Bowling for cents writes "There is evidence that the massive Storm Worm botnet is being broken up into smaller networks, and a ZDNet post thinks that's a surefire sign that the CPU power is up for sale to spammers and denial-of-service attackers. The latest variants of Storm are now using a 40-byte key to encrypt their Overnet/eDonkey peer-to-peer traffic, meaning that each node will only be able to communicate with nodes that use the same key. This effectively allows the Storm author to segment the Storm botnet into smaller networks. This could be a precursor to selling Storm to other spammers, as an end-to-end spam botnet system, complete with fast-flux DNS and hosting capabilities."
Being the n00b that I am, I don't know what fast flux DNS is. I know what DNS is, and I know the meaning of fast... but flux to me is something you put on a pipe before you weld it. What does it mean in this context?
It means the spammers register a bunch of domain names to spam in their emails, and rotate the zombie PC IP they're pointing to every few minutes. Makes it harder to shut down.
Basically, you set your records to expire in a very, very short time, and constantly change the DNS servers, as well as the records. This makes it very hard to shut down the DNS, since its always moving and changing. I guess a good way to picture it is if at google, every single one of their 1M servers was changing. IE, every 5 seconds, a different machine was the dns server for "Google.com" and the www address changed to a different computer. Then, try to figure out which machine was misbehaving, and displaying the wrong data. It would be difficult.
...and if there aren't, then why are reputable DNS servers allowing these super-fast changes to DNS records anyway? Certainly such trends can be easily detected and stopped dead in its tracks?
Sure there are legitimate reasons to do this - one of them is cheap datacenter fail-over. If I have web servers colocated in two different datacenters with two different ISPs, and one of them goes down, I can change the TTL on my DNS records to, say 30 seconds, and point all the addresses to the other location. The short short TTL will cause global DNS to be updated much more quickly than normal, and my web site's traffic won't dead-end. On the other hand, I defintiely see ISPs that don't respect DNS TTLs
and one of them goes down, I can change the TTL on my DNS records to, say 30 seconds
Changing the TTL when you need to change the records, won't make any difference. Those nameservers that already have cached the IP addresses of your machines will have cached the old TTL also. Those nameservers that need to look up the IP address will pick up the new IP address irrespective of the TTL.
It really only makes a difference if your domain's TTL is short before you need to make the change.
Actually you'll have to change the TTL prior to failing over. So if you use it for active fail-over and not for scheduled maintenance, the other nameservers will be using your 'old' TTL. A common mistake by cheap webhosters. The other issue is that TTL is a suggested time for keeping your records alive. The other (caching) nameserver can choose to ignore it (to circumvent stuff like this botnet or just to keep it's own load down) or if it can't reach your nameservers after that TTL you specified it will just
Registrars are extremely reluctant to remove domains just because somebody claims that they are part of a botnet. Basically, you need a court order. You'll only get a court order if a judge rules against the botnet operator. You'll only get a ruling if somebody takes the botnet operator to court in a criminal case. That will only happen if a government intervenes.
No governments are interested in dealing with this problem.
This is the planet's largest ever privately controlled computer grid system. It is larger than google in terms of machines, and by the nature of its design it is about unkillable. It was most likely started by one *really* smart guy, as in uber scary smart, sitting in front of one machine at a console prompt. Think about that in your condescending leetness. And "just big"? This is the world's first Lex Luthor scale hack, because it is controllable, and has several practical (to them) attributes. It's a plan
When a machine gets infected, the virus usually patches the system so that it own it without the intervention of other malware. These guys, unfortunately, aren't stupid; sadly, an infected computer is probably more patched than most (not yet) infected boxes. After you steal something, you tend to defend it so that it remains in your possession.
I'm not sure whether to be impressed, depressed, or both.
These things are getting so insidious and vast in scope, I'm honestly wondering if I can safely believe that any Windows machine I come across with problems ISN'T on Storm or one of the other botnets. At what point does having a multi-use computing device become more of a problem than the benefits it provides? If 90% of what you get for connecting to the Internet is problems, what's the point? Bile spewing bloggers, bought-and-paid news reports and total advertising awareness?
I'm extremely impressed. Security has been lax for far too long, and I can't really blame anyone for taking advantage of that.
Plus, botnets are pretty sweet. I wouldn't mind having one myself, for, you know, distributed compiles or something;) Or maybe a beowulf cluster of botnets...
Security has been lax for far too long, and I can't really blame anyone for taking advantage of that.
You may not be able to blame anyone. But I can certainly assign blame.
Is the person/group that designed this botnet talented? Without a doubt. Do they deserve respect? Hell, no.
If you respect this person, then you would have to also respect the people who put together those televangelist networks and faith-healers. Liars, cheats, and thieves. They deserve no respect.
Here's a small and possibly unrepresentative datapoint from last weekend that would tend to suggest there are a lot of infected PCs out there, some of them with Storm. Basically, 2 of 3 PCs scanned had backdoor trojans and I didn't have time to debug the third PC enough to scan it.
I spyware scanned three PCs belonging to two friends/family households. Naturally, they were all Windows. I used Webroot Spysweeper which is pretty good but costs, and Kaspersky online scan, which is good but slow, and virus only.
- PC 1: infected with various spyware and a backdoor trojan (remote access by the bad guys) - had an up to date antivirus (AVG) that didn't spot any of this, but no anti-spyware installed.
- PC 2 (same network as 1): couldn't even install new software (error on running any new.EXE), ran out of time to debug this so did not install Webroot or any other tools. Also had AVG antivirus, which was up to date, and no anti-spyware. Presumed infected.
- PC 3: (2nd household) - infected with a different backdoor trojan and several viruses. Had Norton anti-virus that had not updated since 2004.
I would assume the average Windows PC has a high chance of some sort of infection, unless the users are very careful about installing third party software, some of which carries spyware or worse, and clicking on links in IE. Even Firefox had spyware on one of these machines.
Windows PCs run by power users (not the users here) can be somewhat secure, but it's painful to make them so. One colleague who's very techie still got infected by a PDF security hole recently, so you need Secunia PSI to run continuously, as well as monitoring some security blogs, and updating software regularly, as well as using a good anti-spyware tool, not using IE/Outlook, etc etc. However, once you are making this much effort, the work needed to install Ubuntu becomes much less of a hurdle - you might as well just switch over one PC so you have a safe PC for online shopping/banking etc.
The only good thing about this story is that nothing very important was being done on these PCs - little online shopping and no online banking... however, that's the users' self-reported status and they may well not want to admit they are at risk.
I don't do this for a living, I'm just a Windows and Linux user who wondered why there were so many popups on one of these PCs and ended up getting sucked into this when I should have been socialising - fortunately anti-spyware scans can run during dinner...
It is my non-expert (I am not certified to say this) opinion that there is no antivirus program or suite that does... anything.
FWIW & YMMV, I setup my family and acquaintances with XP-SP2, IE7, Windows Defender and the latest version of SAV Corporate/Enterprise in Unmanaged mode. I just turn on Automatic Updates in Windows and setup the AV software to update every night. My biggest "problem user" is a girl whose laptop was completely owned by spyware when I first met her. After a pave and rebuild wi
If 90% of what you get for connecting to the Internet is problems, what's the point? Bile spewing bloggers, bought-and-paid news reports and total advertising awareness?
The malware attacks behind this botnet have been relentless all year, using a wide range of clever social engineering lures to trick Windows users into downloading executable files with rootkit components.
Windows has downloaded a new security update. Do you wish to install?
40 bytes = 320 bits, which is not feasible to crack with modern technology.
Yes, it can, I've read Digital Fortress, the Dan Brown book. What do you mean, that was fiction? Next you'll be telling me the DaVinci Code isn't true!
I remember when we proposed an anonymous P2P system for the anti-spam system "Okopipi" (successor of Blue Frog). We were criticized by saying spammers would use that system to make P2P networks for DNS attacks.
One year later, spammers are ALREADY using a P2P system for such thing, while nobody has the means to counter them.
The lesson: They got ahead of us. It's time we invest in countermeasures of our own, or succumb to the enemy. Because, we're losing.
So if we don't have exactly the same weapons that spammers have, we lose? Oh horseshit. It doesn't take clever technical tricks, it takes ISPs stopping direct port 25 access from their residential ranges. But they won't, because they're criminally negligent. They're also afraid that the zombies will send through the smarthost, that their smarthost will get blacklisted, and that they'll actually have to start paying attention to the security on their own networks. God forbid. If the dynamic residential r
The zombies *will* go through the smarthost, and we will be pretty much back where we started, whether or not the smarthosts get blacklisted.
Blocking port 25 is a reasonable idea, and many ISPs do it, but to say to do otherwise is criminally negligent or that doing so would stop worms from spreading is completely absurd.
Pretty much the only effective tool ISPs have is to completely shut down the connection to any infected computer. But people will (rightly) get upset about that.
http://www.schneier.com/crypto-gram-0710.html#1 [schneier.com]
A good essay on the Storm Worm and how it works and how it can be prevented (or rather why it CAN'T be prevented in many cases).
One thing we can do? Everyone can just stop accepting mail from servers with short TTL and the fast-flux DNS model is no good to spammers. Yes, it's inconvenient to some ("wah! but I run sendmail off my laptop on dial-up!" - Yeah, well, go back in time to 1993 and have yourself a ball...). Frankly, they can just get the hell over it and use one of a dozen other methods to send out mail or increase their TTL. Spam is way more inconvenient and it affects everyone. This doesn't address other uses for these botne
by Anonymous Coward
on Tuesday October 16 2007, @11:41AM (#20997629)
I've not been actively following the Storm Worm Botnet stories, but I've picked up a few details which, on the surface, are downright frightening: Storm infects between 1 and 50 million PCs; it's more powerful than the world's supercomputers; dynamically evolves to avoid counteractions by security companies; and only uses 20% of its potential computing power at the moment.
These blurbs, if they're true, paint a bleak picture. Should the hackers leverage the network's full power, couldn't they shut down just about any server on earth? And imagine the bandwidth costs of this thing operating at full force.
So for those in the know, is Storm just a way to propagate spam and annoy people? Or is it something even more dangerous?
What amazed me about this article is how unsure it is of everything. "Appears that" and "may be" keep coming up. If things are that unsure, how can the potential customers of this segmented spamnet know that there is a service for sale? Wouldn't any marketing that these bot-admins do also be picked up by the white hat guys? I'm confused.
People are hijacking PCs and servers all over the globe and selling access to them to spammers and other shady characters. This is an organized crime of GLOBAL scale. Why the hell isn't Interpol or some large law enforcement body prepared to follow the money to the sources and burn them with it?
And if we don't have the REAL people to work on this, perhaps we should hire Hollywood to get the job done because it seems like the only real law enforcement that happens these days is in the movies or on TV.
The updates are part of the Slashdot tenth anniversary auction. In addition to the @slashdot.org address and low user id, CmdrTaco has also gotten the operators of the Storm Worm Botnet to auction its use off as part of the charity action.
Some potential uses for the winning bidder:
No longer will you have to only imagine having a Beowulf cluster of those.
Create your own Slashdot effect at the push of a button.
Thousands of Slashdot sock puppet accounts at your beck and call, ready to mod you up, karma-assassinate your foes, or post supportive replies to all the drivel you post.
Bring the parallel power of distributed computing to bear on problems like cracking DRM, modelling global warming, or ray tracing pictures of Natalie Portman with hot grits.
DDOS the RIAA / SCO / Diebold / whoever and become an instant Slashdot hero.
In Soviet Russia, spammers inboxes get flooded by YOU!
There's only one way that there'll be enough public outcry to cause solutions to be generated. The spammers will have to overplay their hands hugely. (Think Al Qaeda in Iraq - things are turning around over there at the grassroots level, mainly because AQI was chopping off people's heads and serving roasted children on platters to parents, and the public outcry has been enormous.)
Everyone hates spam, but spam filtering techniques have progressed to the point where we're at an uneasy stalemate with spammers. Everyone hates DDoS attacks, but in truth, how many people have really been the victim of one, and how many companies with muscle are really vulnerable to a normal-sized one? What will have to happen is that some overambitious crook gets it in their head to attack a Google or a Level3 or an Amazon or a national military, and puts the muscle behind it to make it work. It'll take players of that sort of weight to induce ISPs to do what they should have been doing all this time - proactively detecting botnet traffic and suspending the account of any user, individual or corporation, participating in such botnets.
I suppose we could also black hole enough of the world that the botnet controllers are forced into the reach of countries with tough computer anticrime resources, where they can be put behind bars and well out of the reach of any keyboard. I'm just not quite sure the Russians will stand for that....
I'm sorry, I'm probably sounding completely lame to those more firm in cryptography, but I have to ask:
What would it take to attack the 40 byte key? Imagine a coordinated effort by the biggest 500 gouverment computing setups around the world. All the blue genes and whatnot pitching in. The Japanese sure have the one or other state-of-the-art mainframe supercomputer, and CERN, ESA, Nasa and few German weather services have a few aswell. There is tons of horsepower laying around idle at agencies, bureaus and the occasional school or corporation. If they all pitch in in a coordinated brute force attack *and* have Seti@Home do a few hours too it should be possible, no? Especially if one takes into account that at least the NSA has mathmatical functions that do some of the dirty work and speed up the process a little. They wouldn't even have to publish them.
Wait, let's just check:
255 to the power of 40 is rougly 1.8 times 10 to the power of 96 (Gulp!). Thats nearly Gogol. (10^100, what Google initially was supposed to be called, the guy registering the domain mixed up the letters...) Whatever. On it goes: For the sake of ease I'll roughly estimate that after the overhead has been dealt with, half of the top 500 (or a simular setup) will be doing optimized attacks on an average of 50 billion tries per second. An average state-of-the-art mid-range server has aprox. 20 GigaFLOPS, so I think that's fairly realistic for a large mainframe doing a multi-step operation. 250 * 50 000 000 000 = 1.25*10^13 tries per second.
*60*60*24 makes 1.08*10^18 per day. [Sidenote: This may be way off wack allready and total bollocks but it's fun actually]
*7*52*5 makes 1.96*10^21. Oh, gee. This doesn't look to good. Where at it for 5 years and have only covered less than the fourth root of our total amount of keys. Even if we had 10 times the power it would make up only 1 percent of the keypace. Sheesh. We'll probably be cheaper off in handing out Linux PCs to everyone on the planet.
It's no use. I gotta start working on my next project: Finding an explicit function for prime numbers. Hehehe. I could use the Million from the Fields Medal too.:-)
Bottom line: My question/assumption was lame. But at least I found out myself.:-)
I think the best way to tell if you are infected is to monitor your network traffic. Ideally, from an independent machine watching the traffic. (Not that I have ever done this, but it seems like the most fool-proof method.)
I am up to date with everything (AV, FW, Widows Patches)
What are you up to? Dating patches of women who lost their husband? Yeah, that might infect you!;)
First your firewall, useless (against storm). One of the attack paths of storm is to get YOU the user to visit an infected site, often by sending you an email. Unless your firewall somehow knows ALL infected sites and blocks them all (unlikely) the email will arrive, and the site will be visited and the trojan loaded. You could setup a firewall that protects against this, but you don't have one, because if you did, you wouldn't have to ask, you would know. Firewalls only help against worm attacks, were an outside computer probes your network for weaknesses. IF you configure your firewall extremely rigidly and only allow known traffic through it, then malware on your network could be blinded, unable to connect to any command parts of the storm network. It is possible to use for instance iptables (linux) to inspect all packages going through it and simply drop unwanted traffic. Since storm now apparently uses encrypted p2p(edonkey) traffic this shouldn't even be too hard. This would however result in a less userfriendly network. The only experience I got was in a setup that ONLY wanted regular HTTP traffic, and this meant a LOT of stuff failed, even web traffic because not all web application create proper headers. (I wonder what the recent MS stealth update means for windows, did this traffic pass unseen through software firewalls?)
Then your AV software. Forget about it, storm mutates itself. Since AV software mostly works with signatures, it can never be uptodate enough. I read a report that it changes every half hour. How the hell are you going to keep your signature data that uptodate?
Windows patches. They ain't uptodate thanks to MS dreaded patch tuesday. THis means that a security hole can EASILY be unpatched for weeks. COnsidering this is MS we are talking about, practice is far longer. You will be the target of exploits MS does not know about yet, won't develop a patch for for months, that they will delay for weeks to deploy and for which the AV companies do not have signature.
Anyway the most recent big security hole involves PDF's, that is Adobe, nothing to do with MS. You have to be uptodate on EVERYTHING. That includes EVERY codec, every handler EVERY single piece of code on your computer. Have an image browser installed? Are you sure that not a single on of the image codecs it uses has a flaw? If you update one image browser are you sure that not one single program on your computer still uses an old library that is still vulnerable? Remember, if a storm attack only infects a fraction of a percentage of computers, they still got hundreds of thousands of machines.
START TO GET THE PICTURE?
Basically you are like a good soldier, who keeps his gun clean, doesn't screw with hookers and stays awake on guard asking how well he standsup to a full out nuclear war. YOU ARE TOAST PRIVATE!
But there is hope, the most common form of infection is still through user interaction. YOU have to open the PDF, you have to execute the exe/scr/sh/dmg/whatever, you have to visit the link. The most powerfull attack is social engineering, get that soldier in his invincible armour to pickup a grenade and eat it.
The really odd thing is that you do not even have to be paranoid to avoid it. Just don't click on things. IF somebody sends you a story headline, visit the BBC site yourselve. If somebody wants to send you pictures of some celeb flashing her aging bits, don't. There is plenty of fresh porn with nice looking girls out there (cheggit.net).
So what do you need to stay safe?
Mostly, your brain. Disable every bit of automation in software and instead let your brain do the thinking. NEVER just use automatic install (spyware) and never allow for instance outlook to preload crap or preview stuff. Email is for text, not webpages. But mostly ask yourselve WHO is sending me this, and WHY. One of the most amazing attacks I seen was by sending a "joke" attachment to people in your address book. Here is a hint, I am dutch. My brother I
Basically, it's impossible to know for certain that you're infected, because the people that design and implement these botnets are the best in the world at what they do. They are paid quite a lot, regularly, have no scruples about how they conduct their research, and can do their research totally anonymously. The only way to know if your operating system has been infected is to be lucky enough to have the bad guys screw up and flood your system with enough bad stuff to affect performance. Even then, plain
What is fast flux DNS? (Score:3, Interesting)
Re:What is fast flux DNS? (Score:5, Informative)
Parent
Re: (Score:2)
Re:What is fast flux DNS? (Score:4, Funny)
Parent
Re: (Score:2, Funny)
Re: (Score:2, Informative)
Re:What is fast flux DNS? (Score:4, Informative)
Parent
Are there legitimate reasons to do this... (Score:3, Interesting)
Yes. Re:Are there legitimate reasons to do this... (Score:3, Interesting)
On the other hand, I defintiely see ISPs that don't respect DNS TTLs
Re:Yes. Re:Are there legitimate reasons to do this (Score:4, Insightful)
It really only makes a difference if your domain's TTL is short before you need to make the change.
Parent
Re: (Score:3, Informative)
The other issue is that TTL is a suggested time for keeping your records alive. The other (caching) nameserver can choose to ignore it (to circumvent stuff like this botnet or just to keep it's own load down) or if it can't reach your nameservers after that TTL you specified it will just
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
No governments are interested in dealing with this problem.
Three words (Score:3, Insightful)
How long before.. (Score:5, Interesting)
How long before Storm is better than the Internet?
It seems to be peer-2-peer, can host files, must be reliable (DNS and all that), encrypted traffic.
If you assume Internet is past its sell by date, what would the next generation network look like?
:-)
(OK, maybe it wouldn't be owned by the mafia (insert USA joke here))
Parent
"not truly inventive"??? WTH? (Score:3, Insightful)
Re: (Score:2)
Microsoft?
Re-infect it how? (Score:3, Insightful)
Survival of the fittest in action (Score:3, Insightful)
These things are getting so insidious and vast in scope, I'm honestly wondering if I can safely believe that any Windows machine I come across with problems ISN'T on Storm or one of the other botnets. At what point does having a multi-use computing device become more of a problem than the benefits it provides? If 90% of what you get for connecting to the Internet is problems, what's the point? Bile spewing bloggers, bought-and-paid news reports and total advertising awareness?
Re: (Score:2)
Plus, botnets are pretty sweet. I wouldn't mind having one myself, for, you know, distributed compiles or something
Re: (Score:2)
You may not be able to blame anyone. But I can certainly assign blame.
Is the person/group that designed this botnet talented? Without a doubt. Do they deserve respect? Hell, no.
If you respect this person, then you would have to also respect the people who put together those televangelist networks and faith-healers. Liars, cheats, and thieves. They deserve no respect.
Re:Survival of the fittest in action (Score:5, Interesting)
I spyware scanned three PCs belonging to two friends/family households. Naturally, they were all Windows. I used Webroot Spysweeper which is pretty good but costs, and Kaspersky online scan, which is good but slow, and virus only.
- PC 1: infected with various spyware and a backdoor trojan (remote access by the bad guys) - had an up to date antivirus (AVG) that didn't spot any of this, but no anti-spyware installed.
- PC 2 (same network as 1): couldn't even install new software (error on running any new
- PC 3: (2nd household) - infected with a different backdoor trojan and several viruses. Had Norton anti-virus that had not updated since 2004.
I would assume the average Windows PC has a high chance of some sort of infection, unless the users are very careful about installing third party software, some of which carries spyware or worse, and clicking on links in IE. Even Firefox had spyware on one of these machines.
Windows PCs run by power users (not the users here) can be somewhat secure, but it's painful to make them so. One colleague who's very techie still got infected by a PDF security hole recently, so you need Secunia PSI to run continuously, as well as monitoring some security blogs, and updating software regularly, as well as using a good anti-spyware tool, not using IE/Outlook, etc etc. However, once you are making this much effort, the work needed to install Ubuntu becomes much less of a hurdle - you might as well just switch over one PC so you have a safe PC for online shopping/banking etc.
The only good thing about this story is that nothing very important was being done on these PCs - little online shopping and no online banking... however, that's the users' self-reported status and they may well not want to admit they are at risk.
I don't do this for a living, I'm just a Windows and Linux user who wondered why there were so many popups on one of these PCs and ended up getting sucked into this when I should have been socialising - fortunately anti-spyware scans can run during dinner...
Parent
Re: (Score:3, Insightful)
FWIW & YMMV, I setup my family and acquaintances with XP-SP2, IE7, Windows Defender and the latest version of SAV Corporate/Enterprise in Unmanaged mode. I just turn on Automatic Updates in Windows and setup the AV software to update every night. My biggest "problem user" is a girl whose laptop was completely owned by spyware when I first met her. After a pave and rebuild wi
Re: (Score:2)
Because, and only because, I refuse to hook it to a network while I'm trying to de-worm it.
the point (Score:3, Funny)
Slashvertising. (Score:5, Funny)
Clever (Score:5, Funny)
Windows has downloaded a new security update. Do you wish to install?
Re: (Score:2)
Break the key with zombies? (Score:5, Funny)
Re:Break the key with zombies? (Score:4, Insightful)
Parent
Re: (Score:3, Funny)
Just curious.. (Score:4, Funny)
Re: (Score:2)
Blue Frog remembrance... (Score:5, Insightful)
One year later, spammers are ALREADY using a P2P system for such thing, while nobody has the means to counter them.
The lesson: They got ahead of us. It's time we invest in countermeasures of our own, or succumb to the enemy. Because, we're losing.
Re: (Score:3, Insightful)
If the dynamic residential r
Re: (Score:3, Insightful)
Blocking port 25 is a reasonable idea, and many ISPs do it, but to say to do otherwise is criminally negligent or that doing so would stop worms from spreading is completely absurd.
Pretty much the only effective tool ISPs have is to completely shut down the connection to any infected computer. But people will (rightly) get upset about that.
Bruce Schneier discusses the Storm Worm (Score:5, Informative)
A good essay on the Storm Worm and how it works and how it can be prevented (or rather why it CAN'T be prevented in many cases).
Fixing one part (Score:2)
Yes, it's inconvenient to some ("wah! but I run sendmail off my laptop on dial-up!" - Yeah, well, go back in time to 1993 and have yourself a ball...). Frankly, they can just get the hell over it and use one of a dozen other methods to send out mail or increase their TTL. Spam is way more inconvenient and it affects everyone.
This doesn't address other uses for these botne
So, how bad is it? (Score:3, Interesting)
These blurbs, if they're true, paint a bleak picture. Should the hackers leverage the network's full power, couldn't they shut down just about any server on earth? And imagine the bandwidth costs of this thing operating at full force.
So for those in the know, is Storm just a way to propagate spam and annoy people? Or is it something even more dangerous?
Re: (Score:3, Insightful)
What is the difference between that statement and "I have no idea how many, so I'll toss out scary numbers."
(hint: the second statement is honest)
Rename (Score:4, Funny)
How would this service be marketed? (Score:2)
What is preventing a sting? (Score:3, Insightful)
And if we don't have the REAL people to work on this, perhaps we should hire Hollywood to get the job done because it seems like the only real law enforcement that happens these days is in the movies or on TV.
CmdrTaco is behind this (Score:5, Funny)
The updates are part of the Slashdot tenth anniversary auction. In addition to the @slashdot.org address and low user id, CmdrTaco has also gotten the operators of the Storm Worm Botnet to auction its use off as part of the charity action.
Some potential uses for the winning bidder:
Only one way anything will be done about this (Score:3, Insightful)
Everyone hates spam, but spam filtering techniques have progressed to the point where we're at an uneasy stalemate with spammers. Everyone hates DDoS attacks, but in truth, how many people have really been the victim of one, and how many companies with muscle are really vulnerable to a normal-sized one? What will have to happen is that some overambitious crook gets it in their head to attack a Google or a Level3 or an Amazon or a national military, and puts the muscle behind it to make it work. It'll take players of that sort of weight to induce ISPs to do what they should have been doing all this time - proactively detecting botnet traffic and suspending the account of any user, individual or corporation, participating in such botnets.
I suppose we could also black hole enough of the world that the botnet controllers are forced into the reach of countries with tough computer anticrime resources, where they can be put behind bars and well out of the reach of any keyboard. I'm just not quite sure the Russians will stand for that....
Is the 40 byte key attackable? (Score:3, Interesting)
What would it take to attack the 40 byte key? Imagine a coordinated effort by the biggest 500 gouverment computing setups around the world. All the blue genes and whatnot pitching in. The Japanese sure have the one or other state-of-the-art mainframe supercomputer, and CERN, ESA, Nasa and few German weather services have a few aswell. There is tons of horsepower laying around idle at agencies, bureaus and the occasional school or corporation. If they all pitch in in a coordinated brute force attack *and* have Seti@Home do a few hours too it should be possible, no? Especially if one takes into account that at least the NSA has mathmatical functions that do some of the dirty work and speed up the process a little. They wouldn't even have to publish them.
Wait, let's just check:
255 to the power of 40 is rougly 1.8 times 10 to the power of 96 (Gulp!). Thats nearly Gogol. (10^100, what Google initially was supposed to be called, the guy registering the domain mixed up the letters...)
Whatever.
On it goes: For the sake of ease I'll roughly estimate that after the overhead has been dealt with, half of the top 500 (or a simular setup) will be doing optimized attacks on an average of 50 billion tries per second. An average state-of-the-art mid-range server has aprox. 20 GigaFLOPS, so I think that's fairly realistic for a large mainframe doing a multi-step operation.
250 * 50 000 000 000 = 1.25*10^13 tries per second.
*60*60*24 makes 1.08*10^18 per day. [Sidenote: This may be way off wack allready and total bollocks but it's fun actually]
*7*52*5 makes 1.96*10^21. Oh, gee. This doesn't look to good. Where at it for 5 years and have only covered less than the fourth root of our total amount of keys. Even if we had 10 times the power it would make up only 1 percent of the keypace. Sheesh. We'll probably be cheaper off in handing out Linux PCs to everyone on the planet.
It's no use. I gotta start working on my next project: Finding an explicit function for prime numbers. Hehehe. I could use the Million from the Fields Medal too.
Bottom line: My question/assumption was lame. But at least I found out myself.
Re: (Score:3, Funny)
Yes. (Score:5, Insightful)
Simple answer, complex solution.
First your firewall, useless (against storm). One of the attack paths of storm is to get YOU the user to visit an infected site, often by sending you an email. Unless your firewall somehow knows ALL infected sites and blocks them all (unlikely) the email will arrive, and the site will be visited and the trojan loaded. You could setup a firewall that protects against this, but you don't have one, because if you did, you wouldn't have to ask, you would know. Firewalls only help against worm attacks, were an outside computer probes your network for weaknesses. IF you configure your firewall extremely rigidly and only allow known traffic through it, then malware on your network could be blinded, unable to connect to any command parts of the storm network. It is possible to use for instance iptables (linux) to inspect all packages going through it and simply drop unwanted traffic. Since storm now apparently uses encrypted p2p(edonkey) traffic this shouldn't even be too hard. This would however result in a less userfriendly network. The only experience I got was in a setup that ONLY wanted regular HTTP traffic, and this meant a LOT of stuff failed, even web traffic because not all web application create proper headers. (I wonder what the recent MS stealth update means for windows, did this traffic pass unseen through software firewalls?)
Then your AV software. Forget about it, storm mutates itself. Since AV software mostly works with signatures, it can never be uptodate enough. I read a report that it changes every half hour. How the hell are you going to keep your signature data that uptodate?
Windows patches. They ain't uptodate thanks to MS dreaded patch tuesday. THis means that a security hole can EASILY be unpatched for weeks. COnsidering this is MS we are talking about, practice is far longer. You will be the target of exploits MS does not know about yet, won't develop a patch for for months, that they will delay for weeks to deploy and for which the AV companies do not have signature.
Anyway the most recent big security hole involves PDF's, that is Adobe, nothing to do with MS. You have to be uptodate on EVERYTHING. That includes EVERY codec, every handler EVERY single piece of code on your computer. Have an image browser installed? Are you sure that not a single on of the image codecs it uses has a flaw? If you update one image browser are you sure that not one single program on your computer still uses an old library that is still vulnerable? Remember, if a storm attack only infects a fraction of a percentage of computers, they still got hundreds of thousands of machines.
START TO GET THE PICTURE?
Basically you are like a good soldier, who keeps his gun clean, doesn't screw with hookers and stays awake on guard asking how well he standsup to a full out nuclear war. YOU ARE TOAST PRIVATE!
But there is hope, the most common form of infection is still through user interaction. YOU have to open the PDF, you have to execute the exe/scr/sh/dmg/whatever, you have to visit the link. The most powerfull attack is social engineering, get that soldier in his invincible armour to pickup a grenade and eat it.
The really odd thing is that you do not even have to be paranoid to avoid it. Just don't click on things. IF somebody sends you a story headline, visit the BBC site yourselve. If somebody wants to send you pictures of some celeb flashing her aging bits, don't. There is plenty of fresh porn with nice looking girls out there (cheggit.net).
So what do you need to stay safe?
Mostly, your brain. Disable every bit of automation in software and instead let your brain do the thinking. NEVER just use automatic install (spyware) and never allow for instance outlook to preload crap or preview stuff. Email is for text, not webpages. But mostly ask yourselve WHO is sending me this, and WHY. One of the most amazing attacks I seen was by sending a "joke" attachment to people in your address book. Here is a hint, I am dutch. My brother I
Parent
Re: (Score:3, Informative)
Re: (Score:3, Informative)
The only way to know if your operating system has been infected is to be lucky enough to have the bad guys screw up and flood your system with enough bad stuff to affect performance. Even then, plain