Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Anti-Scammers Become Storm Botnet Victims

CowboyNeal posted more than 6 years ago | from the sticking-their-necks-out dept.

The Internet 207

capnkr writes "It looks like the efforts of the anti-scammers at sites like 419eater, Scamwarners, Artists Against 419, and possibly others have become the target of the Storm botnet. Spamnation has a post about it, and as of this writing none of the above listed sites are responding. Spamnation reports that CastleCops and other anti-spam forums are being DDoSed as well. Sounds like a massive, concerted effort against the folks who are fighting the good fight. Although I hate it for the owners and admins of the above sites, I think it shows without a doubt that their efforts to 'get back' at the scammers are working."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered


Slashdotted (5, Insightful)

elh_inny (557966) | more than 6 years ago | (#20520955)

Posting the info and having people slashdot the mentioned sites is not going to help them either :)

Re:Slashdotted (3, Insightful)

MollyB (162595) | more than 6 years ago | (#20521073)

To an extent, you are correct. But I got the impression from the Spamnation link (#4) that this has been going on for days. Heck, the Update on that site was dated Sept. 6. We only have n number of users. The Russians (read TFA) have lots and lots (technical term) of botnets and are assumed to be taking revenge on their tormentors. I think this trumps the slashdot effect, but that's just my opinion.

More than just DDoS (4, Informative)

weierstrass (669421) | more than 6 years ago | (#20521227)

At the moment http://www.aa419.org/ [aa419.org] gives me the main pages of my own web server on my laptop

user@my-box:~$ host aa419.org
aa419.org has address
aa419.org mail is handled by 5 mail.aa419.org.

Re:More than just DDoS (5, Informative)

cpq (1153697) | more than 6 years ago | (#20521661)

user@my-box:~$ host aa419.org aa419.org has address
Actually this is the SMART thing to do. If they're attacking the hostname of the website, any smart admin would change the DNS record to lower the TTL to update, and update their address to This way the botnet boxes end up attacking themselves. I've done it before. Then once the attack is over you update your A name record to the actual IP.

Re:More than just DDoS (1)

morgan_greywolf (835522) | more than 6 years ago | (#20521753)

Probably Slashdotted. They use DynDNS for DNS:

morgan@dagda:~$ dig aa419.org

; > DiG 9.3.4 > aa419.org ;; global options: printcmd ;; Got answer: ;; ->>HEADER'd (2, Informative)

cpq (1153697) | more than 6 years ago | (#20521733)

Some of the site's are using DNS records to point back to and lowering their TTL so the botnet machines attack themselves. Easy way to defend (in some way) a DDoS. Don't count on the site(s) being up until the owners are sure more bandwidth / CPU cycles won't be wasted.

interesting (-1, Flamebait)

Anonymous Coward | more than 6 years ago | (#20520969)

[edit] Original

Day 1

Mommy, I am only 8 inches long, but I have all my organs. I love the sound of your voice. Every time I hear it, I wave my arms and legs. The sound of your heart beat is my favorite lullaby.

Day 2

Mommy, today I learned how to suck my thumb. If you could see me, you could definitely tell that I am a baby. I'm not big enough to survive outside my home though. It is so nice and warm in here.

Day 3

You know what Mommy, I'm a girl!! I hope that makes you happy. I always want you to be happy. I don't like it when you cry. You sound so sad. It makes me sad too, and I cry with you even though you can't hear me.

Day 4

Mommy, my hair is starting to grow. It is very short and fine, but I will have a lot of it. I spend a lot of my time exercising. I can turn my head and curl my fingers and toes, and stretch my arms and legs. I am becoming quite good at it too.

Day 5

You went to the doctor today. Mommy, he lied to you. He said that I'm not a baby. I am a baby Mommy, your baby. I think and feel. Mommy, what's abortion?

Day 6

I can hear that doctor again. I don't like him. He seems cold and heartless. Something is intruding my home. The doctor called it a needle. Mommy what is it? It burns! Please make him stop! I can't get away from it! Mommy!! HELP me!! No . . .

Day 7

Mommy, I am okay. I am in Jesus's arms. he is holding me. He told me about abortion. Why didn't you want me Mommy?

One more heart that was stopped. Two more eyes that will never see. Two more hands that will never touch. Two more legs that will never run. One more mouth that will never speak.


Re:interesting (0, Offtopic)

Anonymous Coward | more than 6 years ago | (#20521061)

Week 5: Mommy, now i've just started to develop a brain and only now does conciousness have a probability greater than zero of occurring. Mommy, how the fuck was i having that internal monologue during the first few days of my life? Oh wait i wasn't as i was just non-sentient sack of chemicals.

Re:interesting (0, Offtopic)

Anonymous Coward | more than 6 years ago | (#20521189)

I can hear that doctor again.

Really. What with? No hearing system at that stage. Barely present nervous system and certainly nothing large enough to call a brain at the other end capable of interpreting the signals.

Learn some basic science, creationism-boy.

Re:interesting (3, Funny)

Anonymous Coward | more than 6 years ago | (#20521687)


I do, usually. But in your case the post-natal variety seems fitting.

craigslist scammers (4, Funny)

digitalsushi (137809) | more than 6 years ago | (#20520975)

I screwed with a craigslist scammer this week. It was sorta fun.

http://digitalsushi.com/goraku/fakecheck/story.htm l [digitalsushi.com]

Getting him to mail a check made out to "Pownd Uholot" was entertaining. :)

Re:craigslist scammers (0)

Anonymous Coward | more than 6 years ago | (#20521009)

That mail from the "FBI agent" is gold :D Thanks for that

Re:craigslist scammers (3, Interesting)

WhatAmIDoingHere (742870) | more than 6 years ago | (#20521081)

You blew your load too quickly. The comedy comes from pissing them off and seeing how many hoops you can get them to jump through before telling them that you're just fucking with them.

Re:craigslist scammers (1)

digitalsushi (137809) | more than 6 years ago | (#20521089)

i was gonna tell him that my imaginary daughter spilled juice on the check, and then ask for another overnighted copy. but the scammer wasn't getting any more clever, and i just got bored with it honestly.

Grey Hat solution (3, Interesting)

DigiShaman (671371) | more than 6 years ago | (#20520999)

Aside from the legalities, perhaps Grey Hats round the world need to start developing "neuter-viri" (self replicating auto-patchers). These zombified machines have got to be defanged somehow, and fast.

Re:Grey Hat solution (2, Insightful)

snsr (917423) | more than 6 years ago | (#20521063)

"neuter-viri" (self replicating auto-patchers).
This is a great idea. I wonder how well this would be recieved- I guess ideally it wouldn't even be noticed.

Re:Grey Hat solution (2, Insightful)

saskboy (600063) | more than 6 years ago | (#20521107)

The authors would have to be extremely careful. If they include a bug, the results could be worse than doing nothing at all. And if they include a backdoor or auto-update feature, the blackhats could end up using machines with the auto-patcher infection instead.

Re:Grey Hat solution (4, Interesting)

Evi1BastardFromHe11 (986822) | more than 6 years ago | (#20521115)

What would this accomplish? The lusers have to be hit hard to start to care about what sort of malware resides on their machines. I would rather see a solution where someone exploits a hole in the Storm control implementation and distributes a disk shredding update to all nodes.

50M dead HDDs would be fun in the oldschool spirit and at the same time would generate enough of fuss for people to start actually caring about security.

Re:Grey Hat solution (4, Funny)

budgenator (254554) | more than 6 years ago | (#20521259)

There was a great disturbance in the force, it was if 50 million zombies all died as one. Then suddenly they returned in their pristine and un-patched state, and then suddenly update.windows.com went super-nova and imploded into a black hole.

Battle of the Worms.... (4, Informative)

CharonX (522492) | more than 6 years ago | (#20521211)

I recall reading a quite interesting article on this topic a while ago while doing research for a university seminar I had to hold.
The big crux is that the "worm" needs to show negative behaviour, i.e. exploit it's host bandwith and CPU cycles, at least for a while, to gain sufficient impact to "infect & patch" vulnerable machines. It would turn into a battle of the worms, where "grey" worms attempt to infect as many machines as possible, plug the security holes, seek new machines to "infect and patch" and then, after a while, self-delete themselves - while the "black" worms, attempt almost the same, only that they do not self-delete but instead continue to exploit their host. Most machines that become victims of rootkits or worms are actually patched up once infected, to avoid losing the machine to competing malware.

Re:Grey Hat solution (4, Informative)

Nintendork (411169) | more than 6 years ago | (#20521527)

Someone already did this to counter the Blaster worm. See Welchia [wikipedia.org] . The problem with this one though is that it was flooding networks with ICMP pings, causing more network outages [internetnews.com] than the Blaster worm it was designed to fight.

Re:Grey Hat solution (3, Interesting)

Anonymous Coward | more than 6 years ago | (#20522627)

That is because Welchia was poorly designed. A properly designed counter-worm would not actively seek out targets. Instead, it would patch the system and wait for an infected system to contact it, where it would then spread to that infected system.

Free Software Solution. (1)

Erris (531066) | more than 6 years ago | (#20522207)

The defang you are looking for has been provided by the free software community. Unlike the worms themselves, user and vendor action are required for this to work and it's completely legal. Vendor support is growing every day because everyone now realizes the root cause is a costly software monoculture. IBM, HP and Dell now all sell gnu/linux to desktop users. With a little bit of advertising the problem will go away soon.

Going to need a bot-net to take out the bot-net. (1)

snsr (917423) | more than 6 years ago | (#20521027)

Good to know that these sites have been effective; I had always been skeptical of them having any measurable effect. What's the next salvo?

Re:Going to need a bot-net to take out the bot-net (1)

gbjbaanb (229885) | more than 6 years ago | (#20521449)

Maybe BlueSecurity will resurrect Bluefrog now that its been shown that the spammers will go after you regardless. It is good to know the anti-spam crowd is having an effect though, once the botnet is patched into obscurity, we can get back to normality.

The counter-solution (2, Interesting)

EvilMonkeySlayer (826044) | more than 6 years ago | (#20521047)

The counter solution to this is for a big company like Google, Yahoo, Microsoft (yes, Microsoft) should offer either their servers, hosting, bandwidth etc. To these sites that are quite evidently being successful against the scammers. Or at the least they could give the sites some cash injections to buy more capable servers, fatter lines etc.

Re:The counter-solution (1)

cpq (1153697) | more than 6 years ago | (#20521699)

Or you can always get the idiot PC users who download .exe's , .pif's etc from email and get them a bloody virus scanner. Anyone think of attacking that end instead of putting the site on a damn quad-core w/ GigE uplink?

Re:The counter-solution (1)

Joebert (946227) | more than 6 years ago | (#20522111)

These are corporations you're talking about, they're just happy the botnets' attention isn't on them. Why would they want to draw fire to themselves, what's in it for them ?

Re:The counter-solution (2, Interesting)

Anonymous Brave Guy (457657) | more than 6 years ago | (#20522309)

What on earth makes you think people like Microsoft and Google don't get hit by these people?

I have no data you don't, but I'd be amazed if no-one has ever threatened the richest IT companies in the world with outages if they don't pay up.

Re:The counter-solution (1)

Joebert (946227) | more than 6 years ago | (#20522357)

If the portion of the botnet is attacking sites not on Corporation property, it's obviously not attacking Corporation property.
Why do somthing to bring it to Corporation property, what's in it for them other than an increased workload ?

somebody needs to stop... (0, Troll)

FudRucker (866063) | more than 6 years ago | (#20521099)

flooding the PC market with ms-windows PCs that never get updated or virus checked to clueless consumers...

as long as msft & oem pc manufacturers are more interested is making a quick buck and the problems that go along with it are ignored this sort of thing is never going to stop...

-if you mod this comment down it just buries your head deeper in the sand-

Re:somebody needs to stop... (3, Informative)

Constantine XVI (880691) | more than 6 years ago | (#20521129)

Storm actually does install updates and checks for viruses on its victims. It just excludes anything that would make life harder on itself.

And just in case any site survives the DDOS attack (0, Redundant)

DrXym (126579) | more than 6 years ago | (#20521103)

The submitter has helpfully provided the links to these sites so Slashdotters can finish the job.

Re:And just in case any site survives the DDOS att (1)

The Ancients (626689) | more than 6 years ago | (#20521203)

Because we all know we're all to lazy to look for the links ourselves.

Hmm. I'm not actually sure if that's true, sarcastic, funny, or what...

Solution??? (4, Insightful)

Glock27 (446276) | more than 6 years ago | (#20521153)

Why have I seen several articles on this Storm worm, and yet no one seems concerned with how to remove it from systems?

Is there a scanner and fix available? It does require executing an email attachment, right?

It really shouldn't be called a worm unless it can worm its way in without social engineering...

Worm / hacker / cracker (1)

wantedman (577548) | more than 6 years ago | (#20521337)

Actually, the entire virus / worm / trojan definition is pretty muddled.

AFAIK, Worm meant it propagated by the Internet. Trojan horse was something that was an undesirable feature in a software package and did not propagate on it's own. Virus attacked itself to different software packages by itself, unlike a trojan horse, and it relied on piracy to spread. And since the sneaker net was way more prevelent than the Internet, making the virus the most common in early computing, virus came to refer to all 3.

Self-emailing malware share more features with worms than trojans, so they're more often classified as worms, although there is a move to reclassify them as trojans.

All anti-virus programs detect and fix it, and there are also stand alone fixes avalible. Clicky [teamfurry.com] The problem is all the unpatched boxes.

Almost (3, Informative)

Xenographic (557057) | more than 6 years ago | (#20521677)

* A worm infects without user intervention (e.g. SQL Slammer, which *was* a worm).
* A trojan is a hidden "feature" of some otherwise legitimate software.
* A virus is a program that attaches itself to other files.
* A backdoor gives someone remote control of the machine.
* A botnet is an advanced backdoor where one can control many machines at once, e.g. from an IRC channel. PCs infected by completely different malware can all join the same person's botnet. Conversely, PCs infected by customized versions of the same malware can join different botnets.

The problem is that the media doesn't understand ANY of this and that the categories aren't all mutually exclusive. This is a trojan & backdoor that spreads via dumb users executing attachments they shouldn't.

Re:Almost (1)

mashade (912744) | more than 6 years ago | (#20521775)

Almost ;)

From what I've seen, this trojan isn't even spread as an attachment. It's simply a link within an email, spoofed to some credible URL. You click it, and a download begins under the facade of an 'authentication program'.

Re:Solution??? (0)

budgenator (254554) | more than 6 years ago | (#20521355)

team fury [teamfurry.com] reports a removal tool called SunShine [teamfurry.com] can remove the worm; of course being a Linux Geek rather than a windows geek I've no-way to vouch for the tool so if you toast your harddrive, you've been warned, YMMV

Re:Solution??? (4, Insightful)

Joebert (946227) | more than 6 years ago | (#20522157)

This is exactly how people get infected.

Who the fuck are you, & who the fuck is "Team Fury" ?

Re:Solution??? (2, Insightful)

an.echte.trilingue (1063180) | more than 6 years ago | (#20521379)

It is delivered as a Trojan. People don't discuss removal techniques because the answer is so painfully obvious that most here don't think it is worth mentioning. Norton, AVG, clamAV, any anti-virus on the market or available for free will detect storms various incarnations, and most of them will disable it. Problem is, there are just millions and millions of (windows) users who don't bother with the most basic security.

Re:Solution??? (4, Insightful)

Anonymous Brave Guy (457657) | more than 6 years ago | (#20522349)

Problem is, there are just millions and millions of (windows) users who don't bother with the most basic security.

And the solution is for ISPs to cut off any machine that appears to have been compromised, and for ISPs to collectively isolate and cut off other ISPs that allow significant amounts of bad traffic out of their networks.

I'm all for due process, but in cases like this, a real-time response is required and there isn't much doubt whether a machine/network is emitting significant amounts of bad traffic or not. You just have to make people get their own house in order, and if they don't, kick them off the Internet until they do.

Re:Solution??? (2, Interesting)

an.echte.trilingue (1063180) | more than 6 years ago | (#20522441)

I hear you. I work for a small business, and we have our email handled by our ISP. They won't cut off other users who are spamming, and so their mail server is now starting to show up on spam blacklists. It is really embarrassing to have to call our partners and customers and tell them to check their spam box for our email, and then we are lucky if it is even there. We will be changing ISPs soon... I hope.

Re:Solution??? (1)

TehZorroness (1104427) | more than 6 years ago | (#20522565)

Precisely! Right now the internet is a terrible mess. It is much to easy to get away with atrocious abuse of network infrastructure (ie. DoS, DDoS, Botnets, spam ect. ect). The ISPs truly don't give a damn. I have been the victim of a small handful of attacks over the years. I'll tell you the story you all already know. It is quite easy to be a complete scumbag on the net. Being DoSed is not at all a fun experience. It costs time, money, and inconvenience to put up with.

If I plow through Main Street in a tank and fire shells though arbitrarily passing vehicles, I will have my license removed and will certainly spend some time in jail. On the internet, abuse goes unpunished. In my opinion, people who abuse network infrastructure should be quite simply suspended from that network. All ISPs should invest a lot more effort in a counter-abuse department which can actively handle reports from the public. As for those infected by botnets, they need to be pulled over and have a stern talking to before they are allowed back on the net.

Re:Solution??? (1)

advocate_one (662832) | more than 6 years ago | (#20521411)

It usually comes as an email with an enticing subject line such as "xxxx has sent you an E-card" and inviting you to click on a link in the email to view the ecard...

I'm expecting a waver of emails inviting the reader to "click here [address.ru] to see Vannessa Hudgens's naughty pics, the ones Disney tried to ban..."

Re:Solution??? (3, Interesting)

Technician (215283) | more than 6 years ago | (#20522171)

I got a bunch of those e-card emails several weeks ago. Knowing how my Ubuntu box is configured, I went ahead to see how the exploit works. The link is a very sparce page indicating a video download that will start automatically. If it doesn't, click here. The exploit uses both a script and social engineering. Firefox didn't start an automatic download on Ubuntu, so for grins I clicked the link. I was asked where I wanted to save e-card.exe. This exploit page was common to many e-mails indicating cards from my mother, relative, etc. I thought it interesting there was no information passed to load any kind of customized card like a real e-card. Also highly suspicious is the link was an IP address, not a URL. That move alone gets past filtered DNS services and a hosts file.

By the way, the download in Ubuntu asking where to save it has a cancel button. I didn't download it to get a filesize. Sorry.

I know I am not sending any extra data as part of this bot simply because my network switch sits right under my monitor. There is no unusual traffic here. I think everyone should be constantly monitoring their network traffic.

Maybe MS and Ubuntu can make a traffic monitor that sits on the desktop by default. I know most people would ignore it thinking it is Limewire or Torrent traffic.

Re:Solution??? (4, Informative)

arkhan_jg (618674) | more than 6 years ago | (#20521471)

It is a backdoor trojan, not a worm - largely spread via email .exe attachments, but also installed by at least one other mass mailer worm, W32.Mixor.Q@mm.

http://en.wikipedia.org/wiki/Storm_Worm [wikipedia.org]
http://www.symantec.com/security_response/writeup. jsp?docid=2007-011917-1403-99&tabid=2 [symantec.com]

It's detected and removed by the usual array of anti-virus software (it installs a malicious device service %System%\wincom32.sys, that joins it to the private distributed P2P control network). However, it does also have capability to download additional malicious software, and has changed form several times.

http://www.symantec.com/enterprise/security_respon se/weblog/2007/01/trojanpeacomm_building_a_peert.h tml [symantec.com]
Currently the malware being downloaded is as follows:

game0.exe: A downloader + rootkit component - detected as Trojan.Abwiz.F
game1.exe: Proxy Mail Relay for spam which opens port TCP 25 on the infected machine - detected as W32.Mixor.Q@mm
game2.exe: Mail Harvester which gathers mail addresses on the machine and post them as 1.JPG to a remote server - detected as W32.Mixor.Q@mm
game3.exe: W32.Mixor.Q@mm
game4.exe: It contacts a C&C server to download some configuration file - detected as W32.Mixor.Q@mm

Re:Solution??? (1)

skeeto (1138903) | more than 6 years ago | (#20522285)

Why have I seen several articles on this Storm worm, and yet no one seems concerned with how to remove it from systems?

Yep, there is a patch that will remove the worm so that you will never get it again: here [debian.org] .

so sad... (0)

Anonymous Coward | more than 6 years ago | (#20521157)

if only someone had taken the time to teach Skynet love.

Want 'script' that would click all links on page (0, Offtopic)

gHeTtO RaBbi (1150785) | more than 6 years ago | (#20521171)

Want 'script' that would click all links on page and then down load those pages, and put them in a nice, neat stack for me to scroll through at my leisure. I'd like it to put all the pics in a separate stack, and blown each one up to the max resolution. I'd like it to also, once finished with the links and down loads from the first page, to start clicking and down loading the links from the first batch of links from the first page, and so on. I think it would need a fairly robust 'back out of this dead end' feature as well as stopping troublesome down loads, so as to continue with doing a reasonable job down loading and filing most of the data. Hasn't someone already done this? I might want it to work well with google. It would hit the first 20, then the next 20, etc.

The Final Virus (-1, Troll)

Anonymous Coward | more than 6 years ago | (#20521181)

This is yet more evidence of the need for a real life Final Virus [catb.org] . It's just a shame that in order to write malware of this complexity you pretty much have to be employed full-time by the Russian mafia to do it.

Yes, I'm militantly anti-Windows. This kind of attack is the reason why. That botnet is practically fucking sentient. Pick any ten supercomputers, imagine them in a Beowulf cluster, and you still won't be anywhere near its power. All because Gates cut a deal with IBM 20 years ago. Fuck that.

Big deal? (1)

machinelou (1119861) | more than 6 years ago | (#20521207)

Doesn't that seem like a poor allocation of resources on behalf of the bot net controllers? I mean, how long could a DDOS attack possibly be carried on? A few hours? Maybe a day at most? I can see that, for a retailer, that sort of thing would seriously impact business but if these sites go down for a day, does that really matter?

In addition, implementing a DDOS probably entails some sort of risk. This could be either in terms of having individual machines identified and temporarily disabled or in terms of the risk of getting caught increasing with every illegal act that is committed (although, the risk is probably very small, it's still there).

Re:Big deal? (2, Insightful)

cpq (1153697) | more than 6 years ago | (#20521711)

Doesn't that seem like a poor allocation of resources on behalf of the bot net controllers? I mean, how long could a DDOS attack possibly be carried on? A few hours? Maybe a day at most? I can see that, for a retailer, that sort of thing would seriously impact business but if these sites go down for a day, does that really matter?
They could have it run for a month or two. With the lack of knowledge of PC users, and the mass-spreading technique, and the fact we have cable infected PCs and now have zombied Verizon FiOS machines, that's some serious bandwidth. This is just a slap on the wrists from the runners of the botnet, perhaps making a point?

Re:Big deal? (1)

arkhan_jg (618674) | more than 6 years ago | (#20522061)

Why would they stop after one day? The latest attacks have been going on for several days already. The current estimates put between 10 and 50 million computers as part of the storm botnet. They'd need to keep rolling in new ones as they get filtered out, but just 2 million computers involved in a rolling DDOS would be a real headache, especially if they just do normal http requests like a real user; most DDOS attacks only use a few 10's of thousands bots at most, though average numbers required are rising as defences improve.

How do you explain this to the average joe? (4, Interesting)

mark-t (151149) | more than 6 years ago | (#20521279)

I told my oldest son about this botnet yesterday, mentioning that with between 2 million and 20 million CPU's working at any one time, and even that larger figure likely representing only a fraction of the botnet's total capacity, it collectively represented the most powerful supercomputer ever built... and it was effectively under the control of a small group of people with criminal intent - the author, or authors, of the worm. My son responded to me with a great deal of scepticism, first saying that none of these security experts which have made this analysis have any way to estimate what sort of computing power military organizations might have, so saying that it represented the most powerful supercomputer ever was actually a completely meaningless claim, and also, he proclaimed that the story was most probably just hype and over exaggerated. He said that the claim of the most powerful supercomputer ever being controlled by criminals was simply too much to be believable, like the headlines one might see on the front page of the Weekly World News tabloid. He also said that it was ludicrous to see how sending people "penis extension ads" (which is about all he figures a botnet can do) can actually seriously harm anything or anyone.

So this got me to wondering... how much of this actually _is_ something that is of any real concern, and if it really is, how could it be explained to people in such a way that it's not going to sound like some claim from a conspiracy theorist?

Re:How do you explain this to the average joe? (1)

DavidTC (10147) | more than 6 years ago | (#20521403)

Your son is an idiot.

Yes, the supercomputer they have control of is only the most powerful known computer, but it's unlikely that, barring national government involvement, there are any others, and considering the amount of power they would draw, they'd need some sort of secret power source, too.

But arguing about the difference between 'most powerful known' and 'most powerful' is idiotic. I'm sorry, everyone knows what people are talking about.

Secondly, they clearly can do serious harm to the internet and any machine on it. Whether or not any specific attack would harm any people is unknowable, but they can, right now, take any company or person they want offline and keep them there.

Re:How do you explain this to the average joe? (0)

Anonymous Coward | more than 6 years ago | (#20521577)

Whether or not any specific attack would harm any people is unknowable, but they can, right now, take any company or person they want offline and keep them there.

I think the GP's point is that if "the most powerful supercomputer in the world" is capable of no more than sending a lot of email or interrupting some organization's internet access, is it really that "powerful"?

I mean, don't we usually measure the "power" of supercomputers in terms of their compute power? How quickly can the botnet render "Toy Story"? How many SETI@home blocks? Can it do weather modeling? Atomic bomb modeling?

Flooding the internet just doesn't seem like a particularly good demonstration of supercomputing power. Nor do I think the average Joe, who's own internet connection goes down periodically, for inexplicable reasons, sometimes for hours, if not days, will be especially impressed with taking "any company or person offline."

Re:How do you explain this to the average joe? (5, Insightful)

garompeta (1068578) | more than 6 years ago | (#20521693)

You are underestimating how valuable and powerful distributed computing is, my friend.
It has been used as a distributed MD5 crackers, collisions in SHA-1, and search for extraterrestrial life... (eer... yeah)
Having a gigantic botnet of at least 100,000 computers to unimaginable millions of infected computers that we'll probably ignoring or we are unable to detect, this gives a tremendous asset to a malicious hacker.

It is a very fat milking cow:

1) Crack passwords that it is not considered crackeable in a reasonable amount of time
2) Botnets to attack whoever he wants (at a reasonable price or for a reasonable cause)
3) Millions of Passwords, logins accounts, paypal, amazon, credit card, identity, whatever, stolen.
4) Millions of proxies to hop on and chain hiding the source of a real meticulous attack. 5) Millions of illegal distributed server to host for illegal materials (eg: virii, worms, child pornography)


Re:How do you explain this to the average joe? (1)

garompeta (1068578) | more than 6 years ago | (#20521463)

Simple: 1) by saying that you have facts 2) by reminding him you are an expert in computers and programming 3) by showing to him a sample of what a "good" trojan can do in his laptop. (good: AV stealthy, rootkit, proxy http/socks, bot, keylogger, distributed computing capabilities, rat, rat with gui, shell, at least) 4) fry his computer, steal all his logins. 5) When you see him crying telling him, "I told you so".

Re:How do you explain this to the average joe? (1)

mark-t (151149) | more than 6 years ago | (#20521517)

Er... is there any alternative to options 3,4,and 5? I'd rather not cause any real damage. I helped raise him to be skeptical of exaggerated claims, and I understand where this is coming from, and I don't even really care whether he believes the story or not, personally... although I admit that found it bothersome that the fact that I know a thing or two about computers wasn't duly considered in his assessment.

Re:How do you explain this to the average joe? (1)

garompeta (1068578) | more than 6 years ago | (#20521597)

hey that was fast!, Of course there is an alternative. I was just joking, but actually thinking of it... it could work! It depends how naive your son is, the more he is the easier to montage the show. If he doesn't have the slightest idea about trojans and rats, why don't you get a few well-known ones, and show to him what someone can do in his machine? (without destroying anything) The more impressionable he is, the more "aware" he will be of the potential threats he had been ignoring. Since news articles can be "felt" like easily hyped, why don't you show him technical papers (this gives more credibility in my opinion) and researches about real cases and real methods. A interesting case can be found in GRC.com, where Gibson explaines with enough detailes how he was DDoS and how he tracked the attacker back. To be make him more security conscious and with the real shit, get him the book series "Stealing the network", those stories are well written by real hackers in very, very possible scenarios with real methologies and accesible and well-known tools.

Re:How do you explain this to the average joe? (1)

mark-t (151149) | more than 6 years ago | (#20521777)

I think what he finds incredible is how 'science-fiction' it sounds.... 20 million computers all being infected by a single virus... all potentially dedicatable towards a single distributed goal... sort of reminiscent of T3, perhaps.

Re:How do you explain this to the average joe? (1)

garompeta (1068578) | more than 6 years ago | (#20522401)

Then, don't you find suitable my advises to give him a reality check?

Give him the real thing, show him how a real trojan works and some technical papers.
Why don't you show him the whole process? Get an unpatched (Sp1) Windows XP (download it), and do a complete "hacking" job, exploiting DCOM RPC, uploading a backdoor, executing it, getting gui control remotely and finally loading the keylogging module of the trojan?.

It is not hard to do, it will look impressive ("oh, my god he is using the console, he is a hacker") and the exploits available are very stable and sophisticated.

You can even change the console to "color 0a" to make it look "cooler" =P (Oh my god, my dad is a über-hacker!)

If it is hard for you to perform such a show, just give him what I told you, real cases, technical papers or from trustable sources. That looks more objective than the "news media". And as I told you before there is a case in grc.com GO TO THE SITE and click the DRDoS note.
If he has some brain, I think he will get it.

Re:How do you explain this to the average joe? (0)

Anonymous Coward | more than 6 years ago | (#20521835)

Well, it's clear that your son has very limited analytical expertise (some blame the teachers, I actually blame the parents). If he's five it's ok, if he's fifteen, oh dear...

Some movies, some Wikipedia, some angles (4, Insightful)

Torodung (31985) | more than 6 years ago | (#20522679)

This article [wikipedia.org] is a good place to start.

You could also introduce him to the theory behind Bittorrent [wikipedia.org] , which is a good demonstration of how many computers each doing a small task, given modest bandwidth, can add up to massive distribution and publication power in short order.

Now, what if some distributed network decided to siphon a gig of illegal or embarrassing materials onto a compromised target machine. Perhaps a politician that is voting the wrong way?

Then ask him, not if the entire banking industry is safe, but if an individual's information (SHA hash collision or private key, but that's not "average Joe" speak) could be subject to a distributed brute force attack [wikipedia.org] .

With the growing power of computers making tiny pieces of malware harder and harder to notice (that 1% of processor time is more and more powerful), and malware being able to literally hide files from the user until such time that it chooses to reveal them, it seems like it's only a matter of time before someone with a large enough botnet, and enough imagination, could start attacking individuals and/or siphoning off their money. How you do this is not something I care to discuss, but the black hats (both the actual criminals and the security experts, as an exercise) already have ideas and are working on it. That's why you'll see them periodically calling for stronger encryption (more bits in the keys). If there was no possible threat, they wouldn't be creating and suggesting longer keys. Rootkits [microsoft.com] would not be a concern, if files hidden from the user were always benign (most are).

But all it takes is the wrong person to have the right idea, a breakthrough that changes the assumptions, especially in cryptography. Show him the movie "Sneakers [imdb.com] " if you want to fuel some imagination regarding that. It's crap, but it's also fun and sizes the problem for the average Joe. Assuming that only ethical people work in cryptography is somewhat naive. Assuming that unethical people are not watching the progress of ethical individuals in the field is stupid.

There's nothing to say such solutions and attacks haven't occurred already, but it seems, as your son suggests, unlikely. You can bet if a criminal has figured it out, a little bit of money siphoned off here and there would be almost impossible to detect, especially in an environment where people are unwilling to believe it's even possible. Believe me, if the idea has hit Hollywood [imdb.com] , it's old hat. That's exactly how such a criminal would proceed if they had found a way to leverage such distributed computing applications. They would target a distributed network of accounts, one by one, in a way that looked like banking errors (which are numerous and automatically corrected by the bank) and slowly siphon money from the banking industry itself, through compromised individual accounts. No individual would suffer, because of correction processes in the banks, the world's capital reserves would.

Then ask what that money could buy in terms of influence, weapons, elections?

Any compromised machine is a liability to its user. Botnets are a menace to society, and we're lucky all they're (hopefully) being used for is "penis enlargement" ads and DDoS attacks. That's barely scraping the surface of their potential.

If he wants to go on believing that his safety and security are a given, without any effort on his own part, there's little you can do, but anyone with any imagination, who is not in flat out denial, can demonstrate that distributed computing applications have a great deal of power, and that basic security is everyone's concern. It is definitely not good that these networks exist and are in the hands of people bent on harm.


fallacious statement (1)

mr100percent (57156) | more than 6 years ago | (#20521293)

Although I hate it for the owners and admins of the above sites, I think it shows without a doubt that their efforts to 'get back' at the scammers are working.

By that logic, does all the hate mail Fred Phelps get mean that he's on the right track?
Does it mean that all those protesting Bush's speeches validate his argument?
Odd way for the author to phrase it. I don't think there's a cause and effect here. They might be publicly opposed to the spamming and phishing scams, but they fact that they're getting attacked doesn't necessarily mean they're making more than a dent in it.

Re:fallacious statement (1)

AaxelB (1034884) | more than 6 years ago | (#20521491)

fallacious statement
Sorry, offtopic, but I remember once in early high school I was trying to figure out what "fallacious" meant, and was trying to break it down to its roots (I know too few roots for that really to be useful) and looking for words that sound similar to see if that gave some hint. The only word I came up with was "fellatio," and as you might guess, that gave me an odd pespective.

Now, whenever anyone uses "fallacious," my first response is as if it were "fellatious."

I wonder what a fellatious statement would be...

Re:fallacious statement (0)

Anonymous Coward | more than 6 years ago | (#20522339)

Someday, you will father my child.

Re:fallacious statement (1)

Angostura (703910) | more than 6 years ago | (#20521889)

Nope, you've got yourself into a logical twist.

By that logic, does all the hate mail Fred Phelps get mean that he's on the right track?

It's a poor analogy. It wouldn't be someone sending hate mail to Fred Phelps. It would be someone putting up posters about the problems with Fred Phelps, and then Phelps setting out to kill the Poster-makers.

Does it mean that all those protesting Bush's speeches validate his argument?
Wrong analogy again. A correct analogy would be If those protesting against Bush's speeches caused a massive decline in support for Bush and he moved to outlaw protest. It has nothing to do with validating his argument.

Hope that helps.

Re:fallacious statement (0)

Anonymous Coward | more than 6 years ago | (#20522717)

Perhaps it's more like a hose swatting at flies. The fact that the horse spends time and energy trying to destroy them is ergo proof that the flies are having an effect on hurting the horse?

Re:fallacious statement (1)

capnkr (1153623) | more than 6 years ago | (#20522597)

"Odd way for the author to phrase it. I don't think there's a cause and effect here." - mr100percent

So if the scammers, whatever their ilk, didn't do (or pay to have done) this DDOS attack by the biggest botnot in existence, then... Who Did?
And... Why?

The stated goal of a scambaiter is not just to get some sort of a prize from the scammer, it is primarily
to deprive the scammer of time and resources they could/would otherwise spend on victims (source: 419eater.com).

Since the scammers had to spend *something* on this attack, that same "something" cannot be spent scamming victims.

Mission Accomplished. And a great example of Cause and Effect. Though perhaps a bit more effect than anticipated. :) BTW, the 'eater has been the victim of DDOS'es before this one, though this might be the biggest such attack to date; they recovered quicker before, and IIRC there weren't as many other sites taken down simultaneously. To me, this big an effort on the part of the scammers shows that the 'eater and other such sites are very much a thorn in the side of the scammers.

Even if this is solely an action by the controllers of the Storm botnet to publicly 'flex their muscles', it is keeping "Storm" (or part of it, at least) busy and away from 'innocents/ignorants', and that fits right into the goals of the anti-scammer sites as well...

Of course, YMMV.

Bandwidth... (0)

Anonymous Coward | more than 6 years ago | (#20521321)

Assuming you run a DDOS attack with 100'000 clients and 100kbit/s upstream per client you end up with ~9700mbit/s. _Most_ sites don't have so much bandwidth and if they do, it costs a lot of cash. The botnet is most likely even bigger and can assign more clients to the attack. So NO, getting a bigger pipe is not gonna work for them... One way to solve this problem is making the ISP disconnect the infected clients or block them at the edge of the originating network.

TheScamBaiter is still up (0)

Anonymous Coward | more than 6 years ago | (#20521343)

TheScamBaiter.com [thescambaiter.com] has been under attack for several days too, but has stayed up so far.

Solution (1, Redundant)

JamesRose (1062530) | more than 6 years ago | (#20521461)

Right a piece of code that detects if the storm bot virii are present, then have it format the hard drive. If their computer is putting other computers with real work to do in danger they should be deleted until the administrator learns to use it. Seems harsh but trying to fix a computer thats already infected is almost impossible to do, as they keep changing the virii, so carpet bomb it.

Re:Solution (1)

nyctopterus (717502) | more than 6 years ago | (#20522047)

Brilliant! And let's bomb all the major cities in the world because they have criminal elements operating out of them.

Possible solution: treat computers like a car (2, Insightful)

Swavek (1139471) | more than 6 years ago | (#20521467)

Didn't some internet provider at one time threaten or attempt to disconnect customers whose computer were suspected to have spyware or a virus infection? I think more internet provider (errr.. high speed internet providers) should take charge and disconnect computers that are (or might be) part of a large botnet. This brings me to the point that like most people don't have a clue how a car functions under the hood, most people also don't know how a computer functions inside its case. So ignorance should not be an excuse for having a computer that's infected with every virus or malware under the sun which is connected to the internet. If a person had a car that kept causing problems on the road than it would eventually find itself towed away or shoved off the road (much like a computer might be forcefully disconnected from it's internet provider).
Much like the local police or the local transportation dept. might maintain roads and highways, so should the super information highway be maintained by internet providers and various security experts. Ignorance cannot be an excuse! It certainly doesn't work when you're being arrested for vehicular manslaughter. "But officer, I didn't see that old lady crossing the road..."

Re:Possible solution: treat computers like a car (2, Insightful)

wubboy (96276) | more than 6 years ago | (#20521575)

Something like, if os = Windows then deny?

Re:Possible solution: treat computers like a car (2, Insightful)

pokerdad (1124121) | more than 6 years ago | (#20521731)

Didn't some internet provider at one time threaten or attempt to disconnect customers whose computer were suspected to have spyware or a virus infection?

Virtually all ISPs do this, its just that what they count as "suspected to have spyware or a virus infection" is pretty lax. Usually the only thing that counts is sending out more than x many emails in a certain time frame. Of course, I would rather have them be lax than be intruding to my system.

Re:Possible solution: treat computers like a car (2, Interesting)

Anonymous Coward | more than 6 years ago | (#20522149)

Where I work (local WISP, over 4000 subscribers and growing!), we block nothing to or from a customer's PC (or PCs) unless it trips our antivirus or antispam system with a known signature. We do not do heuristic scanning, so we don't get false positives from malformed data or "something close".

We also have intrusion protection at all of our border routers, that scans incoming and outgoing traffic. Our traffic wipes its feet before going out to the internet, if you know what I mean.

We also have a service plan for customers that covers all labor for anything they need done to their computer systems. So, if we detect that they are sending out viruses or spam (or both), we give them a call, pick up their PC, clean it, and return it to them at no additional charge.

The benefits of this program have been measured in lower support calls from customers, a cleaner internal network, more bandwidth available to everyone, and customers who no longer have to spend hundreds of dollars at a brick and mortar computer store to have their systems cleaned up and repaired. We are proactive in protecting the rest of the internet from whatever someone brought home from work (or any other network) on a laptop.

It's a hell of a lot of work, and a lot of money invested in hardware based IPS/Anti-SPAM/Anti-virus detection and prevention. But, it's an end-to-end service that rivals no other ISP that I know of.

We advertise by word of mouth, BTW, and will break 5000 customers by summer of next year. People on our system love this stuff!

Re:Possible solution: treat computers like a car (1)

jamar0303 (896820) | more than 6 years ago | (#20521909)

YES, that's exactly what we need. If people would only actually give a damn about their security, there would be no such incidents. Support the use of OS X on PCs if you're not into the Linux thing, because Windows is proven to be insecure (I only use XP because I haven't installed my patched copy of OS X on it yet).

Re:Possible solution: treat computers like a car (1)

cpq (1153697) | more than 6 years ago | (#20522295)

Packet shaping + Disconnection from the network with a generic catch-all DNS redirect to a page with the virus cleaner would work quite well on mitigating the attack from the ISP's side. But what do they care, it's just their bandwidth :)

The choice of targets is significant in itself (1)

The Mutant (167716) | more than 6 years ago | (#20521725)

I mean, don't they have better things to do with these resources? Seems like the choice of targets tells us a lot about the opportunities - or perhaps lack of opportunities - that this resource (i.e., the Storm botnet) can be put to.

I mean, why not use it to make money? Attacking these sites ain't gonna directly generate any revenue. And one must consider such a resource as having a time value; what is the half life of a bot net anyhow? Is this one, given it's size, likely to be significantly different?

Sure, these scams are easier to pull off it people are uninformed. But how many of the people who are likely to get involved in such scams, upon receipt of these emails, will google first?

It might be a demonstration/test (2, Insightful)

quanticle (843097) | more than 6 years ago | (#20521867)

It might be a test or demonstration of the botnet. Like any weapon it needs to be test fired before actual use. The persons controlling this might be trying to kill two birds with one stone - test the botnet, and knock those who taunt you off the air.

size (1, Interesting)

Johnny Mnemonic (176043) | more than 6 years ago | (#20521985)

Is the size of the the Storm network large enough to hold a really big player hostage? Could they eg DDoS Microsoft's update portal? Or Google's homepage? either for ransom or without?

Could they cripple other internet backbone infrastructure stuff, and thereby hold the nation's entire computer infrastructure hostage?
As TFA mentions, a DDoS attack is more expensive for the customer of the botnetters, as is easier to detect and stop at the ISP level, so I wonder if those attacks are really feasible, or if it'd just mean that everyone that's infected loses internet access until they get cleaned up. Which might not be such a bad thing.

But, in short, is the Storm Botnet an actual national security threat? Could a foreign power commission it to do the US computing infrastructure grievous harm; but could it be stopped if the DHS etc took protective action at the ISP level?

Re:size (0)

Anonymous Coward | more than 6 years ago | (#20522035)

The sad truth is that we just don't know. There's never been anything this big before.

Makes me wish I was a bit more underground. I'd give almost anything to get in on this. I know exactly what I'd like to make it do. I want to pick a large region with crappy bandwidth, like, say, the entire African continent, and blow them off the internet for a few days. Just to see what would happen.

Hmmm. I need to get me some criminal contacts.

Re:size (4, Insightful)

maztuhblastah (745586) | more than 6 years ago | (#20522651)

if the DHS etc took protective action at the ISP level?

Oh please god.... no....

Think of what you're saying! The same group of people who color-code our paranoia, who decide that waterbottles are dangerous, and who advise us to purchase duct tape... you want to turn to them for help securing the Internet? Do you have any idea how painful that would be?

No -- the responsibility here lies with the users and (to some extent) the carriers. If the user's machines are infected, disconnect them. If the carriers detect a large, coordinated traffic pattern, investigate -- and if it's a DDOS attack, block it at the firewall level (before the traffic leaves your network segments.)

Slashdotted (*blush*) (1)

Torodung (31985) | more than 6 years ago | (#20522097)

Sorry guys, we know your suffering a DDoS attack right now, but we just thought we'd publish links to your sites on Slashdot to compound the issue. Think of it as an experiment to see what effect a massive storm of legitimate traffic will have on an ongoing DDoS attack.

What? Your data center is a molten slag?! Eureka! We'll stop by with marshmallows and weenies.

This is one case where publishing the hyperlinks might have been a bad idea. I wonder how many people are hitting their refresh buttons right now. ;^)


This is not proof (2, Insightful)

Rich Klein (699591) | more than 6 years ago | (#20522515)

"I think it shows without a doubt that their efforts to 'get back' at the scammers are working."

I'd like to agree with you, but it makes about as much sense as saying that increased violence in Iraq is proof that the US has terrorists on the run.

The scam-baiters may be doing a lot of good, but DDoS attacks against them aren't proof of it.

testing for Storm (1)

phrostie (121428) | more than 6 years ago | (#20522561)

is there a way to test or check that people who might be part of the bot net how to see if they have it?

rather than gong on about what it is doing, how about we spread the word on how to stop it one computer at a time.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account