Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Crime Security Spam The Internet IT

Zeroing In On the Internet's 'Evil Cities' 90

Posted by timothy from the their-palantirs-are-everywhere dept.
We've sometimes seen malware sources broken down by country; now a Dutch study attempts to increase the resolution of that information. An anonymous reader writes with some bits gleaned from the recently published study (PDF): "Seoul is the most criminal city on the Internet, followed by Taipei and Beijing. When the population of the top 20 cities is taking into account, Chelyabinsk , in Russia, tops the list, followed by Buenos Aires and Kuala Lampur. These results were found by researchers from the from the University of Twente and Quarantainenet, a security company from the Netherlands. The researchers also found that analyzing attacks' origin at the city level [Original, in Dutch] instead of country level reveals interesting findings. For example, the U.S. ranked #3 in the list of the most criminal countries for the reporting period, while no major U.S. city was found among the most evil ones, while only one European city was listed among the top 20 cities, but 8 EU countries were among the most criminal. It was also observed that the list of criminal cities remains stable over a period time and that when the attack type is taken into account, 50% of the most evil cities remains the same."
This discussion has been archived. No new comments can be posted.

Zeroing In On the Internet's 'Evil Cities' More

Zeroing In On the Internet's 'Evil Cities'

Comments Filter:

  • Lack of information much? (Score:4, Informative)

    by msobkow ( 48369 ) on Sunday July 10, 2011 @05:45PM (#36715042) Homepage Journal

    Serious lack of useful information in the linked articles. The summary is longer!

  • Isolate them from the WWW until they clean up their act at the local level. Go get them Google!

    • Re: (Score:2)

      by jrumney ( 197329 )
      Who is "them"? Are you advocating collective punishment for the actions of a minority who appear to be more concentrated in a few foriegn cities rather than evenly distributed like in US and Europe. The reality is probably more to do with the reliability of geolocation services in those countries - making the entire nation appear to be coming from the capital.

  • missing the point (Score:5, Insightful)

    by Anonymous Coward on Sunday July 10, 2011 @06:02PM (#36715168)

    FTFP:

    In this work, by originated we mean where the attack came from. We do not consider if there
    were other hosts controlling the attacking one

    So this is not about criminal activity. It is about "which city has the most zombies".

    That information is still useful, but not "most evil"

    • Re:missing the point (Score:4, Funny)

      by Solandri ( 704621 ) on Sunday July 10, 2011 @06:19PM (#36715278)

      So this is not about criminal activity. It is about "which city has the most zombies".

      That information is still useful, but not "most evil"

      So it's "most undead"?

    • Re: (Score:1)

      by aliquis ( 678370 )

      So this is not about criminal activity. It is about "which city has the most zombies".

      That information is still useful, but not "most evil"

      I thought the first rule of robots where to do no harm =P

    • How can you say that?!?! Zombies are most certainly very evil! They want your brains for crying out loud, well I guess in their case it would be more of a groan.

    • So this is not about criminal activity. It is about "which city has the most zombies".

      close but it is actually about "which city has the most zombies that own computers".

      see what i did there? ;)

  • We are in decline, but our banksters still have no match.

    The City? Don't make me laugh. GS boys have nastier grub for breakfast.

  • Dodgy conclusions... (Score:3, Insightful)

    by Anonymous Coward on Sunday July 10, 2011 @06:09PM (#36715206)

    Seoul is likely to be at the top of the list not because it's naturally criminal, but simply because it contains the largest proportion of computers connected to a high speed network. With a large enough botnet it's a bit like a city sized data centre.

    • Re: (Score:3, Informative)

      by Stormwatch ( 703920 )

      But most importantly: South Korea has possibly the worst case of Microsoft monoculture in the world. [kanai.net]

      • That's really interesting. They blocked themselves into using IE and ActiveX controls exclusively for everything because they couldn't wait for 128-bit encryption to come out in '99. So it's not *just* that they're running windows, but that they have to use IE and still haven't moved over to the 128-bit standard.

        • Yep. Things are changing over here, though; I'm seeing more and more Apple stuff these days. An awful lot of university students I see are using MacBooks. Plus, the trend seems to be towards mobile: Android is making major headway locally, as well as Safari on iPhone.

          Unfortunately, the banks are not changing in what I would call a reasonable way: instead of switching over to standard encryption, they're simply developing custom software for Mac or mobile, which is kind of odd.

      • Talk about cherry-picking your data. Don't get me wrong, I also think that using Windows with IE (esp. 6) is a recipe for zombifying your computer. Nevertheless, did you see if other top-malware cities have a MS monoculture? And are there any cities with MS monoculture who are not top malware origins? And after all that, you are still in the correlation!=causation domain, although you will then at least have a valid working hypothesis.

        • No kidding (Score:5, Interesting)

          by Sycraft-fu ( 314770 ) on Monday July 11, 2011 @02:18AM (#36717722)

          What I think you'll find actually is the cause is more of a cultural thing. I've done no empirical research on this, but I do get a few data point of observations from the large number of Asian grad students we get. I've noticed something that is very common in both Chinese and Korean students:

          1) Pirated software is a way of life. The idea of paying for software is just not really an idea they have. They don't see it as wrong in any way, it is just how you do things. Well while the BSA's stuff about viruses is over inflated, it is based in reality. There are plenty of warez sites out there which have infected software. This seems to be particularly true of Chinese sites. Finding one that isn't ridden with viruses is difficult.

          2) Virus scanners are just something that isn't considered to be needed on computers. This may be in part because of language barriers. Most of the best virus scanners are Eastern European, and the companies market in English primarily. I have noticed since Qihoo has come to be that more Chinese students have scanners, it in particular. Unfortunately it is a really poor virus scanner (gets a ton of false positives and have poor heuristics and so doesn't deal well with unknown malware) so it doesn't do much good.

          3) ISPs that just won't give a shit, at all, about anything. Efforts at contacting Chinese ISPs about problems have never done anything. Most ISPs, if you make them aware of a system causing problems, will take action. Some these days proactively watch their network and shut down problem connections. We've never had any luck with Chinese ISPs. We've even gotten people to translate our message in to Chinese and the response is always "We are not responsible for that IP, please get us the correct IP." They are of course responsible, APNIC confirms it, they just don't care.

          I think that is a large reason why areas like this are so very infected. The propensity for not having a scanner and downloading from any random site makes infection much easier, and since ISPs don't seem to care there is little to stem the tide. You combine that with the normal user ignorance of computer security that we see across the world and there you go.

    • This study might also not mean a lot if they didn't take into account the size of the metropolitan area around the city. For example Los Angeles might not have ranked high if you only include attacks from within the proper city limits but exclude attacks from contiguous cities like Hollywood or poorer areas.

    • Or even more importantly because it contains a large percentage of the country's population. No US city has as high a percentage of the US population.
    • Exactly, the batch of attacks experienced lately by korean institutions is a clear indicator that there are third parties involved here.

      Having said that the root cause is the negligence of security by both individuals and organizations, but that's no different from any other coutnry in the world .. it just so happens that korea has both very high bandwidth available and very high uptake of the available bandwidth, ie. they're just further ahead in the curve than other countries are regarding the internet

  • Wrong data for Buenos Aires (Score:4, Informative)

    by Guillermito ( 187510 ) on Sunday July 10, 2011 @06:23PM (#36715310) Homepage

    In the per capita list, Buenos Aires ranks 2nd, but the city population data they use are wrong. They say Buenos Aires population is 3 million, but that's only Buenos Aires city proper, the whole metro area has an estimated population of about 13 million. So Buenos Aires should rank lower than listed in that study.

    • "City" means "city", not "you can drive for 2 hours out of the city limits and yet still be counted somehow".

      • Re: (Score:2)

        by xaxa ( 988988 )

        but "city limits" has a different meaning in most countries. In some it's just the city centre, in others the whole sprawl.

        • Re: (Score:2)

          by dkf ( 304284 )

          Measuring the size of a city is hard, especially when it runs into others. You can't use the formal governmental definition because they're all too often either too large or too small. A classic example is the City of London, which only has about 11500 inhabitants whereas the area normally called London has about 7753600 people and the whole metro area is somewhere in the region of 12-14 million (Eurostat puts it at 11917000, but that might well be an underestimate). It's very very hard to draw a boundary t

    • Normalization for Russia is unreliable in the cities outside of two capitals (M and S-P) which makes Chelyabinsk's place at the top of per capita list questionable.

      For example my parents newly installed fiberoptics connection is registered in the neighboring province, 8 hours by train.

      It could be that Chelyabinsk localization covers 10 times more people than nominal population 1M.

  • Chelyabinsk also has a reputation as being the most contaminated city, with nuclear contamination from Mayak. Now maybe there's a connection..

  • I could very easily hire a spam group out of any one of these countries to push my malware out for profit but who is really "evil"? The companies in foreign countries that offer the service or the people who hire them? My guess is if we were to follow the money it would lead us to very different places.

    • I could very easily hire a spam group out of any one of these countries to push my malware out for profit but who is really "evil"? The companies in foreign countries that offer the service or the people who hire them?

      Yes.

  • Was this with or without co.cc? (Score:3, Informative)

    by davidwr ( 791652 ) on Sunday July 10, 2011 @08:15PM (#36716028) Homepage Journal

    Seoul, South Korea was #1 on the list, and it may be for reasons other than just generally good Internet connectivity:

    It's the home of co.cc, which Google recently blacklisted for being a den of evil.

    If it was before the co.cc Google Death Penalty [slashdot.org] then maybe we should re-run the study in a few weeks.

    From Google pulls co.cc subdomains from search, brings our global malware nightmare to an end [engadget.com]:

    Google classifies [the company behind co.cc] as a "freehost" -- it belongs to a Korean [emphasis added] company...

  • For example, the U.S. ranked #3 in the list of the most criminal countries for the reporting period, while no major U.S. city was found among the most evil ones,

    Does this mean the US just has all of it's malware spread evenly between the many major cities? Or are all the compromised machines in rural places like Buttfuck, Indiana?

    • Does this mean the US just has all of it's malware spread evenly between the many major cities?

      Yes. The problem with this study is the low accuracy of the geoip data for Asia. Hanoi and Ho Chi Minh are around the middle of these lists but one half of the country appears in the geoip lookup as Hanoi; the other half appears as Ho Chi Minh - I'm currently 450km from HCM but that's where Maxmind says I am. I know from experience there are plenty of spammier locales in China than Beijing - again data is just getting aggregated. So the data in their writeup ('paper.pdf') is kind of lame because they only h

    • Re: (Score:2)

      by mrxak ( 727974 )

      All our evildoers are probably pasty white suburb kids who live in their parent's basements running scripts they downloaded.

  • location of IPs is misleading (Score:3)

    by PopeRatzo ( 965947 ) * on Sunday July 10, 2011 @09:19PM (#36716432) Journal

    The paper explains that they used the IP locations to see where the attacks were coming from. If someone in Shanghai has a botnet that includes a bunch of machines on a university campus in Missouri and launches his attacks through that botnet, wouldn't it count as an attack coming from Missouri instead of Shanghai?

    I'm not sure I'm comfortable with the methodology of this study. I'm too tired to read it more carefully now, but it looks like it might be making conclusions about "evil cities" that is not really warranted.

    • On the other hand, the owner of a network in Missouri that hosts botnet deserves a good deal of the credit for either their complicity or their stupidity.

      (I was tempted to grant a huss based upon the possibility that educational funding cuts have resulted in the poor hypothetical sap being unable to afford any decent sniffers...but then I remembered Wireshark [wireshark.org].)

      • On the other hand, the owner of a network in Missouri that hosts botnet deserves a good deal of the credit for either their complicity or their stupidity.

        Ah, but the report chose to use the term "evil".

        You and I might disagree, but normally stupidity does not meet the high standard of "evil".

        You might say "Pol Pot was evil" or "My uncle's farts are evil" but you would rarely say, "He's so stupid that he's evil."

    • Re: (Score:2)

      by jrumney ( 197329 )

      wouldn't it count as an attack coming from Missouri instead of Shanghai?

      Actually, according to the geolocation provider's own figures, it would count as an attack coming 90% from Missouri with another 9.7% spread over other states and 0.3% appearing to come from other countries. If it appeared to be coming from Kuala Lumpur though, there's only a 53% chance that it is coming from anywhere within a 25 mile radius of the city (which takes in a much larger population than they've accounted for in their calc

  • Is there a widget that would generate a hosts file to block dangerous locations by clicking on a map? Sorry, that sounds like an iPhone app.
  • A beautiful city! It is home to the world's first three peacetime nuclear disasters. You can read up on the place in the Exile [exile.ru].
  • This page has a visualized correlation of ssh blacklisted IP's against Cities. It is updated daily. Source is the sshbl.org blacklist.

    Current daily winners are Moscow and San Francisco with 17 each.
    http://hackertarget.com/ssh-blacklist/ [hackertarget.com]
  • they actually needed to do a study?

Slashdot Top Deals

Statistics are no substitute for judgement. -- Henry Clay

Close