Zeus Attackers Turned the Tables On Researchers 119
ancientribe writes "The attackers behind a recent Zeus Trojan exploit that targeted quarterly federal taxpayers who file electronically also set up a trap for researchers investigating the attack as well as their competing cybercrime gangs. They fed them a phony administrative panel with fake statistics on the number of Zeus-infected machines, as well as phony 'botnet' software that actually gathers intelligence on the researcher or competitor who downloads it."
Why can't we have commercial software like this? (Score:5, Insightful)
I'm being a bit sardonic here, but why can't we have commercial software that we pay for this well thought out? Of all the categories of software (games, utilities, Office suites), malware has evolved from being CPU/disk/memory hogs to some of the leanest and most well coded executables that ever hit a CPU on the planet.
Deviously creative, but... (Score:3, Insightful)
Come on, who wouldn't have thought of that?
I almost admire them (Score:4, Insightful)
The devious, insidious bastards. It's exactly the sort of thing your average armchair-spamming-fantasist would concoct before decrying that the world is full of idiots and they would make a much better criminal, if only they had the time to learn how to code. I mean, it's creative and ridiculous on a par with bad-scifi plot twists.
A bit scary but, well, I'm impressed.
Re:Deviously creative, but... (Score:3, Insightful)
All the other groups who run botnets, apparently.
The bad news about internet crime (Score:4, Insightful)
The bad news about botnet operators, malware authors, and other black hats: they aren't stupid.
Common security tactic, reversed use... (Score:4, Insightful)
Re:Why can't we have commercial software like this (Score:5, Insightful)
You can't get it because you are unable or unwilling to pay top dollar for quality software that works. By contrast Botnet owners, Wall St firms, and the Chinese government are willing to pay top dollar for software which functions perfectly and reliably and indeed do so.
It should also be noted that when software companies attempt to cross such buyers by providing less than stellar product, they tend to end up regretting it. The average user by contrast keeps buying Windows, Office, Norton and DVD codec software no matter how much they get burned. The incentive to produce quality software for the general user simply doesn't exist.
Re:Why can't we have commercial software like this (Score:4, Insightful)
Re:The bad news about internet crime (Score:4, Insightful)
It's natural selection in action. We catch and punish the stupid criminals more often, which allows the smart ones to thrive.
Re:Why can't we have commercial software like this (Score:2, Insightful)
Pretty much every piece of software out these days has a EULA declaiming responsibility for anything that happens with the software, up to and including serious financial harm.
And just like with pretty much every piece of open source software as well?
Re:Why can't we have commercial software like this (Score:3, Insightful)
It has nothing to do with the cost of the software. Extremely expensive enterprise software are often just as crappy as any cheap crap out there, sadly sometimes even worse. The difference is that the expensive software has highly trained personnel supporting it, carefully not doing anything not throughly documented and tested.
Personally im convinced laws demanding responsibility from software firms would benefit them as well as it would put an end to the feature frenzy from the marketing departments. In the end the software would be cheaper to develop and manage, not more expensive.
Re:Why can't we have commercial software like this (Score:5, Insightful)
Why don't commercial programs have such high quality and thought out design? Simply because there's not enough money in it. The writers of these programs (the Bad Guys(TM)) make far more money on their work than legit companies do. Plus they have real reasons for being so good: stay out of the gulag. How do you think products like Norton Antivirus got to be such pieces of crap? Make what sells instead of what works. The Bad Guys(TM) have the exact opposite motivation. Make what works, and the money starts coming in. They sell to vulnerable machines and other Bad Guys(TM) and if it doesn't work well, their paycheck doesn't get very big.
In other words, big companies don't need good programming and quality checks. They have marketing departments.
Re:The bad news about internet crime (Score:4, Insightful)
The bad news about botnet operators, malware authors, and other black hats: they aren't stupid.
And the worse news: we ARE
and that's why they're in business.
Re:Deviously creative, but... (Score:3, Insightful)
Point is though - the bot net operators now know who is gunning for them. This is a disadvantage for the researchers, it'll make it harder for them to track down the operators.
Re:Why can't we have commercial software like this (Score:3, Insightful)
Yes, but most of the OSS is gratis, so a warranty wouldn't make sense, because there's no sale.
If I were to pay for that OS software, I'd expect a warranty like in any other sale.
Re:I almost admire them (Score:5, Insightful)
Ha! I've outsmarted you, then. My comments are never insightful!
Re:The bad news about internet crime (Score:4, Insightful)
No, we're not. But the rest of us is busy trying to get things done, not play a battle of wits with black hats. It's another one of the time thieves that prevent people from actually performing work and earning money, that you just want to deflect with the least amount of hassle and cost. More often than not that's not about a head-to-head comparison, it's just about being a harder, lower profit than the rest.
I've talked to people working for rather large companies and in the end they are simply amoral. If they can increase profits by a million through lowering security so they make two million in extra income and lose one million to black hats, they don't care about the morality of it. Catching criminals is really only relevant if you can set examples that lead to fewer attacks which has a dollar value.
If it was all about security we'd all be running OpenBSD and those who made Acrobat Reader would be put to the wall and shot. That is not how the world works, even for us regular users it's about usabilty and "good enough" security. Not that I like to have my computer hacked and my identity stolen, any more than I want a burglar to rob me. But I don't live in a bunker with vault doors either.
It didn't work (Score:3, Insightful)
From the article, it sounds like the honeypot was only discovered after the REAL botnet was pwned. I don't see any claim that it worked. The article says potential targets of the honeypot were researchers and competitors. I suspect the primary target was competitors. The researchers surely know they are likely being monitored and to treat anything they find with suspicion.