Storm Worm Rising 218
The Storm worm has been an increasing problem in the last few months, but a change in tactics may mean something big is going to happen. The article discusses a bit of back story about the worm, including the somewhat frightening numbers about the millions of spam emails carrying the worm payload. They estimate between a quarter and a million infected systems usable for spam or DDOS attacks.
How are these numbers calculated? (Score:5, Funny)
Seriously though, how does one go about estimating these numbers? Is it something as simple as an estimate of what proportion of infected e-mails are expected to result in an infected desktop? I doubt that would give a very accurate figure.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Funny)
It's product placement for Swiffer dusters, able to swifly swiff up dust, viruses and worms.
Re: (Score:2)
Re:How are these numbers calculated? (Score:4, Informative)
"Joe Stewart, senior security researcher at managed security company SecureWorks, at the Black Hat conference.
From the number of infected machines he's found, Stewart estimates that the Storm botnet could comprise anywhere from 250,000 to 1 million infected computers. And that raises questions, along with eyebrows. "
Re: (Score:2, Insightful)
Re:How are these numbers calculated? (Score:5, Informative)
In reality, the only source that can give you a precise count for the Storm botnet is the Storm controller - and he/she's not talking. So we do the best we can at estimating its size given the data available.
I don't think we'll ever see a solution... (Score:2, Insightful)
Re: (Score:2, Insightful)
I believe what we have here is a free market. If you don't like the non-warranty offered by one company, don't buy their product. Buy the one product from a company that does give the warranty you want.
Or one could buy the product that doesn't get turned into a zombie. Thus spake the Apple fanboy. ;-)
Re: (Score:3, Insightful)
Re:How are these numbers calculated? (Score:5, Funny)
- 1. Roll 2D6
- 2. Take the number rolled, and multiply it times the number of worm messages that have arrived in your inbox.
- 3. If your computer is actually infected, square the result.
- 4. Play a game of Solitare
- 5. Add your final score to the result
- 6. Divide the result by your Boss's vigilance.
- 7. Make a saving throw against discovery, and multiply the result by 1000
- 8. Round up to the nearest 100,000
- 9. Publish
- 10. Profit!
Lower bounds are trickier as they will require you to actually care about what you're doing.Re: (Score:3, Funny)
Microsoft is going to lose big (Score:3, Insightful)
"The silent majority" is uninformed. (Score:5, Insightful)
They've been shown that in countless movies and TV shows and by "experts" on the news.
They're the ones you see claiming that Linux and Mac's will have the "same problems" as their market share increases.
With all the past outbreaks on Windows machines, anyone who wanted to migrate has already started their migration. This won't change anything for anyone else.
Re:"The silent majority" is uninformed. (Score:5, Interesting)
More accurate, perhaps, to say that they think this is just the way computers don't work.
There was a program on last week where they had a collection of self proclaimed grumpy old women listing things they hated about computers - and you know what? Every single complaint was not about computers per se, but about Microsoft software.
There's got to be an opportunity in there somewhere for the FOSS movement. Imagine if we could convince the "I hate computers" brigade that what they mainly hate is Microsoft ...
That's just silly. People have different convincer strategies. If nothing else, there are people out there who still haven't heard that there's an alternative. There's a lot of meat left on that bone.
Re: (Score:2)
Response: That's just silly. People have different convincer strategies. If nothing else, there are people out there who still haven't heard that there's an alternative. There's a lot of meat left on that bone.
True. I'd say the long, dark tunnel from XP to Vista has a few side corridors.
Re: (Score:2)
That's one long fucking tunnel that they are dragging us kicking and scream all the way.
Re: (Score:3, Interesting)
The usual stuff. Clippy, Outlook, "you appear to be writing a letter", Word's grammar checker... that sort of thing. Nip over to annoyances.org and you'll find a hundred or so examples.
Oh do behave. That argument might fly for specialist drafting or accountancy software, but not here. For the market segment under discussion, all people want is a browser, a word processor, something to check their em
Re: (Score:3, Insightful)
Why wouldn't YouTube work with Linux? YouTube runs on Linux. http://uptime.netcraft.com/up/graph?site=youtube.c om [netcraft.com]
There is a Linux version of flash, it was behind for a while but YouTube still worked even then. I have no probl
Re:"The silent majority" is uninformed. (Score:5, Informative)
No, but they are Microsoft though - which is what I said in the first place.
You're right, I just used it as a loose example. I'd be more specific about the complaints, but I wasn't expecting a test, and I forgot to make notes. All I can do is report what I remember from the show.
meh. It's a support forum, not an advocacy site. It's not so much "Microsoft sucks" as "what do I do when when the registry fills up?". You don't get a lot of penguin heads there because... well, because we all use Linux and it's a windows support forum.
Hatred isn't a rational act, though, is it? I mean, most people don't wake up in the morning and say "now who shall I hate today? Who is the most rational target for my hatred?". It's not like that. On the other hand, there's no shortage of people who think "if that computer crashes and loses my document one more time today, it's going through that window..." My point is that a lot of the things I heard cited as inspiring this hatred were typical MS grumbling points.
And if it's a good enough reason to hate computers, it's good enough to hate Microsoft. It's just a question of education ;)
Oh quite possibly, although the latest Ubuntu is getting very good in that respect. But they'd be spared the malware, and the viruses and the worms... which is the starting point for this discussion.
Yes, perfectly. At least since flash 9 was released for Linux.
Re: (Score:3, Insightful)
They could indeed. Probably not those particular ones however. The show is callled Grumpy Old Women [bbc.co.uk] and takes a handful of the BBC's more curmudgeonly female celebs and gives them free rein to gripe about the things that wind them up. Not as good as Grumpy Old Men (IMHO) but that could be down to gender bias on my part.
The "silent majority" however (and no, it's not my choice of phrase, either) don'
Re: (Score:3, Interesting)
And all of them so very tast^Wdifferent, too! :)
Convincer strategies was something they told us about on a training course I went on a while back. A convincer strategy is what has to happen inside someone's head before they accept a given proposition as being true.
So, one person's convincer strategy might be that he needs to hear it a certain number of times (and all you need to do is keep on at them) while someone else might need to try it for themselves. Some
Re: (Score:2)
I don't think that's quite the case any more. Many of the people
Re: (Score:3, Funny)
Well, it is changing it for me! I got an ecard from "friend" and I downloaded the exe on my iMac, and it won't work. I could not see the card. I tried again on my Red Hat Enterprise 4 server, and even after chmod +x *AND* running as root with X windows going, the card would not open.
That is the last straw for me! I can't get cards from my "friend". I a
Re:"The silent majority" is uninformed. (Score:5, Funny)
--
Try to hack my 31337 firewall! [127.0.0.1]
Yeah, you really should do; you clearly need a more secure OS than the one you're running now. I just hacked your firewall, and man have you got a lot of weird stuff on there.
Re:"The silent majority" is uninformed. (Score:4, Insightful)
- An uneducated user from executing a binary file they download from a URL they are given
- A process that user is running from executing further code with that user's privileges
- That user's processes from making outbound TCP/UDP connections
- That user's processes from accessing an SMTP server to send emails
- A user from configuring a process to run on logging in
By my thinking, that's really all that's needed for a botnet to work on a given platform. I am certainly ignorant of many details regarding the BSD/Linux kernels and I stand ready to be corrected, but I believe I've seen all those things happening individually as part of day to day user life on my linux box.Re:Microsoft is going to lose big (Score:5, Informative)
WTF are you talking about? RTFA, please. If you actually did that before funboying around, you'd notice that the program in question is not a worm at all, but a trojan. User has to manually run the attachment, probably clicking through a couple of dialogs practically begging him not to. But, since the user really, really _wants_ to see the cute kittens, or a naked celebrity, or whatever the trojan claims to be, trojan will be run. No OS can defend against the user being a sucker.
So, move along, please. Your tirade is totally off topic here.
Re: (Score:2)
Love the tag "situationnormal" (Score:3, Informative)
SNAFU (Situation Normal: All F***ed Up)
* Before I get 10 million suggestions for a decade-past issue, yes we did find more effective ways of blocking it.
Naked teens attack home director (Score:5, Informative)
http://en.wikipedia.org/wiki/Storm_Worm [wikipedia.org]
Re: (Score:2)
Question on that article (Score:4, Interesting)
http://en.wikipedia.org/wiki/Storm_Worm [wikipedia.org]
Perhaps to avoid infecting government servers (and upping the ante, if he got caught)? That's the only thing I could think of. I'm sure there's a very logical reason, but I have no idea what it might be.
Re: (Score:2)
Well, all "windows server reliability" jokes aside, it could just be that the author's code had some issues running as expected on the 2003 server machines (due to some behaviour in that version of the OS as opposed to other versions), that perhaps he/she didn't feel like debugging or figuring out.
Re: (Score:3, Insightful)
The companies that care enough about their security issues are those with critical servers, and many of these use win 2K3.
Storm affecting these boxes would mean quicker detection of the virus, and lesser migration. Without these (and with users who dont update anti-virus signatures very regularly), the virus has a greater potential of spreading. Of course, the author didn't imagine Storm would be this popular, and that t
worth worrying about (Score:4, Interesting)
Catalyst for change? (Score:4, Interesting)
#1. Spoofed IP addresses - not that common anymore. It used to be that you'd tie up a machine by having it send replies to machines that did not initiate the connection. There is a simple solution to this. Anyone assigned a block of IP addresses has to make sure that all outbound traffic references IP addresses on that block.
#2. Thousands of machines eating up your bandwidth - the most common type now. This is where the zombie army each makes continued requests of your machine. For webservers, they can request a page over and over and over until they use up all your bandwidth and legitimate visitors cannot get through. This is more difficult to fix. It can partially be handled by blocking the range of addresses that host the zombies. Such as Comcast and Verizon and so forth. There are more complicated attacks. Such has sending half a request.
There's not much that can be done with #2 until a law gets passed saying that the person paying for the Internet connection is responsible for $X of clean-up charges. Then people will have a financial incentive to look at more secure systems.
Re: (Score:2)
I wonder how grandma and grandpa will feel when get a letter in the mail to discover that there internet they use to only check mails from the kids/grandkids has been hijacked by a worm that they never heard about and now have to pay fines to cover damages. I mean oth
Why not offer to swap them ahead of time? (Score:3, Interesting)
Why wait?
... automatically?
Why not take a few pro-active measures? Such as emailing all your clients with the new rules and offering to assist them in evaluating their systems
Re: (Score:2)
I never said it shouldn't be put into affect i said really only problem is the whole "aww poor them" factor and we know that can be looked over easily especially when you slap them
Re: (Score:2)
Well, maybe they will then realise that a computer can be a nuisance for others, and learn to treat it as such. Owning a computer is a responsibilty.
I am in favour of some form of punishment for zombied computers for some time now. You would be fined with
Re: (Score:2)
people do not take responsibility for their anything that involves computers. evar. people don't take responsibility for their actions on the computer (i did not delete it! the computer just ate it!), they don't take responsibility for the computer itself (how does
Re: (Score:2)
#1. Spoofed IP addresses - not that common anymore. It used to be that you'd tie up a machine by having it send replies to machines that did not initiate the connection. There is a simple solution to this. Anyone assigned a block of IP addresses has to make sure that all outbound traffic references IP addresses on that block.
There might be a simple solution to #1, namely ingress/egress filtering as you suggest, but its not very effective unless deployed nearly everywhere. Anywhere that doesn't use filtering can be used to basically spoof anywhere. Plus, according to results from the Spoofer Project at MIT [mit.edu], even those networks where there is some level of ingress/egress filtering are able to spoof large amounts of IP addresses. Note the percentages in those results are percentages for hosts which do encounter some filtering.
More information (Score:5, Informative)
Shouldn't everyone be blocking
NO! (Score:5, Insightful)
NO! It's annoying enough that Google rapes through my
If I'm working on a c++ program at work and zip it up and gmail it home (lock the computer while it uploads) and forget to 'make clean'
Re:NO! (Score:4, Interesting)
Re:NO! (Score:4, Informative)
I've just switched to using RAR and as for now Google is leaving my attachments alone...
M Addario
Re: (Score:2)
As a sibling pointed out, that won't work. But you can nest an un-passworded "mycode.zip" inside a password-protected "wrapper.zip" file. Spam filters will see that wrapper.zip contains mycode.zip (because of Zip's stupid encryption (hah!) doesn't protect its content list), but won't be able to examine mycode.zip.
Alternatively, use GPG and go forward.
getting around google virus scans (Score:2)
attach reversed.zip, download remotely and then
tac reversed.zip > yourarchive.zip
works perfectly
***"man tac" if youre unaware of it
Re: (Score:2, Interesting)
It annoys me as well, the number of zips I have called
Maybe - just maybe - google could consider allowing zips to account users who have specified it as a preference (default block as currently occurs).
Re: (Score:2)
Especially when a user is sending it to himself
Re: (Score:2)
Re: (Score:3, Informative)
encapsulate the zip (Score:2)
Re: (Score:2)
Re: (Score:2)
I did this extensively while working on my masters, now p
Re: (Score:2)
Re: (Score:2, Informative)
Why you aren't using version control is another question.
Re: (Score:2)
Use FTP and quit abusing email. If you are working in an environment where you are coding for a living, my guess is that you can harass the IT folks into setting up an FTP server and access for you.
File host service! (Score:2)
Re:More information (Score:4, Insightful)
For me the biggest problem with these is that there is no attachment for AV to pick off and there is hardly any text and no real advertising in the email so our spam filters don't block it either.
What does God need with a starship? (Score:2, Redundant)
"Why do you need a botnet that big?" he asks. "You don't need a million [infected computers] to send spam."
For spam, a million-strong botnet might be overkill. But botnets can do much more - like launching denial-of-service attacks. These attacks aim to overwhelm a Web site or Internet server by sending it a constant stream of garbage data at a particular Web site or Internet server.
So the question is, who is controlling these botnets and why? DDoS attacks can be pretty useful if someone wants to get a point across or to extort money from someone or some company. It will be interesting to see if they can trace it back to the source.
Re:What does God need with a starship? (Score:4, Insightful)
Removal Tool (Score:3, Informative)
Re:Removal Tool (Score:5, Funny)
The goggle really might do nothing.
Re:Removal Tool (Score:5, Funny)
Re: (Score:2)
Hm. You know, I thought I'd made a poor choice of words (I should've said "inured" you to anything) but, to judge from most furries I've seen, I was probably right the first time.
Re: (Score:2)
You know, you have to admit that would be one upside to being furry: it hardens you to just about anything, and it does it quick.
Hm. You know, I thought I'd made a poor choice of words (I should've said "inured" you to anything) but, to judge from most furries I've seen, I was probably right the first time.
I still remember how I discovered one of my best friends in high school was a furry. I was doing a global search on his computer to find a file and ended up with a picture of two gay mice engaging in hardcore bdsm. Fucking Christ, warn a person, will ya? I could handle the gay part but you add furry to it and it all goes downhill. He's probably into pedo vore by now.
Re: (Score:2)
that is why (Score:5, Funny)
Maybe there's a silver lining here... (Score:5, Interesting)
Re: (Score:2)
Re: (Score:2)
I can imagine it easily - 99% of the surfers denied acess would simply go "damm internet" and surf elsewhere, or go do something off-net.
ISP Solution (Score:2)
Every web page the infected connection tries to go to says: This is a message from [YourISP]. In accordance with Federal regulations, your Internet access has been temporarily suspended. Your connection has been identified as one which has the [Virus flavor of the week]. You can download a removal tool: [link here] or contact us at 800-whatever. If you prefer, you may contact us at the phone number listed on your service bill.
Every email gets bounced/returned with the same message.
It would work without th
Re: (Score:2)
Re: (Score:2)
Thanks, but no.
Re: (Score:2)
Re: (Score:2)
The solution is neither simple, nor painless. If detection of a botnet infection is (as it is now) left to the end user, one would merely have to "not check" in order to circumvent quarantine. And lets face it
Re: (Score:2)
Barking up a wrong tree, dude.
This thing is a trojan, OS has nothing to do with it. User decided to run the malicious program.
But, I agree with your conclusion. Those responsible should be held accountable. Users that trojaned their machines should be cut off from the net, possibly even fined.
Re: (Score:3, Interesting)
What technically minded people in general forget is that most users want their security soluti
Re: (Score:2)
Well, I'm sure that someone is able to explain it to them. If noone else, then Googles lobbyists.
(2) the average user would not know why his computer cannot access the internet;
Maybe user support could clue him in? If he's doesn't care to call them up, then he doesn't need connectivity anyways.
(3) many flat out refuse to learn good online habits until forced to and even then
Beyond the slashdot effect... (Score:2, Informative)
A few years back there was a spate of DDOS attacks on root servers, for example: http://www.informationweek.com/news/showArticle.jh tml?articleID=197004237 [informationweek.com] which were described at the time as "
Re: (Score:2)
This one, I have a feeling actually IS that large.
Especially for a few worms, where different variants were released by different groups who bought the source code and modified it. This one quite possibly is that large.
ALSO, 250,000 computers, while it is a massive botnet, is not truly excessive in regards to spam. Take a look at what is being filtered for nowadays. NJABL, DSB
Whats Worse? Storm or Nugache (Score:2)
Insert Scary Music Here
An email warning I got yesterday (Score:3, Interesting)
As much as I hate to suggest this... (Score:2)
Us conscientious customers shouldn't have to suffer the conditions imposed on us by people who can't bother to take even the most simple precautions. How much better would service be without all these botnets clogging the tubes?
Re: (Score:2)
Re: (Score:2)
The public has been aware of computer viruses for 20 years now, and there are plenty of free tools (many of which are provided at no cost by ISPs) to prevent an infection. It's long past time people took responsibility for their own computers.
Re: (Score:2)
The computer makers and the OS writers should handle this, it's THEIR PRODUCT!!!
Hey DELL and M$! I bought this computer from you and it got itself infected with
spambots because YOU didn't provide the security to prevent this. So (to quote
Weird Al) I'LL SUE YA!
Re: (Score:2)
Yet we expect people to maintain their own cars. Are you suggesting it's unrealistic to expect people to get regular oil changes?
The computer makers and the OS writers should handle this, it's THEIR PRODUCT!!!
So let's sue automakers when a negligent owner lets their car's engine seize.
Re: (Score:2)
Military? (Score:5, Interesting)
how to know (Score:2)
Incidentally, for Windows lusers who realize they may have been practicing unsafe computing, is there any way to tell that you've been zombified? I know some of these worms are fairly stealthy. Some
Had this show up (Score:3, Interesting)
Hi. Worshipper has sent you a greeting card.
See your card as often as you wish during the next 15 days.
SEEING YOUR CARD
If your email software creates links to Web pages, click on your card's direct www address below while you are connected to the Internet:
http://682.81.0.23/?9907cd64e28cae3d7703a3b01bda de (Poster's note: This URL has been altered to protect the rampant mad clickers amongst us)
Or copy and paste it into your browser's "Location" box (where Internet addresses go).
We hope you enjoy your awesome card.
Wishing you the best, Administrator, americangreetings.comMandatory Disconnect of Infected Computers (Score:3, Insightful)
Then if a botnet attack comes, turn off the overseas pipes as needed. Yeah I am a dreamer, but I am at least half way practical.
SPAM - the stupid side of things... (Score:2)
For year's I've wondered why we have such a persistant SPAM problem. There are number of things that can be done - but aren't.
- I don't believe there is ANY excuse for old viruses to circulate the web. I understand a new virus, but once a virus is known it should be stopped at the ISP & backbone levels.
- Where is the government? SPAM supposedly costs business' billions of dollars a year. That wo
Cool (Score:2)
Then perhaps something might actually be done about this nonsense once and for all. The only way something will get done is if hits the pocket books of enough 'big players'
Re:Cool (Score:4, Interesting)
I'm going to call it a net win for productivity and busniess in general. Which means that it's most likely that big business is behind the internet shutdown...and the Storm worm.
Shit, where'd I put that damned tinfoil hat...
Linux won't run it! :( (Score:2)
Seriously though, I thought Windows was supposed to be more secure, and less prone to this stuff than Linux? I mean, that's what Microsoft's Get The Facts campaig
Re: (Score:2)
English is not too difficult to understand if you look at the clues.
----
Mods, that joke is on topic, look up the parent original post.