The Birth and Battle of Conficker 239
NewScientist has an interesting look back at the birth of the Conficker worm and how this sophisticated monster quickly grew to such power and infamy. "Since that flurry of activity in early April, all has been uneasily quiet on the Conficker front. In some senses, that marks a victory for the criminals. The zombie network is now established and being used for its intended purpose: to make money. Through its peer-to-peer capabilities, the worm can be updated on the infected network at any time. It is not an unprecedented situation. There are several other large networks of machines infected with malicious software. Conficker has simply joined the list. The security community will continue to fight them, but as long as the worm remains embedded in any computer there can be no quick fixes."
Hate to say it... (Score:3, Insightful)
Correction (Score:3, Informative)
The security community will continue to fight them, but as long as the worm remains embedded in any Windows computer there can be no quick fixes.
Fixed that for ya.
Re:Correction (Score:5, Funny)
But its hard to tell... care to elaborate?
Re: (Score:2)
hasn't there been multiple worms for openssl and apache?
i'm suprised i have to make this point yet again, but there are more machines infected than the whole linux marketshare. until linux is really in the hands of the common newb you won't have an apples and apples comparison.
Re:Correction (Score:5, Interesting)
There are more than you think. Old home computers are quickly becoming Linux computers.
There are a lot of independent techs out there who service the lion's share of home computers. Yes, Best Buy and the like get a lot, too. But they can't compete on quality service with the little guy (due to overhead), so they have to keep themselves going through quantity.
I know a handful "home computer techs" - people who work out of their house or have a small one-room office somewhere. They're making ends meet and keeping their families going by doing this while at the same time putting linux on computers that are only mildly useful for anything beyond XP (and sometimes even XP, eg. 256Mb RAM).
More often than not, the system is in need of a reinstall anyway due to some combination of users messing them up and malware. It's like scoring a 3-pointer at the buzzer, in terms of removing an infection vector.
I'm one such person, while I'm unemployed. I'd say maybe one out of 5 of the computers that come to me leave with Linux installed. Those satisfied customers then refer their friends and family. Not much repeat service, but quite a few referrals. It would also appear that people are oddly appreciative for preventing them from installing all that crap as well - "it just works nice and fast and there are no pop-ups".
Not only that, but when someone upgrades their computer (and they've got the proclivity to tinker) they'll do something with the old one. Linux has picked up a lot of mindshare, and I know many of the so called "tech savvy" types (who still need someone who knows what they're doing on occasion when they can't recover or get stuck) are doing this.
Re:Correction (Score:5, Interesting)
sure linux has mindshare, but that hasn't translated into market share. The year of the linux desktop will also be the year of the linux virus.
Re:Correction (Score:5, Insightful)
Really?
All the linux systems floating around for years and years and years, and no one has gotten a proper linux virus to propagate. You know why that is? Uncle joe can install his porno software (not really aware of what that would be, but for the argument), and still have relatively secure computing because of the WAY LINUX IS DESIGNED, USED, AND MAINTAINED!!!!
Re:Correction (Score:5, Insightful)
If a Linux based distribution was the dominant desktop OS the morons who run a PC would be infected within minutes. They'll click on, suck up, snort or fk anything presented to them. I've had intelligent people click on, install or follow complex instructions that disable all security on a PC so they could install 'that cool looking game' and then lie about it even when I had logging software logging to a remote server.
They're not morons (Score:5, Insightful)
Because in theory it's impossible to solve the halting problem.
In theory users have to figure out whether a program is safe (analogous to "halt") even though
1) They don't have the actual true description of the program
2) They don't know the full inputs of the program
And that's a harder problem than the halting problem
While you could say - nobody should install anything that's "Not Expert or Vendor Approved", to me that's a rather dismal state of things.
Things could be so much better. Really.
For instance if you had an O/S that will require applications/applets to list out the type of access they require.
Then the O/S can provide a meaningful and TRUE description to the user of what the application might do.
And the O/S can also enforce the limits of the access.
So if something says it's a screensaver, it's only going to get screensaver access. It's not going to be able to make recordings from your microphone and webcam, and send them to Elbonia behind your back. It's not going to be able to write to anywhere other than it's own designated scratchpad area, not even your USB drives.
And that would be a secure modern O/S.
Then you can tell your "morons" - "You can install whatever stuff you like, unless the O/S gives you that red warning dialog box about the program requiring full user or system privileges".
In terms of security, most current O/Ses aren't even better than what was available 40 years ago. Heck, Unix is a watered down Multics.
They're just decorated with fancy graphics and animations so most people think they're advanced.
Yes, Vista does have some sandboxing, but the way MS has implemented stuff makes many people turn off many of the protections. So they'll become the next hosts for the next Conficker.
As for Linux, Apparmor and SELinux don't appear "Desktop Ready" yet.
Re: (Score:3, Insightful)
For instance if you had an O/S that will require applications/applets to list out the type of access they require.
Then the O/S can provide a meaningful and TRUE description to the user of what the application might do.
And the O/S can also enforce the limits of the access.
When I read this part, I thought you would mention Symbian. At least it looks like it does what you suggest. I am not a Symbian specialist, but when you write something that needs access to more than simple GUI stuff, you need to sign the app (tied to a specific phone IMEI, at least with the free online signing process), and in the process request what you want to allow the app to access (GPS data, user data, comms etc). Then when installing the app, Symbian will warn you that the app requires access to spe
Re: (Score:2)
Yes it would be something like that, but more oriented to a desktop/server environment e.g. https://bugs.launchpad.net/ubuntu/+bug/156693
I was thinking more of there being a hopefully manageable number of "predefined sandbox templates" that an application could request to be run within e.g. "guest applet", "screensaver".
Specifying one of those predefined templates, would imply a list of access items (network, user data etc). These do not necessarily h
Re:Correction (Score:5, Insightful)
I'm tired of this meme.
The thing about worms like Conficker is that they absolutely do not rely on user interactivity with some sort of trojan interface. No, "CLICK HERE FOR FREE PORN!" or, "DOWNLOAD THIS APP AND GET GREAT WAREZ!" apps.
Conficker spreads site to site silently through vulnerabilities in Windows.
Yes, it's possible to own *NIX boxen via trojan horse deployments, but for home users who aren't running apache, mysql, openssl, ssh, ftp, gopher, BIND, etc. the non-user infection vectors dry up. This is because Windows *sucks* for system security. While it's possible to pull privilege escalation on *NIX machines, and other OSes, often, they're a pain in the ass and usually require specialized setups(certain version of MySQL running with certain version of Apache, with... etc). Home users really don't have to worry about Samba file/print sharing owning their machine like NetBIOS on Windows users have to worry about their machines being similarly owned.
Sure, disabling autorun, running firewalls, virus scanners, etc. is great computing practice, I think it's more to expect from a typical home user who just wants the damned thing to work regardless. Lots of people use a computer thinking it's, well, a computer. Not a car, or a fax machine or a rifle that every so often needs to be broken down and maintained. Nor should it be. Modern file systems are virtually self-optimizing and aside from system updates and making sure there's room on your disk, which NO OS can really claim to do for you, unless you count Apple's MobileMe/.Mac service, even then it's only 20 gigs, most modern OSes can just be used on end with out much worry. Except most machines aren't running with components designed in this decade, they're often running Windows.
Re: (Score:2)
Do you know what's easier to do than following any of those directions?
Buying a fucking Mac.
Good day sir.
Re: (Score:2)
Hardened and resistant does not mean "Immune." Yes, flaws exist in the OS, but no where on the scale that it exists on the Windows platform.
All this hype I hear about the gaining market share of OSX also increasing the market share for malware, viruses, etc(trojans excluded, operator error when it prompts for username and password is something that no OS can really be hardened against, although recovery from such a idiot move can be, I don't know how well OSX handles being rootkitted or attacked after havi
Re: (Score:2)
You're an idiot. thankfully i've got insomnia and willing to go point to point here.
never ONCE said it was "immune", or ANY OS is "completely immune", did I? As you say, USERS THEMSELVES are a 'problem' (PEBKAC, ever heard of it? It too, though, can be corrected via education), first of all, & as I said?? New 'holes' show up, in the OS & its apps that run on it, plus drivers & services also.
HOWEVER?
It appears that after my setup, per my own experiences, & that of others I show proof of (& I can produce more than the 1 I did that showed 2 people experiencing practical immunity, as long as they obey a few simple rules my guide illustrates though - funny that, eh?) that Windows CAN BE MADE SO, & again:
SO CAN USERS - with a bit of "education"!
IN fact, education, such as my guide yields for them!!
(& I put it on "rookie user" forums, the most, not where 'security gurus' are - they KNOW about it, but can only reach so many people... & it's those "rookie users" that need that info., more than anybody else does)...
You're missing the point. Windows *can* be made to be secure. Sure. Great. So can VAX/VMS. That doesn't make the product that ships out the door from Redmond gold. Firewalls, antiviruses, and antimalware apps just try to put a gold plating on a giant stinking turd.
In fact, for YOUR OS of choice? IF you possess the skills/saavy to do so?? DO 'spread the word' to them, on any platform you wish, as I have!
Here's my OS X safety guide:
"Don't download warez. Or, if you do, whenever it prompts you for a username and password, never give it. Ever. Also, your co
Re: (Score:2)
Noise.
Just. Noise.
I'm not sure if you're a clever troll or some sort of new take on Samir Gupta, or if you're just an idiot. But you're full of noise.
Clearly you don't know what a fallacy is, otherwise you wouldn't have used so many of them in your defense of Windows and limp wristed slapfight with Linux. Clearly you don't know what you're talking about. What the hell do you mean by "hardcodes?" Like, you helped some computer science phd remove hardcoded variable values out of some application? What d
Re: (Score:2)
You're digging your heels in, not listening to anything anyone ever has to say to you, because as you describe your self, that you're above the level of experience of people who post here generally. I don't have a life. I'll admit it. But, I don't. So I'm biting.
Unfortunately, your conclusions are all wrong. Your history of past posting shows people pointing out everything wrong you've said.
What you've done has absolutely no bearing on whether or not you're right. We've got accomplished astronauts who
Re: (Score:2)
You still do. Think other remotely exploitable holes won't appear in Apple's MacOS X? Think again - this is the "nature of the beast", & up until yesterday, & our discussion began BEFORE that?? MacOS X had a java hole that was big enough to drive a truck through...
A single Java flaw that took months to patch with no actual threat in the wild, despite how many machines were vulnerable prior(hint: that same flaw hit across all platforms; even windows) versus...
ActiveX.
QED.
(THIS IS THE "SHEER ARROGANCE" as well as ignorance you display & others like yourself, that try to tell others "*NIX is impenetrable" when clearly, you STILL have a problem in MacOS X even now, & it produces 3 problems of System Access, DOS/DDOS, or Privelege Escalation possibilities - & the ONLY way you can 'shield yourself' vs. them, is to do SOME of what I do (alter permissions/access rights)).
Arrogrance or did i just not buy a crapware OS? I just now ran nmap and the only service running is Bonjour. Which has no current vulnerabilities right now.
I win. GTFO.
Re: (Score:2)
LOL, grow up, & get this simple point thru your head, ok? You do NOT own this website, nor are you even a modeator here... so ordering me around? LOL, waste of time, you don't have the clout for it (or the ability to 'get the better of me', period) & anyone is free to read this exchange & see the numerous errors you made throughout it, vs. the points & evidences I put out vs. your "straight outta pravda" propoganda.
Still doesn't mean I can't tell you to get the fuck off the internet.
When you learn to THINK FOR YOURSELF one day, hopefully? You'll choose your words, & opponents, more carefully (because anyone here reading can see your "foaming @ the mouth raging frothing replies" replete with profanities doubtless out of frustration from making SO MANY ERRORS here? They will decide for themselves as to "who won" here (& I can assure you, it is NOT yourself, based on your 'performance', or rather, lack thereof)).
Being a dedicated Windows user for about 10 to 15 years has gotten me to really think for myself.
I thought, "Maybe I want a machine that isn't going to die just from browsing the web." Then I got a Mac.
By the way? WHY are you avoiding my questions now
Because you're an idiot. It's something I can't stress to you enough. Stop flogging WIndows. It's not secure. It's garbage.
Re: (Score:2, Interesting)
I have a friend who installed Ubuntu on his machine and was actually quite happy with it. He searched google for basic information and was able to get xine up and running to watch dvd movies on his 32 inch monitor connected to the pc. He was extremely happy that he no longer had to worry about viruses.
One day he called me frantically complaining about the inability to login because the system refused to accept his password. After calming him down, I found out that he had a second account called .... test. T
Re: (Score:2)
Just curious, but what did he need he need ssh for?
I know what I use it for, but I really can't see my mom using ssh. And it's pretty easy to lock down if only you are using it to help update his system (or some other legitimate excuse.)
There is not much you can do in regards to weak passwords other than forcing users to create strong passwords. But you can not install applications that allow others to remotely log into your system.
Re: (Score:2)
i understand there are lots of pc's out there with linux on them, but that is just a drop in the ocean compared to what's sold with windows on it, and most of the linux systems out there are maintained by professionals and don't get uncle joe on them installing that bit of software to get his free porn.
sure linux has mindshare, but that hasn't translated into market share. The year of the linux desktop will also be the year of the linux virus.
market share isn't the only thing that contributes to the security of an os. If software gets patched quickly, that can stop a lot of infections, which is an F/OSS strong point, not to mention the fact that unix and unix-like operating systems were designed to be secure.
Re:Correction (Score:5, Insightful)
Uh, if those windows machines actually ran "windows update" there would be no conficker.
So if Desktop Linux had the same users, they may not run "ubuntu update". Why? Because the last time they updated their machine stopped working properly
Think that will never happen? See: https://answers.launchpad.net/ubuntu/+question/24523
Notice that user actually understands "grub" and "kernels" and knows where to find help. Other users might just never update. If the O/S ever has millions of users, these users start to add up.
> the fact that unix and unix-like operating systems were designed to be secure.
Incorrect. Unix is a watered down Multics.
Linux and most Unix OSes don't provide much security by default.
By default, any program the user runs, can do everything that user can do. There is no sandboxing.
And whatever a unix/linux normal user can do is more than enough for the conficker worm to make money for its masters.
So all the bad guys need to do is get the user to run their program.
If Ubuntu ever has "windows class" users I doubt it'll be hard to get them to download a file and type:
perl conficker
Then it's pwnage time.
If desktop linux ever has the market share that windows has, it'll start to have lots more "dancing pigs" applets that people want to run.
Some will actually be OK. And some will be malware.
An O/S whose security depends on people being able to tell whether something is safe or not, without the people actually being able to see and understand the source code, or know the entire inputs, is an O/S that expects people to solve something harder than the halting problem.
Thus in my opinion Windows and most Unixlike OS have poor security.
There are ways to give users better info on whether something is safe or not before they run it.
For instance say an O/S requires a program to list out what sort of access it requires ("guest applet access", or "full system privileges").
Then the O/S can provide the user more meaningful AND true information, and the O/S can also enforce those limits if the user decides to actually run the program.
So if a "dancing pig" applet claims to not want network access, it will NOT get network access, even if it tries to later.
That's far more secure than what the current O/Ses do.
Re: (Score:2)
...the fact that unix and unix-like operating systems were designed to be secure.
Incorrect. Unix is a watered down Multics.
Total bollocks. You've never used Multics, have you?
Linux and most Unix OSes don't provide much security by default.
Do you have even the faintest idea what you're talking about? Didn't think so.
By default, any program the user runs, can do everything that user can do. There is no sandboxing.
...except that the standard user can't do much to damage the system. By design. The worst they can do is to nuke their own files.
That's not the worst they could do (Score:5, Insightful)
That's not a nice thing to say. Why did you say that? Did I hurt you somehow before?
> The worst they can do is to nuke their own files.
Nah. As I've been saying - they could run the wrong program and then the bad bad things could happen.
While having their own data destroyed is typically far worse than losing their entire operating system, that's NOT the worst that could happen when a user runs the wrong program.
1) Their data could get silently corrupted. Silent corruption is often far far worse than complete data loss. When you have complete data loss, it's obvious. So you restore from backups, or deal with it in other ways. When something tampers with the data, you could be screwed so badly and not know why. By the time you realize something is wrong, all your backups could be of the corrupted data.
2) Their secrets could get exposed and abused.
3) Their computer could get taken over and used for illegal stuff. While they might eventually be exonerated, the pain and damage involved is likely to be more than mere data loss.
Plus it's probably easier to live if people think you're some incompetent loser who went out of business because of massive data loss, than if people think you really downloaded, stored and shared all those illegal and _disgusting_ porn.
I'm sure others can think of many other things worse than "nuking their own files".
e.g. they could unknowingly help Skynet survive and grow in strength
Re: (Score:3, Informative)
Uh, if those windows machines actually ran "windows update" there would be no conficker. So if Desktop Linux had the same users, they may not run "ubuntu update". Why? Because the last time they updated their machine stopped working properly Think that will never happen? See: https://answers.launchpad.net/ubuntu/+question/24523 [launchpad.net] Notice that user actually understands "grub" and "kernels" and knows where to find help. Other users might just never update. If the O/S ever has millions of users, these users start to add up.
This is why I run a stable distro that doesn't break everything all the time. Debian stable for example, I think it would be highly unlikely for anything to break during an update.
Re: (Score:2)
On most perl installs the LWP library is included (even on Windows perl installs). IO::Socket::INET is most certainly included. And you can bundle perl libs (especially the ones written in perl) you need if you use pp.
It's not difficult to write a cross platform perl trojan than makes sure it is restarted each time (if linux/freebsd use crontab and/or at, if windows use the registry), searches the web or a P2P network for new instructions, validates the inst
Re: (Score:2, Interesting)
I'm one such person, while I'm unemployed. I'd say maybe one out of 5 of the computers that come to me leave with Linux installed. Those satisfied customers then refer their friends and family. Not much repeat service, but quite a few referrals.
What percentage of those users are still using Linux in 1 month? In 6 months? After 1 year? Per usual, something about your allegedly genuine pro-Linux story just begs more questions. How many users later dump the machine and end up just getting a new Windows machine instead? How many gain a new found appreciation for Windows after having used Linux for any length of time? How many users ever come back complaining that their X server is crashing or sound latency problems make watching YouTube unbearab
Re:Correction (Score:5, Interesting)
In my experience 100% of the people I have volunteered to install Linux on their systems not only continue to use linux for years afterwords, bring me their new computers they buy with windows installed and ask me to remove it.
Among others:
dozens of first time to almost completely computer illiterate people.
Lots of people that have been using windows for years and are fed up with the crap, especially after most linux distros had more in common with windows xp than vista had in common with windows xp.
At least half dozen people over 60.
Lots and lots of teenagers.
Not to mention everyone that works in my office never seen a linux computer before they walked through the door, and now have them at home.
So, these arguments are for the ignorant that have not used a major distro in the last couple years.
Re: (Score:2)
my arguement isn't that l
Re: (Score:2)
have you ever used linux?
Re: (Score:2, Interesting)
Comment removed (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The trojan will of course have to work on several subtly different distros that are running one of several windowing environments and the users will be browsing the web with one of half a dozen web browsers. Windows is a monoculture and is therefore very easy to attack. Desktop Linux is not.
Re: (Score:2)
I'm not exactly unemployed-rather self-employed.
A fine distinction at best.
Re: (Score:2)
There are more than you think. Old home computers are quickly becoming Linux computers.
More likely they are going to the dumpster.
The most conspicuous thing about Slashdot conversion stories is that you never see the numbers.
You never see the competition.
Repairing or rebuilding an aging system is going to take a little time.
That sets an upper limit to how much product will be moving out of the geek's one man shop.
There are other curiosities.
Such as the customer who wants to see a four, five - six or eigh
Re:Correction (Score:5, Insightful)
>Linux has picked up a lot of mindshare
The problem with Linux on the desktop is that it's not very compelling.
Linux shines when the people around you are using it. That is, on your LAN or within telnet's reach. X is amazing, when used remotely. Why download and install a program when you can just telnet over to where its installed? Assuming the bandwidth is there (and it's a hell of a lot more there each year), the program will run. And it will be a lot faster than doing it the newfangled way, which is to make it a web service.
Linux makes a great desktop, if by "desktop" you mean network terminal. But we don't have a network. We have the web, which is a single graphical application (the "browser") that runs best on Windows. Just like a video game.
Linux won't, and probably can't, catch on until the network is there to support it. That includes small and large businesses, which have networks that would benefit from it, and are still using Windows. Businesses can use Linux the way it is intended, right now. But the "home desktop" is designed to deliver applications, not services.
Let's put it this way: The day some 14-year-old kid installs IIS for XP and hosts a webpage from his bedroom will be the first day of Linux's life. To my knowledge, nobody is hosting squat. Except on bittorrent, which doesn't quite count, because although BT is a protocol, people use it like just another Windows app.
Re:Correction (Score:5, Insightful)
hasn't there been multiple worms for openssl and apache?
i'm suprised i have to make this point yet again, but there are more machines infected than the whole linux marketshare. until linux is really in the hands of the common newb you won't have an apples and apples comparison.
Silence, in this context, really is golden.
The absence of data actually does signify, as far as this argument is concerned. In effective terms, users can find a secure haven in non-Windows systems. There is, admittedly, some truth to the assertion that there's a myth of invulnerability surrounding FOSS systems. Amusingly, black hats seem to buy into it [imagicity.com] as much as anyone else.
Want effective protection from malware right now? Don't run Windows.
Will that protection exist tomorrow? Will it exist even after everyone and their dog has flocked to FOSS? These are, for the moment, academic questions. Developers, however, deal with such academic questions all the time. My personal feeling is that FOSS developers are up to the task of securing their systems even in the face of concerted attacks.
So what about that famously touted malware vector, 'stupid user tricks'? Ignorance and naivete are vulnerabilities in any system, technical or human. One doesn't have to look far for proof of that. But there's a fundamental logical flaw in this argument when applied to FOSS systems: The argument essentially says, "Once FOSS is just like Windows, it will be just as insecure as Windows."
This assumes that a mass movement to FOSS won't be accompanied by a cultural change, and I can't see how that's possible. The culture of the incurious, uninvolved and too-trusting Windows user is exactly what keeps Linux (and much of FOSS) off the desktop. FOSS punishes each of those tendencies. In effect, it pushes back against the very behaviour that remains Windows' last, greatest vulnerability.
I'm not trying to make the case for cultural change. Frankly, I'm getting jaded enough that I'm not so sure there will ever be a year of Linux on the desktop. But here's the thing: I don't care. Linux (and FOSS systems generally) work for me and my customers now. That's enough for today. I'll continue looking ahead with caution, but today, at least, I'm safe, and most of the rest of the world is not.
Re:Correction (Score:4, Funny)
i'm suprised i have to make this point yet again, but there are more machines infected than the whole linux marketshare. until linux is really in the hands of the common newb you won't have an apples and apples comparison.
I know. It's typical isn't it? I've been waiting for a Linux version of Conficker for some months now. That's why I still have to dual boot: I just can't get the same experience using Linux as with Windows.
And before you suggest it, I'm not about to take the trouble to manually downoad and install some other academically written virus as a substitute. Also, typically, deficiencies in WINE stop me from running the Windows virus.
I know there is the whole marketshare thing, but I think there's just more the developers could be doing on a variety of fronts to address what is really a critical problem with Linux.
Re: (Score:2)
> I know there is the whole marketshare thing, but I think there's just more the
> developers could be doing on a variety of fronts to address what is really a critical
> problem with Linux.
The guys at Freedesktop.org are hard at work on the problem and making considerable progress.
Re:Correction (Score:5, Insightful)
It may not be popular on /., but Windows isn't the main problem here. The core of the problem is people not giving a shit about the security of their system. Whether that system is Windows, Linux or Mac is irrelevant.
Windows has reached a point where it can be considered "fairly secure". There are few known security holes, and none that can't be fixed with a little system tweaking and putting a router in front of the machine. But what can the system do if the user is the main point of failure, when he grants everyone any kind of privileges?
Take a look at the Dancing pig problem [wikipedia.org]. In a nutshell: "Given a choice between dancing pigs and security, users will pick dancing pigs every time."
A webpage promises the user what he wants to see or do. Firewalls and security systems ring alarms because what the page actually will do is install malware. But the user clicks it away and allows it in. Because he wants to see the dancing pigs (or install a crack, or see some pron, or ...).
What system could avert that? Only one that does not allow its owner to do what he pleases. Do we want machines that we don't own but that only install what's "good for us"? I wouldn't want to go there...
As long as people don't give a shit about their security, this problem will not end. Be it with Windows, Mac, Linux or FantasyOS. And people will not give a shit about their system's security and whether their system is a threat to the rest of the internet as long as they are not held responsible for their system's actions.
Time to reconsider "anti-worms":? (Score:2)
n/t
Re: (Score:2, Interesting)
My God! It's full of anti-worms [distrowatch.com].
Re: (Score:2)
Go for it. See if you can reverse engineer conficker's encrypted and digitally signed binaries. It's only RC4 and MD-6. MD-6 was only released a few weeks prior to the first wild sightings of version C. Still wanna mess with these guys? Then all you have to do is figure out which of the 50,000 domains spread across ~120 .tlds to register so you can put your binary on it for when conficker does it's daily payload check.
Or if you want, you can try to infiltrate it via its own P2P network. You better be quick,
"Watch me" service (Score:5, Interesting)
If your ISP provided a free service where it would text or phone you and offer to help clean up your systems if it detected malware-ish behavior coming from your computer or network, would you sign up?
The only gotcha is that you would be inviting the ISP to watch your traffic.
OK, this is slashdot, so most people would say "no," but how many regular people would say "yes" and would that make much of a difference?
Re:"Watch me" service (Score:4, Insightful)
Regular people just care that whatever is on their computer isn't directly costing them money or causing it to visibly malfunction. From experience, I know most would ignore any offers to help, sadly. Guess the trick is to find a way to make them want to disinfect their computers.
Re:"Watch me" service (Score:4, Insightful)
Re: (Score:2)
after all computers are supposed to be slow after about a year because all the hardware goes obsolete right?
that; or they're running SSD's.
Re: (Score:2)
Re:"Watch me" service (Score:4, Insightful)
Re: (Score:2)
Especially if the RIAA lapdo, er, CBS is involved and your ISP happens to be a subsidiary.
Re: (Score:3, Funny)
Guess the trick is to find a way to make them want to disinfect their computers.
"Every time you don't update your antivirus, a kitten is struck by lightning."
Re: (Score:3, Funny)
Re:"Watch me" service (Score:4, Insightful)
Guess the trick is to find a way to make them want to disinfect their computers.
Or make them want something that Linux has but Windows doesn't. Unfortunately, users tend to have weird priorities. They won't budge over the seemingly intangible factor known as 'security', but they might switch in a heartbeat for Gnometris.
Re: (Score:2)
You're not alone in that experience. I've converted my father to Linux a couple of years ago. I converted him because of security issues and all the Window maintenance hassle. :) ).
But I also know that the real reason he has switched were foobillard and same-gnome. He still plays his old spider game in wine though because he doesn't want to lose fine statistics he has there (have to look whether I can change AisleRiot's stats manually to make him switch
Re: (Score:3, Insightful)
Regular people just care that whatever is on their computer isn't directly costing them money or causing it to visibly malfunction. From experience, I know most would ignore any offers to help, sadly. Guess the trick is to find a way to make them want to disinfect their computers.
Easy, do what the government does... fearmonger.
"ZOMG Identity theft!!#!"
They'll be begging for free help.
Re: (Score:3, Informative)
"So? Ffffft.
How likely is that to happen? Almost zero? Fffft. And when it happens? My bank will cover the loss so I shut up and don't make a stink about it, so does Visa, so? Ffffft."
That's how this is perceived. It's no biggie. The money that may be lost will be covered by the financial institutions that don't want people to lose faith in online transactions. And that's about all people care about when it comes to identity theft.
Re: (Score:2)
"Regular people" don't care at all. That's the whole point here.
They don't care as long as it "works". And "works" means, as long as they can surf their web, read their email, write their letters and maybe play a game or two. As long as the system does that, they don't care about anything going on inside. They don't care whether they spew out spam as long as their connection remains fast enough to read pages and mail at normal speed. They don't care whether they are a botnet hub as long as it doesn't slow t
Re: (Score:2)
Re: (Score:3, Interesting)
Except that government is vulnerable to pressure from lobbyists.
"Bot traffic" could easily be written up in legalese to mean anything special interests don't like, such as bit torrent.
Which may be even easier than expected if ACTA remains classified to the bitter end.
Re:"Watch me" service (Score:5, Informative)
OpenDNS already have a system set up where, if you use their DNS servers, it will tell you if it detects any Confiker-type activity on your network. Non-intrusive, transparent to the end-user, and quite effective.
Re: (Score:2)
The ISP where I live - Shaw - offers free Anti-Virus based upon F-Secure. Based upon this link it does protect against Cornficker and tools are provided to remove it.
http://www.f-secure.com/v-descs/worm_w32_downadup_gen.shtml (non c
Re: (Score:2)
You know, that WOULD actually be a quite well working solution.
Whatever the worm wants to do, it must eventually do a DNS lookup. How many people go "normally" to masjwefkangagjagawrh.uprekj.cn?
Re: (Score:2)
Whatever the worm wants to do, it must eventually do a DNS lookup.
Not necessarily. At would have to do is have a list of the static IP addresses of its control servers, and if that list changes it could be remotely updated anyway. DNS is not a requirement: as you note it is actually a point of failure.
Re: (Score:2)
Usually malware updates using DNS. Simply for convenience. If the server fails for some reason (detection, put offline by the ISP or law enforcement, etc), all it takes is to change the DNS entry and wait for the propagation, without the need to actually change the malware and risk another detection.
But the system would work for IP addresses as well. You try to connect with xxx.xxx.xxx.xxx and it's a known malware host, you get a warning from your ISP that you're probably infected because, again, why should
If we look carefully at these Windows worms... (Score:5, Funny)
If only we consider more thoroughly what single thing they all have in common, we might be able to find a cure.
I've got it... (Score:4, Insightful)
And more specifically the sort of people who would install stuff just because a pop up tells them they are infected and they should install "Antivirus 2009".
And those who would type in passwords for encrypted zipfiles to decrypt them and install the stuff inside them...
Re: (Score:2)
Conficker required no such user action as "installing stuff because a pop up tells them to".
Stop, stop, stop repeating this meme. It's just not true.
Re: (Score:2)
I've got it... It's people!
Actually, most trojans and similar malware get in to people's computers because of a mouse driver problem.
Ahem.
Sure.. (Score:2)
The problem with bot-nets is not that people don't care (exactly) but that they are ignorant, literally, they don't know. Everyone wouldn't fix it or know how or who to turn to but the net result would still be X percentage less infected computers. Probably even an X percent increase in awareness/interest (personal information accessible/business information-secrets accessible/illici
Re: (Score:2)
Re: (Score:2, Informative)
I ran an ISP only a few years ago. The number one source of identifying hacked PC's was abuse messages coming to our admin accounts. It didn't take our support staff long to lock out and call the customer. Many would say, "yes, the computer has been running slow lately", and thanked us for fixing their virus.
We also monitored our MRTG graphs. If we noticed strange spikes in traffic, our network people would investigate. One time we had to shut down a chess server at a high school. I will say this was in a r
Re: (Score:2)
If your ISP provided a free service where it would text or phone you and offer to help clean up your systems if it detected malware-ish behavior coming from your computer or network, would you sign up?
I'll take the odds that your cable ISP has a free Internet security bundle for Windows.
Security Center [rr.com]
OK, this is slashdot, so most people would say "no," but how many regular people would say "yes" and would that make much of a difference?
The uncomfortable truth about privacy is that is you are most likel
Re: (Score:2)
Sure! I'm in the EU, they're watching my traffic already anyway, mandated by law. They could at least use that privacy invasion for some good, too, for a change.
Re: (Score:3, Interesting)
Probably because ISPs tend to have deeper pockets than customers and are thusly more apt to be shoehorned into a booby trap if they try to be a good samaratin.
Why can't we remove it? (Score:2, Interesting)
Re:Why can't we remove it? (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
So should linux kernels do the same thing? Surely it'd be good if your server shut down because you didn't apply an openssh patch.
Re: (Score:2)
Windows should ship with a built-in, suspicious network activity detecting component that disables the network if it flags a problem? And people complain when they get erroneous WGA warnings! Imagine the response when anyone running a P2P program, or a UPnP-type software, or security scanning software gets shut down. All of these are legitimate examples of software that is supposed to look for other computers in ways similar to Conficker's searches. Of course, the first action of a smart worm would be t
Re: (Score:2)
MS already did this sort of thing with insta-revokable video drivers that didn't play ball with Protected Video Path.
Forcing users to apply patches opens the door to slavery to whatever special interests get in bed with Microsoft.
Re: (Score:2)
Consider this for a moment: You are the writer of a worm that has full control over the system. What is the first thing you disable? I mean, before you start any kind of "suspicious network activity"...
Re: (Score:2)
Re: (Score:2)
> We now have Windows Defender... What is so special about Conficker..
For one, conficker kills Windows Defender and keeps it from starting up on reboot.
We ALL know the words to this one by now! (Score:5, Insightful)
Botnets, worldwide botnets.
What kind of boxes are on botnets?
Compaq, H.P., Dell and Sony, true!
Gateway, Packard Bell, maybe even Asus, too!
Are boxes, found on botnets,
All running Windows! Foo!
Re: (Score:2)
It's an old jingle for Armour hot dogs:
"Hot dogs, Armour hot dogs,
What kind of kids eat Armour hot dogs?..."
Internet Telescope (Score:2, Interesting)
User education! (Score:5, Insightful)
Re:User education! (Score:4, Insightful)
That's just because they learned that everytime they installed something that announced itself as "critical update" and "warning, machine infection possible if you don't do this" they got bombarded with advertisments and had strange new toolbars in their browsers...
Re: (Score:2)
So let's give the users an education. Instead of trying to block all these botnets, hack them! They are designed to distribute malicious software, so use that capability! Write a payload that would erase the hard drive on every infected machine and send it out there. I guarantee you that in a few weeks the users will be educated.
Re: (Score:2)
So why haven't you talk about this to your system administrator?
Virus devastates millions of complacent idiots (Score:2)
A computer worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is posing a growing threat to users blitheringly stupid [today.com] enough to still think Windows is not ridiculously and unfixably insecure by design.
Despite many years' warnings that Microsoft regards security as a marketing problem and has only ever done the absolute minimum it can get away with, millions of users who click on any rubbish they see in the hope of pictures of female tennis stars hav
Any zombie networks running on Linux ... (Score:2)
or on some other non-Windows OS? This is a serious question ... what is the amount of exploits and similar with regard to non Windows computers. Is it known?
'computer' worm (Score:2)
Don't they mean a BUG in the Operating System and defects in the Memory Management unit lead to the worst virus/worm [sri.com] infestation in years.
'One major implication from the Conficker B and C variants, as well as other now recently emerging malware families,
Re: (Score:3, Interesting)
As a computer consultant that (has to) advocate Windows, allow me to answer this.
The average computer user in a company doesn't know jack about his machine. Fortunately, he's not required to do administrative tasks, but he's required to work with it. And he's required to produce. Trying to convince management that they should toss out all Windows machines and install Linux everywhere is something you should only try if you always wanted to take over bolder duty from Sisyphos.
Second, the average computer adm
Re: (Score:2)
Thanks for taking the time to write a thoughtful though flawed response. The thing is, I never mentioned Linux. Furthermore, I would say that the continued existence and popularity of the Apple Macintosh refutes the rest of your arguments hinging on ease of use and technical support. In fact you have perfectly illustrated the point that I am making here.
There was a time when doctors routinely prescribed smoking cigarettes as a quick and easy fix to all manner of ills. The long term hazards and effects weren
Re: (Score:2)
You want to convince management to buy even MORE expensive computers? Computers that they will dismiss as "fancy but impractical", with one less mouse button (read: you get LESS for MORE money!), computers that will (in their mind) break the all-holy compatibility with their clients (and competitors), no matter how much you explain to them that nearly all software is available?
Even Sisyphus would refuse to push that boulder.
According to your logic, they'd be happy to spend more money. Usually they're not. I
Re: (Score:2)
Considering the H1N5 was there too IIRC, it ain't that bad...