Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Half of Fortune 500s, US Agencies Still Infected With DNSChanger Trojan

samzenpus posted more than 2 years ago | from the still-here dept.

Businesses 112

tsu doh nimh writes "Two months after authorities shut down a massive Internet traffic hijacking scheme, the malicious software that powered the criminal network is still running on computers at half of the Fortune 500 companies, and on PCs at nearly 50 percent of all federal government agencies. Internet Identity, a Tacoma, Wash. company that sells security services, found evidence of at least one DNSChanger infection in computers at half of all Fortune 500 firms, and 27 out of 55 major government entities. Computers still infected with DNSChanger are up against a countdown clock. As part of the DNSChanger botnet takedown, the feds secured a court order to replace the Trojan's DNS infrastructure with surrogate, legitimate DNS servers. But those servers are only allowed to operate until March 8, 2012. Unless the court extends that order, any computers still infected with DNSChanger may no longer be able to browse the Web. The FBI is currently debating whether to extend the deadline or let it expire."

cancel ×

112 comments

Sorry! There are no comments related to the filter you selected.

Just goes to show you (4, Insightful)

koan (80826) | more than 2 years ago | (#38934955)

The only people in IT that know what they are doing are the "hackers".

Re:Just goes to show you (4, Insightful)

betterunixthanunix (980855) | more than 2 years ago | (#38935005)

Unfortunately, proving that you are better than a company's security staff often involves committing a crime, which looks bad when you are applying for a job later in life. Not everyone can be an independent consultant like Kevin Mitnick.

Re:Just goes to show you (1)

koan (80826) | more than 2 years ago | (#38935151)

Wow how wrong you are, you simply say to the corporation "I'm a security consultant want to watch me get through your security?" they say "yes", you say "pay me" and then show then how insecure their network truly is.

It's not as though there are any shortages of hacking stories out there, take the STARTFOR hack recently, 200 gigs of data moved off the network and no one noticed? Unencrypted credit card data? Those seem like newb mistakes to me so they obviously could have benefited from a security audit by someone that is knowledgeable in hacking.

Re:Just goes to show you (1)

maxwell demon (590494) | more than 2 years ago | (#38935249)

Wow how wrong you are, you simply say to the corporation "I'm a security consultant want to watch me get through your security?" they say "yes", you say "pay me" and then show then how insecure their network truly is.

Wow. it's that easy to get into a corporate network? After all, you might be employed by the competition to steal your corporate secrets.

Re:Just goes to show you (0)

Anonymous Coward | more than 2 years ago | (#38935345)

Hence the rise of penetration testing certifications.

And if they have any brains at all they don't keep their "corporate secrets" where anyone can get them.

Re:Just goes to show you (3, Insightful)

Sir_Sri (199544) | more than 2 years ago | (#38936109)

That's sort of the point. If they had any brains we wouldn't need to be telling the CEO not to have his password on a post it note on his monitor.

Re:Just goes to show you (2)

silverglade00 (1751552) | more than 2 years ago | (#38938063)

If they had any brains, they would know that the CEO does not need access to individual customer's credit card numbers and only needs high level reporting data so getting his password off the monitor wouldn't reveal anything that isn't published on the company's press release page.

Re:Just goes to show you (1)

FoolishOwl (1698506) | more than 2 years ago | (#38936731)

Also, I believe best practices for penetration testing involves negotiating the parameters for the testing and documenting them in a contract. Otherwise it's risky for both sides of the transaction.

Re:Just goes to show you (4, Insightful)

betterunixthanunix (980855) | more than 2 years ago | (#38935255)

Wow how wrong you are, you simply say to the corporation "I'm a security consultant want to watch me get through your security?" they say "yes", you say "pay me" and then show then how insecure their network truly is.

Right, because the company is not going to ask to see your credentials before they pay you to attack their system. How do you get your credentials as a security consultant in the first place? How does anyone know that your time is worth paying for?

hi, im president of the united hackers association (0)

Anonymous Coward | more than 2 years ago | (#38935537)

want me to hack you and show you how and how to fix it?
PAY ME NOW
LOL
i see how that goes over....

Re:hi, im president of the united hackers associat (0)

Anonymous Coward | more than 2 years ago | (#38936091)

Fail it's "P4y meh nao"

Re:Just goes to show you (1)

davester666 (731373) | more than 2 years ago | (#38935699)

All you need are fancy laminated business cards. It's proof you are a professional.

Re:Just goes to show you (2)

Runaway1956 (1322357) | more than 2 years ago | (#38936171)

Uhhhhh - no. Laminated business cards? That's geek, not professional. Pros get those cool embossed stiff paper business cards. Laminated is just to protect a geek's card from Cheeto dust.

so your saying (0)

Anonymous Coward | more than 2 years ago | (#38936579)

piracy has its use in employment after all
fake id's that is

Re:Just goes to show you (2)

Chris Mattern (191822) | more than 2 years ago | (#38935621)

Wow how wrong you are,they say "yes", you say "pay me" and then show then how insecure their network truly is.

Wow, you have no conception of how corporation politics work, do you? You simply say to the corporation "I'm a security consultant want to watch me get through your security?" and they say, "If you attempt to hack our systems we will prosecute you to the fullest extent of the law."

Re:Just goes to show you (0)

Anonymous Coward | more than 2 years ago | (#38935947)

That's why you ask permission "WANT to watch" obviously the OP's over simplification of the process gave you plenty of ammo for rebuttal however the gist of what he/she is saying is right on the money.

So, to give back what you gave, "Wow you obviously have no reading comprehension or assessment of the actual point"

Re:Just goes to show you (1)

couchslug (175151) | more than 2 years ago | (#38936231)

Which is why I'd never do that. Fuck 'em. No one who may be hostile to me gets my help. I laugh at their misfortune and wish them more of same.

Shoot all the messengers ya want, I won't be among them.

Re:Just goes to show you (1)

HomelessInLaJolla (1026842) | more than 2 years ago | (#38937547)

Precisely reflected by "Wheel of Fortune"... Those people have more money, we are more intelligent and solve the puzzle.

Re:Just goes to show you (0)

Anonymous Coward | more than 2 years ago | (#38935149)

What OS does DNSChanger run on?

Re:Just goes to show you (0)

Anonymous Coward | more than 2 years ago | (#38936479)

The only people in IT that know what they are doing are the "hackers".

Well, in this case it sounds like Bubba is doing the hackers.

Re:Just goes to show you (2)

deek (22697) | more than 2 years ago | (#38938287)

The only people in IT that know what they are doing are the "hackers".

Actually, if you think about it, the crackers have a much much easier time of it. They only have to find one security issue. The people in IT have to try and cover ALL security issues. Never mind the fact that it's impossible to cover all security issues, because IT staff don't always have access to source code, are not always expert programmers, and don't necessarily know the best security practices for all programming languages.

Re:Just goes to show you (0)

Anonymous Coward | more than 2 years ago | (#38938755)

Good point all the more reason to keep your important data offline, it really is that simple.

Re:Just goes to show you (1)

Anonymous Coward | more than 2 years ago | (#38939305)

no, you've still got it simplified, you need to grab all the security problems on the network, in the order of most politically feasible to fix to least. One does not simply walk in to mordor. You pick on the little guys first, then the bigs get you axed for not "noticing" the stuff they knew was a problem.

Re:Just goes to show you (1)

kangsterizer (1698322) | more than 2 years ago | (#38938595)

The only people in IT that know what they are doing are the "hackers".

Yes and no. Hackers hack each other rather often, making the other hacker look "dumb".
But then the other hack hacks the first one back.

Then which one is better than the other uhm?

Well none. This stuff is just too darn complex to figure out all the variables at any point in time. You can just focus on some thing and make them better, or break them.
Or focus on the general issues and try to manage/detect/solve issues on a larger scale.

Or, of course, be a true genius (true being the keyword here), or redesign your entire hardware and software stack (and i do mean entire, including the os, and so on). In fact, some attempted this at least on the software side, but since no software run on those, even if they're a lot more secure by design, it doesn't help much.

Oh boo hoo (2, Insightful)

Anonymous Coward | more than 2 years ago | (#38934957)

Maybe loss of service will finally motivate owners/managers to clean up the problem.

Re:Oh boo hoo (4, Insightful)

WrongSizeGlass (838941) | more than 2 years ago | (#38935069)

As part of the DNSChanger botnet takedown, the feds secured a court order to replace the Trojan's DNS infrastructure with surrogate, legitimate DNS servers. But those servers are only allowed to operate until March 8, 2012. Unless the court extends that order, any computers still infected with DNSChanger may no longer be able to browse the Web.

Maybe loss of service will finally motivate owners/managers to clean up the problem.

You're right. The only way that most of these companies or government agencies will even realize that they are infected/affected will be when some of their PC's stop working properly.

Re:Oh boo hoo (0)

Anonymous Coward | more than 2 years ago | (#38935855)

Or they could do it halfway, Have one out of every X number of requests return the server that they control. That server should return a page explaining the situation for every get request for an file extension that would contain html (like html, htm, asp, aspx, cfm, jsp, etc.) and a 404 for everything else. Everyday closer to the deadline decrease the X variable on the dns server.

Maybe not even then. (1)

khasim (1285) | more than 2 years ago | (#38936043)

In my experience, they'll just poke at the non-functioning systems until they do something that makes them work again. Or until they run out of ideas and blame the "network card" or something and replace the hardware.

If they don't know that they're infected by now, they don't have the expertise (basic knowledge) to monitor their own systems.

They will just say "yep, that happens to computers sometimes" and move on. Never understanding that there is a huge hole in their security practices.

Re:Maybe not even then. (1)

St.Creed (853824) | more than 2 years ago | (#38937295)

I'd recommend installing a different Trojan that points to another set of DNS-servers :) If you install an advanced trojan it should be able to keep out the competition as well, likely improving user experience on the computer.

Of course, the trade off may not be to their liking :)

Re:Oh boo hoo (2)

rrohbeck (944847) | more than 2 years ago | (#38937583)

Exactly. Just modify the DNS on the servers so that every entry goes to a server in fbi.gov that says "Your computer is infected and here's how to get rid of that."

Fuck'em (4, Insightful)

hannson (1369413) | more than 2 years ago | (#38934963)

Just shut it down, it forces them to deal with it.

Why, when you can shame 'em too? (5, Insightful)

Zocalo (252965) | more than 2 years ago | (#38935079)

Just re-configure the surrogate DNS servers to return the same reply to every query and point all traffic towards an FBI server hosting a web page that explains what's happened and why they are seeing the web page they are. May as well make mention of the fact that the DoJ has apparently been sending out email notifications followed up with snail mail version of these infections to the designated WHOIS abuse/tech contacts for IP ranges showing infected hosts, just in case they hadn't already figured it out for themselves. I don't think it'll take too long before someone in senior management figures out what that implies and goes for a walk over to the IT department with a clue-by-four.

Re:Why, when you can shame 'em too? (1)

maxwell demon (590494) | more than 2 years ago | (#38935111)

Just re-configure the surrogate DNS servers to return the same reply to every query and point all traffic towards an FBI server

I don't think the FBI would have any interest in DDoSing their own server ...

Re:Why, when you can shame 'em too? (1)

yesteraeon (872571) | more than 2 years ago | (#38935263)

They're already receiving all DNS requests from the infected systems, I think they could probably handle serving up a lightweight web page in addition to this.

Re:Why, when you can shame 'em too? (2)

dissy (172727) | more than 2 years ago | (#38935921)

The FBI is partnered up with GoDaddy, who historically they let handle these types of things.

They can let GoDaddy host the page, and their network wouldn't even notice it next to the other billion and a half parked and expired domain auction pages.

I'd be a little surprised of GoDaddy isn't who is currently providing the DNS infrastructure for what they are already doing anyway.

A tiny text web page with no graphics could easily come in at under 2kb.
Their servers support Z compression, so at least for all non-IE6 browsers the data transferred over the wire will be even less than that.

Of course if the FBI is logging all the DNS lookups from infected computers, to add that data to their massive database-of-such-things, then perhaps they will renew the court order and keep silently redirecting people like they have been, to continue recording...

Re:Why, when you can shame 'em too? (0)

Anonymous Coward | more than 2 years ago | (#38936515)

Meh, host it somewhere resilient, add some ads at the bottom, profit.

Better make sure the ads are OK though ;).

Re:Fuck'em (-1, Offtopic)

Ethanol-fueled (1125189) | more than 2 years ago | (#38935325)

Talk, [youtube.com] it's only talk, arguments, agreements, advice Answers, articulate announcements, It's only talk

Talk, it's only talk, Babble, burble, banter, Bicker bicker bicker Brouhaha, balderdash, ballyhoo, It's only talk,

Backtalk: Comments, cliches, commentary Chatter, chit chat. Conversation, contradiction, criticism It's only talk - Cheap talk

Talk, it's only talk, Debates, discussions These are words with a "d" this time - Dialogue, duologue, diatribe, Dissension, declamation, Double talk, double talk

Re:Fuck'em (0)

Anonymous Coward | more than 2 years ago | (#38936227)

Fully agree!

"Unless the court extends that order, any computers still infected with DNSChanger may no longer be able to browse the Web. "

Perfect, the solution is already there. Only the stupid "infected" owners will be penalized. Love it.

Re:Fuck'em (4, Insightful)

Antibozo (410516) | more than 2 years ago | (#38936307)

They should have shut it down in the first place. It's wildly irresponsible and stupid for the FBI to have set up a replacement infrastructure.

Presumably the hosts that are compromised had a vulnerability. Leaving a working infrastructure in place has masked the signal not only that DNSChanger was installed, but that there might be an unpatched vulnerability. If they'd shut it down, staff would have looked at the boxes and identified that there was malware installed, then cleaned up the boxes in the process and fixed their patching process. Who knows what additional malware may have been installed in the interim using the same or other unpatched vulnerabilities, because the FBI meddled?

In addition, by taking the responsibility for maintaining a DNS infrastructure, they run the risk of contributing to another mass compromise if the replacement infrastructure is itself compromised or becomes the victim of a cache poisoning attack.

Stupid, stupid, stupid.

Cause is obvious (5, Funny)

SlithyMagister (822218) | more than 2 years ago | (#38934971)

Half of all Fortune 500 Companies run Symantec Endpoint Protection as the AV "solution"

Re:Cause is obvious (0, Flamebait)

rubycodez (864176) | more than 2 years ago | (#38935257)

and all of them run Windows thinking it's an actual "operating system".

Re:Cause is obvious (-1)

Anonymous Coward | more than 2 years ago | (#38935353)

As opposed to the worthless fat polesmoker garbage your faggoty ass runs?

Re:Cause is obvious (1)

rubycodez (864176) | more than 2 years ago | (#38935487)

guess again, I don't run OSX. still fantasizing about me, eh? get a boyfriend, my man

Re:Cause is obvious (-1)

Anonymous Coward | more than 2 years ago | (#38935675)

and all of them run Windows thinking it's an actual "operating system".

Good thing they're not dumb enough to think that Linux can accomplish anything in business.

Re:Cause is obvious (1)

Billly Gates (198444) | more than 2 years ago | (#38937381)

You mean the only operting system that can be remotely managed, has the business apps, supports Office (with outlook), has support from every IT professional in existence, can run on every PC ever made, wont break with an apt-get, ... not so real OS?

Sorry the age of green screen CRT terminals died over 2 decades ago. Not one is going to switch to the IBM mainframe or a big unix box.

The Wintel PC is here to stay in the Office.

Redirection? (4, Interesting)

mehrotra.akash (1539473) | more than 2 years ago | (#38935021)

After the deadline, for a few weeks, redirect all traffic from these machines to a page explaining the issue
Or for some time before the deadline,randomly redirect some requests to a page explaining that the computer is infected and internet will not be usable from the deadline onwards.

Re:Redirection? (1, Troll)

ae1294 (1547521) | more than 2 years ago | (#38935137)

After the deadline, for a few weeks, redirect all traffic from these machines to a page explaining the issue
Or for some time before the deadline,randomly redirect some requests to a page explaining that the computer is infected and internet will not be usable from the deadline onwards.

Nah, Goatse and Rickroll'em

pathetic (3, Insightful)

Anonymous Coward | more than 2 years ago | (#38935041)

You just know there are tons of unemployed admins who could easily sort this shit out but instead these companies hired some douchebag fratboy who flunked out of law school to run their networks...

Re:pathetic (4, Funny)

sgt scrub (869860) | more than 2 years ago | (#38935171)

The guy in charge of hiring is the bosses son and he "knows the internet".

Re:pathetic (1)

Sir_Sri (199544) | more than 2 years ago | (#38936421)

Probably not really. The smalled fortune 500 companies, D.R. Horton and Seaboard both have over 3000 employees (and seaboard is up around 9k), with even that many computers it would be fairly hard to be 100% sure all of them are clean all the time, especially across multiple sites and all that.

"27 out of 55 major government entities" (1)

canada_dry (830702) | more than 2 years ago | (#38935043)

Who else thinks they should let the surrogate servers expire? Can you imagine the swift response to correct the problem when the government workers find out they can't surf pr0n all day!

Re:"27 out of 55 major government entities" (1)

AliasMarlowe (1042386) | more than 2 years ago | (#38935081)

Can you imagine the swift response to correct the problem when the government workers find out they can't surf pr0n all day!

Hey, don't exaggerate. They aren't surfing pr0n all day; just for eight hours (maybe less if they're in late or leave early).

Re:"27 out of 55 major government entities" (1)

yesteraeon (872571) | more than 2 years ago | (#38935293)

Hey don't sell them short! We only know about the pr0n surfing they're doing at work. They're probably putting in another solid 8 hours at home!

Re:"27 out of 55 major government entities" (1)

flyingfsck (986395) | more than 2 years ago | (#38935917)

Come on, they only leave early to compensate for being in late.

Re:"27 out of 55 major government entities" (1)

gtall (79522) | more than 2 years ago | (#38940301)

You do realize that the penalty for surfing porn on government equipment is loss of government job? But thanks for helping spread the myth that government workers do nothing all day. In most cases, they have the worst jobs available, they have to put up with you, the unthinking public. You are the people who believe in JFK conspiracies, UFOs, that the Jews control everything, the Twin Towers was a CIA/FBI plot, etc.

Why are government employees... (1)

Streetlight (1102081) | more than 2 years ago | (#38935107)

wasting their time browsing the Web. I would think they have better things to do.

Re:Why are government employees... (0)

Anonymous Coward | more than 2 years ago | (#38935133)

No joke! I mean they need to focus on the true American cause at the moment of annihilating Iran and the people that live there!

IT Knows. (1)

Anonymous Coward | more than 2 years ago | (#38935141)

I came to post the same thing that everyone else already posted: Let them expire!

These people obviously need better protection and the only way they're going to know they're infected is if you let their computers just stop working.

It amazes me that everyone here gets it instinctively, but whatever 'experts' work for the government can't think their way through it.

Seriously? (5, Insightful)

sgt scrub (869860) | more than 2 years ago | (#38935145)

any computers still infected with DNSChanger may no longer be able to browse the Web

There are over 250 IT departments that not only allow infected machines to remain on the network but allow users to continue to use them?!? The IT world has officially gone to shit. I'm going back to bed.

Re:Seriously? (0)

Anonymous Coward | more than 2 years ago | (#38935311)

Is it the fault of IT, management or the users? Where I work IT has no control, management demands users have free reign of everything. IT cannot prevent users from continually reinfecting themselves, even if IT is continuously cleaning up the mess.

I say shutdown the legit DNS servers so we can deal with this one once and for all (or at least more clearly identify the idiots).

Re:Seriously? (1)

Billly Gates (198444) | more than 2 years ago | (#38937397)

IT doesn't have time to check every PC for malware. They are just trying not to get fired as the CEO and bean counters look at them as wasteful cost centers that bring down the share price and offer no business value.

Unless something breaks they wont ever know.

Re:Seriously? (1)

Spad (470073) | more than 2 years ago | (#38937431)

Most of the places I've worked have suffered from at least one serious security hole that has gone unaddressed due to either lack of comprehension, lack of skill or lack of funding; be it as obvious as everyone running as root/local admin or more "policy based" problems such as applying crippling restrictions on web browsing but having ways around the filters for "important" people (read: management) that inevitably find their way into the hands of the rest of the staff so that you might as well just turn off the proxies.

I'm willing to bet that most of those 250 departments either aren't even aware that any of their machines are infected or have been prevented from fixing them by higher priority issues such as rolling out iPads to all the execs so they can show off the size of their penises in meetings.

Re:Seriously? (1)

sgt scrub (869860) | more than 2 years ago | (#38940907)

due to either lack of comprehension, lack of skill or lack of funding

You could have just written, "Bought managers penis enlarging iDevice instead of funding IT". Everyone would have understood.

Which can be translated to... (1)

jcreus (2547928) | more than 2 years ago | (#38935155)

Half of the Fortune 500s use Windows. Joking apart, I doubt anyone uses Linux in the frontends, sadly.

MSE? (1)

mehrotra.akash (1539473) | more than 2 years ago | (#38935247)

MSE is free with Windows, so is Microsoft Malware removal tool
I'm guessing govt. departments dont use pirated windows, so why not just update MSE definitions to detect this trojan?

Re:MSE? (1)

maxwell demon (590494) | more than 2 years ago | (#38935297)

Unless the trojan just prevents the signatures for it to be downloaded.

Re:MSE? (0)

Anonymous Coward | more than 2 years ago | (#38935341)

Just download the definitions directly from Microsoft [microsoft.com] from a known-good system, put them on a USB drive, and install it on the infected computer.

Re:MSE? (2)

ConceptJunkie (24823) | more than 2 years ago | (#38938091)

That's about 3 steps too many. That's why it doesn't happen.

Re:MSE? (1)

Billly Gates (198444) | more than 2 years ago | (#38935589)

Not that simple. Most use symantic endpoint which will conflict with mse. Users dont have admin rights and there is nothing they can do. Mse is forbidden with more than 10 users.

Besides the policy from the cio is to use only approved software he bought from his games of golf with slick salesmen. It costs money to hire compentent IT professionals and the bean counters hate this as the goal of the company is to raise its stock price and not keep computers clean.

Re:MSE? (1)

jonwil (467024) | more than 2 years ago | (#38937867)

Even if MSE isn't an option, the standard "Windows Malicious Software Removal Tool" that Microsoft makes available as part of every "Patch Tuesday" should be something IT departments are running on their systems.

Window only? (1)

mspohr (589790) | more than 2 years ago | (#38935323)

Do I have to worry about my Linux and Mac computers?
The article isn't clear (as usual) .

Re:Window only? (2)

Nerdfest (867930) | more than 2 years ago | (#38935411)

I was poking around and found some tips for removing it from OS X machines, so I'm guessing it can affect those.

IPv5 (3, Funny)

Anonymous Coward | more than 2 years ago | (#38935339)

According to the explanation picture in TFA, the address for the contact page of fbi.gov is 987.654.321. Is that IPv5?

Re:IPv5 (4, Funny)

ColdWetDog (752185) | more than 2 years ago | (#38935607)

According to the explanation picture in TFA, the address for the contact page of fbi.gov is 987.654.321. Is that IPv5?

That's their phone number, you idiot. The FBI doesn't use computers yet.

Screw em if they are to lazy to do their job (1)

mordjah (1088481) | more than 2 years ago | (#38935365)

+1 just pull the plug on the thing. Let the wannabe it managers it at these outfits RTFM and scratch their heads awhile since they dont properly monitor their network. Can we get a list of effected companies? May be in interesting day to short some stocks..

AmigaOS installed on my penis' tip! (-1)

Anonymous Coward | more than 2 years ago | (#38935377)

David Mills: I've been trying to figure something in my head, and maybe you can help me out, yeah? When a person is insane, as you clearly are, do you know that you're insane? Maybe you're just sitting around, reading "Guns and Ammo", masturbating in your own feces, do you just stop and go, "Wow! It is amazing how fucking crazy I really am!"? Yeah. Do you guys do that?

And you still use WINDOWS! HHHHHHHHHHAaaaaaaaa

Oh Noes! (1)

PPH (736903) | more than 2 years ago | (#38935393)

Unless the court extends that order, any computers still infected with DNSChanger may no longer be able to browse the Web.

Stupid people kicked off the 'Net? What will become of us?

Sadly, since many of these systems are corporate machines, it means that their users are probably prohibited from patching them themselves. So if some PHB has failed to authorize IT to perform the fix, everyone else will suffer.

In other news (1)

devent (1627873) | more than 2 years ago | (#38935395)

Users with the system Linux, like Ubuntu, Fedora, Redhat, etc. are still save and still waiting for a virus to target them in the wild.

In other news, Pwn2Own will no more have any Linux systems in the competition, because it would be futile attempt anyway and the proprietary system companies looking bad in comparison.

Re:In other news (0)

Anonymous Coward | more than 2 years ago | (#38935585)

There are not nearly enough people using Linux to justify the effort of making an effective tojan or removable media transmissible virus, or other network independent infection vector. Not that it is impossible to infect it over a network, I just don't want to get into that retarded debate. There is almost nothing to be done to save users from themselves, you just don't have enough of them.

It would be like a virus in te real world that infected tall red headed people. Even in the world largest unclean camp of tall red headed people, it is unlikely to ever evolve. That doesn't make being red headed cool.

Re:In other news (0)

Anonymous Coward | more than 2 years ago | (#38936129)

How about Android?

Re:In other news (0)

Anonymous Coward | more than 2 years ago | (#38936191)

servers run linux and have bigger internet pipes than home boxes.

dumbass.

Re:In other news (0)

Anonymous Coward | more than 2 years ago | (#38937367)

right .. linux is only used in places where you are forced to use system administrator to install it, secure it and maintain it.

Re:In other news (1)

Runaway1956 (1322357) | more than 2 years ago | (#38936313)

You poor simple douche. You did get part of your idiocy right - red heads aren't cool, they are HOT! The rest? I hear you whining, "I haven't managed to code any malware that will run reliably on Linux - aww, fuck it, there aren't enough Linux computers to infect anyway!"

Just run along and play with your self, you douche. Here's a magnifying glass and a pair of tweezers. And, don't be messing with that redhead down the street. She'll tear your fucking head off, and shit down your windpipe, 'cause she doesn't like limp dicked douches like yourself.

Re:In other news (1)

gtall (79522) | more than 2 years ago | (#38940311)

There, there, suffering from low male testosterone again, are we? There are pills you can get, just watch the TV like a good little social misfit.

Like playing Whack A Mole (5, Interesting)

djl4570 (801529) | more than 2 years ago | (#38935397)

Back in the mid nineties I had to deal with clueless users installing various crapletts on their systems. Screen savers, animated icons, animated cursors and games mostly downloaded from BBS's, AOL, Prodigy, Delphi etc. As soon as you cleaned up one outbreak there was another. Of course upper management was silent on the matter of installing the crapletts. Here we are fifteen years later and it's the same song. I'm sure the IT departments want to clean this up but upper management isn't providing the necessary support.

Re:Like playing Whack A Mole (1)

andymadigan (792996) | more than 2 years ago | (#38937285)

Probably because IT thinks everything is a "crapplett". Cygwin? crapplett. Chrome? crapplett. Dia? crapplett. If it's open source, it must be insecure, nevermind that our backend is WebLogic running on Red Hat.

Once someone who's trying to do actual work gets their manager involved, then IT shoots back with "well, we have to certify that it's secure and that will take X months". Management gets sick of IT constantly getting in the way and tells them to bugger off.

IT thinks they can come up with a whitelist of applications and a whitelist of web sites that people need to do their jobs (doubly funny as IT has no idea what those people do). The same logic would have us still using horse driven plows, or would have them using green screen terminals.

Re:Like playing Whack A Mole (1)

Spad (470073) | more than 2 years ago | (#38937479)

Most of those issues are caused by one of two things: 1) Policies created by some moron who doesn't know anything about IT but read a white paper once so thinks they're God's Gift to compliance (my current employer blocks any website that uses a META Refesh because of some reason...security...compliance) or 2) IT staff with a God Complex. Neither are that hard to fix, but both seem endemic across the corporate and government world.

Smart IT departments deal with this with: "Show me that you need this program to do your job and that we don't already have something in place that does the same thing to the same standard" process along with a quick check to make sure the program is "legit". If it takes you more than a week to do (in most environments), you're doing it wrong.

Ulterior motives? (0)

Anonymous Coward | more than 2 years ago | (#38936079)

Am I the only one that meets this kind of alarmist news from a "security consulting" firm with a massive grain of salt? Their business relies upon these kinds of things, after all. I know as well as many do just how pervasive the 'social engineering' aspect to these kind of threats can be, but I think half is both an exagerrated and self-serving number.

Re:Ulterior motives? (1)

fluffy99 (870997) | more than 2 years ago | (#38936433)

half is both an exagerrated and self-serving number.

The way they stated it is exaggerating, but the numbers are plausible. They said they found at least 1 infected computer in half of the Fortune 500 companies, plus one in 27 out of 55 govt agencies. That's a whole whopping 277 computers. Entirely possible. They probably just looked at the logs from the DNS servers.

Re:Ulterior motives? (0)

Anonymous Coward | more than 2 years ago | (#38936599)

The impression they create (probably not unintentionally) is that these companies are somehow plagued by a much larger-scale infection of them than a single computer. I find their claims to be a little suspect in that light - either they're lying through the kind of misdirection you're suggesting (saying its 1 computer when the implication to the usual person is that this means the company is infected), or they're just lying about the number of companies.

Without some more indepth word on how they came to these conclusions its hard if not impossivle to say what the depth of the infection is, or the vector of infection, so I take the news with a massive grain of salt.

QoS (Quality of Sysads) (0)

Anonymous Coward | more than 2 years ago | (#38936285)

The underlying problem here is the same underlying problem we've had all along. If you're some type of antisocial freak, fluent in 1337sp33k and Klingon but not so hot with English, it's not really a shock that you are unemployed and doing your hax0ring from your mother's basement. Maybe you could fix this DNS issue for small or large companies quicker and more efficiently than the IT teams at these corporations, and maybe you're more qualified to do so. Unfortunately, due to your extremely repressive personality, nobody will ever know because you can't talk to people. Most of the real nerds that I meet seem to think they deserve unlimited power to rule the Department of IT with an iron fist, or any other way they see fit. You can save your money and do that with your home network. The office network is not your play thing, and it never will be. It can't just "not work" because you wanted to "try something" you thought would be cool. Oh, and management's job is not to make your life as convenient as possible. You can go through the proper channels just like everyone else. If you can't communicate your needs effectively, that's your problem. When everyone's computers suffer because you didn't get your way, who ends up on the cutting room floor (hint: it's not the end users and it's not the management)? This paragraph is probably lost on most of its readers because, tragically, the average geek will never be able to see past the end of his own nose.

Case in point:
I've been out of IT for a couple years (and oh, what a glorious couple of years), and the IT department where I work has someone on staff about 80 hours per week. I mentioned (bragged) to one of them that I'd bought an OCZ Agility 3, and was proud of Wind0ze for automatically turning on TRIM, turning off defrag, etc. He said he didn't really understand any of that (last sentence), but good for me. Clearly this is not someone who understands the finer points of computers, but this is someone who can keep a decent-size network running efficiently about 99-99.5% of the time. When end-users have problems, IT can explain to them. When someone needs to put a mac on the network, IT doesn't cry to IT's mother about how extended exposure to apples apparantely causes fatal heart attacks, but just does it with a smile on IT's face.

If status quo is nothing, I'd rather have someone who won't cause problems than someone who will find solutions.

Re:QoS (Quality of Sysads) (1)

tqk (413719) | more than 2 years ago | (#38936931)

... I'd rather have someone who won't cause problems than someone who will find solutions.

That sounds just like the douche bag admins who're so powerless/ineffectual/ignorant that they let half of Fortune 500 companies and gov't agencies continue to run malware long after they'd been warned about it.

Now I understand. The Ostrich defense.

Transparent proxy (1)

Beached (52204) | more than 2 years ago | (#38936495)

Couldn't this be mitigated by redirecting all DNS packets to corporate DNS servers and logging all requests for something else?

Let it expire (1)

Khyber (864651) | more than 2 years ago | (#38936583)

These companies and agencies need a solid smack to their face. "NO! NO INTERNET FOR YOU! FIX YOUR SHIT!"

If the just turn them off... (2)

geekprime (969454) | more than 2 years ago | (#38936629)

If the just turn them off then the systems wit the problems will HAVE to be fixed, isn't that the idea?

Perhaps instead of just turning them off when the time is up, start now by redirecting every request to a webpage explaining what is wrong and
a link to a removal tool.

Re:If the just turn them off... (1)

oDDmON oUT (231200) | more than 2 years ago | (#38936719)

Mod paret up +1 Insightful

I am the one whos jobless. (-1)

Anonymous Coward | more than 2 years ago | (#38937001)

I sure as hell can do a better job than these tards.

Anyone employed in this job who's network is unable to surf the web when the FBI pulls the plug, should be fired.
So as I may be brought in to fix it and get hired full time.

Please Please Please.

Really they have no clue where their DNS is pointed.

Dear FBI give the IP address of the malware DNS to a real DNS provider. Have them make it live, call it a day.

This is a story? (0)

Anonymous Coward | more than 2 years ago | (#38938281)

Come on. Some company publishes a story that there are viruses everywhere, but miraculously, they have a solution for it!!! What great fellows. Does anyone believe what they are saying? It may very well be true (doubt it) but their self serving agenda makes what they are saying unbelievable.

Good (0)

Anonymous Coward | more than 2 years ago | (#38938801)

Very Good! :))

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>