Forgot your password?
typodupeerror
Security Operating Systems Software Windows

Conficker Worm Could Create World's Biggest Botnet 220

Posted by kdawson
from the holding-our-collective-breath dept.
nk497 writes "The worm that's supposedly infected almost nine million PCs running Windows, dubbed Cornficker or Downadup, could lead to a massive botnet, security researchers have said. The worm initially spread to systems unpatched against MS08-067, but has since 'evolved and is now able to spread to patched computers through portable USB drives through brute-force password-guessing.'"
This discussion has been archived. No new comments can be posted.

Conficker Worm Could Create World's Biggest Botnet

Comments Filter:
  • Evolution (Score:4, Funny)

    by KasperMeerts (1305097) on Tuesday January 20, 2009 @05:20AM (#26526751)

    The worm initially spread to systems unpatched against MS08-067, but has since 'evolved

    It hasn't evolved. This is clearly Intelligent Design and anyone denying this is a godless heathen!

    • Re:Evolution (Score:4, Informative)

      by gravos (912628) on Tuesday January 20, 2009 @05:27AM (#26526781) Homepage
      Downadup and other such similar worms exploit a vulnerability in the Windows Server service: Server Service Vulnerability -- CVE-2008-4250 [nist.gov]

      The vulnerability is detailed by October 23rd's Microsoft Security Bulletin MS08-067. [microsoft.com]
    • by Yvanhoe (564877)
      For once, I agree with this opinion...
      Still not Ghost In The Shell :
    • I have to agree although I wonder how big the pool of machines would have to be and how smart a programmer would have to be to make a worm which genuinely mutates...

      • Oh, there has been self-mutating code. The problems with code mutations is the same, though, as with mutation in real life land: Most of them just can't live. Many more can live but are at a disadvantage compared to the "original". So true "evolution" just doesn't make sense for a computer worm. Yes, it spreads fast, yes, it's generation cycle is about that of a bacterium, but unlike life, the originator of the worm had a plan: Use it to infect. And while "go forth and multiply" (which proves reverse Polish

    • Re: (Score:2, Informative)

      by Ed Avis (5917)

      It has evolved - but not by natural selection. Some amount of evolution is accepted as a fact by everyone except young-earth creationists (those who believe the world is about 6000 years old). For example, we know that horses used to have toes and now they have hooves. But some believe this evolution is caused by natural selection and genetic variation, while others believe it was the act of a creator or designer. The evolution of wolves into domestic dogs is an example of evolution caused by man (you c

    • by ozbird (127571)

      It hasn't evolved. This is clearly Intelligent Design and anyone denying this is a godless heathen!

      Unlike Windows, which is clearly not Intelligent Design. (Windows 7 is not the messiah, either - it's just a naughty service pack.)

      • I certainly agree that Windows isn't Intelligently Designed, but does it count as Evolution if it gets worse over time?

        I think Windows is a case of "Just Happened".

    • by genner (694963)

      The worm initially spread to systems unpatched against MS08-067, but has since 'evolved

      It hasn't evolved. This is clearly Intelligent Design and anyone denying this is a godless heathen!

      Nope it evolved from a simplier program. Anyone who believes in a flying spaghetti coder is just ignorant.

  • follow the money. (Score:5, Interesting)

    by leuk_he (194174) on Tuesday January 20, 2009 @05:27AM (#26526779) Homepage Journal

    It should not be that hard to follow the money generates by this malware. Infecting 8 million PC should be a crime.

    from the write down, it downloads data from

    " hxxp://trafficconverter.biz/[Removed]antispyware/[Removed].exe"

    follow that money and the bad guys will be found quickly.

    • by calmofthestorm (1344385) on Tuesday January 20, 2009 @05:36AM (#26526809)

      It should not be that hard to follow the money generates by this malware. Infecting 8 million PC should be a crime.

      It's a crime if it's spammers. It's not a crime if it's government or content industry.

      Bitterness aside, the main problem is that usually the people doing it are in a country where it is, for a number of reasons, difficult to track them down. Still, I agree that, short of keeping your OS up to date (if you /must/ use Windows), following the money is the best approach.

      • Re: (Score:3, Interesting)

        by Anonymous Coward

        You're assuming too much. Keeping Windows up to date?

        One problem is the lifecycle support. SP1 isn't supported anymore, I believe, and even trying to manually install the patch won't work because it requires SP2 or higher to be done. (For XP, of course.)

        SP2 won't necessarily work on all computers, for one reason or another. Some may choose not to go up to SP2 due to all that garbage installed with it. (I think a very annoying firewall is installed, and doesn't it tamper with Internet Explorer against one's

        • Re: (Score:3, Insightful)

          by Cowmonaut (989226)

          The Windows Firewall is greatly improved in SP3, but even the default un-patched firewall in XP is more or less a joke if you plan on doing any network sharing. So either way you have to deal with it. Also, I think it's SP3 you mean about the tampering with IE. It'll install IE7 if you want it or not unless you already had it installed. The only way to uninstall it without going through a big hassle is to have IE7 installed prior to installing SP3 if I remember right.

          There are very few reasons to not in

          • I think it's SP3 you mean about the tampering with IE. It'll install IE7 if you want it or not unless you already had it installed.

            Oddly, the reverse seemed to happen to me. I had installed IE7 on my daughter's box. When SP3 went in, it reverted to IE6.

            Go figure.

          • by nabsltd (1313397)

            Also, I think it's SP3 you mean about the tampering with IE. It'll install IE7 if you want it or not unless you already had it installed.

            I have many XP machines with SP3 installed, and none have IE7.

            Since there are no options to the SP3 install, I can't see how someone could choose not to install IE7 if it was actually part of SP3.

        • by Korin43 (881732)
          I have a customized CD for Windows XP now, but I used to just install it then turn the Firewall and annoying warnings off. It takes about 2 seconds, and it's definitely worth it for the ability to get updates (and the improved wireless tool).
    • Re: (Score:3, Insightful)

      by jonwil (467024)

      Its a good bet that the machine or machines responding to the trafficconverter.biz domain name are either hacked (e.g. zombies) or obtained using stolen or fake credit cards and other ID.

      The chances that the information listed for the account(s) owning trafficconverter.biz matches with the owners of this botnet is very little.

      • by Richard W.M. Jones (591125) <rich@anne[ ].org ['xia' in gap]> on Tuesday January 20, 2009 @06:07AM (#26526975) Homepage

        It's not like the FBI and Interpol and going to look at the bogus whois information and throw their hands up and say "oh noes". They can go and raid the registrar's offices and find out what IPs registered the domain, what credit cards (stolen or not) were used, and if they were stolen, where from and when. Furthermore the worm has a whole list of websites, so every single one of those can be checked in the same way, and even if they are all hijacked, there will be hundreds of potential clues about the perpetrators.

        Personally, I am sick of spammers attempting to add comment spam to sites that I run, signing up for bogus accounts, sending massive amounts of spam, continuously trying ssh connections, running exploits etc the list goes on. The police need to do something to help us.

        Rich.

        • by timmarhy (659436) on Tuesday January 20, 2009 @06:31AM (#26527103)
          agreed 100%. until some serious pound me in the ass prison time is handed out to more than a few of these guys, it won't stop. better coordination with isp's is also the answer here, once these virus/spam sites are identified, for fucks sake blacklist them. this simple act would stop 100,000's of infected pc's from giving up information making the whole venture less profitable.
          • Re: (Score:3, Interesting)

            by Opportunist (166417)

            You assume that you're dealing with a country that has a stable legal infrastructure. In 99 of 100 of such cases, you are not.

            The servers are usually located either in countries from the Soviet Union breakup or emerging countries in Southeast Asia. Sometimes, but rarely, South America. And if it's anywhere else, rest assured that it's a hacked server that won't stay up longer than a few days. Those people know exactly how long it takes you to find them, find their server's location, get the local authoritie

        • Re:follow the money. (Score:4, Interesting)

          by maple_shaft (1046302) on Tuesday January 20, 2009 @06:40AM (#26527149)

          This nasty virus has caused me to be up working overtime for the past two weeks.

          Well one hint to finding the assholes who wrote this virus is the fact that the virus willingly ignores computers originating within the Ukraine.

          That narrows it down to about 80 million people. ;-)

          • Re: (Score:3, Funny)

            This nasty virus has caused me to be up working overtime for the past two weeks.

            Well one hint to finding the assholes who wrote this virus is the fact that the virus willingly ignores computers originating within the Ukraine.

            That narrows it down to about 80 million people. ;-)

            Ukraine has about 46 million people. And the situation is already being dealt with -- Russia has stopped to supply them with gas.

        • by mlush (620447) on Tuesday January 20, 2009 @07:23AM (#26527347)

          Personally, I am sick of spammers attempting to add comment spam to sites that I run, signing up for bogus accounts, sending massive amounts of spam, continuously trying ssh connections, running exploits etc the list goes on. The police need to do something to help us.

          Rich.

          I think you should be careful what you wish for. The Police could do something, they could turn the Internet into a Police State.

        • Personally, I am sick of spammers attempting to add comment spam to sites that I run, signing up for bogus accounts, sending massive amounts of spam, continuously trying ssh connections

          One thing you can help at least - move your public ssh port to a # in the range of 10000-30000. The number of login attempts on my servers have dropped from thousands a day to none since I did that a few years ago.

        • continuously trying ssh connections

          What the heck do you have ssh open to the world for in the first place?

          Try this:
          http://www.openvpn.org/ [openvpn.org]

          I've got customers with Windows and Linux servers running this, and Windows and Linux clients, also. There are at least several pages that I've found with a single Google query on how to install it on OS X.
          It will also run on the BSDs.

          There really is no excuse to have any management port open to the Internet anymore, on any machine.

        • Re: (Score:2, Interesting)

          by hesaigo999ca (786966)

          Actually you are on to something, we (the people) are not giving enough definition of responsibility for someone owning a website that can be used for harm.
          When you drive a car and can hurt people by driving over them, you need a license and pass some courses etc...

          Well for owning a website, you have to pay with an proper credit card, should any of those numbers show up as having been stolen the site is downed immediately, and the person contacted to provide new information for credit card approval, and as

        • The police need to do something to help us.

          They've already sent an SOS to the world. What more do you want?

        • Until you got all the paperwork down to make this raid, there will be no data left on the server. Been there, done that, didn't even get a cool looking t-shirt.

      • Re: (Score:2, Informative)

        It is common practice for domains to be registered using stolen credit card numbers and phony registration information, as well as using bots within the net to act as proxies between you and the actual server, such as with fast flux [wikipedia.org]. That combined with the fact that the servers are generally hosted in countries that don't have a lot of money, man power, or motivation to track these types of operations down makes stopping them a very difficult process.
    • Re:follow the money. (Score:5, Interesting)

      by ledow (319597) on Tuesday January 20, 2009 @06:43AM (#26527165) Homepage

      It sounds very simple but you're missing the bigger picture.

      How do we know that that virus has ANYTHING to do with trafficonverter.biz or that they knowingly provide that service? What are you going to do, shut down the website without a full legal investigation? Brilliant! I don't like slashdot, so I make a virus that looks like it gets its instructions from them, or from random comments posted on there. You've now made it incredibly easy for me to "social-DoS" a website. I can get them shutdown, or cause them lots of financial hassle to deal with the investigation, just by downloading something from them with my virus.

      Or say I want AVG out of business - I make the program download a particular older version of AVG to use a known vulnerability in it to propogate my virus or elevate its permissions. Or I just install it on every machine I infect forcibly. If people don't start associating AVG with malware (like that Antivirus 2008/2009 thing) then I've just given them the impression that it's a horrible piece of software that forces itself on you. Or I make sure that it's the only virus scanner that can or can't detect my virus - either way, I win in discrediting AVG.

      The fact is that a virus is an unwanted, untrusted application. Because it's untrusted, you can't just start shutting things down because you find a "clue" in that virus's code. That's why it takes *so* long to convict known virus-writers. International boundaries, legal obligations (hence why you can't just "take over" a botnet that has people's/company's PC's in it and issue random command to "clean it up"), verifiable evidence, there are a million holes.

      The problem is not that viruses make money. It's that viruses STILL WORK. That they STILL EXIST. That they are STILL CAUGHT by people. They've been around for 30-odd-years and they are more prevelant than ever and 99.9% of viruses operate on a single platform, targetting old, known, already-patched vulnerabilities. The fix for viruses is not to stop their creation by "persuasion" (removing revenue streams, harsher sentences, etc.) but to prevent them by technical means and ensure those means are adhered to. This means punishing users and operating systems that *don't* conform. Virus infections are a daily occurence and people are now blasé about them... I've had people casually mention having dozens of viruses on their machines and could I have a look if they bring it in next month, etc. The problem, again, is an OS that allows such things to exist and propogate so readily and simply (literally, I could write a Windows virus in a matter of hours with no previous knowledge and virtually zero documentation... Unix-based? Wouldn't know where to start because I would need to find a gaping hole in heavily-tested, proven-rugged, complex code that I can barely understand.

      My provider shuts customers off if they use port 139 (and others) on their PC's without having previously informed them that, basically, "I know what I'm doing". The Internet stops and all webpages are replaced by an automated message about how to install a firewall (which, thankfully, also includes the "I know what I'm doing" option). I do "know what I'm doing", I have several layers of protection on everything connected to the Internet but I've left this on. What we need is a massive opt-in that enforces this for the average person. My ISP can already scan every webpage and email for me for viruses and replace them with warning text. They need to extend this to be the default, with opt-out. Then when Joe-Idiot gets a virus, it's probably his own fault because he bypassed the safety barrier and thus you can throw him off if his IP starts spamming or trying to infect others.

      Even a simple method (e.g. an automated port scan every day, ala GRC.com's ShieldsUp and an email if open ports change). It's not a catch-all but it will certainly shock a few people if they realised just how open their PC's are and will warn companies and professionals when something happens that sho

      • Re: (Score:3, Interesting)

        by Joce640k (829181)

        Dunno, but whay can't we remove trafficonverter.biz from the DNS for a few weeks?

        You might say it's bad for them and "all smappers need to do to shut down a web site is...blah, blah" but that's ignoring how spammers work. If spammers learn that websites will be removed from DNS at the first sign of trouble then they won't use websites.

        Spammers don't do it for political reasons, they're thieves who are trying to get money.

      • Re: (Score:3, Insightful)

        by jabithew (1340853)

        Then when Joe-Idiot gets a virus, it's probably his own fault because he bypassed the safety barrier and thus you can throw him off if his IP starts spamming or trying to infect others.

        Most ISP terms of service allow them to do this already. If they actually tried to enforce it, they wouldn't have any customers left.

        • Re: (Score:3, Insightful)

          by value_added (719364)

          Most ISP terms of service allow them to do this already. If they actually tried to enforce it, they wouldn't have any customers left.

          That's a fair comment, but I don't think it's true. Given the near-monopoloy position of ISPs, the customer either can't leave, or would think long and hard before doing so.

          The real issue I think is that it will cost the ISP real money (in terms of added call volume to their support weenies). If they allow their infected customers to pollute the internet, then the cost is pa

      • Re: (Score:3, Insightful)

        by jrumney (197329)

        What are you going to do, shut down the website without a full legal investigation?

        Yes, sometimes the public interest outweighs the commercial interest of a business. It happens in meatspace every day for all kinds of reasons, from anonymous bomb threats to the president coming within 2 miles of the place.

      • The problem is that most people tolerate a certain amount of crap in their life. They don't clean the windshield for a single bug-strike, they don't pump up a tire that is a little low, and they don't care about computer virus problems if they haven't been hurt by them lately.

        In simple economic terms, it currently costs the average computer user more time and effort to protect against virus problems than they (personally) perceive themselves to suffer from them. They'd rather throw $60 at the problem and

      • I'm more and more convinced that the solution is simple: "Accept only trusted communications". Automatically refuse any attempt at communication to your network that is not properly signed and encrypted, as well as specifically authorized by a competent authority within your organization.

    • Re: (Score:3, Informative)

      by Opportunist (166417)

      A nice idea in theory. Since I'm in exactly this business, allow me to illustrate how this works (or rather, how it doesn't).

      You follow this trail to some registrar in, say, Uzbekistan. He will point you to Malaysia, where the server is located. So you phone your local Interpol office (let's assume you are on good terms with them and they actually listen when you call, as in my case. It helps when you point them to some bank scams first so they see you as someone who ain't just a waste of time). If they are

  • ISP Blacklists (Score:2, Interesting)

    by Devil's BSD (562630)

    One thing about botnets... I don't really understand why there couldn't be a blacklist of known botnet controllers maintained by a trusted authority (SANS, or perhaps a collaboration of the leading AV vendors, for example) that ISPs could use to block their customers from connecting to. Or, they could even go one step further and shut off the customers connecting to botnets until they're sure the customers have cleaned their computers.

    • by IBBoard (1128019)

      Ignoring any technical issues I can see two main issues with that:

      1) ISPs would have to put in effort and money to combat these things
      2) By actively trying to combat them they would then be more responsible for the ones they didn't catch

      It's good in theory (just like stopping the spammers with measures ISPs could take) but the practice never seems to make sense to the corporates.

      • Re:ISP Blacklists (Score:5, Interesting)

        by ChienAndalu (1293930) on Tuesday January 20, 2009 @06:02AM (#26526941)

        1) ISPs would have to put in effort and money to combat these things

        Depending on the amount of traffic that worm generates, it might even be worth it.

        • by IBBoard (1128019)

          It might, but that assumes that the ISP puts in the effort and money to investigate whether it is worth it or not in the first place ;)

        • I know ISPs are considerably more complex and technically advanced today than in 1997, but my first inside knowledge of an ISP was a tech sales guy who installed a modem bank in his garage. He had some inkling of how to wire it all together and he could read the help files on the server software and keep it up 99% of the time, but beyond that he didn't really have deep understanding of anything he was doing. He certainly wasn't about to launch any theory based investigations to solve problems he saw for

      • by Nursie (632944)

        Wait,

        are you telling me the the ISPs don't use services like spamhaus?

        I think there could be a similar service for botnet control points.

    • Re: (Score:3, Insightful)

      This would only work for centralized command and control mechanisms. More sophisticated bots use decentralized p2p type communication, as was with the storm worm last year. Conflicker uses a built in mechanism to generate new domains to contact each day, and while security firms are deploying blacklists based on the generator code, it could easily be changed in a new variant. This is of course not taking into account the difficulty one would have in getting ISP's to maintain a list of blacklisted domains
    • by will_die (586523)
      part of the problem with this one is that connects to one of 5 time servers to get the date. Once it has that information it follows a formula to determine what "master" web server to connected to; once connected to the "master" it downloads more software and can upload info. The people running the "master" have been generating a bunch sites each day using fake information, so each day you have figure out what the real site is and then get the blocked or shutdown. However once the new day come around you
    • One thing about botnets... I don't really understand why there couldn't be a blacklist of known botnet controllers ...

      Like this one [spamhaus.org]?

  • by Viol8 (599362) on Tuesday January 20, 2009 @05:46AM (#26526851)

    I dont use Windows much but I assumed MS had disabled or at least set the default to off of the autoexec.bat feature so how else could it spread just by plugging in a USB stick? Someone tell me this security hole the size of a planet isn't still enabled by default in Windows installs??

    • by k.a.f. (168896) on Tuesday January 20, 2009 @05:51AM (#26526893)

      I dont use Windows much but I assumed MS had disabled or at least set the default to off of the autoexec.bat feature so how else could it spread just by plugging in a USB stick? Someone tell me this security hole the size of a planet isn't still enabled by default in Windows installs??

      It posts an "execute" option in the autoplay dialog that looks almost exactly like the harmless "browse folder" option, complete with misleading folder icon. It's moderately clever, but of course still rquires autoplay to be enabled.

    • Re: (Score:2, Informative)

      It's autorun.inf not autoexec.bat, and it does require a bit of user interaction. Double clicking on it in explorer in XP will execute it but on systems running vista/7 it must rely on social engineering [sans.org].
    • by Spad (470073) <slashdot&spad,co,uk> on Tuesday January 20, 2009 @05:54AM (#26526907) Homepage

      Autorun is still enabled by default in Windows for all removable devices.

      USB sticks are a little odd though as autorun only works for certain ones with a specific hardware flag set. I would guess it's trivial for this worm to change the flag to enable autorun, however.

      • Re: (Score:3, Insightful)

        I would guess it's trivial for this worm to change the flag to enable autorun, however.

        Only after its executing....and if it's doing that, what's the point?

        • Re: (Score:3, Informative)

          by Aladrin (926209)

          Infect other computers. That's the whole point of putting itself on the USB stick in the first place.

        • It obviously was executing on the machine from which it got onto the stick.

      • by transporter_ii (986545) on Tuesday January 20, 2009 @06:54AM (#26527203) Homepage

        I would have to agree. I fought, what I think is this worm, at work for a week or so. If not, here is what I fought.

        *Would disable Recovery console so you couldn't go back to an early date.
        *Spread by USB thumb drive.
        *Stick in a thumb drive, if the computer had AVG, it would detect it, but not be able to "heal" everything...but by this time it was too late.

        One variant of it put in a root kit and blocked all access to antivirus sites. You could go anywhere on the Internet unless it happened to be an antivirus site.

        This same one also blocked exe files if they happened to be something like Spybot search and destroy. It just wouldn't run anymore.

        Also, it turns off the ability to change settings to view hidden files and folders, so you can't see the folders it adds.

        My guess is, it is pretty freaking trivial for these people to do whatever they freaking want in Windows (except for probably disabling DRM!).

        Transporter_ii

    • by Zocalo (252965) on Tuesday January 20, 2009 @05:56AM (#26526917) Homepage
      Conficker basically does some social engineering. Unless Autorun is disabled (it still isn't by default) when you insert a USB stick on a Windows box you get a dialog box asking what you want to do. One of the options on the box appears as "Open folder to view files" which might sound innocuous, but is actually an "autorun.inf" option created by Conficker that in reality runs the virus. The only real clue that you have that something is amiss is that the real "Open folder" option is visible as below the Conficker generated fake.
      • by ChienAndalu (1293930) on Tuesday January 20, 2009 @06:05AM (#26526961)

        I really hate Microsoft for this kind of stupidity. They could have just made an option "autorun program from USB stick" with nothing customizable about it.

        • by Anonymous Coward on Tuesday January 20, 2009 @06:39AM (#26527145)

          See http://isc.sans.org/diary.html?storyid=5695

          The option appears as :

          Install or run program: Open folder to view files (Publisher not specified)

          So people falling for it, would have clicked even on "Install virus and destroy your life ? YES/NO".

        • by Fred_A (10934)

          That would be great :

          Infect your system from removable drive ?
          [yes] [no] [file not found]

          I wonder what most users would pick though.

      • by yuna49 (905461)

        One of the options on the box appears as "Open folder to view files" which might sound innocuous, but is actually an "autorun.inf" option created by Conficker that in reality runs the virus.

        I may be dense, but why would you want to give untrusted programs control over what appears in the autorun dialog box? Shouldn't control over those options reside entirely with the OS? I suppose game manufacturers might want to put some icon next to "Play Game" or something like that, but that seems to create a rather

    • by h3rmanni (797836) on Tuesday January 20, 2009 @05:57AM (#26526919)
      http://www.f-secure.com/weblog/ [f-secure.com] has screenshots showing how exactly it executes from USB sticks under Vista and Windows 7 beta.
      • Re: (Score:3, Insightful)

        I must admit, it is cleverly done. Put me in front of a Windows machine with default settings and I'd probably select the topmost option.
        Still, it's an epic fail to enable such autostart of random programs from USB stick. It is sacrificing essential security for questionable convenience.

    • the size of Pluto maybe.

  • by Stanislav_J (947290) on Tuesday January 20, 2009 @06:08AM (#26526981)
    Do I just have a dirty mind, or did others upon first glance read this as the "Cornfucker" worm?
  • "It creates 250 possible domains each day," it added. "We've registered some selected domains out of this pool and are monitoring the connections being made to them."

    Why is it able to register domains automatically? This is where we should be working to block the verdamt thing... stopping the automatic registration of domains... make it take time and require money to actually create the domain...

  • by Anonymous Coward

    The guys at Winh4x [blogspot.com] have generated a script that detects servers missing the MS08-067 update.

  • Cancel or allow ? (Score:3, Interesting)

    by smoker2 (750216) on Tuesday January 20, 2009 @07:12AM (#26527287) Homepage Journal
    As it's windows anyway, can't MS issue a patch that asks a user for confirmation every time an outgoing request gets made ? Or at least keep logs that it can monitor for bot like activity. If you are getting more than a certain number of outgoing connections without any other user input, then it should flag it to the user as suspicious, via a report that appears on boot, and need confirmation before anything else can be executed.

    You could still have trusted services, time.windows.com etc, but multiple requests when the browser hasn't registered a click for an hour should be regarded as suspicious. I realise this is the "wrong end of the stick", but we have to deal with things the way they are, not how we'd like them to be. At least being nagged will bring the publics awareness to the problem existing on their machines.

    Another idea - use the mouse, so that if it's left unmoved for more than x amount of time the "watchdog" would lock the net down. If you need to leave something running like bittorrent, you can specifically add it as a trusted service, but never permanently. Anything other than BT accessing the net during that time period (or until you move the mouse again) will automatically be denied.

    It seems to me that the wider community is having to carry the can for the sorry state of windows security, so making life inconvenient for those who leave their machines unpatched should be fair game.
    • by Xest (935314)

      It'd be trivial for trojan developers to just emulate a move of the mouse, or a press of the keyboard or a button.

      • Re: (Score:2, Interesting)

        by Fittysix (191672)

        The 'dimming the desktop' isn't just to catch the users attention. When a UAC prompt comes up it does so on the secure desktop, where mouse and keyboard can not be manipulated by a program. For example, when using synergy http://synergy2.sourceforge.net/ I was unable to interact with the UAC prompt without using the local keyboard/mouse.

        • by Xest (935314)

          That's because synergy will have been running in user mode.

          Unfortunately, trojans et al. are a little less respectful of privileges and memory boundaries.

          I'm not sure how this really relates to the original idea here though unless you're suggesting the keyboard and mouse threads always run in this mode but interacts with the desktop that remains running at reduced privileges? I can imagine that would only make things worse.

  • Say it ain't so (Score:3, Insightful)

    by damn_registrars (1103043) * <damn.registrars@gmail.com> on Tuesday January 20, 2009 @07:35AM (#26527403) Homepage Journal
    It wasn't that long ago that someone declared the storm botnet had been cracked wide open [slashdot.org], from which some people made the extremely erroneous extrapolation that botnets would become a thing of the past.

    Well, I guess that almost held for two weeks. Maybe someday people will consider addressing the underlying cause of these problems instead of the symptoms.
  • by Dystopian Rebel (714995) * on Tuesday January 20, 2009 @08:36AM (#26527877) Journal

    The only reason why there hasn't been a class action lawsuit against Microsoft for their incompetence is that many misguided people STILL think that every 20 minutes of MS Word is worth 1 week of their time spent Patching and Praying and trying to recover data.

    The argument that the vast Windows Ecosystem (700 m computers) is itself an argument for using Windows has been disproven by the Internet. If you have a network or connect to the Internet, Windows is a significant risk. And don't blame the users. That's as arrogant as the US makers of the cars that Nader condemned [wikipedia.org] in 1965. Windows is "Unsafe At Internet Speed".

    The Windows operating system, which is a liability on any network, must be constantly patched to protect against the "latest" threats. Microsoft's only constructive answers to these exploits are "patch and pray" and also to cripple connectivity (Windows XP SP2).

    There will always be smart Bad Guys. The Bad Guys who excel at being bad are MUCH more creative than Microsoft and they have clearly put Generalissimo Ballmero and his regiments to flight. If you have the worst possible defences, you can't expect to be left in peace. Using Windows today is like sending your cavalry to engage hostile tanks. You *will* get slaughtered at some point and if it doesn't happen immediately, it's because the tank crews took pity.

    • by Spad (470073) <slashdot&spad,co,uk> on Tuesday January 20, 2009 @09:03AM (#26528109) Homepage

      *ALL* operating systems much be constantly patched to protect against the "latest" threats. Windows just gets the majority share of attention because there are millions of Windows boxes, many unpatched, many owned and operated by computer illiterate users who have little or no interest in securing them (And even in Vista, which is a vast improvement on XP from a security perspective, the default security leaves a lot to be desired).

      Ok, they are *usually* less serious than this particular vulnerability, but my Ubuntu box downloads "critical" updates at least once a week on average.

      Microsoft have made a lot of bad design decisions in their products, often in order to thwart competition, but them actually being incompetent or negligent, especially in recent years, is a lot harder to prove.

      • *ALL* operating systems much be constantly patched to protect against the "latest" threats.

        Not if the threat is in the Windows Ecosystem. All OSs are updated, but how many OSs are used to form Botnets based on OS-specific technology?

        Ok, they are *usually* less serious than this particular vulnerability, but my Ubuntu box downloads "critical" updates at least once a week on average.

        My Ubuntu box and my OS X box receive updates, sure. But, for example, I am unaware of any Linux-based or OS X-based Botnets. They will not be updated for this Botnet. The easiest target is the target of choice.

        Microsoft have made a lot of bad design decisions in their products, often in order to thwart competition, but them actually being incompetent or negligent, especially in recent years, is a lot harder to prove.

        Exhibit A - the invention of the Botnet.

    • by Abcd1234 (188840) on Tuesday January 20, 2009 @10:31AM (#26529097) Homepage

      The only reason why there hasn't been a class action lawsuit against Microsoft for their incompetence is that many misguided people STILL think that every 20 minutes of MS Word is worth 1 week of their time spent Patching and Praying and trying to recover data.

      Actually, I think it's more fundamental than that. I think the last 20 years of Microsoft dominance have convinced people that this is the *only way computers can work*. That it's impossible to do any better. So they've learned to live with the instability, the insecurity, the constant fear of losing work due to mysterious crashes and instabilities.

      Heck, just look at the praise lavished on XP. Compared to 95, XP is a quantum leap in terms of stability. And yet, in my experience, it's only just adequate. But compared to what people were used to, it's amazing!

"Never ascribe to malice that which is caused by greed and ignorance." -- Cal Keegan

Working...