Please create an account to participate in the Slashdot moderation system


Forgot your password?

Slashdot videos: Now with more Slashdot!

  • View

  • Discuss

  • Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

Security IT

New Botnet Dwarfs Storm 607

Posted by CmdrTaco
from the that's-a-lotta-zombies dept.
ancientribe writes "Storm is no longer the world's largest botnet: Researchers at Damballa have discovered Kraken, a botnet of 400,000 zombies — twice the size of Storm. But even more disturbing is that it has infected machines at 50 of the Fortune 500, and is undetectable in over 80 percent of machines running antivirus software. Kraken appears to be evading detection by a combination of clever obfuscation techniques that hinder its detection and analysis by researchers."
This discussion has been archived. No new comments can be posted.

New Botnet Dwarfs Storm

Comments Filter:
  • 500,000 Spam a day (Score:2, Interesting)

    by insane_machine (952012) on Monday April 07, 2008 @10:42AM (#22988572)
    "The firm has seen single Kraken bots sending out up to 500,000 pieces of spam in a day."

    So that's why I have been getting so much spam lately.
  • by Anonymous Coward on Monday April 07, 2008 @10:43AM (#22988584)
    ...that security through obscurity didn't work? Apparently it does:

    Kraken appears to be evading detection by a combination of clever obfuscation techniques that hinder its detection and analysis by researchers.
  • Re:Scary (Score:3, Interesting)

    by TheRealMindChild (743925) on Monday April 07, 2008 @10:49AM (#22988676) Homepage Journal
    I simply wrote a script that scans through traffic logs on the router and gives me a nice report of questionable (not typical) traffic patterns. I've caught some baddies on a buddies machine that was on my network.
  • Re:Spamming (Score:2, Interesting)

    by Anonymous Coward on Monday April 07, 2008 @10:51AM (#22988694)
    Any given Fortune 500 company is big enough to justify having their own mail servers that handle all their traffic for them. Internal users will use the server as relay to the outside world, and all internal machines will naturally be "trusted". How do you suggest the admins are supposed to know which traffic passing out from inside their own network is legitimate and which is botnet traffic? Yes, you could filter all traffic, but that isn't going to be much of a help when a new infection springs up inside your own network.
  • by khasim (1285) <> on Monday April 07, 2008 @10:55AM (#22988742)
    Someone who doesn't notice a 10x or more increase in outbound traffic?

    Or, more likely, someone who just does not check the logs.
  • Re:Spamming (Score:4, Interesting)

    by Scutter (18425) on Monday April 07, 2008 @10:56AM (#22988752) Journal
    Any given Fortune 500 company is big enough to justify having their own mail servers that handle all their traffic for them. Internal users will use the server as relay to the outside world, and all internal machines will naturally be "trusted". How do you suggest the admins are supposed to know which traffic passing out from inside their own network is legitimate and which is botnet traffic? Yes, you could filter all traffic, but that isn't going to be much of a help when a new infection springs up inside your own network.

    How about "don't trust your users" and "don't set up your server as an uncontrolled relay for them"? It certainly possibly, if nothing else, to limit the number of connections/minute or the number of recipients/message to at least contain the damage rather than allow your users unfettered access to your mail subsystems.
  • Re:Scary (Score:5, Interesting)

    by Pojut (1027544) on Monday April 07, 2008 @11:03AM (#22988834) Homepage

    Dispose of Windows, install a more secure OS, and take the time to learn to properly use your new OS

    Or you could just learn how to properly secure XP and not go clicking all willy-nilly on every email you receive.

    With a combination of three free programs and a bit of common sense, I haven't gotten a single virus or bit of spyware on my XP box in literally years. ZoneAlarm, AVG, and Spybot make a fantastic defense.
  • Last I heard, they were arguing the exact opposite - non-Windows systems are too hard for the government to break into.

    And who knows, perhaps Kraken is sending your data to HLS on the side? If I made a government spy virus, I'd disguise it as a spambot too... the signal is lost in the noise.

    This, needless to say, could also explain the surprisingly low discovery rate on standard AV tools.

    [/tinfoil hat]
  • by Lumpy (12016) on Monday April 07, 2008 @11:17AM (#22989018) Homepage
    yes actually.

    Viriuses and bots are Incredibly easy to get installed and infected on a PC. It's brain dead easy.

    It's far harder to get a linux or OSX or BSD infection going as you trigger the "you are trying to install "XXXX" enter your admin information to allow this to install for applications that are going to get it's hooks in the system. all other applications ca reside in a location that is safer and installable by the user only. and YES you can do this in linux, a user can download compile and run or even install an app to the user directory and use it just fine.

    all OSX users I know dont simply click yes to everything because the software makers have 1/2 a brain for those platforms. windows apps all think they need to shove crap all over the pc. and therefore pc users are usedto having even a fricking mp3 playing app shoving thing in the windows system directory, changing the registry, etc...

    stop that stupid behavior (return to farking ini files in the app directory instead of the incredibly stupid registry) and stop installing 65,000 random dll's in the system directories.

  • Re:Scary (Score:5, Interesting)

    by Pojut (1027544) on Monday April 07, 2008 @11:17AM (#22989030) Homepage

    ..and is undetectable in over 80 percent of machines running antivirus software.

    Hence why I also said using a bit of common sense (i.e. not clicking on everything that shows up in your email) and using a well-configured firewall. I also will occasionally check on the traffic that is outbound from my PC just to make sure something like this has not occured.

    It really is not difficult to keep a windows box secure. Granted, it requires more attention than a Linux box, but's quite easy to set up and maintain.
  • by AndGodSed (968378) on Monday April 07, 2008 @11:47AM (#22989494) Homepage Journal
    Ah - the old "Linux is not user friendly" rant.

    Dude - that is a way old argument. When last did you use Linux? Try Ubuntu - and some of that so-called "crapware" and then post an informed reply.
  • by ConfusedVorlon (657247) on Monday April 07, 2008 @11:53AM (#22989582) Homepage
    serious question:

    most folks don't send more than 50 mails a day (number pulled out of a** and is for illustration only)

    so how about this ISP anti-spam approach:

    1) if a user sends more than 350 emails in a week, or more than 100 emails in a day, the ISP emails the user with a 'do you have a zombie' email.

    this would list the subjects & initial contents of emails sent.

    user could either reply 'yup, I send a lot of email please bump me up to a higher trigger level' or 'please help me fix this - I'm not really a viagra salesman'

    x days/emails after the warning, the ISP could start blocking stuff if there was no response to their warning mail.

    This would give people a chance to know if their machine was infected (I think mine is clean - but I certainly don't monitor outgoing smtp traffic) and generally provide a service to all at little inconvenence.

    Would this be bad ??? Is it really hard to spot a zombie PC that is sending spam out through your network?
  • An analogy of tents. (Score:2, Interesting)

    by pyrr (1170465) on Monday April 07, 2008 @12:01PM (#22989688)

    Once upon a time, there was a city where most people lived in tents. Most were made of ripstop nylon, but there were some made of canvas, blue tarps, and some were basically old garbage bags.

    Obviously, tents aren't that secure. Most people didn't bother to even try to secure the flaps on their tents, some bought and installed luggage padlocks to secure the zippers, but even those were only a slight hinderance in this city that relied mostly upon trust and goodwill. All an intruder needed was a knife to slash a hole in the fabric or a stitch-puller to intrude on others' tents, for the purpose of mischief, hiding radios that only broadcast advertisements, stealing information, and the like. Some even set-up shop in other folks' tents, posting advertising and selling goods and services, simply not caring about the actual owners' wishes.

    There weren't only tents in the city. Some people did live in wooden or stone shacks, and a few of the tent-dwellers even modified their tents into reinforced shanties with sheets of metal and plywood. They were largely ignored by the criminal element, simply because the time and effort it took to break into one reinforced tent or shack, they could break-into several tents and accomplish the same ends. Given that the overwhelming number of ne'er-do-wells in this city only possessed pocketknives, they lacked the means to break into the stronger structures, and typically had to resort to tricking the residents of those structures into leaving the doors ajar.

    Windows has two critical traits that cause it to be such a problem on the internet: it's easily compromised and extremely popular. If either factor wasn't in its favor, the problem probably wouldn't be quite as serious, but Windows just hasn't developed appropriately for use in a multiuser, networked computing environment. The same rules that apply when you're camping in the wilderness when you're isolated become absurd when you're building a shelter when there are other people, including criminal elements, in close proximity.

    To the question you pose, I think the answer is probably going to turn out to be, "Actually, yes". The overwhelming majority of current exploits are against pathetic Windows security, where there is little separation between the outside vs. inside, and no compartmentalization on the inside to limit the damage. There will still be some level of crime and confidence games in communities that have greater individual security, but the casual and inexperienced criminals wouldn't have the sort of free reign they enjoy when it takes little skill or knowledge to accomplish their goals. Would an internet dominated by Linux and OS X still have machines compromised into zombies on botnets? Of course, they're still maintained by humans who don't all care about security and fall for tricks. But it wouldn't be anywhere near on this magnitude.

  • Instead of filtering torrents, your local ISP should be redirecting their deep packet inspection efforts on thwarting spambots. Regardless how deep it is buried in your OS, at some point it is going to have to announce its presence when it starts spewing spam. With >90% of the internet being choked up with spam, shouldn't ISPs worry about spambots rather than P2P? If spam is detected, a friendly email could be sent back to the source indicating that your PC is likely infected with malware.

    Also, if more people ( not everybody ) switched to alternative operating systems such as Macs and Linux, (preferrably different distros) it would be much harder for malware to propogate, as they would have to split their efforts at hiding in many different targets and spreading between incompatible systems.
  • by Anonymous Coward on Monday April 07, 2008 @12:21PM (#22989954)
    Funny, I have it running on a $200.00 Dell pc.

    granted it's not LEGAL, but it is OSX.
    also the macbook air is no more than an equlivant Dell laptop.

    dell latitude 830 with upgraded video card and ram $1590.00 + 3 year warranty = $1800.00

    Macbook Air with 3 year warranty = $1850.00

    yup. way more expensive... I'll pay that $50.00 for the 1/3rd the weight and size.

    Insane memory useage? have you ever seen Vista? OSX uses 1/10th the memory. you must be uneducated.
  • Undetectable? (Score:5, Interesting)

    by nick_davison (217681) on Monday April 07, 2008 @12:29PM (#22990090)

    a botnet of 400,000 undetectable in over 80 percent of machines
    So, does that mean it's a botnet of 2,000,000 zombies, or that there are actually only 80,000 that have been detected but they're pretty sure they're only finding 20% of them so 400,000 sounds right?

    If it's truly undetectable, how would you know what percentage of cases were undetectable? Surely, be definition, you couldn't tell?

    In other news, most women think I'm damn sexy. It's just undetectable in 99% of cases. But I'm sure they do!
  • by bestinshow (985111) on Monday April 07, 2008 @12:30PM (#22990102)
    The problem is that Windows hides file extensions to make filenames look prettier.

    Of course, the user should think "hmm, why does this filename have .jpg still?", but let's ignore the user for now and assume them to be a moron that will do the worst possible action.

    Windows could do a lot more itself. It could have a set of very basic rules to run on files when they are downloaded or double clicked.

    e.g.,: Filename has two extensions, last of which is exe - mark as highly probably virus/trojan/spyware. Alert the user to this fact, with the disabled "Continue" button for 10 seconds, or never enabled to force the user to rename (Also only use the extension as a hint to the action that will be undertaken when double clicked. Perform analysis of file contents to check that it actually appears to be that type of file.)

    Don't run downloaded .exes (in fact, any .exe that hasn't been run before) until there has been a warning, with a delay so the user can't just click Continue. The warning window shouldn't be bland non-exciting 9pt Calibri either, there should be something to make the user pay attention and think. "Why is Aunt Mavis sending me a cool dancing sheep screensaver?!" I think that Vista does this already?

    Self-extracting zip archives should be identified and de-archived by the OS Zip extraction function, and the .exe part should never be run. Indeed, self-extracting zips should be banned, simply because they're a useless format nowadays.

    But in the end, there will be idiot-user ways around these rules, there will be flaws in the rules (I'm not spending all day tweaking them for a mere Slashdot post), and the malware will adapt.

    On a Mac I imagine you could just give you malware the system image icon in the application package, and it would fool most users. Apart from user education (hahahaaaaaaaaaaaaaaaaaaaaaaaaaa) it's going to be difficult to eradicate the malware problem.

    Of course every time an image file format, or Office file format, etc, has a buffer overrun issue on an OS, exploits will be made. Parsers should be stricter, and peer reviewed for good secure programming practices.
  • by Creepy (93888) on Monday April 07, 2008 @12:32PM (#22990128) Journal
    yeah - I have a feeling the situation is a lot worse than this with botnets - my blog server was hit with a comment spam bot slowing that machine to a crawl. After shutting down my forum for two days, I dumped the database for 200000 'pending' posts that failed a graphical word ID check (meaning they would get trashed from pending in a week), wrote a script to grep out the IPs and got almost 120000 as unique (all now blocked). I re-enabled comments and got 80000 more before I disabled it again yesterday and now plan to completely block posts that fail a graphical ID check. Some of these may be attributable to dynamic IP leases, but I still suspect over 150000-200000 machines are involved. I'm still getting severe network performance problems today, so it's like having a denial-of-service attack. I've submitted a list of IPs and timestamps to my ISP, so hopefully they'll be able to do something about it, but I imagine that will take a while.
  • by Anonymous Coward on Monday April 07, 2008 @12:55PM (#22990452)
    Well, at least you have an opinion. It's really the mark of users that plain suck. Give all those same users who click on everything and anything that sounds vaguely interesting a nice, shiny new Ubuntu machine - ALL of the users mind you - so replace most people's Windows machines. See how long it takes those same people to be rooted. Now what will you complain about? Their sucky OS? Or their lack of ability to treat their computing resources as carefully as they SHOULD be treating their government ID's such as SSN's in the US and bank info, etc.? It's the users - not the OS.
  • Re:Detection? (Score:2, Interesting)

    by bigpicture (939772) on Monday April 07, 2008 @01:04PM (#22990610)
    They have a heuristic engine that seems to catch most things, before they are recognized to be out there. ("in the wild") If you read all the independent tests it consistently comes out ahead of all others. I have been using it for three or four years, and never had an infection, but with Norton and McAfee I have had infections.

    NOD so far has nailed all the web files that I have opened, either accidentally or intentionally. The big red splash screen pops up every time.
  • by 99BottlesOfBeerInMyF (813746) on Monday April 07, 2008 @02:26PM (#22991742)

    Well, at least you have an opinion. It's really the mark of users that plain suck.

    I really wish this was the case, but OS vendors could do much much, much more to make their systems secure by default. As for the metric that users suck, sure they do. Last I read, however, compromises that had no user interaction were still responsible for more incidences than ones that have a user interaction component, There are a lot more trojans out there than worms that compromise machines silently, but the latter hit a lot more machines at a time and more often.

    Give all those same users who click on everything and anything that sounds vaguely interesting a nice, shiny new Ubuntu machine - ALL of the users mind you - so replace most people's Windows machines. See how long it takes those same people to be rooted.

    Actually, they would probably last a lot longer. The truth is, Linux is attacked less by automated worms so most users would fare better. It is not that Ubuntu is really much better for security than Windows (it is better in some ways, worse in others) but there is one big thing Ubuntu has going for it. Canonical does not have monopoly influence on the desktop OS market.

    Ubuntu currently has security that is appropriate to the threat posed by malware attacking it. Regardless if that security is currently better or worse than Windows, there is no reason to think Ubuntu would not continue to provide whatever level of security is desired by users. You see, Canonical sells services based around Ubuntu. Most of the contributors to Linux are users (either on a large or small scale) or are hired by users. If Canonical does not provide them with the security they want, they can and will go elsewhere. There are lots of Linux distros and companies selling services based upon it. In a worst case, Linux can fork to provide users what they need. Basically, is comes down to motivation. If Ubuntu is not good enough, Canonical loses money; ergo, Canonical will invest in security improvements so they can make more money.

    When Windows does not provide the appropriate level of security to make the average user happy, Microsoft does not lose significant money. In fact, in many cases machines are slowed down by malware such that the user does switch to a new vendor. The problem is, they switch computer vendors (from Dell to Lenovo for example) and Microsoft actually gets an extra sale out of it. Usually the influence MS wields in the desktop OS market makes switching to another OS vendor impractical or uneconomical, especially given MS's ability to break interoperability with other OS's and lock in user's via their data, applications, etc.

    Now what will you complain about? Their sucky OS?

    It is not even that Windows sucks on technical merits. They suck because they are the biggest target and they don't care. When I go down to the bar, I don't wear a bulletproof vest of any sort. When I browse the internet from a Mac or Linux machine I don't bother with sandboxing my browser or running it in a VM that resets every time I use it, or even running antivirus software scans. I don't need to. If, I take a business trip to Baghdad, I'll probably wear a vest. Most people would not think to do so. For someone at a tourist bureau in Baghdad to try to persuade people that Baghdad is a more secure place than Minneapolis is absurd. For them to argue that there are more troops protecting you in Baghdad than in Minneapolis is beside the point. For them to argue their are concrete emplacements and checkpoints to catch "bad guys" is likewise beside the point. The measures in place are insufficient to deal with the level of threat presented. This is true for Baghdad and Windows.

    And to answer your second question, if Ubuntu were regularly compromised in daily use, yeah I'd argue its security sucks. There is a lot of work that can be done to make every OS more secure for users, but for the most part only Windows has a big problem for normal

  • by DrEldarion (114072) on Monday April 07, 2008 @04:05PM (#22992758)
    It also guarantees that no regular-Joe home users will ever use that OS because they don't want to have to change permissions on every shitty time-waster game they download from the internet.
  • by kesuki (321456) on Monday April 07, 2008 @04:30PM (#22993044) Journal
    btw, you can actually make a nice secure user 'chattr' who is not root and have a fairly secure password length for when the Mr remote admin needs to use chattr to install updates, etc. just make sure Mr Idiot is safely logged out when doing the updates.

    thought if this after i posted, although technically Mr idiot can "sudo su chattr" if he's a sudoer unless, you require all user chattr logins to shhd. not sure off hand how to do that on Linux, more used to how to do that on BSD systems.
  • by 99BottlesOfBeerInMyF (813746) on Monday April 07, 2008 @04:53PM (#22993350)

    Of course, you could make code show what it will do upfront ("This program will create files in your home directory, but won't open any network ports, or modify any files it didn't create").

    Your argument here is interesting because of two points. First, generally restricting new programs so that they cannot do anything they want. The second and more focused point is preventing installers from writing files here there and everywhere. I think default ACLs to restrict programs are going to be very important to the future of computing. Keeping programs contained within a given part of the filesystem is also useful and I'd argue an approach that does well in this regard is the application packages used on OS X. It is a win in that it removes the need for installers in most cases (drag and drop beats running random code) and provides a folder where all an applications files can be stored. It allows applications to write to specific other locations, but just config files, not binaries and there are advantages to storing the config files outside the package.

    This is something that could be done (I think Microsoft's "managed code" is a valid template for this approach). But the UI is really hard to nail, and the user must still read and understand what's being proposed.

    I agree with this although I'd make a few points. MS's UI is a travesty. It is not just poor, but it makes the same UI mistake people have been complaining about for years. The "OK/Cancel flaw" has been well documented and explained by numerous experts. MS has little excuse for doing it all over again. Second, I think if you get to the point of asking users to authorize or deny specific activities it should only be as a last resort after several other passes that attempt to resolve the issue.

    Consider: "This program will modify system files and read any files on the system, and open network connections both on the local zone and the Internet", does the average user allow that to run? Perhaps not, but what if it's pron?!

    Has your OS certified this software is from a specific vendor? Has your antivirus provider certified this software as specifically safe or unsafe? Given that it is uncertified software from somewhere unknown I think it is very important to give the user good options. Don't give them buttons that say: (OK)(Cancel). Give them buttons that say: (Allow program_name to run, but restrict access)(Don't allow program_name to run)(Allow program_name to run and have complete control of the computer)(Advanced options). If they click the first option try running the software without letting it touch the network of system files and see what happens. If that fails automatically run it, but give it access to dummy files and network access. If that too fails, let it run in a clean VM with a bridge to the network (while watching that VM/network for potentially malicious behavior like running a mail server that sends a lot of traffic).

    Seriously, though - can an OS be secure, if it's users don't make rational choices?

    I think the key is to give the users good choices and only as a last resort after automated work by the experts has failed. Never give users cryptic choices. You have to avoid training users into thinking allowing access to programs equates to programs working. Right now clicking "OK" for most users is a conditioned response that people do like putting gas in a car. You click "OK" all the time to keep your computer running stuff. That association needs to be broken. Granting access should be a separate issue to whether or not a program will run. A user can validly want to run a program so they can look at porn, but still not trust that program. A secure OS should let them run it, but still not trust it. Let it connect to he internet and access a dummy address book file and take control of a dummy Webcam and install a keystroke logger in the VM and send that useless data to some third party. Then, the user can look at their porn and still be secure as much as possible.

The less time planning, the more time programming.