Researchers Say Kelihos Gang Is Building New Botnet 110
alphadogg writes "The cyber-criminal gang that operated the recently disabled Kelihos botnet has already begun building a new botnet with the help of a Facebook worm, according to security researchers from Seculert. Security experts from Kaspersky Lab, CrowdStrike, Dell SecureWorks and the Honeynet Project, announced that they took control of the 110,000 PC-strong Kelihos botnet on Wednesday using a method called sinkholing. That worm has compromised over 70,000 Facebook accounts so far and is currently distributing a new version of the Kelihos Trojan."
Re: (Score:2)
Relatively low (compared to XP/Win7) and continually declining marketshare would be my guess.
Re: (Score:2)
Because Vista was so shitty that even malware crashed before being able to execute.
Two deadly vectors of infection... (Score:4, Insightful)
Another reason I'm glad I don't use Facebook or Windows.
Re:Two deadly vectors of infection... (Score:4, Insightful)
As a previous poster pointed out, trojans care not if it's Windows, Linux, Mac OSX or BSD because the user is the weak link, not the OS. All you need is 1) a trojan for that OS and 2) a user that gives the trojan permissions - most infections I've come across on Windows lately do not have administrator permissions unless the user does. Likewise, Facebook isn't so much the weak link as users are because they'll click on anything.
Re: (Score:2)
Re: (Score:3)
So why does this only infect Windows? Are Linux and Mac users smarter? Are all Facebook users incredibly stupid? Do only Linux and Mac users realize that it's stupid to type in your password for some random software? Are only Windows users smart enough to remember their administrator passwords? Does god hate Windows? Do the people who write trojans hold a particularly low opinion of Windows users? Are they trying to educate Windows users? Is that possible? I know a few Windows users and they don't s
Re: (Score:2)
Re: (Score:2)
You could try "+1 Funny".
Re: (Score:2)
You could try "+1 Funny".
I could, but I was trying for a "+1 Funny" myself.
Re: (Score:2)
So why does this only infect Windows? Are Linux and Mac users smarter?
I suspect that there are a few reasons for targeting Windows.
Re: (Score:2)
As a previous poster pointed out, trojans care not if it's Windows, Linux, Mac OSX or BSD because the user is the weak link, not the OS.
True in theory.
Real life begs to differ, though. Geeks regularily forget about real life. In your head, your password policy grants your users great passwords at a theoretical complexity of 10^18. In real life, the actual complexity is closer to 10^7 due to patterns.
Same with the trojans and other malware. Yes, theoretically some classes of malware could be just as easily targeted on OS X or Linux. In reality, though, OS X has about 15% market share and less than 1% virus share, while Linux has 5% market sh
Re: (Score:2)
This is why Windows will never truly be a Real OS.
Re: (Score:2)
Re: (Score:2)
You were successfully trolled.
Re: (Score:2)
BTW. Copy pasta is great! Needs a little salt
Re: (Score:2)
Re: (Score:2)
DEAR APK,
I've already had to scroll past this same post twice IN THIS THREAD ALONE.
You have copy/pasted the exact same set of directions to just about every security related article for the past several months.
We've all already seen it, and it's just wasting space.
If you want to inform new people, fine.
Put together your own web site, post all of these directions in a single place where you can keep them up to da
Re: (Score:2)
Fine, you're awesome, incredible, and one of the most accomplished programmers the world has ever seen.
I don't care, and it doesn't negate anything that I said.
You act like a dick with low self esteem who likes to blow his own horn on other peoples web sites.
No one cares what you have done when we can look at and test the actual information you are presenting, so quit with the self promotion.
I wasn't being condescending, nor was I trying to be insulting.
Instead I was simply pointing out t
is facebook the new preferred target for attacks? (Score:1)
seems prime for that.. with the average smart user there having the i.q. of a 90s aol'er.
Anonymous (Score:3, Funny)
We all knew Anonymous would strike again. Why aren't the authorities doing something about these criminals?
Maybe what we need to do is make it so that nobody can access the internet without supplying a sample of their DNA. And then make it so that all communications from the user to the internet are logged in an extremely verbose manner, and have a system of spy networks at the ready to detect subversive behavior. The governments could intentionally put things like porn or questionable books like Fahrenheit 451, 1984, or The Diary of Anne Frank on the internet and then arrest civilians when they try to access them.
I wish I were in a position of power where I could institute a program like that in the United States of America. For too long we have strayed from the Lord's Path, and we need a true leader to bring this country back in the right direction.
Comment removed (Score:5, Insightful)
Re:How many of those where linux pc's again? None (Score:2, Insightful)
Linux isn't some magic bullet that is immune to trojans
repeat after me, Linux is the kernel, Linux is the kernel, Linux is the kernel, Linux is the kernel, Linux is the kernel, Linux is the kernel, Linux is the kernel, Linux is the kernel, Linux is the kernel
as long as whatever happens to be the payload can access user's files and see what the user does and can make network connections that's all it needs
How do you pretend to deliver that payload exactly? Heck, every Linux distribution out there is totally different from the others, they have different, ABIs (elibc, glibc, uclibc), different kernel versions which are also patched differently. They run different window managers and different desktops environ
Re: (Score:3)
People running Linux are also more educated.
Isn't the front line of defense in security a vigilant and knowledgeable userbase, not the OS/kernel? Yeah, yeah, I know, it's a free-ponies-for-all pipe dream.
Re:How many of those where linux pc's again? None (Score:5, Insightful)
How do you pretend to deliver that payload exactly? Heck, every Linux distribution out there is totally different from the others, they have different, ABIs (elibc, glibc, uclibc), different kernel versions which are also patched differently. They run different window managers and different desktops environments. People running Linux are also more educated.
And nearly all will run bash, python and perl scripts. A malicious payload doesn't have to be a compiled binary.
Re: (Score:2)
So yes, that would work, if the user:
1) accepts the download of the malicious trojan.
2) manually sets the executable bit of the file
3) doesn't bother to look at the contents of the -readable- script.
4) manually runs the script.
I run Linux and love it, but even though my view is biased even I have to admit that no system is immune to the dancing pigs problem [wikipedia.org].
Lets say the trojan is a new game on Freshmeat and distributed as an rpm or deb package for Linux and exe install file for Windows. User will happily dpkg the file on their system and that will be the end of that.
You would very easily have a full project on Sourceforge with the code perfectly clean, but have the pre-compiled binaries specially modified. Sure you won't get thos
Re: (Score:3)
It's a simple case of majority-ism. Most facebook users will be on Windows and probably IE, so if you're going to make a trojan, to make your job easy that's who you target.
Security isn't limited to exploits in the scope of a user's OS; it's all about privacy, and messing in their web-identified spaces also counts as a security violation.
Re: (Score:1)
People running Linux are also more educated.
My grandma is running Linux, I wouldn't call here that educated.
Re: (Score:1, Funny)
apt-get install trojan
E: Unable to locate package trojan
Nope, doesn't work.
Re: (Score:2)
Of course it isn't. However, unlike any OS that Microsoft has ever sold, security is part of the basic design, not something that's tacked on later as an afterthought. And, as others have pointed out, Linux isn't a monoculture, the way Windows is. There are only a few versions of Windows out there, all of them, almost without exception, using the same file manager and desktop environment. Most of them use the same email client and office suite, a
Re: (Score:2)
I am sick and tired of this MS FUD. ... why do I keep coming here?
Your bias is based on 10 to 15 year old facts on depreciated or nearly depreciated kernels and apis. I think it is a sign of insecurity to blindly follow something when facts are contrary.
Last week a slashdotter said in a straight face that he is waiting for the first ever unix virus as they do not exist and was gloating. I kindly reminded him where did the term root*kit came from? Root sounds like a Linux account if you ask me.
I have seen fi
Re: (Score:2)
FUD? Are you denying, then, that well over 90% of all the viruses found "in the wild" target MS Windows and that the rest target the Mac OS? Are you claiming that there is, currently, malware out there designed to target Linux? If so, I'd like to know about it because I've never heard of it.
As far as root kits go, you either need to have access to a machine to install one or you need to trick somebody into giving your installer root access, just as you need to get
Re: (Score:1)
Tons of malware target Linux.
SQL injections, *root*kits, and php vulnurabilities all target Linux or the LAMP stack. Linux hosts the servers with the fast pipes and the sensitive credit card data. The Windows PCs serve as the bots to launch the attacks
Rootkit can be installed by an exploit. The whole oh just do not be root and click on shit is 1990s security. All you need to do is exploit php or your sql database and I can get your server to run my code and then install the rootkit to hide it.
Its that out o
Re: (Score:2)
Re: (Score:2)
There is a big difference between a virus or trojan that takes advantage of a flaw in the operating system and one that relies on brute forcing the password to a privileged user account or tricking a user into handing over the password directly.
I support networks for a living, and we also deal with lots of small businesses and residential systems.
The single biggest infection vector on any operating system is third party browser plugins such as flas
Re: (Score:2)
Re: (Score:2)
What I find most interesting, however, is the cross-platform attacks. Please note, that I never said that Linux malware is completely impossible, I said that it's nowhere near as much of a danger to Linux a
Re: (Score:2)
I known it's probably a waste of time arguing with AC, but there's one thing I have to point out: I never said that Linux is invulnerable. I didn't because it's not. It is, however, much better at security than Windows and far, far faster at plugging security holes once they're found. If nothing else, not having to wait for Patch Tuesday to distribute things makes it more efficient. And, I might add, the only FUD in this discussion is the straw-men people like you keep coming
Re: (Score:2)
so it's not security through obscurity, it's security through diversity.
either variant of linux on it's own is not a large enough target.
this is how wild plants survive better than crops...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The OS in question bears no relevance here:
Can you show us any current Linux trojans?
Re: (Score:2)
Re: (Score:2)
Firstly Android while having a Linux kernel does not act like linux, it rose not require a password to install software like you do in Linux this is done by the people implimenting Android because they want it to be easy and in know way intemadating to the users so they make it easy to use at the expense of security. Secondly most of the Android malware are trojan apps that are installed by users trojans are a User security issue not a os security issue. And third Android is based on Java whichever you hear
Re: (Score:2)
Riighterr!!!! Knew so - how's Android (a Linux) doing, security-wise for years now? Torn up!
Actually, no. More of a beat up.
Despite Microsoft attempting to buy scare stories with free phones, malware on Android is rare and generally easily removed.
"Microsoft is offering five Android malware victims a free Windows Phone 7 phone. The catch? You need to share your rage against Android with the Twitterverse."
http://securitywatch.pcmag.com/none/291668-microsoft-offers-free-windows-phones-to-android-malware-victims [pcmag.com]
"Advanced users are already wary of alarmist declarations from security vendors, and though the malware threat for Android is growing, many consider it overblown, especially when compared to Windows and other desktop operating systems".
http://androidcommunity.com/symantec-backs-off-of-android-malware-claims-after-researchers-cry-foul-20120201/ [androidcommunity.com]
security firms that warn of Android malware 'charlatans and scammers'
http://www.zdnet.com/blog/hardware/are-security-firms-that-warn-of-android-malware-charlatans-and-scammers/16412 [zdnet.com]
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
How comical! How comical! APK has already been annihilated. Hillbilly Mutt 20 agrees, and he's an existentialist Armageddon.
How could you possibly delude yourself to such an extreme degree that you believe that someone like APK, who doesn't use the legendary Gamemaker to solve all of his problems, could beat a Gamemaker advocate such as I? The hilarity of such a mindset is simply astounding!
Re: (Score:1)
I know of your true power, APK. I know of it all! I've defeated you time and time again. Don't you dare make me trick into so I can your buttsnap. Don't you dare.
Now fuckin' use Gamemaker instead of your shitty hosts file.
Re: (Score:1)
How comical! How comical! They're all 100% incorrect. Gamemaker reigns supreme. If they were True Puter Experts, like me, they'd be using Gamemaker!
Turn to dust and die now!
Re: (Score:1)
I am one who cannot be defeated by someone like you. You, one who doesn't even use Gamemaker, cannot possibly hope to comprehend my true ferocity!
I'm a buttnude extremist! I have the power! I have the Gamemaker!
You agree with me 100%. That's why you're cowering in the corner and trying to save your public image by saying you're right. But you know otherwise. You know you're 100% wrong.
Re: (Score:1)
A mere clone! Get out of here! You're a mere eyesore!
Gamemaker is the greatest. "Slashdot" and your experts (you) have been utterly annihilated. Now return to Gamemakerdom.
Re: (Score:1)
"I am one who cannot be defeated by someone like you. You, one who doesn't even use Gamemaker, cannot possibly hope to comprehend my true ferocity!
I'm a buttnude extremist! I have the power! I have the Gamemaker!
You agree with me 100%. That's why you're cowering in the corner and trying to save your public image by saying you're right. But you know otherwise. You know you're 100% wrong."
Your ad hominem attacks will never defeat my arguments based in logic.