Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

The Coming Botnet Stock Exchange

Soulskill posted more than 4 years ago | from the where-do-i-go-to-invest dept.

Spam 105

Trailrunner7 writes "Robert Hansen, a security researcher and CEO of SecTheory, has been gleaning intelligence from professional attackers in recent months, having a series of off-the-record conversations with spammers and malicious hackers in an effort to gain insight into their tactics, mindset and motivation. 'He's not the type to hack randomly, he's only interested in targeted attacks with big payouts. Well, the more I thought about it the more I thought that this is a very solvable problem for bad guys. There are already other types of bad guys who do things like spam, steal credentials and DDoS. For that to work they need a botnet with thousands or millions of machines. The chances of a million machine botnet having compromised at least one machine within a target of interest is relatively high.' Hansen's solution to the hacker's problem provides a glimpse into a business model we might see in the not-too-distant future. It's an evolutionary version of the botnet-for-hire or malware-as-a-service model that's taken off in recent years. In Hansen's model, an attacker looking to infiltrate a specific network would not spend weeks throwing resources against machines in that network, looking for a weak spot and potentially raising the suspicion of the company's security team. Instead, he would contact a botmaster and give him a laundry list of the machines or IP addresses he's interested in compromising. If the botmaster already has his hooks into the network, the customer could then buy access directly into the network rather than spending his own time and resources trying to get in."

Sorry! There are no comments related to the filter you selected.

gay niggers 4 life! (-1, Troll)

Anonymous Coward | more than 4 years ago | (#31485100)

Please. have a look [goatse.fr]

Honeypot? (4, Insightful)

dhanson865 (1134161) | more than 4 years ago | (#31485142)

Yeah, interesting concept but the fear would be that the botnet owner would respond by saying knock, knock, the FBI is here (substitute the agency you think applies if the FBI isn't your cup of tea).

If you do something yourself you know all the players. If you pay someone to do it you don't know if you are walking into a trap.

disclaimer: I'm not too worried about this as I don't plan on taking either route.

Re:Honeypot? (3, Interesting)

dch24 (904899) | more than 4 years ago | (#31485320)

Business does require a certain amount of trust, but it's amazing how money talks. For example, the conversation might go like this:

"Uh, I don't trust you but I want to search your botnet. Strictly for research purposes."
"I'm trustworthy. I control such-and-such handle over at such-and-such forum. I'm going to post '(some message)' in 5 minutes -- that proves it. But my botnet is expensive. Can you pay?"
"Yeah, here's a paypal gift to prove I have funds."
"Ok, I'm listening. What do you want?"
(And the negotiation goes on from there.)

This is an Apple-like vertical integration of services (but for botnets). The same guy who has "owned" the hardware offers "other services" on his "platform." I couldn't keep a straight face as I typed that.

I don't really think this is a "stock exchange."

Re:Honeypot? (1)

waspleg (316038) | more than 4 years ago | (#31490402)

this has been done for years, it's just not money that changes hands it's other hacked accounts/access/etc, irc is where i saw it, i'm sure there are other venues as well.

Re:Honeypot? (3, Informative)

Anonymous Coward | more than 4 years ago | (#31485324)

This particular problem already exists - and yet there are online exchanges to buy/swap/sell credit card information, bank account info etc. The risk is sold off - so if a guy has 1000 bank accounts (+pin + atm card number etc) with an average of $10,000 on each of them, he sells it to someone who will actually do the hard work at say $20 per account.

Your argument would be the same at the exchanges too... but they exist and thrive. So, a botnet selling cloud computing power is not far fetched.

Re:Honeypot? (5, Insightful)

fuzzyfuzzyfungus (1223518) | more than 4 years ago | (#31485694)

There is a notable risk for the botnet owner, as well.

If I am a security guy for some entity that I fear may contain compromised systems, and potentially be the target of more focused attacks, I can use this hypothetical "botnet stock exchange" to verify my suspicions. "So, I'm interested in buying access to hosts within OWN_IP_BLOCK, anybody have some?" If no, breath slightly easier. If yes, I now know which of my hosts need serious inspection and rebuilding.

Depending on exactly how the exchange is run, basic checks(ie. botnet or no botnet, not necessarily specific hosts) might well be cheap or even free. You don't have much of a market if people can't ask "Is anybody selling X?" and receive a useful answer. More specific answers would probably cost you, as would the services of the sorts of grey hats who work for white hats but can talk to black hats; but there are certainly circumstances where it could be cost effective.

Re:Honeypot? (1)

QuestionsNotAnswers (723120) | more than 4 years ago | (#31487284)

> I'm interested in buying access to hosts within OWN_IP_BLOCK, anybody have some?

Can this be mitigated? Is it realistic? Will you know how it was compromised?

A primary means black hats use to measure trust for purchases is repeat sales to the same buyer (for differing needs) and maybe some illegal activity e.g. paid via illegal means (to filter out anyone that is constrained to only legal means). Passing those tests is difficult (although possible by professional white-hat-consultants, however white hats want to remain undetected by the black hats so have constraints).

It is also dependent on the price you are willing to pay. Obviously you need to pay the botnet herder more than the sum of: worth of the machine to them, cost of the risk to them due to transaction, cost of sales, their normal profit margin.

If you offer a little, all you will find is bottom feeders and liars - i.e. information value is low.

If you offer a lot, you are giving an incentive to get your network compromised.

Re:Honeypot? (0)

Anonymous Coward | more than 4 years ago | (#31493692)

aren't botnet creators already selling access to their "zombies" ???
I thought this was already happening

Bad title (5, Insightful)

Galestar (1473827) | more than 4 years ago | (#31485148)

How is this a "stock exchange"?

Re:Bad title (3, Funny)

K. S. Kyosuke (729550) | more than 4 years ago | (#31485224)

I guess they are going to set up their office at Firewall Street.

Re:Bad title (5, Funny)

Anonymous Coward | more than 4 years ago | (#31485372)

Both involve trusting your money to less than scrupulous people to do all the work for you in hopes that you'll get back more than you put in with no rational reason to back up this hope.

Actually I take that back. The hackers will at least worry about their reputation.

Re:Bad title (5, Funny)

eviloverlordx (99809) | more than 4 years ago | (#31485778)

Just wait. In a few years, they'll be applying for a bailout, too.

Re:Bad title (0)

Anonymous Coward | more than 4 years ago | (#31485988)

How is this a "stock exchange"?

This would be a case of provisioning global resources, supply and demand just like any other market. Google has done some work in this area.

    Murray Stokely, Jim Winget, Ed Keyes, Carrie Grimes, Benjamin Yolken, Using a Market Economy to Provision Compute Resources Across Planet-wide Clusters, Proceedings for the International Parallel and Distributed Processing Symposium 2009.

    http://www.stokely.org/papers/google-cluster-auctions.pdf

I could easily see a market for this sort of thing. Using a broker you trusted to do the work based on the 'cost' of the target machines.

Re:Bad title (2, Funny)

hatemonger (1671340) | more than 4 years ago | (#31486156)

Agreed. My first thought after reading the title was a large network of machines making microsecond stock purchases and sales with other machines, hoping that its algorithms are good enough to turn a profit. Some senior British official proposed a small fee per stock transaction to prevent that from happening, claiming that it would hurt the "buy and hold" stock purchasers, but I hadn't heard anything for a while. Samsonite? I was way off!

Re:Bad title (1, Interesting)

Anonymous Coward | more than 4 years ago | (#31486730)

It's also just an idea someone put out. There's now evidence it's "Coming". We've all been bitching about fraudulent Slashdot titles for years. I don't think they'll ever stop with the hype.

Re:Bad title (1)

Athanasius (306480) | more than 4 years ago | (#31492284)

Real Stock Exchange:

As best as I understand it that is pretty close to how real stock exchanges work. You don't necessarily sell shares just by saying you want to, someone else has to be prepared to buy them at the price you're asking. Nor can you buy them without someone offering to sell. The stock exchange keeps tracks of these offers and provides a mechanism to resolve them (OK, so there are stock brokers involved too, but this basic concept is how it works).

Botnet/Compromised Host Stock Exchange:

The botnet owner has 'bought' stock in the target machines by compromising them. He can offer to sell for at least a minimum price. The other party to the transaction offers to 'buy' a share of this stock at up to a given price. The 'stock market' resolves these offers by putting the two parties in touch where the buy maximum is at least the sell minimum price.

The ?? (0)

Anonymous Coward | more than 4 years ago | (#31485158)

Finally! Someone has figured out the missing step.

1. Create an idea
2. Implement it
3. Create a botnet for hire!
4. PROFIT!

Re:The ?? (0)

Anonymous Coward | more than 4 years ago | (#31489396)

Hey tard boy, in South Park there was only 3 steps.

Robert Hansen has access (2, Interesting)

BadAnalogyGuy (945258) | more than 4 years ago | (#31485172)

Is SecTheory a harbor for these malicious users? Why does Hansen have such deep contacts?

Another question. (2, Insightful)

khasim (1285) | more than 4 years ago | (#31485276)

He's not the type to hack randomly, he's only interested in targeted attacks with big payouts.

Yeah, whatever. If I was an evil cracker I'd be damn sure to randomly target machines so I could use them for my targeted attacks. And I'd want a lot of them so I could bounce the attack through them to make it more difficult to find me.

If anything, if this guy was such a great cracker/hacker, wouldn't he already know about the percentages? Cracking any single specific machine is difficult. Cracking any random machine in a specific block would be much easier.

Then you'd use that machine (those machines) to more easily target the specific machine.

Re:Another question. (1)

Securityemo (1407943) | more than 4 years ago | (#31488902)

The basic principle of botnet herding obviously involves spamming botnet trojans through whatever vectors available, but it's the utilization of these resources that is discussed. Imagine what havoc a dedicated person could cause through, let's say, insider trading?

How to Pay? (5, Funny)

MrTripps (1306469) | more than 4 years ago | (#31485208)

So you have just hired a bot master. How do you pay them? You know they are dirty hackers, so it isn't like you would just give them your credit card number or Pay Pal account. Maybe the guy just wakes up and finds a crate of Jolt and Hot Pockets on his doorstep.

Re:How to Pay? (1)

Soilworker (795251) | more than 4 years ago | (#31485260)

Obviously those leave traces all over the place, cash only.

Re:How to Pay? (1)

snowraver1 (1052510) | more than 4 years ago | (#31485296)

Western Union. "From anywhere, to anyone".

Re:How to Pay? (1, Informative)

Anonymous Coward | more than 4 years ago | (#31485338)

This is one of those things you learn from RTFAing over the years. They use anonymizing proxies, just like they do for everything else: http://www.wired.com/science/discoveries/news/2006/12/72278

Re:How to Pay? (4, Funny)

v1 (525388) | more than 4 years ago | (#31485508)

I can hook you up with an acquaintance in Nigeria that's very good with money transfers aquaintenance, let me know.

Re:How to Pay? (1)

Aradorn (750787) | more than 4 years ago | (#31485708)

'OK, if I decide to do this, I'm gonna need an unlimited supply of Xena tapes, and Hot Pockets'.

Re:How to Pay? (1)

foldingstock (945985) | more than 4 years ago | (#31486210)

Original line, which was also used in previews/commercials, was: "OK, if I decide to do this, I'm gonna need an unlimited supply of Star Trek tapes, and Hot Pockets."

It was changed to "Xena" for the actual film.

Re:How to Pay? (0)

Anonymous Coward | more than 4 years ago | (#31486760)

How does this guy not have insightful 5 and the douche up there ^^ is a 4?!??

botnet bank (0)

Anonymous Coward | more than 4 years ago | (#31485730)

How do you pay them?

That is easy, you use a botnet bank of course. The difficult question is how to bail them out when the botnet bubble burst.

Re:How to Pay? (1)

slayer_ix (927649) | more than 4 years ago | (#31486718)

Why not just use cash? You know like the classic brief case of greenbacks in a shady area of town.

Re:How to Pay? (3, Informative)

St.Creed (853824) | more than 4 years ago | (#31487062)

That would require physical access to the botnet-master (risky) or knowledge of the physical whereabouts of said person (risky again).

No, I'd much rather set up a paypal account with a fake firm in Tonga, linked to another fake firm on the Cayman Isles. It's apparently impressively difficult to get any information out of Tonga regarding business owners, whatever their background. The same goes for the Cayman Isles. And you could always route it again through Tonga, for double fun. And you wouldn't even have to leave your house. And the best news: there are already providers for it. [offshore-p...sional.com]

Re:How to Pay? (1)

vaguestalker (1685122) | more than 4 years ago | (#31493728)

The site you refer to doesn't seem to even provide a Tonga service. I also notice they pretend to be a country in themselves when marketing their Casino license service. Regretfully this field also has a lot of "black hats" operating within it, not necessarily these guys, yet the indications are there. When shopping for services like that its always better to look at vendors that operate from a slightly better regulated jurisdiction, like for example Cyprus. Here is an example http://www.internetincorporate.com/ [internetincorporate.com] of company formation professionals that are trustworthy. Tread lightly in the murky tax haven shallows.

Re:How to Pay? (0)

Anonymous Coward | more than 4 years ago | (#31487026)

The answer used to be 'egold'. No idea these days. Probably Western Union to some patsy.

Re:How to Pay? (0)

Anonymous Coward | more than 4 years ago | (#31492754)

e-gold, perhaps?

buzzword bingo (1)

Thud457 (234763) | more than 4 years ago | (#31485244)

Cloud Computing FTW!!!

I can't believe we are still discussing this ... (-1, Flamebait)

GNUALMAFUERTE (697061) | more than 4 years ago | (#31485330)

When the solution (and who is responsible for the problem) are so obvious.

The one that should be held responsible for this is microsoft. No, I am not trolling. We are making Toyota responsible for all the incidents, and possible future incidents with their acceleration issues, aren't we? Why not hold microsoft responible for their own products too?

We've known for years that windows is directly responsible for all this security issues. It's an unreliable and insecure system, and the company refuses to patch vulnerabilities.

The solution, is obvious too: use another operating system.

Why do we have to spend so many resources, including government resources that we pay for with our taxes, for something that is a non-issue?

Spending time and money sending the FBI behind spammers because microsoft's software is insecure is at best stupid, and most probably absolutely corrupt.

Be careful what you wish for. (3, Insightful)

khasim (1285) | more than 4 years ago | (#31485418)

Why not hold microsoft responible for their own products too?

And what happens to FOSS developers who accidentally leave a bug in their code?

Re:Be careful what you wish for. (0)

Anonymous Coward | more than 4 years ago | (#31485860)

Why not hold microsoft responible for their own products too?

And what happens to FOSS developers who accidentally leave a bug in their code?

does microsoft also leave those big "YOU ARE USING THIS SOFTWARE AT YOUR OWN RISK!" -notes in clearly visible places in their products too? The difference here would be that in microsoft's case, the customer is paying for a product which microsoft claims to be good. In the case of open source (and other free as in beer) software, the user pays nothing and gets no warranty.

Re:Be careful what you wish for. (1)

Lunix Nutcase (1092239) | more than 4 years ago | (#31489486)

Yes, such a disclaimer of warranty is in the Windows EULA that you agree to when using the product and has been since the beginning.

Re:Be careful what you wish for. (1)

cynyr (703126) | more than 4 years ago | (#31485868)

non commercial product. if it was dual licensed even then the contract could state that the software comes as is.

Re:Be careful what you wish for. (1)

Lunix Nutcase (1092239) | more than 4 years ago | (#31489544)

If it were that simple that one was free of an implied warranty by being non-commercial there would be no point in putting a disclaimer of warranty in the licenses of FOSS software. The issue, though, isn't as clear as you would like it to seem.

Re:Be careful what you wish for. (1)

icebraining (1313345) | more than 4 years ago | (#31485902)

The obligation doesn't come from the product, it comes from the fact they ask you to pay for it.

Re:Be careful what you wish for. (2, Informative)

Lunix Nutcase (1092239) | more than 4 years ago | (#31489436)

Maybe you should read the Windows EULA?

Microsoft and its suppliers provide the Software and support services (if any) AS IS AND WITH ALL FAULTS, and hereby disclaim all other warranties and conditions, whether express, implied or statutory, including, but not limited to, any (if any) implied warranties, duties or conditions of merchantability, of fitness for a particular purpose, of reliability or availability, of accuracy or completeness of responses, of results, of workmanlike effort, of lack of viruses, and of lack of negligence, all with regard to the Software, and the provision of or failure to provide support or other services, information, software, and related content through the Software or otherwise arising out of the use of the Software. ALSO, THERE IS NO WARRANTY OR CONDITION OF TITLE, QUIET ENJOYMENT, QUIET POSSESSION, CORRESPONDENCE TO DESCRIPTION OR NON-INFRINGEMENT WITH REGARD TO THE SOFTWARE.

Re:Be careful what you wish for. (1)

icebraining (1313345) | more than 4 years ago | (#31490542)

Oh, I'm not talking about what it is, I'm talking about what it should be, legally. And EULAs are not above the law. In fact, EULAs (presented after the sale, as in this case) are not even valid in some countries, like Germany.

Re:I can't believe we are still discussing this .. (5, Insightful)

Galestar (1473827) | more than 4 years ago | (#31485434)

You have oversimplified the issue. The root causes are;
1. Windows / [insert other exploitable program here (ie. Flash/Adobe PDF reader)]
2. Stupid users

If your user downloads and runs malware, there's almost nothing your OS can do to stop it. The only way to stop it is to force application signing... but who really wants that?

So tell me, which OS would you choose that could stop all malware even with stupid users?

Re:I can't believe we are still discussing this .. (1)

DCstewieG (824956) | more than 4 years ago | (#31485922)

It would be interesting if enough unsophisticated users who unknowingly run bots decided that something like the iPad is "good enough" for them and they got rid of their PC. I say would be because it's not going to happen.

But to answer your questions, very casual users, and iPhone OS.

Re:I can't believe we are still discussing this .. (1)

cynyr (703126) | more than 4 years ago | (#31485970)

even app signing wouldn't work, it would ahve to be open enough to allow small outfits to produce code, and would need to allow dev to test run their code prior to the app signing. Both of those are holes, whats to stop a hacker from making a legit app and then using the same cert on both it and the malware?

*nix without admin rights, and their home dir mounted no_exec with backup taken every 6 hours, admined by dell/HP/etc. No way to install a new app, and no way to run something from the home dir, problem solved.

Re:I can't believe we are still discussing this .. (1)

Volante3192 (953645) | more than 4 years ago | (#31486404)

*nix without admin rights, and their home dir mounted no_exec with backup taken every 6 hours, admined by dell/HP/etc. No way to install a new app, and no way to run something from the home dir, problem solved.

I guess we need to add the criteria of 'user needs to be productive'.

You can do that in Windows as well, by the way. GPOs and NTFS permissions are wonderful little toys.

Re:I can't believe we are still discussing this .. (0)

Anonymous Coward | more than 4 years ago | (#31492916)

So tell me, which OS would you choose that could stop all malware even with stupid users?

Plan 9, CapROS, or Coyotos. Not all malware, but most. (Assume for the point of the argument that the stupid users would be able to actually use them.)

Windows, albeit AFTER security hardening & use (0)

Anonymous Coward | more than 4 years ago | (#31495542)

"So tell me, which OS would you choose that could stop all malware even with stupid users?" - by Galestar (1473827) on Monday March 15, @01:45PM (#31485434)

Reiterating my subject-line, once more: Windows, albeit AFTER security hardening & user education!

How so? Ok:

----

HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA/Windows 7 (+ make it "fun-to-do" via CIS Tool Guidance & beyond):

http://www.tcmagazine.com/forums/index.php?s=568d95985ad83ef4add94de09f6026d3&showtopic=2662 [tcmagazine.com]

----

It works!

It's based on the concept computer security folks the past few years have been calling "LAYERED SECURITY"...

Proofs to its efficacy?

Ok, some quoted testimonials:

----

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=2 [xtremepccentral.com]

"I recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual." - THRONKA, user of my guide @ XTremePcCentral

AND

"APK, thanks for such a great guide. This would, and should, be an inspiration to such security measures. Also, the pc that has "tweaks": IS STILL GOING! NO PROBLEMS!" - THRONKA, user of my guide @ XTremePcCentral

AND

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=3 [xtremepccentral.com]

"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads. APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, needed system local)" - THRONKA, user of my guide @ XTremePcCentral

AND

http://forums.theplanet.com/index.php?s=80bbbffc22d358de6b01b8450d596746&showtopic=89123&st=60&start=60 [theplanet.com]

"the use of the hosts file has worked for me in many ways. for one it stops ad banners, it helps speed up your computer as well. if you need more proof i am writing to you on a 400 hertz computer and i run with ease. i do not get 200++ viruses and spy ware a month as i use to. now i am lucky if i get 1 or 2 viruses a month. if you want my opinion if you stick to what APK says in his article about securing your computer then you will be safe and should not get any viruses or spy ware, but if you do get hit with viruses and spy ware then it will your own fault. keep up the good fight APK." - Kings Joker, user of my guide @ THE PLANET

----

(Those results are only a SMALL SAMPLING TOO, mind you - I can produce more such results, upon request, from other users & sites online)

Addtionally - Users aren't "stupid" really, just ignorant of HOW/WHEN/WHERE/WHY/WHAT causes their hassles, usually. Still, they can learn... especially after you point out HOW they get infested/infected, & especially when it CO$T$ THEM THEIR MONIES TO REMOVE SAID INFESTATIONS (that teaches ANYONE a lesson pretty much), because when it comes to expenses, ANYONE learns, & pretty fast!

HOWEVER - There's ONLY 1 WEAKNESS TO IT: Human beings, & they not being 'disciplined' about the indiscriminate usage of javascript (the main "harbinger of doom" out there today online), OR, what they download for example... King's Joker above tends to "2nd that motion" (& there is NOTHING I can do about that! Per Dr. Manhattan of "The Watchmen", ala -> "I can change almost anything, but I can't change human nature"). He's written me once WHY he got himself suckered too - pr0n: He hits sites with it that use javascript, & he knows he takes his chances that way. He's gone down from 200++ viruses a month, to MAYBE 1 a month tops... &, when he gets one? He knows (per that guide's "how to remove malware" section) how to get rid of them, himself now, too.

He's FAR from a "Computer Expert" too... just an ordinary guy! Still, he's proof that ANYONE can learn how to manage a PC & NOT get infested, & IF they do? They can be shown HOW to "burn out" infectors, themselves, & easily as well!

APK

P.S.-> That's the "latest iteration" of my guide for Windows users & to show them how to "security-harden" a system running Windows. I wrote it (and ones far earlier than it years before, circa 1998-2002, @ NTCompatible.com -> http://web.archive.org/web/20010405012842/www.ntcompatible.com/article1.shtml [archive.org] [archive.org] which was later "picked up on" by NEOWIN & rated well -> http://www.neowin.net/news/main/01/11/29/apk-a-to-z-internet-speedup--security-text [neowin.net] [neowin.net] after they spotted where the original article @ NTCompatible.com spawned the current one above (top most URL in this post) grew from evolved out of)... & all I know is, it works (no infestations here, for decades now, because I "got wise" to how botmasters/hackers-cracker/malware-makers in general think & work... & I decided to spread that around to others, especially less "tech saavy" others (across 15 forums online, & so far, to the tune of over 300,000++ views worldwide since 2008 on this version of said security guide for Windows users)... apk

Re:I can't believe we are still discussing this .. (0)

Anonymous Coward | more than 4 years ago | (#31485492)

Come off the "I am not trolling" bullshit. Everything you post is a troll designed to discredit the beliefs you appear to be promoting.

At least that's what I hope, because you do more damage to the Free Software movement with your posts than any positive effects you may have had.

Re:I can't believe we are still discussing this .. (1)

NoSleepDemon (1521253) | more than 4 years ago | (#31485514)

Windows is no more secure than Linux, or whatever hippie OS you're into. Any OS as popular as Windows is going to get the crap hacked out of it, the only reason Linux (assuming you're into that, but substitute it for whatever you like) is 'more secure' is because your grandmother doesn't open .exe attachments on it.

Re:I can't believe we are still discussing this .. (0)

Anonymous Coward | more than 4 years ago | (#31486308)

Linux is more secure because things from the internet don't just open and run automatically. On windows, to own the machine is simple, deliver an exploit and execute it. Grandma Linux user might click the exe attachment and get it downloaded and delivered, but you're not going to trick her into going into a shell, set the x bit(s) so it can run and then running it. Has not at all to do with how many machines there are, its simple fact that running an exploit on Windows is low hanging fruit and its easy -- not a thing at all to do with Windows being popular.

Until the day that Windows gets a proper package manager like a Linux distro has, there will be no end to the Windows malware infestations.

Windows users install software by visting some website, thinking something looks cool and downloading it - a couple of yes clicks later and a new zombie joins a botnet.

Linux users install software by checking a repository where its downloaded from a trusted source. While its certainly possible to visit a website and download, install, something on a Linux machine as well, thats made much less likely because anyone without the knowledge to do that will just get something from the package manager.

Doesn't matter if there are 10x more windows, it would be just as true if there were 10x as many hippy os machines

Simple fact of the matter is windows software deployment model is severly flawed. It needs a package manager with some basic white-lists like a Linux distro has. Add that to windows and then make it so that something from the internet doesn't just run when you click on it because it ends in .exe and Window's security might get somewhere. And another dialog box to click "yes" or "install" on doesn't help.

Re:I can't believe we are still discussing this .. (0)

Anonymous Coward | more than 4 years ago | (#31487728)

Sorry, but you're wrong, and your superficial understanding of how operating systems work and how they are exploited is why.

The repository model would not scale to the level that Windows exists in. The users would not put up with it.

Non-execute bits are nothing but an annoyance in Linux - so much that modern DEs have dozens of ways to get around it.

Exploits (buffer overflow + shellcode) are just as possible in Linux as they are in Windows.

Repeat after me: NOBODY. GIVES. A. SHIT. ABOUT. YOUR. HIPPY. OS.

Re:I can't believe we are still discussing this .. (1)

icebraining (1313345) | more than 4 years ago | (#31490606)

The repository model would not scale to the level that Windows exists in. The users would not put up with it.

Why?

Re:I can't believe we are still discussing this .. (0)

Anonymous Coward | more than 4 years ago | (#31487020)

Windows is no more secure than Linux, or whatever hippie OS you're into. Any OS as popular as Windows is going to get the crap hacked out of it, the only reason Linux (assuming you're into that, but substitute it for whatever you like) is 'more secure' is because your grandmother doesn't open .exe attachments on it.

So why does windows 7 need a virus scanner????

Re:I can't believe we are still discussing this .. (0)

Anonymous Coward | more than 4 years ago | (#31487970)

Because grandma opens .exe attachments from her email, facebook, and other random places on the interwebs.

Re:I can't believe we are still discussing this .. (1)

Volante3192 (953645) | more than 4 years ago | (#31485608)

The solution, is obvious too: use another operating system.

And when the windows l^Husers switch to another operating system and want to see their dancing bunnies, then what?

Re:I can't believe we are still discussing this .. (1)

socsoc (1116769) | more than 4 years ago | (#31487198)

I'd be up for disconnecting them from the matrix.

Re:I can't believe we are still discussing this .. (1)

atomic777 (860023) | more than 4 years ago | (#31485910)

It's not quite that simple. Proving that a product as complex as a consumer-level GUI operating system is bug-free and secure is in general an undecideable problem.

We can't even prove that our critical, lower-level embedded software (aerospace, health-related, etc) is bug-free, and this is why there is substantially more effort put into ensuring that such software is of high quality. For example there are extensive regulations [wikipedia.org] on how exhaustively testing must be done on various components of an aviation-related piece of software, depending on its criticality

Try enforcing something like this on Windows, and even monopolistic Microsoft's fabled profit margins would disappear -- it would be the push that crowd-sourced OSS software would need to acheive a real foothold in the desktop market.

Re:I can't believe we are still discussing this .. (1)

mrsurb (1484303) | more than 4 years ago | (#31491586)

We can't even prove that our critical, lower-level embedded software (aerospace, health-related, etc) is bug-free

Car braking software...

Re:I can't believe we are still discussing this .. (0)

Anonymous Coward | more than 4 years ago | (#31486644)

So if someone who owns a Toyota runs someone else over with malice we should sue Toyota and let the driver go? Get a fucking clue, you troll.

Re:I can't believe we are still discussing this .. (1)

Lunix Nutcase (1092239) | more than 4 years ago | (#31489464)

We are making Toyota responsible for all the incidents, and possible future incidents with their acceleration issues, aren't we? Why not hold microsoft responible for their own products too?

You mean other than the fact that the EULA you agree to when using Windows says that Microsoft disclaims all warranties and Toyota has no such contractual agreement with purchasers of their car? And before you go on about being able to ignore that and claiming EULAs are unenforceable (which is a common slashdot meme but it is wrong) then you would have to say that any such disclaimers in FOSS software would be null and void too thus opening them up to being held responsible for any bugs in their software.

Survey (1)

ardeez (1614603) | more than 4 years ago | (#31485470)

Can somebody do a survey of all of these infected machines and check what OS
version they're running?

If there's a growing number of Vista and Win 7 machines then someone should
get back to MS and let them know whatever they're doing ain't working.

With all of these security initiatives I'd have thought botnets would have been a shrinking
problem - not something that was a growth industry as this article seems to indicate.

Re:Survey (2, Insightful)

Volante3192 (953645) | more than 4 years ago | (#31485654)

If there's a growing number of Vista and Win 7 machines then someone should
get back to MS and let them know whatever they're doing ain't working.

OS gains popularity, users on said OS want to see their dancing bunnies.

An operating system is only as secure as the user behind it. I'd guarentee most of the people around here could run a secure, stable Windows system AND be productive on it. But these are the same people who know to surf with adblock, noscript, a firewall and NOT go looking for dancing bunnies.

Re:Survey (2, Insightful)

Agarax (864558) | more than 4 years ago | (#31491074)

The problem isn't Windows, it's users that are willing to run free-porn.exe that is linked in facebook/email/whatever.

Any operating system is only as secure as the user operating it.

A properly configured Windows 7 machine with a solid antivirus, firewall, and a user who paid attention during 15-20 minutes of information assurance training would be a real bitch to exploit.

Why not use a botnet (1, Interesting)

linzeal (197905) | more than 4 years ago | (#31485576)

To trade stocks in the first place? Buy some penny stocks/junk bonds whatever and get/steal/buy enough logins to various brokerages than just pump the price at an opportune time, take the money and run.

Why not use (1, Insightful)

Anonymous Coward | more than 4 years ago | (#31485960)

the comment field for your comment and the subject line for your subject?

Re:Why not use a botnet (1)

zero0ne (1309517) | more than 4 years ago | (#31486380)

My guess is that the organized cartels are already doing this.

Except that the second you cash out and it is discovered that the stock was inflated by 100,000 hacked e-trade accounts, you are the number one suspect.

Re:Why not use a botnet (1, Insightful)

Anonymous Coward | more than 4 years ago | (#31486438)

Sadly the latency would make then uncompetitive against Wall Street. They already have bots doing trading. [nytimes.com]

Besides, do you seriously think you can out-crook the financial sector? These are people that can literally sell you nothing for a billion dollars and get away with it.

Re:Why not use a botnet (2, Interesting)

Danimoth (852665) | more than 4 years ago | (#31487094)

This happens on a rather frequent basis. I work on a trading desk which sees some retail customer order flow. Every now and then fraudulent pump and dump stocks come to our attention. Its usually not too hard to figure out that some order for 5x the average daily volume in a penny stock is fraudulent. Not to hard to track down the customer to give them a call and find out that they had no idea their account was broken into. A much more effective way is to send the orders a few hundred or thousand shares at a time and have them auto executed by a machine. Usually they trace the attacks back to Eastern Bloc countries. I know Hungry was pretty popular last year.

Re:Why not use a botnet (0)

Anonymous Coward | more than 4 years ago | (#31495034)

I know Hungry was pretty popular last year.

10 million citizens would like a word with you.

Fun fact: According to Wikipedia, the population has decreased since 2001.

Penny stocks? Bah! (1)

SlappyBastard (961143) | more than 4 years ago | (#31488856)

It's already being done on fractions of a cent in arbitrage between the closes and opens of various stock and currency markets. All legitimate trades, mind you.

Go back and look at the Societe Generale incident from 2008. And that guy was just working with Excel macros!!

crime (1, Informative)

Max_W (812974) | more than 4 years ago | (#31485634)

I've been spending more and more time talking to blackhats lately. Frankly, I think they're fascinating people

They are criminals who steal from people. Fascinating people? How sick.

Glamorizing thieves and moral creeps is sending a wrong message especially to young people. If it were up to me I would lock this Robert Hansen into a jail together with his "blackhats" thieves and thrown away the key. This is where he and they belong.

Re:crime (1)

Volante3192 (953645) | more than 4 years ago | (#31485688)

"Mister Spock, you misunderstand us. We can be against him and admire him all at the same time."
"Illogical."
"Totally."

--Space Seed

Re:crime (2, Insightful)

icebraining (1313345) | more than 4 years ago | (#31485770)

Be sure to lock up all those teachers who make children's plays based on Robin Hood.

Re:crime (1, Insightful)

Anonymous Coward | more than 4 years ago | (#31485894)

It is counter-productive for a security researcher to not be fascinated by these people. Your moralizing the issue only holds back any meaningful gathering of knowledge that can be used to mitigate the harm that blackhat hackers can cause to legitimate people. There is a time and place for us to objectively learn more about their culture, technology, and economy for our own well being.

Re:crime (1, Insightful)

azmodean+1 (1328653) | more than 4 years ago | (#31485904)

Probably a troll, but I'll bite.

1. Regardless of your knee-jerk reaction to being interested in how "bad people" think, they ARE fascinating, and often very fruitful to study.
2. Assuming you didn't RTFA, I don't see anywhere where he glamorizes black hats.
3. This is akin to a cop going undercover to find out how criminals operate, you think they should be tossed in jail too?

Security research REQUIRES you to think like the "bad guys", it just comes with the territory.

Re:crime (2, Insightful)

Max_W (812974) | more than 4 years ago | (#31486524)

a cop going undercover to find out how criminals operate

This is a cop, who has an official, documented undercover task, but this man is a civilian associating with criminals on his own will. It is his duty to report the crime in progress.

Otherwise any gang member could say: "I am a sociologist. I was studying the way murderers and thieves operate and think. This is why I was on the crime scene."

Probably you are lucky and were not a victim of these bot-nets and trojans' writers. But these are just about the same crime tools as picklock, gun, ax, etc. And these people are robbers, who just use some other tools.

Your fascination with them is unjustified. It is like a person, who likes to knit, would be fascinated by a criminal, who, say, strangle people by a cord.

One can well be a good talented programmer and not be fascinated by moral freaks, who use programming to commit crime.

Re:crime (1)

archangel9 (1499897) | more than 4 years ago | (#31486962)

How in the world can you try and objectify others' fascination?

One can well be a good talented programmer and be fascinated by pretty much anything.

Re:crime (0)

Anonymous Coward | more than 4 years ago | (#31487296)

(...) but this man is a civilian associating with criminals on his own will. It is his duty to report the crime in progress.

In the United States of America, one is not obligated to report crimes except for a limited number of jurisdictions that require the reporting of violent crimes or crimes against minors.

Re:crime (0)

Anonymous Coward | more than 4 years ago | (#31488946)

In Soviet Russia crime reports you!

Re:crime (1)

azmodean+1 (1328653) | more than 4 years ago | (#31487888)

a cop going undercover to find out how criminals operate

This is a cop, who has an official, documented undercover task, but this man is a civilian associating with criminals on his own will. It is his duty to report the crime in progress.

Otherwise any gang member could say: "I am a sociologist. I was studying the way murderers and thieves operate and think. This is why I was on the crime scene."

Where does Hansen say he was "present at the crime scene"? I assume his contacts didn't give him any incriminating details, so what crimes in progress does he have a duty to report? If he did participate in any crimes, then he is obviously culpable. Otherwise it is a similar situation to a reporter interviewing a criminal, though again a security researcher is lacking the special protections reporters get for that sort of thing.

Probably you are lucky and were not a victim of these bot-nets and trojans' writers. But these are just about the same crime tools as picklock, gun, ax, etc. And these people are robbers, who just use some other tools.

No, I've had systems compromised quite a few times before I knew any better, and had to clean up after many people who have had their systems compromised as well. Although if you mean I haven't been a "serious victim" I guess you are correct, though that wouldn't change my attitude about it. Not studying the problem is a sure-fire way to remain vulnerable to it.

Your fascination with them is unjustified. It is like a person, who likes to knit, would be fascinated by a criminal, who, say, strangle people by a cord.

Let's see, my wife, who happens to knit, IS fascinated by forensic investigation documentaries, partially for the forensic part, but partially for the pathology of the criminal involved. I guess it runs in the family ;)

But seriously, my point here is that interest does not equate with belief. Just because someone studies criminals (of any kind, I don't make a distinction between "regular" thieves and botnet operators) it doesn't mean that they approve of the crime.

One can well be a good talented programmer and not be fascinated by moral freaks, who use programming to commit crime.

Definitely, but I'm skeptical how good a security researcher you can be without being at least a little interested.

Re:crime (0)

Max_W (812974) | more than 4 years ago | (#31488978)

I've had systems compromised quite a few times before I knew any better, and had to clean up after many people who have had their systems compromised as well. Although if you mean I haven't been a "serious victim" I guess you are correct, though that wouldn't change my attitude about it. Not studying the problem is a sure-fire way to remain vulnerable to it.

Security technology alone cannot protect against this crime, the same way as a helmet and bullet-resistant vest cannot protect by itself, the same as a steel reinforced door cannot protect by itself.

The law enforcement and our rejection of this type of criminal behavior are necessary too. These people are not Robin Hoods, they are thieves, who steal from families and destroy companies. And it is a pity that a "security professional" associates with them.

There is a difference with a journalist interviewing a criminal for newspaper, because the criminal is in prison. And these people, whom author describes with fascination as "black hats" are in the middle of committing crime, which may as well involve minors and violence, for all I know.

Re:crime (1)

Securityemo (1407943) | more than 4 years ago | (#31488596)

I find your moral reasoning lacking. What, you think that he'l "turn to the dark side"? That professional mercenary botnet/malware distributors actually care about "professional admiration" and will up their ante because of it? What is it that makes fascination with evil/amoral people inherently "wrong"?

Re:crime (1)

Securityemo (1407943) | more than 4 years ago | (#31488982)

"The head of the Department of Post-Mortem Communications shrugged and sighed. ‘Look,’ he said, as if weary of having to explain so often, and sighed again. ‘I am supposed to be the bad person as defined by university statute, right? I am supposed to listen at doors. Supposed to dabble in the black arts. I’ve got the skull ring. I’ve got the staff with the silver skull on it—’ ‘And a joke-shop mask?’ said Glenda. ‘Quite serviceable as a matter of fact,’ said Hix, haughtily. ‘Rather more frightening than the original thing and washable, which is always a consideration in this department. Anyway, the Archchancellor was down here weeks ago, after the same stuff you are, I very much imagine.’"

Re:crime (1)

hoelk (1537469) | more than 4 years ago | (#31493316)

Your fascination with them is unjustified. It is like a person, who likes to knit, would be fascinated by a criminal, who, say, strangle people by a cord.

it's more like if you like to knit, and is fascinated by someone who knits mind-controlling socks and gets millions of people to wear them on a day-by-day basis without them noticing it.

false equivalency (1)

Medievalist (16032) | more than 4 years ago | (#31494364)

But these are just about the same crime tools as picklock, gun, ax, etc. And these people are robbers, who just use some other tools.

Whoa, whoa, hold on there a minute!

The botnet is "just about the same" as a stolen gun, a stolen axe, stolen lockpicks, etc. Generic tools have no inherent moral dimension; lockpicks can be used to save a baby locked in a burning building, an axe can be used to build a house for a homeless person, a gun can be used to defend against criminals or to hunt for food.

A tool only has the moral dimensions the tool user imposes upon it by the circumstances of its creation, ownership and use.

The botnets are created from unwillingly compelled zombies; they exist as a continuous theft of resources from the zombie owners. Therefore they are not "just about the same" as my gun, my axe, or a set of lock picks.

Re:false equivalency (1)

Max_W (812974) | more than 4 years ago | (#31495336)

Good point. I agree with you that it is a continuous theft.

Re:crime (0)

Anonymous Coward | more than 4 years ago | (#31487492)

Haha, thought crime? You moron.

Re:crime (1)

Securityemo (1407943) | more than 4 years ago | (#31488824)

Look, I hate to break it to you - "security researchers" are basically crackers with morals who, for obvious reasons, would like to live in civilized society without being ostracized. A lot of "them" go "a tad bit" neurotic because of the inherent contradictions in this, but that's how it is. And if you're incapable of feeling more than one emotion towards a thing, concept or person, you're severely emotionally underdeveloped.

i shit on you fagggots (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#31485690)

eat my nuts. faggots.

Hansen's model? (2, Insightful)

Ironhandx (1762146) | more than 4 years ago | (#31485966)

He's reposting word for word what happens on a daily basis and its his model? Is anyone else slightly confused by this?

Though TFA does at least mention "This model makes sense on a number of levels and may well have been implemented already."

Theres even underground exchanges between the various botnet holders to some extent. If botnet controller A does not have enough(or any) compromised machines related to a target in one of his customers shopping lists he'll go to botnet controller B, C, or d-z in order to find what he needs. Obviously they don't trust each other much but there is some level of cooperation.

Even targeted hacks will often try the same methods as used to spread botnets in the first place, if you're in that line of business and there are somewhat reliable sources of compromised machines out there that will get you what you need faster and thus a) reduce your own work load and headaches and b) end up with a happier customer for a prompt job completion. (aka they'll think you're the shit and come back again if they need something else, every business out there, legal or otherwise, needs return customers)

Come on, these guys are doing highly illegal, highly technical, very high problem solving ability oriented tasks for a living. You think they haven't been doing this for, oh, over a decade now? Thats about how dated my information is... I think its a safe bet to assume its still going on.

Re: (0)

Anonymous Coward | more than 4 years ago | (#31486198)

Another uninspiring Hansen/RSnake media attention whoring article.

Nothing new here whatsoever - people willing to pay to gain access to networks/information.

I can already see the ticker (1)

g0bshiTe (596213) | more than 4 years ago | (#31487154)

HX Stocks rose today, as they aquired Zues.

That's the shittiest business model EVER! (0)

SlappyBastard (961143) | more than 4 years ago | (#31488802)

All wealth is created in arbitrage. All wealth arises in the differences between what I know, what I can do, what I want to do and what you know, what you can do and what you want to do. If you hand over your target information, you've closed the gap so much that profit will disappear altogether -- especially if the botnet owner involved figures out what he can gain from the target.

Re:That's the shittiest business model EVER! (1, Insightful)

Anonymous Coward | more than 4 years ago | (#31489352)

SlappyBastard wrote:

All wealth is created in arbitrage.

That's absolute nonsense (unless you're going to use a definition of 'wealth' gamed to mean 'something created in arbitrage'). It's easily proved wrong by simple thought experiments. If I make a chair, I am wealthier by one chair. It doesn't matter whether or not anyone else is willing to pay for the chair. You may be able to argue that if I need something I can't make for myself that the financial system I have to rely on to get has arbitrage as an integral component. I might have to agree with that simply because barter of goods and professional services is taxable by the IRS, but the IRS will only accept money, not goods and services to pay the subsequent taxes.

Reality check (1)

darku (1518879) | more than 4 years ago | (#31490090)

The concept seems sound and trades are not uncommon in the cracker world but this is not the problem. - "How do you know that your system is secure?" - "Aaaa, I have an antivirus and broadband router that is handling my Internet connection. That should keep me safe" - "Ok. And why are there all those ports opened on your router?" - "Well, I'm forwarding everything through it in order to be able to play _______" (Insert game name here) - "I see. Ok." An antivirus and a firewall will not help you if you are stupid enough to open the latest XXX e-mail that knocks on the door of your never-updated Outlook Express or if your password is 123456.

My new BotNet... (1)

MasterOfGoingFaster (922862) | more than 4 years ago | (#31493566)

Hey, I just launched a new BotNet on 127.0.0.1 so if anyone wants to
****** CARRIER LOST *******

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?