Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

FBI Takes Out $14M DNS Malware Operation

samzenpus posted more than 2 years ago | from the take-em-down dept.

Networking 57

coondoggie writes "U.S. law enforcement today said it had smashed what it called a massive, sophisticated Internet fraud scheme that injected malware in more than four million computers in over 100 countries while generating $14 million in illegitimate income. Of the computers infected with malware, at least 500,000 were in the United States, including computers belonging to U.S. government agencies, such as NASA."

cancel ×

57 comments

Last Post (3, Funny)

Anonymous Coward | more than 2 years ago | (#38005868)

Posted from one of the bots.

Your PC was worth $3.50 to the botnet (1)

billstewart (78916) | more than 2 years ago | (#38007056)

Congratulations! The Botnet operators thought $3.50 (for them) was worth more than (probability you noticed a problem) * (all the effort and money it would take you to fix it.) Of course, if you're a typical botnet zombie host, the effort and cost were $0, plus a bit extra because your PC is running slower, but hey, you had lots of bogomips to spare.

That's worth $3.49 more than your geek card:) (1)

EETech1 (1179269) | more than 2 years ago | (#38009160)

Don't you have to be running Linux to have BogoMIPS?

Wouldn't these machines likely be running a different operating system?

Cheers

Re:That's worth $3.49 more than your geek card:) (1)

ewanm89 (1052822) | more than 2 years ago | (#38011696)

Well, as BogoMIPS is a benchmark of processor cycles then yes and no, one still has those cycles on any OS. They just would only get measured in that specific unit if on linux.

Re:That's worth $3.49 more than your geek card:) (1)

EETech1 (1179269) | more than 2 years ago | (#38016638)

Well wouldn't ya know it...
djwong.org/programs/bogomips/
Someone did a Windows port!

I stand corrected, my joke was not funny, or technically correct.

Cheers!

Re:That's worth $3.49 more than your geek card:) (1)

billstewart (78916) | more than 2 years ago | (#38039668)

BogoMIPS is a measure of hardware performance. True, it's a benchmark mainly used by Linux, as opposed to WinBench or FPS-with-some-game, but that doesn't matter; we're not talking about the botnets exploiting a bug in the benchmarking program to get it to do work for them :-) But they're the current benchmark; I've also used machines during the years when we benchmarked in SPECints, in Dhrystones and Whetstones, and in MIPS, and before that (since "1 MIPS" was canonically the speed of a VAX 11/780, and I'd used a couple generations of PDP-11s, IBM mainframes, HP minicomputers, IBM System 34, and an IBM 403 whose speed was probably best measured in punch cards processed per hour), though these days I'm generally more interested in benchmarks like megabits/gigabits per second or packets per second, and in real Mbps vs. vendor-claimed Mbps.

Nice job Feds. Credit when credit is due. (4, Insightful)

bazmail (764941) | more than 2 years ago | (#38005900)

Sometimes you just gotta hand it to 'em

Re:Nice job Feds. Credit when credit is due. (4, Funny)

houstonbofh (602064) | more than 2 years ago | (#38005962)

Sometimes you just gotta hand it to 'em

Other times, they just take it... :)

Re:Nice job Feds. Credit when credit is due. (2)

AHuxley (892839) | more than 2 years ago | (#38006762)

$378.4bn into "dollar accounts" you get a $110m "forfeiture" i.e. 2% of your bank's $12.3bn profit.
http://www.guardian.co.uk/world/2011/apr/03/us-bank-mexico-drug-gangs [guardian.co.uk]
So strange how different parts of the US gov can find the cash and time to hunt cyber millions but fail to get a court to understand drug billions....

Re:Nice job Feds. Credit when credit is due. (0)

Anonymous Coward | more than 2 years ago | (#38045390)

"at least 500,000 were in the United States, including computers belonging to U.S. government agencies, such as NASA."

An ounce of prevention is worth a pound of cure.

And allowing this many infections to develop at once in the first place is perhaps a travesty in itself. These things should be taken care of quickly instead of waiting for infected machines to accumulate to huge numbers before doing anything about it.

Operating systems stats? (2)

agm (467017) | more than 2 years ago | (#38005922)

It would be interesting to see the breakdown of the operating systems the infected computers were running.

Re:Operating systems stats? (0, Insightful)

Anonymous Coward | more than 2 years ago | (#38005966)

windows: 100%
other: 0%

Re:Operating systems stats? (2)

nepka (2501324) | more than 2 years ago | (#38008044)

Sorry, but if you read TFA it says it affected OSX too.

Re:Operating systems stats? (1)

buglista (1967502) | more than 2 years ago | (#38012072)

they tried a Linux version but Network Manager kept on rewriting /etc/resolv.conf.

Re:Operating systems stats? (0)

turbidostato (878842) | more than 2 years ago | (#38005968)

I don't think I'd be surprised at the results.

Re:Operating systems stats? (1)

Jeng (926980) | more than 2 years ago | (#38006028)

Why do you say it would be interesting?

The answer is such a given that your question is actually rhetorical.

Re:Operating systems stats? (2)

Baloroth (2370816) | more than 2 years ago | (#38006086)

Link looks bad, I know. [dnschanger.com] (pretty sure it's clean) That is an advisory for the malware in question (DNSChanger) affecting mac OSX.... so no, it isn't rhetorical. The time of Windows being the only possible infected system is past. Probably thanks to Apple's meteoric rise in popularity.

Re:Operating systems stats? (1)

GNious (953874) | more than 2 years ago | (#38009810)

Nothing like this on the App Store ....

Re:Operating systems stats? (4, Informative)

Baloroth (2370816) | more than 2 years ago | (#38006044)

The FBI info PDF on the malware ( DNSChanger [fbi.gov] ) lists instructions for checking OSX to see if you're infected. It also mentions the malware changes router settings if they are still at defaults. I'm guessing it infects Windows and Mac, with Linux/FreeBSD/Hurd being unaffected as per usual.

Re:Operating systems stats? (0)

Anonymous Coward | more than 2 years ago | (#38008234)

Hurd. Heh. You say that like it's real.

Windows+Router attack, not OSX (0)

Anonymous Coward | more than 2 years ago | (#38008646)

I read the link but it didn't mention OSX.

Let me guess, a Windows turfer? Because you misled people into thinking it was OSX, and added 'Linux' compliment on to get votes.

Re:Windows+Router attack, not OSX (2)

elp (45629) | more than 2 years ago | (#38009860)

I read the link but it didn't mention OSX.

Let me guess, a Windows turfer? Because you misled people into thinking it was OSX, and added 'Linux' compliment on to get votes.

Instructions for apple are on page 4 half way down. Did you fail reading in high school?

Re:Operating systems stats? (1)

Wolfrider (856) | more than 2 years ago | (#38014428)

--All of my browsing goes through a Linux-based Squid proxy with its own DNS settings, so I'm not really worried. Check it out, it's free:

http://communities.vmware.com/message/1828477#1828477 [vmware.com]

Re:Operating systems stats? (0)

Anonymous Coward | more than 2 years ago | (#38028920)

The few Mac issues in the wild all come from Linux.

Re:Operating systems stats? (2)

gsgriffin (1195771) | more than 2 years ago | (#38006198)

This doesn't have to be an OS thing. Look into MiM and MitB and you'll see that it is now browser based.

Socializing the externalities (1)

bill_mcgonigle (4333) | more than 2 years ago | (#38006370)

It would be interesting to see the breakdown of the operating systems the infected computers were running.

Ah, we're all about socializing the externalities for the corporations these days. How much of this bill do you think Microsoft will pick up? How about 'none' so they have no real incentive to secure their products?

Heck, it justifies a larger FBI, so they'll probably give them a metal for being so cooperative.

Re:Socializing the externalities (1)

Anonymous Coward | more than 2 years ago | (#38006712)

they'll probably give them a metal for being so cooperative.

I'd like to give Microsoft a small amount of lead, not very much, but I'd like to do it as fast as possible. About 680 MPH fast. ;)

Re:Socializing the externalities (0)

Anonymous Coward | more than 2 years ago | (#38006844)

None because it's not their fault that hackers broke into their OS and did illegal shit. Are you suggesting that we sue every single Linux contributor when there's an exploit out in the wild? Fuck off.

Re:Socializing the externalities (1)

scarboni888 (1122993) | more than 2 years ago | (#38007428)

Difference here being the Linux contributors aren't making you pay for their software, right?

So it's not really a fair comparison IMO

Re:Socializing the externalities (1)

Raenex (947668) | more than 2 years ago | (#38007756)

Then sue companies like Red Hat. I'm sure the folks here would be OK with that, right?

Re:Operating systems stats? (0)

Anonymous Coward | more than 2 years ago | (#38012700)

Linux fanboy?
Or Apple?

The answer to your question should be pretty obvious, even without a flashy chart classifying infection by OS.

OH, and BTW...
Watch out - they're beginning to target Macs now, as well...
And Linux? Well, most of us know the first rootkit was developed for Unix. And with the sloppily-maintained codebases for most Linux distros, these clowns could have a heyday digging up vulnerabilities. And exploiting them. Windows rootkits really haven't been around all that long. I can still remember when GMER surfaced - and was the *only* anti-rootkit util for Win32.

Times change....

The guy with the biggest share will ALWAYS get targeted more. A bigger target is easier to hit (or defraud, I should say, in this case).

It was those faggot muslims! (-1)

Anonymous Coward | more than 2 years ago | (#38005996)

Fuck Moohammad! Fuck Allah! FUCK ISLAM!!!!!!
 
~()):) picture of Moohammad the child molester with a bomb in his turban.
 
Muslims are dirty fucking cunts and pigs. The sooner Islam is destroyed the better off we'll all be. Fuck you Muslim!

4 million? MASSIVE?!? (3, Interesting)

ackthpt (218170) | more than 2 years ago | (#38006042)

That's like claiming the interception of one bale of weed at the Mexican Border is a Major Interdiction.

Still, glad they're doing something. Every little bit helps.

Re:4 million? MASSIVE?!? (0)

Anonymous Coward | more than 2 years ago | (#38006554)

Minor difference:

American citizens want weed.

Malware.. Not so much.

Re:4 million? MASSIVE?!? (0)

Anonymous Coward | more than 2 years ago | (#38007784)

Lets point those 4 million at your ipaddress and let you tell us how massive a DOS that would be.

FBI stops DNS poisoning scheme (4, Funny)

Compaqt (1758360) | more than 2 years ago | (#38006098)

The FBI managed to stop MAFIAA from passing PROTECT-IP?

easier to kick infested machines off? (0)

Anonymous Coward | more than 2 years ago | (#38006200)

Remember the UDP days? If you'd spam usenet, you'd be cut off. It was not determined by content, just by volume.

We need something similar for virus infections. If your machine gets pwned, and any external signs of that can be detected, you are immediately cut off the internet. No distinction: you can be a housewife, a bank, a government agency, whatever. Doesn't matter: you put an infected machine on the internet, and your connection is disabled until you have clearly demonstrated that you have fixed the problem. After your third strike, you ALSO have to demonstrate that you have taken reasonable action to stop having this problem in the future.

Because goddamn it, it just *isn't that bloody hard*. Seriously. Computers are a core part of modern life. It's possible to run a safe Windows machine, although it takes more knowledge than it does for iOS or Linux say. If you don't have that knowledge, either (A) pay someone else to manage it for you, (B) learn, (C) pick a more secure OS that's easier to avoid malware, or (D) stop using the public internet.

We don't let drivers that crash their vehicles all the time drive on public roads. Time to institute this for the internet. We've had personal computing for 40-odd years now. It's really long past time to learn how the hell to secure your box. There is NO security, no anti-virus program, *nothing*, that can make up for ignorant people. So the only solution is at a social level: we must institute penalties for ignorance. Only that way will the average dude get off his ass and learn not to run HotGirlsNaked.exe. Otherwise, there is nothing in it for him, and there IS NO technical solution to human stupidity. The reason that average dude can sorta-kinda drive without plowing into things left and right is because there is a severe penalty for him if he causes damage to the public or public resources with his car. The internet is a public resource. To avoid the tragedy of the commons, there MUST be a penalty for abusing it.

Re:easier to kick infested machines off? (1)

bill_mcgonigle (4333) | more than 2 years ago | (#38006420)

you put an infected machine on the internet, and your connection is disabled until you have clearly demonstrated that you have fixed the problem.

I used to advocate a messaging system whereby _anybody_ could send a (PGP) signed 'disable' message to an IP address to get the machine turned off at the router. Whether this message got propagated or acted upon would depend on the level of trust in the signer - not unlike BGP. In today's NAT world it might need to be a bit more complex than I'd thought about in the 90s.

But I fear the time has passed for Internet governance to do this without the government barging in, and then it would be too tempting to shut down he political opposition, 'terrists' or the like.

It's possible to run a safe Windows machine, although it takes more knowledge than it does for iOS or Linux say.

I doubt it. There was a story yesterday that 60% of malware found in the wild has no AV-software coverage.

Re:easier to kick infested machines off? (2)

rdebath (884132) | more than 2 years ago | (#38010216)

I doubt it. There was a story yesterday that 60% of malware found in the wild has no AV-software coverage.

Why should that be a surprise? AV software is installed on every vulnerable PC sold and even without updates it mostly protects against all the old threats. Even after that there is a pretty good chance it's infernal nagging for a credit card will get an updated AV installed, with or without a CC. The "mindshare" has been built, everybody believes that Windows must have anti-virus.

But, as has been said repeatedly the AV industry is reactive (though they are starting to try to solve the HARD problem of being intelligently proactive) so all an attacker has to do is make sure that the initial infection vector is obscure. If the initial infection disables the AV it can then download anything; including corpses of old viruses to blame and new updates to run with. The result is that the initial infecting agent will probably no longer exist on the machine, either the botnet will have been upgraded to the most recent version, which isn't yet on the the AV list, or the initial infector will be hidden away to try and stop it getting on the lists at all.

When I consider it, if I was in "the business", I'd be trying pretty hard to keep information out of the hands of the AV "white hats" and it wouldn't really be difficult, I'd just have to keep changing things to keep one step ahead.

Re:easier to kick infested machines off? (-1)

Anonymous Coward | more than 2 years ago | (#38006508)

Hello, please post the full link to HotGirlsNaked.exe thank you.

Re:easier to kick infested machines off? (1)

GameboyRMH (1153867) | more than 2 years ago | (#38014800)

Some ISPs do this, they'll redirect all webpages to a warning page if mass spammings are detected from your connection.

hmm, need to read the FA (1)

Seedy2 (126078) | more than 2 years ago | (#38006274)

Oh wait, so it's not about Skype?

Of course, there are some remaining problems... (3, Interesting)

Arrogant-Bastard (141720) | more than 2 years ago | (#38006872)

...because there are now 4 million pre-compromised systems in the field. It's a certainty that they are now all attractive targets for anyone clever enough to detect them and acquire control of them. I think chances are quite good that as you're reading this, more than one person/group is attempting that very thing. They'll probably succeed. And when they do, they'll use yet another C&C mechanism to organize them, harness them, and get on to whatever mischief they choose.

Seen in that context, this announcement is just a PR exercise. It has no real significance.

Re:Of course, there are some remaining problems... (1)

plover (150551) | more than 2 years ago | (#38013902)

Reading Krebs' article on the topic, the FBI has partnered with ISC to help plan a substitute DNS to stand in for the people whose computers are infected, to notify the ISPs, and to devise a plan to help get their computers cleaned up. The bigger problem is it's a boot sector infection that they don't yet appear to have a way of safely removing.

Personally, I'd rather disenfranchise them. ISC could stand up a substitute DNS server to resolve every address to a redirector site that sends them to a page on fbi.gov explaining that they've been hacked, and they need to bring their computer to a reputable dealer to have the infection removed.

Or maybe they only do this on Tuesdays and Fridays, or for the first 10 names resolved. Just enough annoyance to get their lazy bones off the couch and take care of the problem.

How to check DNS server settings on OS X (3, Informative)

DrProton (79239) | more than 2 years ago | (#38007880)

This is good on Lion and Snow Leopard AFAIK: networksetup -getdnsservers Ethernet Wi-Fi

This command has extensive help: networksetup -help

I use networksetup every day. I have numerous makefile targets that change my network settings based on my location. I'm a a road warrior changing networks frequently and using a VPN and ssh to connect to the corporate network.

Re:How to check DNS server settings on OS X (0)

Anonymous Coward | more than 2 years ago | (#38009900)

If you prefer a non command line method for the same thing:

System Preferences -> Network -> select network on the left -> click Advanced at bottom right -> Click on DNS tab to see current dns Ip addresses.

Also in Network you can use the location drop down at the top of the window to make a new group of network settings (called a location) or pick from one of your predefined locations... makefiles + networksetup may be overkill for many users needs.

Re:How to check DNS server settings on OS X (1)

Wolfrider (856) | more than 2 years ago | (#38014486)

Mod parent up!

malware infects 'computers` (1)

microphage (2429016) | more than 2 years ago | (#38008360)

"U.S. law enforcement today said it had smashed what it called a massive, sophisticated Internet fraud scheme that injected malware in more than four million computers in over 100 countries while generating $14 million in illegitimate income. Of the computers infected with malware, at least 500,000 were in the United States, including computers belonging to U.S. government agencies, such as NASA".

Did any of these malware infested 'computers` run Microsoft Windows?

Estonians? (0)

Anonymous Coward | more than 2 years ago | (#38009420)

Article mentions that the criminals were estonians, but when I read the local news, yes I am from Estonia, I realized that all of them were actually russians. They just happen to have citizenship of Estonia.

Re:Estonians? (1)

gl4ss (559668) | more than 2 years ago | (#38011160)

Article mentions that the criminals were estonians, but when I read the local news, yes I am from Estonia, I realized that all of them were actually russians. They just happen to have citizenship of Estonia.

well, they are estonians. that they just happen to have estonian nationality on their papers makes it so. and one russian.

or if you take another stance you might as well go around running and shouting that linus is swedish.

The computers seized were running (1)

NSN A392-99-964-5927 (1559367) | more than 2 years ago | (#38010072)

FBI code named Magic Lantern (botnet) eeek!

DARE 2.0 (1)

ThatsNotPudding (1045640) | more than 2 years ago | (#38011106)

DNS Abuse Resistance Education and MacRuff, the Router Crime Dog.

Re:DARE 2.0 (0)

Anonymous Coward | more than 2 years ago | (#38012136)

DNS Abuse Resistance Education and MacRuff, the Router Crime Dog.

Help take a byte outa crime!

Good for them! (1)

hesaigo999ca (786966) | more than 2 years ago | (#38012004)

Finally doing some good in the world, keep it up, feels good to the rest of us.

Typical government (1)

tehcyder (746570) | more than 2 years ago | (#38012646)

Interfering in the free market.
Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...