Storm Worm Botnet "Cracked Wide Open" 301
Heise Security reports that a 'team of researchers from Bonn University and RWTH Aachen University have analysed the notorious Storm Worm botnet, and concluded it certainly isn't as invulnerable as it once seemed. Quite the reverse, for in theory it can be rapidly eliminated using software developed and at least partially disclosed by Georg Wicherski, Tillmann Werner, Felix Leder and Mark Schlösser. However it seems in practice the elimination process would fall foul of the law.'
so what? (Score:5, Insightful)
However it seems in practice the elimination process would fall foul of the law.
I'm sure I'm not alone when I say, "So?"
Depends ... (Score:4, Insightful)
However it seems in practice the elimination process would fall foul of the law.
Whose law?
Re:Law? (Score:5, Insightful)
Who cares about laws? I mean, the criminals don't, the government doesn't care, is anyone still clinging to this outdated model of a coexistance standard?
Yes. Governments.
So you are sued and lose your house. (Score:5, Insightful)
That's the problem.
The criminals do not care because they were criminals to begin with. This affects the people who are not criminals but who want to clean up the mess made by the criminals.
Now, if the various governments could/would authorize their law enforcement agencies to use this method ...
Question (Score:4, Insightful)
Some people run some botnet ops from some countries with some loose laws to gain some protection.
Is it not as easy to dismantle a freaking botnet from there?
Re:So you are sued and lose your house. (Score:5, Insightful)
"Now, if the various governments could/would authorize their law enforcement agencies to use this method ..."
That is the worst idea I have heard all week.
Just more whack-a-mole (Score:5, Insightful)
If you want to stop the botnet, you need to remove its incentive. The botnet operates not for someones jollies, but because it is profitable to have a botnet. If you remove the profit motive the botnet will self-disassemble over time.
Re:so what? (Score:5, Insightful)
Not only is it a problem of breaking the law, but there's the problem of "cleaning gone wrong". What if the cleaning program fouls a hospital's computers? Or fouls up some other important infrastructure. Do you want to be the guy standing next to the enter key in that event?
Obviously, infrastructure should be configured and secured against such problems, but it's pretty clear that that assumption is false and dangerous. Just a few months ago a trio of London hospitals [theregister.co.uk] went down because of an infection. Granted it was mostly the administrative side that went down, but that still costs a crap load. And what if it's not just the administrative side of say a power distribution grid that shits its self because of some unforeseeable problem with the cleaning worm?
I sure wouldn't want to be the guy responsible for that. There's also the threat that the cleaning will go wrong in completely unexpected ways causing even worse network disruption. If this option is pursued, those that have the magic bullet would probably want to get some sort of pledge of amnesty from their governments to protect them from prosecution in the event that they cause damage.
Re:Just more whack-a-mole (Score:5, Insightful)
If you want to stop the botnet, you need to remove its incentive. The botnet operates not for someones jollies, but because it is profitable to have a botnet. If you remove the profit motive the botnet will self-disassemble over time.
And how do you propose we do that? Spam is profitable even when only one in 10,000 people respond to them, so how do you stop something like that? People have been building better and better spam filters for years, and more and more effort has been spent on educating people about the various scams, and yet spam is STILL profitable enough to illegally hack thousands of computers in order to send it out.
Saying all we have to do to stop botnets forever is remove the profit motive is like saying all we have to do to stop drug smuggling or illegal immigration or home burglaries is to stop the profit motive. Sounds simple, but virtually impossible in practice.
Re:Just more whack-a-mole (Score:4, Insightful)
Could you explain what you mean by removing the profit motive? Though I may be missing something, I think that you might be oversimplifying things here.
I'm not really sure that it's any more realistic to try and make spamming unprofitable than it would be to make any other successful form of marketing unprofitable, let alone one that is almost free.
We could just as easily say that the solution to stopping welfare abuse would be to remove the financial incentive to doing so... but without actually suggesting anything useful to come to that end, it's a pretty useless comment.
Re:Just more whack-a-mole (Score:5, Insightful)
Spam is profitable even when only one in 10,000 people respond to them
Spam makes for an excellent case study in the problem, more on that in a moment.
People have been building better and better spam filters for years
Filters will never solve the spam problem. I have said that before, and I will continue to say it until people start to realize the reality of the situation.
Build better filters, and spammers will send better spam.
You have to remove the profit motive.
And a fair portion of botnet activity is spam-driven or spam-propagating. So if we work on the spam problem, the botnet problem will diminish.
And there is one angle in particular that is available for stopping spam:
If you look at spam messages, you'll see that the vast majority of them ask you to go to domains that are on the order of days old, and seldom remain up for more than a few weeks. This is because registration of domains is too easy, with too little liability anywhere along the way.
Spamming and spamvertised domains are registered at a bewildering rate 24/7. And most of them are registered with bogus information to boot. We need a few things to hinder this
If the virtual storefronts selling the v!@gr@ are shut down promptly, and proper impediments are put in place to hinder their creation, spam will become less profitable. The owners of the spamvertised domains can only afford to pay the spammers for their services as long as they are still selling products.
Re:So you are sued and lose your house. (Score:5, Insightful)
No Kidding! The problem with such laws (any laws) in most countries, is that they are open to interpretation. This is why we have courts. Which means, that allowing any government agency the right to access 3rd party computers for any reason sets a very, very dangerous precedent which can be exploited by the more fascist politicians in the world.
We've already seen the UK Governing Regime try to find ways of accessing the public's computers whenever they see fit, and without any court warrant. There is no sane way to allow this kind of exception, without running the risk of opening the door to further Government inspection of your computer, if they decide to exploit precedent.
Be very careful with vigilantism. Especially when a government agency is the vigilante. It WILL be exploited for other reasons.
Re:So you are sued and lose your house. (Score:5, Insightful)
up until it crosses national borders then yes it does. But if the guy running the show is in a country without extradition then it is useless. Warrants assume everyone is following similar laws and there is an agency that can police all affected areas equally.
however If an American warrant was being served against a French botnet controller, even with a treaty they still would let him stay free if he didn't harm any french computer users.
Governments are like children, no one else can play in their sandbox, or with their toys.
Re:I am glad I use a Mac (Score:3, Insightful)
While OS X, Linux and others are inherently more secure than an unpatched Windows, the user is still the weakest part of the whole setup.
Wait until we get enough dumb users who install all sorts of shit onto their computers. Granted, the numbers will be much lower than machines which can get infected without any interaction by its owner, but we WILL get users dumb enough to type their password to install "stupid program XYZ" from unknown sources.
Re:So you are sued and lose your house. (Score:5, Insightful)
Re:so what? (Score:3, Insightful)
Just wondering why they don't just post the cleaning executables, and then talk to the local media about their fix for the botnet, and include the URL to the cleaning executable? Invite the public to run it for free. Then convince the media to post their story as a video on their own website (not youtube or anywhere that can be faked).
It won't get everyone, but it'll start. And then users can pass the story around by word of mouth to extend it to others. Hopefully they'll get media in other countries/languages interested, and then get those to also post their stories on their websites. If the University then tracks these and provides all the links (including languages) back to the media sites, we might be able to convince large numbers of people to clean their own systems without hacking anything. All perfectly legal.
While I have to admit that hacking the botnet itself is worth huge geek points, they may still be able to do a lot of good for the internet with the work they've done so far without running afoul of the law. If users download and run it themselves, that is authorisation right there (especially if the software does what they claim it does).
Re:So you are sued and lose your house. (Score:4, Insightful)
Following the rules is what makes them the good guys, though.
Re:so what? (Score:2, Insightful)
Following that logic it would be ok for the RIAA to access your computer without permission to stop you from sharing music.
Re:I am glad I use a Mac (Score:5, Insightful)
While OS X, Linux and others are inherently more secure than an unpatched Windows, the user is still the weakest part of the whole setup.
I disagree. Users are a weak link, but currently not the weakest and there is a lot that can be done before modifying users becomes practical.
Wait until we get enough dumb users who install all sorts of shit onto their computers. Granted, the numbers will be much lower than machines which can get infected without any interaction by its owner, but we WILL get users dumb enough to type their password to install "stupid program XYZ" from unknown sources.
Most users have the expectation that installing a program is not the same thing as giving someone else complete control of their computer and the ability to send as many e-mail messages in the background as they desire. This expectation is not met. Most users who install software use many different mechanisms for such installation, some of which do require users to type in their password. Because of this, why would users not type in their password when installing a program?
My basic point is just that we need to fix operating systems and make them relatively secure, consistent, and understandable to users as well as make sure they don't reward unsafe behavior. People interested in making computers and the internet more secure have plenty of room to make improvements. The problem is, they don't have the motivation. The solution is effective enforcement of antitrust laws. Return competition and capitalism to the market and the problem will solve itself in short order.
Re:so what? (Score:5, Insightful)
Your post is not unlike the difference between, say, a clueless person using inappropiate analogies, and the proof that car analogies hardly ever make any sense.
Seriously, all this crap is blown way out of proportion. Firetrucks. Car-Bombs. My ass...
If they have a tool to eliminate a large botnet then, by all means, do it. Stop crying for attention in the press, just run the damn counter-worm or release the source-code so the scriptkiddies can fragment the worm into insignificance.
If that wipes out the worm: Great!
If that bricks all infected machines: Well, still better than what we had before.
There's no need to worry about collateral damage. Critical, life-supporting systems are not participating in storm. The worst that can happen is that a lot of computer illiterate people will have a "broken PC" over night and will have to ask their "PC guy" to fix it. This is a "risk" that we should be willing to take...
Re:I am glad I use a Mac (Score:2, Insightful)
Re:Screw the law. (Score:5, Insightful)
Because we don't need to. The botnet software is readily detectable. Simple solution: require ISPs to warn users if their machines are found to be infected and, if no action is taken (ie. not cleaned up and the user doesn't contact the ISP to discuss it) in a reasonable timeframe, suspend their network access.
If you're driving with a car that's spraying oil all over the road, dropping pieces off and generally posing a hazard to other drivers, the police will cheerfully ticket you and impound the car. They don't try to fix the car, they take it off the road and leave what to do next up to the owner. I fail to see why a similar approach can't be applied (other than "But then they won't be able to use the Internet!", to which I reply "Well, yes, that's kind of the point.").
Re:I am glad I use a Mac (Score:3, Insightful)
Malware is so prevelent on Windows partially because Windows provides no way for a user to know what the hell is going on. The expected means of installing software is to visit random websites, owned by god-knows-who, download some executable, and run it. You rarely have any means of telling what it's actually installing, where it's installing, and just what these programs actually do. When this is the preferred way of doing things, is it any wonder that people download and install malicious stuff without even knowing it?
A fine example is Chrome, which I installed in the first few days it was released. I didn't notice that stupid Google Updater thing which was silently installed alongside, until much later when I was checking my running processes for unrelated reasons. Getting rid of it was a pain in the ass, too. I'm a veteran user who knows what the hell I'm doing, and Google "should be" a trusted source -- yet this slipped right by me. That thing could easiliy have been malicious (though to my mind, anything that "updates" unknown servers with unknown information about my computer is malicious).
The Linux repository and package management system isn't perfect but it is far and away lightyears ahead of the Windows method.
Re:Me too (Score:4, Insightful)
Well, the Storm net depends on deniability. Whoever is directing the zombies, they needn't reveal anything about themselves to the botnet, or connect from a particular place The command just needs to find its way into the wild.
Naturally, the cure is going to have to exploit the same dynamic. If we're as careful as the botnet designers were, retribution would be basically impossible.
Re:so what? (Score:5, Insightful)
If it screws up uninfected machines and networks, oh well, umm whoops?
If there are actually critical, life-supporting systems affected, damn, I guess we can't say sorry to the dead, perhaps send a nice e-mail to their grieving families?
There are plenty of scenarios in which the cure is far more catastrophic than the botnet. We should not be reckless or rash in implementing a solution. When taking on something that utilises the worlds stupidity I think we should keep Murphys law foremost in mind.
Re:so what? (Score:3, Insightful)
Yes, you are not alone - sadly. I dont like people intentionally meddling around with my computer without giving them my permission, in the same way as I do not appreciate that somebody breaks into my flat to fix damage that somebody else has done when breaking in.
The only way to handle this correctly is that a law is passwd which allows such things under well-defined circumstances (however i have no idea to to set the boundaries).
Re:Me too (Score:3, Insightful)
My only regret is that I'm not smart enough to be able to contribute directly to a project like this, but as a Mac user, who uses a Mac because "that's what he has", I say hell yes, go for it! I don't like seeing people on any platform being victimized at all. Why ask permission? Just put on the white hats out there and gun it. I could offer some cluster server space if that helps at all.
I also think that the "get the Feds on it" idea is ridiculous. This is about doing the right thing, for the right reason, and we don't need them for that... far from it, really.
Re:Me too (Score:5, Insightful)
In the mean time, the vulnerability has been revealed to those who run the Storm botnet and I bet they're already working to deploy a patch that'll make it inneffective.
Re:so what? (Score:3, Insightful)
keep in mind that every time the botnet herder patches the botnet he runs a risk of bricking those machines, he doesn't care, he has a hundred thousand others.
No need for illegal operations (Score:3, Insightful)
If a zombie is detected, it should be isolated in the same way as a commercial wifi node : no access to the net, and web access pointed to a login page. That page would then offer the option of continuing to use the machine offline, or having the bot software neutralised.
No need to worry about knock-on failures from disconnecting a critical machine : any critical system that relies on its net connection is either broken by design or so unusual that it could be handled as a 'do not block' case by the service provider.
Re:so what? (Score:3, Insightful)
Nonsense. If the counter-worm manages to interfere with machines or networks that are not infected by the original worm then these machines and networks were not properly secured and/or isolated in first place. Their admins should be glad that the counter-worm sheds light on the flaws before a malicious operator of the original worm does.
Nonsense. The heart-lung machine in your hospital does not run windows. The telco systems that dispatch your emergency calls do not run windows. If there are any truly critical systems out there vulnerable to a worm then we'd better find out about that sooner than later. What's the difference between a counter-worm breaking them today versus a "regular" worm breaking them tomorrow?
Re:I am glad I use a Mac (Score:1, Insightful)
I've never understood this "if users wouldn't run as Administrator/root, we'd all be safe" argument, you don't need superuser privs to send email.
A big difference is that although a non-admin bot can run, it can't hide. It can't conceal its existence from OS tools which display processes and files, and so it can't hide from any removal/detection tools.
Re:Tor (Score:2, Insightful)
Re:so what? (Score:5, Insightful)
Man, how paranoid can you even be. That's FUD and nonsense!
Repeat after me: Any system that could be negatively affected by a counter-worm is already at the mercy of the STORM operators today, right now, in this minute!
If a STORM operator willy-nilly decides to push a broken update to the botnet, or to perform an expensive attack that makes some of the machines break down then your imaginary life-supporting systems will go down right there, today, in 5 minutes, or tomorrow afternoon.
Nonsense.
Oh my, do you honestly believe that the heart-lung machine at your hospital is connected to the internet? Or that your nuclear power plant is running on Windows XP? Let me assure you: They are not. And if someone in the world truly misdesigned a critical system in a way that could be affected by a windows worm then we'd better be grateful for the learning expirience that they'll inevitably get (with or without a counter-worm). Or would you really want them to get away with that? Do you really think it'd be good idea to let them get into the habit of building critical stuff upon "cheap" Microsoft infrastructure?
Even if your nonsensical assumptions were correct: I'd still much prefer to have one powerplant melt down today due to a counter-worm than to have hundreds of powerplants running on vulnerable systems in 30 years because hey, "nothing ever happened".
Re:so what? (Score:3, Insightful)
I'm pretty sure the cleaning executable you are talking about is the Microsoft Malicious Software Removal Tool, and consumers smart enough to use it have already done so. Maybe more of and ad campaign, but it's not like tool isn't there and wouldn't being automatically used if these people ran updates.
Re:about 16 years late (Score:4, Insightful)
If more people were using software written by another guy from Finland 16 years ago, there would be no W32 crime wave and we would not need super cracker cops authorized to violate your privacy.
Right, there would be a Linux crime wave instead. Linux doesn't prevent users from running trojans or force them to get their operating system patched.