Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security The Internet

Estonian ISP Shuts Srizbi Back Down, For Now 237

Posted by kdawson from the informal-pressure dept.
wiedzmin writes "In response to the recent resurrection of the Srizbi botnet, an Estonian ISP has shut down the hosting company that was housing its new control servers. Starline Web Services, based in Estonia's capital Tallinn, had become the new home for the Srizbi botnet control center after the McColo hosting company (which was taken down earlier this month) has briefly come back to life last week, allowing the botnet to hand-off control to the Estonian network. After Estonia's biggest ISP Linxtelecom demanded that Starline Web Service be taken offline, the newly acquired Srizbi control servers went down with it. However, as the rootkit is armed with an algorithm that periodically generates new domain names where the malware then looks for new instructions, it is only a matter of time before a new set of control servers is created and used to manipulate one of the biggest spam botnets in the world."
This discussion has been archived. No new comments can be posted.

Estonian ISP Shuts Srizbi Back Down, For Now More

Estonian ISP Shuts Srizbi Back Down, For Now

Comments Filter:
  • ...that in two weeks this is going to be back up somewhere else in the world? Heck, we could turn it into a game, guessing which country it is being run from next.

    • Re:Who wants to bet... (Score:5, Interesting)

      by bossanovalithium ( 1396323 ) on Friday November 28, 2008 @08:21AM (#25915385)
      Ok, am I being thick here, but why can't some enterprising soul (or organisation), use the algorhythm to take control of the bots and then gets them to purge or go inactive?

      • Re:Who wants to bet... (Score:5, Interesting)

        by v1 ( 525388 ) on Friday November 28, 2008 @08:54AM (#25915559) Homepage Journal

        I'd love to see that too. Spoofing traffic on IRC is easy. But the problem is the commands must be signed using the bot herder's private key. It's apparently a very large key, (1024 BYTE iirc) and no one has managed to break it yet.

        I bet there are several groups working on them though. Problem is, each time the herder pushes an update, they could rekey it, placing everyone's break attempts back on square 1.

        My PERSONAL preference here is that the command sent should cause the participating computers to post a notice on the user's screen telling them they've been owned, that their computers have been being used to harm the public, and that they (the computers) have been rendered inactive and they'll have to take the computer into the shop for repair. (because no doubt they're infested with more than just this botnet) Some may say that's going too far, but imho, it's completely reasonable. They should share some of the responsibility for the actions of their computer after allowing it to be hijacked and being used to abuse ME. How about it just delete their NIC drivers and post the message?

        • Re:Who wants to bet... (Score:5, Funny)

          by Erikderzweite ( 1146485 ) on Friday November 28, 2008 @09:15AM (#25915649)

          > How about it just delete their NIC drivers and post the message?

          Formating hard disks and writing a message to the boot sector will be a bit more efficient than this. Remember, a clean install in case of an infection is recommended even by Microsoft.

          • Re: (Score:3, Insightful)

            by Frosty Piss ( 770223 )
            This *is* funny.

            But there is truth to it.

            The fact is, these people play by their own rules (no rules at all). As long as the "good guys" insist on dealing with them on the ethical high road, the problem will never go away.

            Either way the reality is play dirty or accept boatloads of spam and quit bitching about it.

            • Re:Who wants to bet... (Score:4, Insightful)

              by McGiraf ( 196030 ) on Friday November 28, 2008 @02:40PM (#25918011)

              "The fact is, these people play by their own rules (no rules at all). As long as the "good guys" insist on dealing with them on the ethical high road, the problem will never go away."

              The same argument could be made about the police and the anti-terrorists. I don't know about you, but I prefer that they have to follow rules.

          • Comment removed (Score:5, Insightful)

            by account_deleted ( 4530225 ) on Friday November 28, 2008 @10:19AM (#25916095)
            Comment removed based on user account deletion

          • Re: (Score:3, Insightful)

            by blhack ( 921171 )

            Formating hard disks and writing a message to the boot sector will be a bit more efficient than this. Remember, a clean install in case of an infection is recommended even by Microsoft.

            You're modded funny, but I hope you're not serious. Yes, yes, I know that people should be performing backups (how many grandmothers do you know who do?).

            How livid, or depressed would you be to loose a few years worth of photographs because somebody who was too annoyed with getting spam decided that you didn't deserve to have your data anymore?

            Do something totally harmless like changing their default gateway to 0.0.0.0, then setting the background image on their desktop to a message with instructions on ho

            • Re: (Score:2)

              by kv9 ( 697238 )

              Yes, yes, I know that people should be performing backups (how many grandmothers do you know who do?). How livid, or depressed would you be to loose a few years worth of photographs because somebody who was too annoyed with getting spam decided that you didn't deserve to have your data anymore?

              without backups they would have lost them anyway when the hard drive died

              Do something totally harmless like changing their default gateway to 0.0.0.0, then setting the background image on their desktop to a message with instructions on how to back up their personal information and take their computer in to be repaired.

              a goatse desktop background would be more effective

        • Re: (Score:2)

          by aliquis ( 678370 )

          Like you have the right to decide that it's appropriate to fuck them up, or that anyone have the rights to do it. Just disable it / change key / whatever. I doubt sending a message would help to, as if the user would care?

          • Re: (Score:2)

            by v1 ( 525388 )

            The problem there is that unless you force them to take it in for service and get it cleaned up properly, it's still going to be infected with other nasty stuff (maybe another botnet) and it's still going to have all the holes in it that let in the bot to begin with, so it's just going to get reinfected again shortly.

            I don't endorse something like formatting, but it should be sufficiently disabled to either lose networking capability, or require a windows reinstall. Maybe screw up their network stack. Tha

            • Re:Who wants to bet... (Score:4, Funny)

              by theaveng ( 1243528 ) on Friday November 28, 2008 @09:36AM (#25915799)

              I object.

              Why should I (and others) waste ~$100 dragging our computers to Best Buy or some other service center? Your proposal violates multiple individual rights (right of property, right of labor, right of money). It's my damn computer, my damn money, and *I* will decide whether or not to take it to the service center.

              Stay the hell away from both my computer and my wallet. (I'm not angry, just flabbergasted that you think it's acceptable behavior to hijack other people's personal property and money.)

              • Re:Who wants to bet... (Score:4, Insightful)

                by oldspewey ( 1303305 ) on Friday November 28, 2008 @09:49AM (#25915881)

                (I'm not angry, just flabbergasted that you think it's acceptable behavior to hijack other people's personal property and money.)

                You mean like the way botnet owners do in the first place?

                • Two wrongs don't make a right. The ends don't justify the means.

                  Whether the hijacker is some Asshole in Russia using my PC to spam emails, or some asshole on slashdot disabling my net connection with a "spend $100 to fix your machine at a service center", they are still assholes. They both deserve to spend time in jail for theft of property; theft of money; and invasion of a private home.

                  I'm reminded of the story of Stalin, who was trying to rebuild Russia into a modern nation - a noble goal. The proble

                  • Re:Who wants to bet... (Score:5, Insightful)

                    by oldspewey ( 1303305 ) on Friday November 28, 2008 @12:15PM (#25916981)

                    Disabling someone else's machine is immoral, no matter what your goal might be.

                    Does "disabling" include cutting off network connectivity? In today's environment of cloud computing and web2.0 apps, being cut off from the net is arguably the same as disabling a machine entirely.

                    And to extend the logic a bit further, it is immoral for an ISP to cut off somebody's account if that account is being used to spew spam. Or to extend things a bit further, it's immoral for an upstream to cut off a downstream spam sewer ... or for anything like RBL or SBL to exist since it can be used to facilitate disruption of network service.

                    I'm not trying to explicitly condone an approach where zombies are vandalized to render them inoperable, but I'm trying to point out how this entire argument is shades of grey - at some point, action against criminal networks involves infringement on people's "right" to do whatever they want with their money, their computer, their internet connection, etc.

                    ... and one other thing to keep in mind: when the day comes (becuase it's a when not an if) that terrorist organizations hire a botnet to attack the computers that control the electric grid, or to perform supercomputing nuclear simulations, or any number of other things ... you are going to see some serious shit being done to botnets and zombies, and it will be done by governments not by random vigilantes.

                  • Re: (Score:2)

                    by whoppo ( 218875 ) *

                    Oh man... you really need to take a pill.

                    First of all, you comparison of "disconnecting" spammers (either by cutting their net connection or pooching their PC's) with Siberian deathcamps is way off the map... just stop it.

                    (for the record, I agree that breaking someone's PC is wrong... but nuking their ISP account is right)

                    Should we make everyone with a compromised PC pay $100 to some PFY to re-install an OS? No.. I don't think so. Should we expect an ISP to maintain the account of some douchebag who doe

              • Re:Who wants to bet... (Score:4, Insightful)

                by v1 ( 525388 ) on Friday November 28, 2008 @09:49AM (#25915883) Homepage Journal

                Stay the hell away from both my computer and my wallet. (I'm not angry, just flabbergasted that you think it's acceptable behavior to hijack other people's personal property and money.)

                THIS, from a person whose computer is already hijacked and being used for illegal activities? If you hold your moral ground here, I'm doing you a favor by hijacking your already hijacked computer, and alerting you to its presence (without causing serious damage) so you can put an end to it.

                Or would you prefer to continue to wallow in ignorant bliss as your computer spews forth tens of thousands of spam each day to the rest of the world? People that take THAT attitude, I have no problem with seeing them get their drives formatted.

                • Re:Who wants to bet... (Score:5, Insightful)

                  by Anonymous Coward on Friday November 28, 2008 @10:52AM (#25916335)

                  Stay the hell away from both my computer and my wallet.
                   THIS, from a person whose computer is already hijacked and being used for illegal activities?

                  Using evil methods to accomplish noble goals is still evil. Once you accept computer hijacking under some circumstances, how do you define the motives for which it's ok? Would it be ok to create or use a zombie net to process SETI or protein folding data? To scan for other zombies? How about DB indexing for your job?

                  If you're going to try to claim the moral high ground, you need to stick to the high ground and not compromise your ethics for the sake of expediency.

                  • This isn't compromising ethics to accomplish a noble goal. The computer's already part of the botnet, disabling the botnet and alerting the users (to the best of your ability) is the ethical thing to do.

                    • >>>The computer's already part of the botnet, disabling the botnet and alerting the users (to the best of your ability) is the ethical thing to do.

                      Riiiiight. Since slashdot loves car analogies, let's suppose I left my keys laying on my table, where the keys are visible to anyone walking past the front window.

                      While leaving your keys in plain sight is supremely stupid, does it justify your invading my home, grabbing the keys, opening my car, removing the steering wheel, and leaving a "get your car s

                    • Re: (Score:3, Insightful)

                      by Tanktalus ( 794810 )

                      Bad car analogy.

                      This is the case where some dick has managed to file down your brake lines such that the next time you try to stop before hitting a pedestrian, your car will sail right through them. The /. solution is to take your spark plugs out and hand them to your mechanic with a note: "Check brake lines."

                      Your PC is already compromised. All the suggestion does is alert you to it. So you have to bring it in for repair - you had to do that before the vigilantes got a hold of your system, you just didn'

                    • >>>the next time you try to stop before hitting a pedestrian, your car will sail right through them.

                      False. The existence of a bot on my PC doesn't endanger my life. Nor does it stop me from using that PC to surf the net, listen to MP3s, or watch bittorent-downloaded tv shows.

                      My analogy was better, because my analogy gets at the heart of the matter - My personal property (car or pc) has been disabled through home invasion. And whether the "invader" does it for a motive of greed, or a motive of "d

                    • >>>All the suggestion does is alert you to it.

                      False. Go back and read what the great-great-great grandparent said: "The PC should be sufficiently disabled to either lose networking capability, or require a windows reinstall." That's vandalism. That's no different than advocating stealing someone's steering wheel from their car so it can no longer be driven. It's destruction of personal property, invasion of a private home/land, and a waste of the owner's money trying to get his car or P

                    • About two weeks ago, some guy tried to steal my car.

                      I pulled my gun and told him he either runs away, or he gets shot in the stomach. He ran. Why did I resort to self-defense? Because the car cost me several thousand dollars, and I'm not going to let some asshat steal a year's worth of my life (how long it took me to earn the money for the car). If you mess with my multi-thousand dollar PC, and disable it, you and the car thief will have much in common.

                      I'm not angry right now, but if you turn my PC int

                    • if you turn my PC into an usuable brick, I will become VERY angry. You wouldn't like me when I'm angry.

                      Who exactly are you planning to turn your anger against?

                    • Re: (Score:2)

                      by Alistar ( 900738 )

                      Yea well, depending on your perspective your the car thief.

                      Your infected computer is causing my company time and money to deal with the crap your causing. By your carjacking anecdote it's all right for me take a bat and threaten to bash your computer unless you get it fixed?

                    • Re: (Score:2)

                      by Skater ( 41976 )

                      Interesting. New car analogy: Your car is spewing oil and coolant all over the ground, everywhere you go, because you've ignored the maintenance on it.

                      Now, you ARE causing problems for everyone else (i.e., pollution). Like the environment, the internet is a shared resource.

                      I've seen plenty of cars that I'd love to take off the road until a competent mechanic can look at them, because the owner certainly doesn't seem to notice or care about the problems.

                      And, this analogy continues to work for longer than

                    • That's a profoundly ignorant analogy.

                      A car analogy isn't going to work very well here because your car doesn't do anything on it's own, and if someone drives off with you'd probably notice.

                      Let's be clear on what a botnet does. When your computer is infected, your computer goes out and picks up instructions from secret locations and then acts on the instructions. If someone else leaves a message saying "shut down and warn your owner", then they've done you a favour.

                      Frankly, I find it amazing that you seem

                  • Using evil methods to accomplish noble goals is still evil.

                    I thought the accompanying maniacal laugh (and shifty eyes) was also necessary for it to become evil.

                • Re:Who wants to bet... (Score:5, Insightful)

                  by theaveng ( 1243528 ) on Friday November 28, 2008 @11:06AM (#25916451)

                  >>>I'm doing you a favor

                  The road to tyranny is paved with good intentions. Most of the men who we study in history class as "evil" would have repeated the exact same phrase: "I'm doing you a favor" as they burned books, or raided homes, or whatever other anti-human rights crime they committed.

                • Re: (Score:3, Insightful)

                  by theaveng ( 1243528 )

                  >>>Or would you prefer to continue to wallow in ignorant bliss as your computer spews forth tens of thousands of spam each day to the rest of the world? People that take THAT attitude, I have no problem with seeing them get their drives formatted.
                  >>>

                  Spammail merely makes you delete a few messages per day. Annoying? Yes absolutely, but not that bad. BUT formatting my hard drive is going to cost me a few hundred dollars in (a) lost music, movies that I purchased and (b) time to re

              • Re: (Score:2)

                by Xugumad ( 39311 )

                For the same reason you have to get a license before we let you drive a car? You're involved in an activity (connecting a computer to the Internet) which can have consequences for others, and therefore it doesn't seem unreasonable to put some requirements on you of due care about how your computer is used.

        • Though it will be a pain when my wife asks me what that message means, and can't I get it off the screen so she can finish the I.Q. test she's taking... this is important stuff she does, you know, so interruptions should be kept to a minimum...

          Then I can teach her what she needs to know about Unbuntu. Should take about 15 minutes.

          Shakespeare didn't know about the Internet, or he would have written 'first, we kill all the spammers' [spectacle.org].

        • Re: (Score:2)

          by Orlando ( 12257 )

          They should share some of the responsibility for the actions of their computer after allowing it to be hijacked and being used to abuse ME

          I was with you all the way up to that point, but no, I'm sorry, it is just arrogant to say that the owner of the machine is in any way responsible for this. It is purely and simply Microsoft's fault that they do not take security seriously enough. Why have they not been taken to task about this?

          If a car manufacturer sells a model that exhibits a problem with the steerin

          • Isn't that why they sell sports cars and suvs and tractor trailers from different parts of the lot ?

          • The thing that I love is that Microsoft is offering anti-virus and malware services.

            "Hey, that car you bought has no doors, but if you subscribe to this service, for a low monthly price, we can screw some plywood over the holes. It will reduce your fuel economy, slow your acceleration, and make all kinds of noises when you're actually driving."

            Instead of, you know, just including doors.

          • Not really, no...

            Despite being a hardcore Linux user since 2003 I do think that a fully patched Windows Box and browsing with NoScript/AdBlock would have prevented the infection in most cases. That requires a user who won't open random attachments though. I agree that security in Windows could be better, but most infections are in fact cases of PEBKAC.

            • Re: (Score:2)

              by Orlando ( 12257 )

              No no no. It is absolutely not up to the user to waste their time on this stuff. If the OS was written properly, ie up to the standards the customer is expecting (OSX anyone?), then they wouldn't have to do this.

        • LOL. Do you know what they do when they get that "0WNED" message? They click it away quicker than they can read it.
          After all, that's why they ended up being infected in the first place. ;)

          The best way would be, to *infect* the control system, and trough that, control the botnet. Then piggyback a trojan into the virus, that acts as a disinfecter. It should harden all the zombies and then kill the bot-software on all bots at the same time and close the ports. Shortly before that, it should wreak havoc on the

        • Is a command that even worked with the Borgs, a lot more advanced that that puny srizbi botnet.

          A bit more in the real world, some years ago got so tired of getting notifications of the firewall of machines sharing their disks on internet that in a moment put in all those ones desktops a text explaining what they had wrong, and how to fix it. But was wrong, you don't fix harm doing even more harm. If their PCs are misbehaving in internet, is their ISP (or someone else they already know) responsability to war

      • Re: (Score:3, Insightful)

        by Fëanáro ( 130986 )

        Ok, am I being thick here, but why can't some enterprising soul (or organisation), use the algorhythm to take control of the bots and then gets them to purge or go inactive?

        I would guess because of public key cryptography. If these bots were made smartly, they will only accept signed commands, so you need the private key.

      • This /was/ being done until recently by a security firm, until it was decided that they could not afford to keep registering lots of domains for the sake of keeping the botnet offline. Had it not been for them, the botnet would have been online a lot sooner after McColo was shut down.

    • Re: (Score:3, Interesting)

      by oliderid ( 710055 )
      I guess the algorithm is linked in a way or another to a clock (time)...If they point to a atomic clock sync, isn't possible to spoof the IP (or change locally domain name config) and then to trace the next domain name?

      • I guess that at least some of the domain names are already taken.

        Now each of these could have been parked by the spammers to prepare for this situation, or they could belong to someone innocent.

        How do you decide which it is?

    • I dont know how much money these people are making but having to move locations every two weeks surely is n't free. Plus whilst you're moving and the bot net is down you're not generating money (from the spaming).

      If this is the case then I would n't mind this going on for ever until they run out of money.

    • Re: (Score:2)

      by Coraon ( 1080675 )
      200 quatloos on South East asia

    • Re: (Score:2, Funny)

      by HTRednek ( 793937 )
      Where in the World is Botnet Sandiego?

  • Algorithm (Score:5, Interesting)

    by Schraegstrichpunkt ( 931443 ) on Friday November 28, 2008 @08:21AM (#25915389) Homepage

    However, as the rootkit is armed with an algorithm that periodically generates new domain names where the malware then looks for new instructions . . .

    Couldn't the registrars run that algorithm ahead of time and ban (or track down) new registrations for those domains?

    • Re:Algorithm (Score:5, Insightful)

      by Rogerborg ( 306625 ) on Friday November 28, 2008 @08:46AM (#25915505) Homepage

      Uh... or get White Hat control servers in place that NUKE THE ZOMBIES FROM ORBIT?

      Enough with the defence. Don't the NSA and DOD have people whose job this is? If they can't deal with Srizbi, how are they going to deal with a real attack?

      • Perhaps these agencies do have qualified people. But, tracking down and disabling this botnet is not the responsibility of either the NSA nor the DOD. IF the only function of this botnet is to generate spam, in the USA this is a civil matter. Perhaps the Federal Trade Commission may take an interest; and, they could make an inter-agency request for help.

        Until this botnet makes an overt or covert attack on the USA, neither the NSA nor the DOD have a responsibility to take action. It is just electronic junk

        • Re: (Score:2)

          by vux984 ( 928602 )

          Until this botnet makes an overt or covert attack on the USA, neither the NSA nor the DOD have a responsibility to take action. It is just electronic junk mail.

          Its not out of the realm of possibility to deploy military resources to provide aid in the event of a disaster - including floods, bio-hazards (disease)... why not to kill a computer virus that's costing the country billions of dollars a year?

          Hell, it would be good practical exercise for the 'cyber warfare' divisions to boot.

    • Re: (Score:2)

      by sa1lnr ( 669048 )

      I was sure I read somewhere that they were registering domains ahead of them but they just didn't have the funds to keep doing this.

      • Re: (Score:2)

        by pbhj ( 607776 )

        I was sure I read somewhere that they [the intelligence services] were registering domains ahead of them but they just didn't have the funds to keep doing this.

        You don't need funds to register the domains. You simply lean on the domain registrar. Presumably the registrations follow an algorithm and bump to the next one if that domain doesn't issue proper ACKs or what-have-you.

        Simply get the registrars to hold issuing those domains and put sniffers on to track the source of the bot command-request traffic ... then nuke the zombies from orbit! ...

        Profit.

    • Re:Algorithm (Score:4, Informative)

      by fedorfedor ( 838521 ) on Friday November 28, 2008 @09:35AM (#25915785)
      According to a disassembly [fireeye.com] of the bot, there are more than a hundred domain names tried each day. (4 per bot variant, but at least 55 different seeds aka magic numbers.)

      Still, it might be worth registering all those domains until someone determines the private key, so a 'good guy' can give the bots a suicide pill.

      -David

    • Re:Algorithm (Score:5, Informative)

      by m0i ( 192134 ) on Friday November 28, 2008 @09:36AM (#25915795) Homepage

      Feasible, algo is described here:
      http://blog.fireeye.com/research/2008/11/technical-details-of-srizbis-domain-generation-algorithm.html [fireeye.com]

    • Re: (Score:2)

      by TheMCP ( 121589 )

      Better: register them, and if possible, use them to send commands to the botnet to shut down. Not sure if these crooks would build such commands in, but if they did, time to use 'em.

  • How about we work together on this? (Score:4, Insightful)

    by naich ( 781425 ) on Friday November 28, 2008 @08:26AM (#25915413)

    If someone publishes the list of all the domains that Srizbi will go to for instructions for the next few years, we can all buy one each and stop the spammers from ever regaining control.

    • Re:How about we work together on this? (Score:5, Insightful)

      by pbhj ( 607776 ) on Friday November 28, 2008 @09:54AM (#25915925) Homepage Journal

      Yeah coz no-one here would take control of a hugely profitable bot-net given the chance???

      • Re: (Score:3, Funny)

        by Killjoy_NL ( 719667 )

        I wouldn't, but then again I have an extremely rare terminal case of the principles.

      • Re: (Score:2)

        by naich ( 781425 )

        Communications with the bot are signed, so no, they couldn't. We could, however stop the spammers talking to their bots by owning every domain that the bots will ever try to connect to.

        • That's a lot of domains to buy. And if we miss one, the spammers could use it to instruct their bots to use a different algorithm. Best case scenario: We get them all and the bots aren't capable of updating their algorithm. Then the spammers just release BotTrojan 2.0 which not only uses a different algorithm, but which can be remotely updated to alter the algorithm used. At best, we've slowed the spammers down and bought ourselves a little time.

      • I wouldn't, but then again I do not have the private key that is needed to do so.

  • Arrest them ... (Score:3, Insightful)

    by Richard W.M. Jones ( 591125 ) <rich@anne[ ].org ['xia' in gap]> on Friday November 28, 2008 @08:29AM (#25915425) Homepage

    Good, but I'd be happier if the people involved had been arrested. Surely there must be enough information out there to trace the controllers of this bot net by now.

    Rich.

  • Think (Score:5, Insightful)

    by ledow ( 319597 ) on Friday November 28, 2008 @08:52AM (#25915543) Homepage

    To all the people who are saying "just take the botnet down with that control system", this isn't always possible.

    Think, for instance, of a virus that not only has this sort of "find my controller" system but that, when it finds instructions, checks an attached PGP public key to ensure their integrity and that they came from the original author. If this particular virus doesn't have it, the next breed will. That makes it completely immune to "false" updates, in the same way that Linux repositories and Windows Update are... unless you have the private key associated with that virus' creation, you can't issue an update that it will take notice off.

    You can't stop things like this by just intercepting the botnets... you can slow them, hinder them, give you time, but there are ways around everything. The way to stop it is to SHUT OFF USERS who have those botnets, who have allowed their computers to be compromised. Permanantly. Give them the incentive to actually keep their systems clean. They can move to another ISP etc. but the only way to stop them is to show them that leaving their PC open to infection is the problem here, along with an OS that allows that sort of compromise to be so easy, and not that some kid in Russia is somehow smarter or more resourceful than the entire world's IT experts.

    I don't know if this worm actually does have a signed update system, but it's a very easy thing to do, with tons of well-audited, open-source, freely available code to do it for you. I would be very surprised if some malware somewhere wasn't already doing it.

  • Is this that Estonia? (Score:3, Insightful)

    by sw155kn1f3 ( 600118 ) on Friday November 28, 2008 @08:54AM (#25915557)

    I remember recently that they accused Russians or Chinese or whatever for attacking their government sites and kind of they created some serious cyberforce after these attacks?
    Kind of makes me wonder. How is this possible to have some serious cyberforce and not able to shut botnet which originates from your own country. Smelling bullshit somewhere.

    • Re: (Score:2)

      by pbhj ( 607776 )

      I remember recently that they accused Russians or Chinese or whatever for attacking their government sites and kind of they created some serious cyberforce after these attacks?
      Kind of makes me wonder. How is this possible to have some serious cyberforce and not able to shut botnet which originates from your own country. Smelling bullshit somewhere.

      How do you fund your "Cyberforce"(!) if you don't spam other countries from your international botnet?

  • Wouldn't it be possible to go after the individual bots? It can't be hard to figure out which IP's (machines) are used and then just contact the ISP that deliver network connection to them and tell them to deal with the situation.
    Have them contact the subscriber and give them a some time to fix their computer, if they don't then cut them off.
    The ISP that doesn't do this would get a warning and some time to deal with the situation, and after that the ones who deliver connectivity to them should cut them off.

  • Guinness World Record? (Score:4, Funny)

    by SIR_Taco ( 467460 ) on Friday November 28, 2008 @09:51AM (#25915901) Homepage

    In essence this is the largest game of Wack-A-Mole ever played.

Slashdot Top Deals

Some people manage by the book, even though they don't know who wrote the book or even what book.

Close