The World's Biggest Botnets 243
ancientribe writes "There's a new peer-to-peer based botnet emerging that could blow the notorious Storm away in size and sophistication, according to researchers, and it's a direct result of how Storm has changed the botnet game, with more powerful and wily botnets on the horizon. This article provides a peek at the 'new Storm' and reveals the three biggest botnets in the world (including Storm) — and what makes them tick and what they are after."
Re:Does it run on Windows? (Score:3, Interesting)
Note total absence of word "Microsoft" (Score:5, Interesting)
It's interesting that these articles don't even mention that Microsoft's insistence on running executable content from the browser is at the heart of all these problems.
You Sank My Enterprise! (Score:2, Interesting)
Ah, but you fail it!
In other words, stupid people and people who dont care about security punish the rest of us. How nice. You dont know how much I would appreciate a "Internet License" to show basic security and protections on the net.
Anyone who thinks non free software can be secured should be denied said license. FTFA:
If you think you can do better than Fortune 100 support teams, you are sorely mistaken. They have all the time, money and employees they want to throw at this problem and still get their ass kicked. People trying to tweak non free software are working in the dark and will always be surprised. No matter how much they spend, they can never fix the problem.
The lack of mention of business security here... (Score:5, Interesting)
Well, let me point out for a second how while dangerous for a single home system to be infected, it is a world worse when a business system becomes infected.
Within hours, typically that botnet has replicated to all of the machines on the internal network. Worse, now that botnet has access to your critical database information, consisting of customer records. Often times, the brains behind these botnets can better datamine than your business can, finding interconnections with your customers to better flood them with spam, or worse.
At my job, one of our machines was hit with the Storm. We isolated it within minutes, but even then it still wa a close call. If I hadn't been doing a routine portscan at just the right moment, we'd have never spotted it.
After that, the boss authorized me to begin a slow migration to Linux.
Re:Note total absence of word "Microsoft" (Score:5, Interesting)
Other stuff, like running an executable sent to you by MSN is so freagin hard it puzzles even me sometimes (I beleive by default you have to change something in the registery, or it simply will flag em and you'll never be able to so much as extract exes from a zip file). Thats probably pushing it too far, but point is, if you don't have the admin password, its relatively difficult to do something retarded aside to hit your own account (which is possible in any OS really, and even then, you get quite a few warnings).
Something of interest, though not really related: Once I installed some game (I forget which) that tried to install a copy protection crap, and Vista actually asked me if I wanted to install it separately from the game itself (I got 2 pop ups). Said no, and it happened that this particular game would run without the copy protection...so I was able to tell it to shoo off (while my friend on XP hosed his install because of it...a patch came out the week later to fix the issue, but I never had the problem in the first place). MS is learning. Slowly.
Re:Microsoft isn't the only irresponsible company (Score:5, Interesting)
Yes, the router was still emailing me every log of all network traffic -- my traffic and the malware traffic also. Seems the malware author does not think my ability to log their traffic was significant.
Netgear was very helpful. Tier1 tech support said securing the router was my responsibility. Asshats!
Re:Note total absence of word "Microsoft" (Score:5, Interesting)
OLPC is potentially quite secure against naive user problems. There are plans for about a billion of these, so you'll have your answer pretty soon.
Re:Yes, free software would fix the problem. (Score:4, Interesting)
Also a bot net of suns is worth far more per machine than windows machines. The numbers I've heard are a sun box on a big connection is worth at least $100 vs about $.1 for a windows box. And there are Solaris 10 botnets out there (thanks telnetd)
Re:You Sank My Enterprise! (Score:5, Interesting)
If you think you can do better than Fortune 100 support teams, you are sorely mistaken. They have all the time, money and employees they want to throw at this problem and still get their ass kicked. People trying to tweak non free software are working in the dark and will always be surprised. No matter how much they spend, they can never fix the problem.
On my home network, I can do things like block every single incoming port and disable pretty much all of the outgoing ones as well. I can install firewall software on each computer to scan the remaining ones. I can create my own install media to remove nearly any part of windows which isn't related to the bare essentials, then install the bets antispyware software and demand that anybody that uses the computers not click on links in email.
I'm sure there's more, but I would be surprised if I were allowed to do even that much if I were responsible for securing a corporate network.
Re:Well.... (Score:2, Interesting)
I'm very concerned that ISPs will attempt to force the user to run antivirus or some other type of software to connect to the network. Besides compatibility and security issues involved in running software controlled by your ISP, some of the antivirus software out there is terrible.
My school requires that you must have some sort of antivirus software installed to connect to the network and provides a virus scanner for us. I was running Windows XP in a virtual machine, so I grabbed the free scanner. It was a Symantec corporate style scanner thing. After going through all the settings, the scanner would still run full system scans in the background. Unfortunately, "in the background" isn't very in the background when you're running Windows XP in a virtual machine, and the VM would use as much of the CPU as possible to do a background scan.
So, I tried to uninstall it. You can't do that. You need a password. I had to manually delete all the files and registry keys manually. Months later I was having problems with 16-bit applications because Symantec had not provided complete removal instructions.
I don't want to need to worry about my ISP forcing me to use some software that will permanently damage any software installation or degrade performance while doing things unrelated to my ISP. There are enough hidden problems with ISPs already.
Re:Note total absence of word "Microsoft" (Score:3, Interesting)
Linux can be quite secure, but most of the fanboiz forget that you all have the root password in your hip pocket. If (or when) Linux were to become the dominant consumer environment, these problems will migrate to linux, because the essence of a consumer machine is that the consumer has admin rights to it. Uneducated admins are the problem, not the OS they happen to be running.
Re:Microsoft isn't the only irresponsible company (Score:3, Interesting)
1) Netgear ppl were complete morons and the GUI is not directly linked to the filesystem records/small database/whatever
or
2) Hacker is good enough to alter this part of the router's code as well, meaning he flashed the firmware remotely.
I wonder how many people have been hit with this without knowing. It is one thing to monitor your PC's activity, but a router? Scary shit. Better get that rusty copy of Snort up and running again.
PS: you actually check your logs..wow. You either work for the NSA or you are half Klingon. Also, did you find out who it was, and whether you were sending out payloads similar to the one you received(meaning that it wasn't an "important" node that attacked you)?
Re:Linux/MacOS are just as insecure (Score:3, Interesting)
I think there's a research OS or two around that have been designed like this, but it's a long way off for most mainstream ones. Of any of the commercial vendors, I could probably see Apple doing it first, because they seem to be the ballsiest when it comes to just breaking backwards-compatibility and rewriting things for the sake of rewriting them (and which arguably "weren't broken" according to others, e.g. launchd), but I still have a hard time imagining it within the next decade. Windows is and will always be a slave to its software base, and most of the Unices tend to be evolutionary rather than revolutionary in their design (which is fine, it's just a different approach).
Software paladins? (Score:4, Interesting)
Part of the Storm threat is that it is able to intimidate those who stand up to it, or attempt to combat it. This would suggest that Storm is in turn vulnerable to an attack by an even bigger botnet. It can succeed on poorly protected machines and lurk in the many dark corners of the Internet, like cockroaches. Suppose enough of us willingly subscribed the spare cycles in our machines to serve as a botnet that would fight the others? Could that work?
Can we come up with a working definition of 'good' for such a botnet? I would not subscribe my machine to any government directed search for terrorists, for example (that's probably got me on a no-fly list). However, it should be possible to confine our botnet to the named botnets in the article, and do 'good' in an sense that would be acceptable to most users. If the project veers towards evil, then there must always be a way to unsubscribe.
Then, we want a fancy UI like the SETI screensaver, so we can see how we are doing, and root for our side.
Re:Microsoft isn't the only irresponsible company (Score:3, Interesting)
PS actually your reply is Redundant; but a good reminder for all. Keep up the good work ;)