wednesday August 08, 2007 @12:13PM (#20157897) Homepage
          It makes no difference if you password protect them or not as to list the zip file content no password is needed. You only need the password to correct extract the files.

          I've just switched to using RAR and as for now Google is leaving my attachments alone...

          M Addario

        • As a sibling pointed out, that won't work. But you can nest an un-passworded "mycode.zip" inside a password-protected "wrapper.zip" file. Spam filters will see that wrapper.zip contains mycode.zip (because of Zip's stupid encryption (hah!) doesn't protect its content list), but won't be able to examine mycode.zip.

          Alternatively, use GPG and go forward.

        • tac yourarchive.zip > reversed.zip

          attach reversed.zip, download remotely and then

          tac reversed.zip > yourarchive.zip

          works perfectly :) ***

          ***"man tac" if youre unaware of it
      • Re: (Score:2, Interesting)

        by LiquidCoooled (634315)
        Actually, if they are clever enough to scan the zips, maybe they could be clever enough to just filter the exes out leaving the rest.
        It annoys me as well, the number of zips I have called .aaa .abc .bmp around because of this is stupid.

        Maybe - just maybe - google could consider allowing zips to account users who have specified it as a preference (default block as currently occurs).
        • Maybe - just maybe - google could consider allowing zips to account users who have specified it as a preference (default block as currently occurs)

          Especially when a user is sending it to himself :) I mean, what, am I trying to infest myself with a virus?
      • Re: (Score:3, Informative)

        by cyfer2000 (548592)
        I use 7zip.
      • They don't (or didn't, as of the last time I sent myself an executable - within the last year) scan RAR or 7Zips for executables. Also, they won't check a doubly encapsulated archive; if you RAR or 7zip or gzip the folder, and then zip that, you should be fine. The best method is to use a lower compression method on the folder first (zip or gzip), and then encapsulate it with an archiver that uses a larger library (like 7zip or bzip2). This will keep it from 'bloating' on the second compression.
      • by oglueck (235089)
        You're honestly abusing email as kind of a SCM tool? Creative...
        • 2.8 gigs of space ... why not? :) submitting it automatically tags it with a time and date and stores it where you can get to it 99.99% of the time. And as I mentioned elsewehere, I tend to be scatterbrained, and misplace/forget my thumb drive, so its nice to have it a website away. The particular pet projects I'm working on, I'm not paranoid about someone getting a hold of, so I really don't give a crap about having the code on a web mail account.

          I did this extensively while working on my masters, now p
      • Re: (Score:2, Informative)

        by ^Case^ (135042)
        Make a "package" make target that copies all relevant files into a package directory, zips the directory and ship of the mail. If you're using OS X or another un*x variant you can do all this with a single make target.

        Why you aren't using version control is another question.
      • Simple answer:
        Use FTP and quit abusing email. If you are working in an environment where you are coding for a living, my guess is that you can harass the IT folks into setting up an FTP server and access for you.
      • Get a secure file host or use YouSendIt [yousendit.com] (SSL supported).
    • by just_another_sean (919159) on Wednesday August 08, 2007 @03:35PM (#20161187) Homepage Journal
      The examples I've seen of this don't have an attachment. It's a "click here! to view your postcard!" link in the email. Clikcing the link takes you to a site that says something like "We're trying a new feature on our site, please click here if you do not see your postcard". This link is then to an executable which of course prompts you to download or run. It seems to me you'd have to be pretty naive or just plain stupid to click through to the point of infection but I'm guessing a lot of people do...

      For me the biggest problem with these is that there is no attachment for AV to pick off and there is hardly any text and no real advertising in the email so our spam filters don't block it either.
  • "Why do you need a botnet that big?" he asks. "You don't need a million [infected computers] to send spam."

    For spam, a million-strong botnet might be overkill. But botnets can do much more - like launching denial-of-service attacks. These attacks aim to overwhelm a Web site or Internet server by sending it a constant stream of garbage data at a particular Web site or Internet server.

    So the question is, who is controlling these botnets and why? DDoS attacks can be pretty useful if someone wants to get a point across or to extort money from someone or some company. It will be interesting to see if they can trace it back to the source.

    • by ktappe (747125) on Wednesday August 08, 2007 @01:01PM (#20158693)

      "Why do you need a botnet that big?" he asks. "You don't need a million [infected computers] to send spam." For spam, a million-strong botnet might be overkill. But botnets can do much more - like launching denial-of-service attacks.
      So the question is, who is controlling these botnets and why?
      It is possible that the creators of this worm did not have any idea how successful they would be. They may have figured they'd get 5,000 PC's, not 500,000. Now suddenly they have a monster by the tail and are not sure what to do with it.
    • by ben0207 (845105) <ben.burton@gmai[ ]om ['l.c' in gap]> on Wednesday August 08, 2007 @11:49AM (#20157519) Homepage
      No fukcing way am I going anywhere near a site called Team Furry.

      The goggle really might do nothing.
    • by jollyreaper (513215) on Wednesday August 08, 2007 @11:57AM (#20157633)

      http://www.teamfurry.com/wordpress/2007/07/19/suns hine-on-a-stormy-day/
      I'm too scared to look. On a scale of goatse to tubgirl, how's it rate?
      • You know, you have to admit that would be one upside to being furry: it hardens you to just about anything, and it does it quick.

        Hm. You know, I thought I'd made a poor choice of words (I should've said "inured" you to anything) but, to judge from most furries I've seen, I was probably right the first time.
        • You know, you have to admit that would be one upside to being furry: it hardens you to just about anything, and it does it quick.

          Hm. You know, I thought I'd made a poor choice of words (I should've said "inured" you to anything) but, to judge from most furries I've seen, I was probably right the first time.

          I still remember how I discovered one of my best friends in high school was a furry. I was doing a global search on his computer to find a file and ended up with a picture of two gay mice engaging in hardcore bdsm. Fucking Christ, warn a person, will ya? I could handle the gay part but you add furry to it and it all goes downhill. He's probably into pedo vore by now.

    • by n-baxley (103975)
      Anyone care to verify this? I'm not about to download an exe that's "supposed" to remove a nasty virus. No offense apachetoolbox.
  • that is why (Score:5, Funny)

    by clubhi (1086577) on Wednesday August 08, 2007 @11:45AM (#20157463)
    That is why I always do my online banking BEFORE I browse for porn
  • by Novae D'Arx (1104915) on Wednesday August 08, 2007 @11:47AM (#20157481) Homepage Journal
    I dunno - maybe this is what we need ~ a botnet big enough to do some real damage could actually catalyze some public awareness. Imagine if they DDoS'd MS, or Amazon, heck, Google? Maybe these guys (esp. Google) could handle this kind of slamming, but they've got lobbyists now. I really wouldn't mind seeing a well-funded FBI task force with the express purpose of rooting out botnets and going after their creators. Yeah, yeah, most of them are not on US soil. I know. However, imagine legislation that actually required the disconnection of infected bots from an ISP until it was cleaned, and a public awareness campaign that painted users who allow this to happen as idiots, and the ISPs as protectors of the rest of the internet users. Most people are concerned that there would be a backlash against the ISPs and they would stop complying for fear of loss of business, but that's where the legislation comes in. It's a quarantine situation - just like IRL, if you've got something nasty and contagious, the CDC can legally quarantine (forcibly, if you're an idiot like the TB guy) you because you're endangering the lives of others by going out and exposing them. Same thing here - don't give the botnets a chance to expand, cut them off, force a windows-cleaning (ISPs could offer a cleanup disk, $5.95 plus tax, or something, to help make it worth it for them - don't want to hurt the small ISPs, even though I think TW and the rest are bastards), and let them reconnect afterwards. Simple, painless, and will definitely make sure people learn their lesson for next time.
    • Being jaded I see only the chance for broken legislation. I see new laws making it illegal to possess or use legitimate security tools.
    • dunno - maybe this is what we need ~ a botnet big enough to do some real damage could actually catalyze some public awareness. Imagine if they DDoS'd MS, or Amazon, heck, Google?

      I can imagine it easily - 99% of the surfers denied acess would simply go "damm internet" and surf elsewhere, or go do something off-net.
      • Every web page the infected connection tries to go to says: This is a message from [YourISP]. In accordance with Federal regulations, your Internet access has been temporarily suspended. Your connection has been identified as one which has the [Virus flavor of the week]. You can download a removal tool: [link here] or contact us at 800-whatever. If you prefer, you may contact us at the phone number listed on your service bill.

        Every email gets bounced/returned with the same message.

        It would work without th

        • The funny part is - in any other context Slashdot would be screaming about ISP's monitoring their traffic and/or vigilante justice (being susceptible to abuse as it is).
    • by fotbr (855184)
      And when $ISP decides they'll only support Windows $Version anyone who hasn't "upgraded" is now SOL. Thanks to monopolies and near monopolies, this will turn into a legislated "upgrade or no internet for you" money maker.

      Thanks, but no.
    • by shish (588640)

      Yeah, yeah, most of them are not on US soil
      Since when has that ever stopped them? [slashdot.org]
    • by UID30 (176734)
      This is most definitely not what we need. Botnets and viruses are either the result of immature over intelligence, or outright malicious criminal act. They cost real people real time/money to combat.

      The solution is neither simple, nor painless. If detection of a botnet infection is (as it is now) left to the end user, one would merely have to "not check" in order to circumvent quarantine. And lets face it ... how many users would really allow their ISP to deep scan their system for possible botnet infec
      • by jpop32 (596022)
        If the problem were easily solvable, it would have been solved long ago. There is no financial incentive for Redmond to produce a invulnerable OS ...

        Barking up a wrong tree, dude.

        This thing is a trojan, OS has nothing to do with it. User decided to run the malicious program.

        But, I agree with your conclusion. Those responsible should be held accountable. Users that trojaned their machines should be cut off from the net, possibly even fined.
    • Re: (Score:3, Interesting)

      by GlL (618007)
      I work for a small ISP in Tacoma, WA. We tried selling a cleanup disk. It didn't work because a $9.95 disk cost us 1 hour of phone support per computer on average. The reality is that most of our customers who get infected aren't technically savvy enough to install and run anti-malware software. We now have a flat-rate tech bench fee of $89 to clean up the computer. We still lose money on the deal, but not as much.
      What technically minded people in general forget is that most users want their security soluti
  • From the article: > For spam, a million-strong botnet might be overkill. > But botnets can do much more - like launching denial-of-service attacks. > These attacks aim to overwhelm a Web site or Internet server by sending > it a constant stream of garbage data at a particular Web site or Internet server.
    A few years back there was a spate of DDOS attacks on root servers, for example: http://www.informationweek.com/news/showArticle.jh tml?articleID=197004237 [informationweek.com] which were described at the time as "
    • by rel4x (783238)
      In past years, they really exaggerated the sizes of botnets. They had a lot of trouble telling the different controllers and whatnot.
      This one, I have a feeling actually IS that large.
      Especially for a few worms, where different variants were released by different groups who bought the source code and modified it. This one quite possibly is that large.
      ALSO, 250,000 computers, while it is a massive botnet, is not truly excessive in regards to spam. Take a look at what is being filtered for nowadays. NJABL, DSB
  • We all know that the Storm botnet is a big ol' spambotnet but what about Nugache? Thats the one I'm more concerned as it is fairly huge and just sits there in the dark waiting!!! Has anyone identified WTH that one is prepping for yet or are we still all in wait mode...

    Insert Scary Music Here

  • by bzipitidoo (647217) <bzipitidoo@yahoo.com> on Wednesday August 08, 2007 @12:14PM (#20157921) Journal
    Yesterday, a non-expert computer user I know sent me an email warning about emails with "postcard for you" in the subject being a carrier for the "worst virus ever". It could erase your entire hard drive!!! The histrionics convinced me it was bogus, so I blew it off. But seems there is something going on after all? That email now looks like it was deliberately timed and edited to ride the next wave of panic.
  • ...but perhaps we need a law that would require ISPs to disconnect customers with compromised computers, and inform them that they will remain disconnected until the computer(s) has been cleaned.

    Us conscientious customers shouldn't have to suffer the conditions imposed on us by people who can't bother to take even the most simple precautions. How much better would service be without all these botnets clogging the tubes?
    • by necro2607 (771790)
      Actually Shaw cable here in western Canada already does so. A friend of mine was kicked offline for a week because one of the computers in his home network had some spyware or botnet-type trojan running on it which my friend didn't know about. He finally called the ISP wondering why the hell he couldn't get online after many days only to find out that they had disconnected his net connection without even notifying him. It seemed like a pretty harsh treatment of a customer - they didn't even let him know
  • Military? (Score:5, Interesting)

    by wytcld (179112) on Wednesday August 08, 2007 @12:25PM (#20158081) Homepage
    It's well-known that the Chinese government has an active computer warfare department. A botnet on this scale is way beyond anything needed for mere industrial blackmail. But if you wanted to bring down large chunks of some nation's Internet quickly, without the attack coming from an obvious (and blockable) source, this would be a great weapon. Let's say you wanted to disable the Internet in Taiwan, or South Korea, or Japan, or all three, just prior to military action. Or let's say you wanted to disrupt financial markets to be sure that your intentional crashing of the dollar [telegraph.co.uk] had maximal effects.
  • People who have all mail to a domain going to one gmail account (ok, me) noticed a bunch of this testing the waters looking spam leaking through the filters, one every two minutes or so, with both the subject and the body being a different short 6-10 character string of mostly numbers. No actual selling content.

    Incidentally, for Windows lusers who realize they may have been practicing unsafe computing, is there any way to tell that you've been zombified? I know some of these worms are fairly stealthy. Some
  • Had this show up (Score:3, Interesting)

    by sanjacguy (908392) on Wednesday August 08, 2007 @12:39PM (#20158305)
    We had this show up in our infrastructure. All the emails were this:

    Hi. Worshipper has sent you a greeting card.

    See your card as often as you wish during the next 15 days.

    SEEING YOUR CARD

    If your email software creates links to Web pages, click on your card's direct www address below while you are connected to the Internet:

    http://682.81.0.23/?9907cd64e28cae3d7703a3b01bda de (Poster's note: This URL has been altered to protect the rampant mad clickers amongst us)

    Or copy and paste it into your browser's "Location" box (where Internet addresses go).

    We hope you enjoy your awesome card.

    Wishing you the best, Administrator, americangreetings.com
  • by BoRegardless (721219) on Wednesday August 08, 2007 @12:53PM (#20158551)
    Make it a Federal Law that ISPs must disconnect infected computers, and users would be forced to fix things very quickly.

    Then if a botnet attack comes, turn off the overseas pipes as needed. Yeah I am a dreamer, but I am at least half way practical.
  • Government and Big Corp always seem to be there when you don't want them. But they're never there when you do.

    For year's I've wondered why we have such a persistant SPAM problem. There are number of things that can be done - but aren't.

    - I don't believe there is ANY excuse for old viruses to circulate the web. I understand a new virus, but once a virus is known it should be stopped at the ISP & backbone levels.

    - Where is the government? SPAM supposedly costs business' billions of dollars a year. That wo
  • by nurb432 (527695)
    With a bit of luck it will kill the entire net for days, perhaps weeks.

    Then perhaps something might actually be done about this nonsense once and for all. The only way something will get done is if hits the pocket books of enough 'big players'
    • Re:Cool (Score:4, Interesting)

      by Overzeetop (214511) on Wednesday August 08, 2007 @02:04PM (#20159663) Journal
      Do you realize the kind of productivity spike we could get if the 'net was down for, say, a week? One day would be lost to people trying to get back up, admittedly, but then we'd all just start doing work, checking the 'net connection more and more infrequently. After a week, we'd probably run out of work on our desks that didn't need internet lookups, though most of us still have paper catalogs around so it wouldn't be a total loss. Faxing would get popular again, as would phones and voicemail...but no outside IM and email to deal with.

      I'm going to call it a net win for productivity and busniess in general. Which means that it's most likely that big business is behind the internet shutdown...and the Storm worm.

      Shit, where'd I put that damned tinfoil hat...
  • I'm sitting here all pissed off because I just can't get that trojan to run. I've been fiddling with wine for hours and even tried it under crossover office, and damn it, I just can't get my machine infected. The next step is going to be installing Windows into a qemu image because I just don't want to miss out on full Windows compatibility! Grrrr.

    Seriously though, I thought Windows was supposed to be more secure, and less prone to this stuff than Linux? I mean, that's what Microsoft's Get The Facts campaig

"The chain which can be yanked is not the eternal chain." -- G. Fitch

Working...