Feds To Remotely Uninstall Bot From Some PCs 211
CWmike writes "Federal authorities will remotely uninstall the Coreflood botnet Trojan from some infected Windows PCs over the next four weeks. Coreflood will be removed from infected computers only when the owners have been identified by the DOJ and they have submitted an authorization form to the FBI. The DOJ's plan to uninstall Coreflood is the latest step in a coordinated campaign to cripple the botnet, which controls more than 2 million compromised computers. The remote wipe move will require consent, and the action does come with warnings from the court that provided the injunction against the botnet, however. 'While the 'uninstall' command has been tested by the FBI and appears to work, it is nevertheless possible that the execution of the 'uninstall' command may produce unanticipated consequences, including damage to the infected computers,' the authorization form reads. FBI Special Agent Briana Neumiller said, 'The process does not affect any user files on an infected computer, nor does it ... access any data on the infected computer.' The DOJ and FBI did not say how many machines it has identified as candidates for its uninstall strategy, but told the judge that FBI field offices would be notifying affected people, companies and organizations."
That's ok (Score:2)
Re: (Score:3)
Re:That's ok (Score:5, Insightful)
The botnet owners can't take preventative action against the uninstall because they don't have valid Command and Control servers running. Since the FBI is controlling those at the moment, the individual bots are hanging in limbo doing nothing. If however the malware is actively looking for new C&C servers to be spun up to receive commands again, there is the potential that the FBI could lose control again. Hence why it is necessary to remove the infection while they maintain control, and only one step in their strategy to cripple the botnet.
Re: (Score:2)
Re: (Score:2)
They could, but it would be a dick move. As much as I'd like to think so, it's just not true that everyone at the FBI is a dick.
Some are asses. ;-)
Re: (Score:2)
Re: (Score:2, Insightful)
Fixing somebody's computer is a gift. Fixing their machine because it is attacking mine, is something I appreciate. If you don't trust a federal agency to have the authority to remove the virus, then whom do you trust? Rival hackers? Microsoft? They've done such a great job so far in containing
Re: (Score:2)
Not if it leaves the machine in an unclean or unusable state. If you thought anti-American attitudes are bad now, imagine the FBI disabling a couple hundred thousand key machines abroad-- just to get rid of a virus.
Re: (Score:2)
Sweet.
A bit draconian, are you?
If there'd been sufficient investment, someone could just shut off the port. Rootkits mean you get a new kernel after you've rendered what rooted it permanently dormant.
So sure. Let's say you render a couple hundred thousand machines unbootable by wiping their partition tables, MBR, or whatever. They wake up the next morning, and do they love you? Can they do business? Can they read x-rays? Will their their stuff work?
Your method might be nice for screwing up extractors in Ira
Re:That's ok (Score:4, Informative)
A bit draconian, are you?
Maybe. Apparently you aren't one of the guys they send massive amounts of unwanted spam to?
So sure. Let's say you render a couple hundred thousand machines unbootable by wiping their partition tables, MBR, or whatever. They wake up the next morning, and do they love you? Can they do business? Can they read x-rays? Will their their stuff work?
The problem is the malware/rootkit leaves their stuff seeming to work; and it's invisible to them, so they don't even bring someone in to look at it, let alone repair it.
Your average organization with malware crawling around has no IT management, there's no active directory, group policy, or technical restrictions against employees running software -- everyone runs as admin, any anti-malware/antivirus software is hopelessly out of date, and they're probably still running Windows XP at the moment.
You're not going to be able to "turn off the port", because there are way too many of them, they don't have static IPs, and WHOIS is basically useless. Their ISP won't even tell you (or law enforcement) who their technical contact is (if they have one) without subpoenas.
The most expeditious way for anyone to handle this is to nuke from orbit by reversing the behavior of the malware author's backdoor. Make the software shout about its presence instead of hiding.
Make the breakage of the machine VISIBLE so the repair company has to be called, and money has to be spent, so the SMB cannot continue to ignore their workstation infection, even when informed of it.
Re: (Score:2)
In the meantime, while a machine is working, it's hopefully serving a useful purpose. Some might be critical, like a point-of-sale or even more critical in a police station or hospital. You can't reach across the Atlantic, grab the machine's hard disk, and crater the machine. No valid SOP does that.
I realize that partitioning the machine by turning off its port is not a valid procedure, because most ISPs or providers in general don't spend money on addressable ports. They should.
But you can't nuke them. You
Re: (Score:2)
Exactly the kind of machine I'd want a bot running on.
Re: (Score:2)
I don't know about you and so called "security consultants", it's very, very easy to check offline (from a separate host) that a hard drive with a Windows partition on it has legitimate files as released by MS. Digital signatures and all that jazz. This whole reinstall attitude is frankly said getting on my nerves. Waste hours (if you're not in an imaged environment) on reinstalling a system where perhaps a couple files and a dozen or two registry entries are wrong?! Fuck no!
Re:That's ok (Score:4, Informative)
it's very, very easy to check offline (from a separate host) that a hard drive with a Windows partition on it has legitimate files as released by MS. Digital signatures and all that jazz.
No. The System filechecker is trivially defeated, even when checking offline.
The trouble with 'digital signatures' is there are multiple valid signers, and you can't enumerate a priori which ones are valid. The tampering of tampered with files does not even necessarily occur on the files you see on the physical medium offline while rootkit is not loaded.
Lots of Windows systems have a boatload of legitimate non-Microsoft application files and non-Microsoft system drivers for hardware are almost universally present. And what the registry contains is really quite important, especially when malware involves loading a program that contains a rootkit.
The loader may be found as an application, small file, or binary blob in the registry somewhere. The actual payload activated by the malware loader, may not even reside as files on the NTFS volume; as anything running as system user may be able to read code from raw disk sectors (even NTFS disk sectors that are not actually linked to files you can scan/access).
Try as you might, it is basically impossible to enumerate every possible registry content that will cause malware hooks to load into memory and run payload at system boot.
Verification of the content of all known system files does not verify the integrity of the system.
Re: (Score:3)
Not if it leaves the machine in an unclean or unusable state. If you thought anti-American attitudes are bad now, imagine the FBI disabling a couple hundred thousand key machines abroad-- just to get rid of a virus.
Disabling is the normal course of action taken on an infected machine. In fact, the only method certain to work.
SOP when discovering a backdoored machine spewing spam, participating in a DDoS, running a backdoor, or botnet node, should be: to if possible, use the malware's infiltrated command and control or the published backdoor to render the backdoor or the system useless to further the attack as quickly as possible.
Easy... easy... You know, I wonder how the situation would be seen if China would start to disable US computers only because they are used for serving content that don't fit their policies. I mean, for them that content might be as "aggressive" and "dangerous" as a botnet.
Re: (Score:2)
Options (Score:2)
"In fact, the only method certain to work."
That and nuking the site from orbit. It's the only way to be sure.
Re: (Score:3)
Right now, there's no precedent that a government organisation could effectively deal with a situation like this without breaking everything. Is it ok if they do a drug bust, and 1 out of 23 innocent people die? Collateral damage by the government has to be mitigated as much as possible.
I'm not saying that we can't trust the government to do anything. I think the F
Re: (Score:2)
The FBI would then be doing what the botnet authors did: making changes to the user's system without the user's authorization. Removing the system from the Internet by requiring the ISP to place a block on the connection until such time as it could be verified as clean would be much more ethical. If the malware removal function has a horrible bug and leaves the system in an unusable state, the FBI is then on the hook for damages, which could make it reluctant to undertake such actions in the future. The
Re: (Score:2)
Re: (Score:3)
Which operating system was this again?
EvolutionSoft PEBCAC [wikipedia.org] 2011
Re: (Score:3)
Well, at least somebody is making an effort to stop all the fucking spam. Slippery slopes are nice and all, but that kind of thing can already be done legally via the courts, the PATRIOT act, etc.. at least what they are doing here is beneficial to the world.
Lemme guess how they're going to get consent... (Score:5, Funny)
Re: (Score:3, Funny)
No, it's going to be through popup ads that look like Windows dialog boxes. First it will scan your computer, then find a virus and offer to sell you Virus Remover 2011 at a steep discount!
Re:Lemme guess how they're going to get consent... (Score:5, Funny)
"The FBI has detected a botnet running on your computer. Due to federal privatization initiatives, botnet removal has been subcontracted to Botnet Blaster 2011. Click here to purchase Botnet Blaster 2011 and avoid having your house stormed by an FBI tactical team."
Re: (Score:2)
(OK, OK, that might have been the ATF or somebody else, I don't know.)
Re: (Score:2)
it'll be more of a chore to submit the authorization than it would be to download an uninstaller..
Release the Company Names (Score:2)
Why not just report the issue to the user? (Score:2)
Re: (Score:2)
Re: (Score:2)
*BLAM*
*BLAM* *BLAM*
Re: (Score:3)
Re: (Score:2)
Yeah, idiots with pwned machines are well known for keeping up to date.
Re: (Score:2)
Critical (XP) and Important (7) updates are available to everyone, including users of pirated systems.
The MSRT is listed as an Important update on my Windows 7 systems (don't have any XP ones to check).
Re: (Score:2)
I believe Microsoft included detection in their MSRT (Malicious Software Removal Tool) so as long as users and regularly updating they should have this taken care of on its own shortly. I imagine the FBI is probably assuming most users aren't actively updating, or targeting "high value" or infrastructure type computers for a more aggressive removal strategy.
For the tin-foil crowd, if the FBI really wanted to do bad things to your files, they wouldn't have made it public they captured the command and control
The remote wipe move will require consent (Score:2)
Re: (Score:2)
Re:The remote wipe move will require consent (Score:5, Interesting)
As much as I would love the Feds to just run a complete vulnerability scan of the US (not unlike the Internet Auditing Project) and then remotely uninstall every instance without telling a damn person (if the virus doesn't de-install cleanly, that's a bug in the virus so go sue the authors), I get the impression there'd be a few complaints. In part, because the Feds have shown themselves to be ethically-challenged from time to time.
If you want - really, truly want - bots and spyware to be gone forever, it's going to take a Federal agency vulnerability scanning your machine and installing nagware when your machine is shown as both infected and insecure. (Insecure alone might just be a honeypot, it doesn't prove there's a real vulnerability present.)
Nobody is going to trust an agency to do this. Doesn't matter if that's just or unjust, the only just that matters is that it's just not going to happen. In consequence, corporations will fail to secure products, users will fail to secure their machines and the problem will miraculously fail to vanish all on its own. Things won't change without pressure and the only sources of pressure big enough won't and/or can't.
Re: (Score:2)
As far as I can tell, the answer to that is "yes". At some point, psychiatric care will be available to deal with this, but for now - and for reasons I will never understand - said third parties are trusted completely and the government is mistrusted utterly, despite them having roughly the same capacity to abuse whatever
Re: (Score:2)
As much as I hate to say this (Score:2, Insightful)
Re: (Score:2, Interesting)
Or maybe Microsoft software is what got these users into this mess, so someone else should fix it and Microsoft should just foot the bill.
Re: (Score:2)
What else do you think they will do with access to your system besides the botnet campaign? "While repairing the botnet, we discovered 137 copyrighted files. These have been reported to the **AA. Have a nice day!"
Comment removed (Score:3, Funny)
Re: (Score:2)
It's like forwarding my calls to a number that will forward my calls to me. They wait and wait, my phone never rings, and eventually they get pissed and hang up!
Re: (Score:2)
-1, Jackassery
A far more effective solution... (Score:2, Insightful)
Uninstall Windows.
Re:A far more effective solution... (Score:5, Interesting)
Uninstall Windows.
Or don't uninstall Windows but make computer owners legally responsible for their computers in the same way they are legally responsible for a swimming pool. The resulting fines would either stop botnets entirely or eliminate the national deficit. In short, a tax on the stupid.
Re: (Score:2)
Yah, those fines will stop botnets the same way the RIAA lawsuits have stopped piracy. It can't fail!
Re: (Score:3)
C'mon, this is Slashdot. You left your garage unlocked, somebody stole your car and ran down some pedestrians.
Re: (Score:2)
C'mon, this is Slashdot. You left your garage unlocked, somebody stole your car and ran down some pedestrians.
C'mon you are an idiot, and you obviously don't own a pool.
Re: (Score:2)
So if someone breaks into your back yard, scoops up the water from your pool, transports it to a freezer then drops the resulting ice on people from rooftops, you are morally responsible for their deaths?
Probably not, but your scenario is ridiculous. In the far more likely case that a child wanders into your yard because you left the gate open and drowns in your pool, chances are you will pay for that the rest of your life. [2keller.com]
It does not seem a stretch at all to extend such mandatory responsibility to computers, which may not cause death but are capable of causing a great deal of damage.
Re: (Score:2)
The solution isn't to fine the 'stupid', software requires a warranty that is fit for purpose.
And if that doesn't happen, which it won't, then fining people for operating a computer that becomes part of a botnet is the next best thing. Fines don't even have to be large. Just enough to make people realize that running insecure software or buying a computer with the wrong operating system on it may cause harm to others.
uninstall command... (Score:2, Insightful)
> 'While the 'uninstall' command has been tested by the FBI and appears to work, it is nevertheless possible that the execution of the 'uninstall' command may produce unanticipated consequences, including damage to the infected computers [...]
I'd say go for it. I mean how is this any different from Windows Update?
Is this (Score:2)
Is this like those messages emailed from Microsoft about virus detected on my system? Those things never seemed to make my machine run better. You'd think Microsoft would test their fixes better... ;=)
Take away their network connection (Score:3)
Why do they need consent? (Score:2)
But, the federal government is held to a higher standard aren't they?
Re: (Score:2)
I wonder if we could use a car analogy here. If your car rolled into the street unattended, could the police tow it or would they be liable for damages from towing it?
Disconnect from internet? (Score:5, Interesting)
Why cannot they just ask the ISP to disconnect infected computers from the network? It should be responsibility of each owner to connect with uninfected computer. The company responsible for this whole mess - Microsoft - will likely not be held accountable, but the users should. And when the OS they use start to be liability in their lives, then maybe they will choose based on that as well.
YACA: If someone installed randomly firing machine guns in the trunk of your car, I doubt FBI response would be a letter asking you if they could please uninstall those for you.
Re: (Score:2)
> Why cannot they just ask the ISP to disconnect infected computers from the network?
Maybe a good idea, maybe not. One risk: If they did this and people did not scream bloody murder, it would be a matter of days until the DoJ started shutting down people suspected of copyright infringement.
Helping people do the pro-social thing, good. Fining them for anti-social behavior (like we do with copyright), good(*). Disconnecting them from the Internet is less obviously good. The Internet is like public sewer sy
Cooperate America strikes again (Score:2)
Now the DOJ and the FBI do the job to secure Windows. Must really suck to live in a country where the government is run for cooperations paid by tax money. (If anyone wonder, it's the job of Microsoft to secure their system not the DOJ or the FBI to do that for them).
"FBI field offices would be notifying affected people, companies and organizations."
yeah, that's why you have the FBI. Not to hunt for criminals like murders, raper or the organized crime, but to go to people and companies and secure their comp
Re: (Score:2)
If this is a joke, (Score:2)
A big fraction of them are probably government (Score:2)
A legal backdoor to gov't monitoring (Score:2)
I am far from paranoid of government, but if you give government a privilege, they will expand its role.
Today, removing Coreflood. Tomorrow? Other dangerous software, like BitTorrent or DC++
It's not paranoid to suggest that if you give a strong central authority a delegated power, they will expand their use of it to justify their salaries/funding.
The "secret" uninstall command (Score:2)
a total solution to infected Windows PCs (Score:2)
Ubuntu [ubuntu.com] is a fast, secure and easy-to-use operating system used by millions of people around the world.
Re: (Score:2)
Re: (Score:3)
You know the first thing they're going to push is the big red button marked "Fire".
Re: (Score:3)
You know the first thing they're going to push is the big red button marked "Fire".
The tank driver can't reach that button. It's for the back seat driver.
Re: (Score:2)
OpenOffice? TuxRacer? This analogy is feeling a little laboured.
Re: (Score:2)
Not until I get onto I-10.
Re: (Score:2)
The hard part is driving it while you're being shot at.
Re: (Score:2)
Re: (Score:2)
The hard part is driving it while you're being shot at.
You must not have driven in any major U.S. city in awhile...
Re: (Score:2)
You've obviously never driven in Los Angeles. Being able to drive a car while being shot at is part of the driver's license test.
Re: (Score:2)
Ever notice how a lot of people who know nothing about a subject think it must be easy?
Re: (Score:2)
Re: (Score:2)
Don't diss our troops man.
Re: (Score:2)
Re: (Score:2)
. Sure, they won't get hurt, but they'll probably never even figure out how to start it.
That's pretty much the whole freakin' point. These are people too stupid to own computers.
Re: (Score:2)
Uh.. if they wanted to do that, they could do. What exactly do you think they'd find so interesting about the average person's web browsing habits? Do they perhaps need credit card details for extra funding? I don't think so.
Re: (Score:2)
Stop and think. If they've already scanned these machines, any keylogger will already be installed. Besides, there's a Firefox extension for jamming keyloggers.
Besides, what would they need a keylogger for? We already know (because the Australian Government has said so) that Echelon is real and does exist. The total lack of use of cryptography means that there's nothing you can type that they can't read already.
Re: (Score:2)
Also, you may be required to wear a tin-foil sombrero. Also, this is probably defeatable in any case.
Re: (Score:2)
The government is doing this at the taxpayer's expense because the taxpayer voted in a government that likes the rich having the money and you not. Vote into power someone who doesn't give a damn about the rich next time. Of course, that requires finding one - and then finding one willing to run for office. In general, those with the best ethics are the least-suited to politics and the ones best-suited to politics are the ones with no ethics.
Re: (Score:2)
Re: (Score:2)
If an auto manufacturer sold a vehicle that melted in the rain,
Then it might be made of sugar (and delicious) or salt (and good for margarita night or deer hunting).
Re: (Score:2)
It's a Trojan. It ruins all the fun.
The above would also have been an acceptable response.
Re: (Score:2)
And while your at name one piece of software or OS that was 100% bug free when released.
How about this little bit of BASIC? 10 PRINT "HELLO WORLD" 20 GOTO 10 Does exactly what I want it to, every time.
Re: (Score:2)
Re: (Score:2)
#1 is already resolved, assuming Bugs 2-5 can be considered Enhancement Requests for v1.1 (or v1.0.1, or v2), and the program had the useful purpose of proving that software can exist, at release, without bugs (this would disqualify Bug #1 as a bug, but rather make it a user education issue for the target audience).
Re: (Score:3, Informative)
Re: (Score:3)
Someone has to take this seriously and deal with these botnets,
i totally agree, but it should be by cutting off access to infected computers and keep them off-line until they are 'clean'. ISP's can detect 'bad things' and do this automatically.
Re: (Score:2)
To take a hypothetical example, let's say a botnet crops up that operates on port 43187. Let's also say my torrent client, used only to download the latest Ubuntu image also happens to use 43187. Is the fact that my modem
Re: (Score:2)
I have free tickets for you to ski on the slippery slope.
Re: (Score:2)
no there are at least a dozen post's above yours saying the exact same thing
if I didn't use my last mod points on one of those threads you would get a redundant
Re: (Score:2)
...and by posting (I assume with the same account) you've undid all the moderation
Re: (Score:2)
Why is it that Americans as so paranoid about their government's motives? No other country in the first world has this level of paranoia about their government.
Re: (Score:2)
Re: (Score:2)
You're confusing prefixing with verbs and adjectives... "install" is a verb so "uninstall" means to "reverse installation"... just like undo means "reverse what was done". On adjectives the prefix means "not" though.... like "unauthorized" and "ungrateful". And I'm not even a native English speaker.
Uninstall is a much better word than "remove" in this context. Remove implies simply deleting files while the process of uninstalling is often much more complex and refer to restoring the state that the compute