News for nerds, stuff that matters
Sections
Slashdot Log In
FBI Releases Results of Operation Bot Roast
ScuttleMonkey (Related)
on Wednesday June 13, @01:57PM
from the notification-flagged-as-spam-and-deleted dept.
|
Log In/Create an Account (Related)
| Top (Related)
| 165 comments
| Search Discussion (Related)
Threshold: -1: 165 comments 0: 161 comments 1: 140 comments 2: 101 comments 3: 31 comments 4: 18 comments 5: 9 comments Flat Nested No Comments Threaded Oldest First Newest First Highest Scores First Oldest First (Ignore Threads) Newest First (Ignore Threads)
and go straight to the source
http://www.fbi.gov/pressrel/pressrel07/botnet06130 7.htm (Related) 0 [fbi.gov]
The debate has moved on (Related) by RedToad (Score:1) Wednesday June 13, @11:43PM
There have already been tons of viral messages from these two domains over the past few years. One of the big Windows worms ("Slammer," if I recall correctly) was often mailed out with an fbi.gov From address. Forging irs.gov messages is common among phishers.
by bob_herrick (784633) (Related) <bob@herrick.gmail@com (Related) >
on Wednesday June 13, @04:04PM (#19496459 (Related) )
1 reply (Related)
beneath your current threshold.Re:And here come the phishers.... (Related) by JohnnyBigodes (Score:2) Wednesday June 13, @05:01PM
Re:And here come the phishers.... (Related) by yuna49 (Score:2) Wednesday June 13, @05:06PM
Re:And here come the phishers.... (Related) by Intron (Score:2) Wednesday June 13, @05:16PM
Re:And here come the phishers.... (Related) by JohnnyBigodes (Score:2) Wednesday June 13, @05:25PM
Re:And here come the phishers.... (Related) by yuna49 (Score:2) Wednesday June 13, @06:49PM
Re:And here come the phishers.... (Related) by Em Adespoton (Score:2) Wednesday June 13, @07:53PM
1 reply (Related)
beneath your current threshold.Stuff like that already happens (Related) by billstewart (Score:2) Wednesday June 13, @04:21PM
Re:Stuff like that already happens (Related) by cibyr (Score:1) Thursday June 14, @01:48AM
Re:And here come the phishers.... (Related) by Adam9 (Score:2) Thursday June 14, @01:26AM
1 reply (Related)
beneath your current threshold.
by QuantumG (50515) (Related) <qg@biodome.org (Related) >
on Wednesday June 13, @02:03PM (#19494535 (Related) )
(http://rtfm.insomnia.org/~qg/ (Related) | Last Journal: Wednesday November 16, @08:11AM (Related) )
Re:That's easy to do. (Related) by Distortal (Score:1) Thursday June 14, @04:03AM
RFC 1491: you CAN get an email for an IP (Related) by artifex2004 (Score:2) Wednesday June 13, @02:22PM
Then a few months back I get word from my credit card company that someone had hacked into my account online (using my username and password), changed my billing address to someplace in NJ, then proceeded to try to charge a bunch of stuff on the account (luckily the CC company caught on to them and locked it down). I couldn't figure out how they did it.
Then a few months after that, I started to notice my computer acting strange. My router would be showing HEAVY activity even when I wasn't doing anything and Windows wasn't downloading updates. Eventually, I realized that someone must had botted my computer (still don't know exactly what they were up to, but I'm sure it involved sending out letters from an innocent Nigerian official just wanting people to help him transfer some money). That's how they got my account info for my credit card.
Anyway. I wiped the whole system clean (even tried out Linux for a while, but didn't care for it) and now the problem is gone. But it still makes me nervous as Hell. What drives me crazy is that I can't figure out how they did it. But, as a hacker friend once said: If it's on a network, it can be hacked--period.
by PitaBred (632671) (Related) <`slashdot' `at' `pitabred.dyndns.org' (Related) >
on Wednesday June 13, @05:03PM (#19497435 (Related) )
(http://pitabred.dyndns.org/ (Related) )
"I accidentally got my girlfriend pregnant by pulling out too late. After giving the kid up for adoption, we tried using a condom, but I didn't care for it, so now I'm back to pulling out, and hoping she doesn't get pregnant, because I really don't know what happened the first time."
Re:Found your problem (Related) by ozmanjusri (Score:2) Wednesday June 13, @09:40PM
1 reply (Related)
beneath your current threshold.Re:I thought I knew what I was doing too (Related) by Intron (Score:2) Wednesday June 13, @05:20PM
Re:I thought I knew what I was doing too (Related) by Bearhouse (Score:2) Wednesday June 13, @05:52PM
Re:I thought I knew what I was doing too (Related) by crabpeople (Score:2) Wednesday June 13, @06:11PM
Re:I thought I knew what I was doing too (Related) by bill_mcgonigle (Score:2) Wednesday June 13, @06:14PM
Also, ZoneAlarm is your friend... (Related) by Anonymous Coward (Score:1) Wednesday June 13, @06:25PM
Re:Also, ZoneAlarm is your friend... (Related) by AnyoneEB (Score:2) Wednesday June 13, @10:57PM
Re:I thought I knew what I was doing too (Related) by camperslo (Score:2) Wednesday June 13, @11:45PM
Re:I thought I knew what I was doing too (Related) by DeadChobi (Score:2) Thursday June 14, @03:15AM
Re:I thought I knew what I was doing too (Related) by dsmall (Score:1) Thursday June 14, @12:56AM
1 reply (Related)
beneath your current threshold.
by DamonHD (794830) (Related) <d@hd.org (Related) >
on Wednesday June 13, @02:03PM (#19494555 (Related) )
(http://d.hd.org/ (Related) )
And then a follow up with negligence-related charges for those who refused to give a f**k maybe?
Rgds
Damon
Re:Why not shut them down? (Related) by Dare nMc (Score:3) Wednesday June 13, @04:40PM
Or another approach. (Related) by khasim (Score:2) Wednesday June 13, @02:20PM
Re:Or another approach. (Related) by Nos. (Score:1) Wednesday June 13, @02:36PM
by khasim (1285) (Related) <brandioch.conner@gmail.com (Related) >
on Wednesday June 13, @02:52PM (#19495271 (Related) )
And ... ?
There isn't any way to shut down all of the zombies. But our government CAN act to shut down the zombies here.
First off, there is NOTHING stopping our FBI from contacting law enforcement agencies in Russia or China. They may not help, but then again, they may help.
Then, you track the traffic back from that machine. And from the next machine. And from the next machine.
Simple. The commands have to come from somewhere. You can monitor all inbound and outbound connections. That will tell you what machines that machine is communicating with. You just keep checking each of those to see whether the trail continues or ends.
A lot. So?
Do we stop arresting criminals just because other criminals will perform the same crimes?
Not really. There's no reason why it would take more than a week. If the zombies are not receiving commands, then they're not sending spam or doing DDoS attacks. In which case, the problem is already solved.
If they are receiving commands, then you've just gotten another link. Maybe more than one link.
In the meantime, the ISP's are limiting the damage caused by those zombies.
Re:Think globally, act locally. (Related) by mikael (Score:2) Wednesday June 13, @03:21PM
Re:Or another approach. (Related) by yuna49 (Score:3) Wednesday June 13, @03:46PM
Re:Or another approach. (Related) by plover (Score:2) Wednesday June 13, @04:59PM
B. It would do the NSA no good to listen to everything without filtering out the 99.999% which is irrelevant. Ergo, they must have pattern filters.
C. Botnets must be a big part of the filtered traffic.
D. NSA must be aware of botnets, their patterns, their control channels, their zombie elements.
E. Yet botnets continue.
F. The NSA must want them to continue unmolested.
The NSA knows how botnets work, and could hijack them at any time. The only reason to do so is to keep them in reserve for their own use.
I suggest the NSA would hijack botnets for counterattack if the US nets were attacked by another country.
That's my conspiracy theory, I hope you like it.
Re:My conspiracy theory (Related) by A nonymous Coward (Score:2) Wednesday June 13, @03:32PM
Re:My conspiracy theory (Related) by rthille (Score:2) Wednesday June 13, @04:27PM
Re:My conspiracy theory (Related) by charlesnw (Score:1) Wednesday June 13, @05:17PM
Re:My conspiracy theory (Related) by jamar0303 (Score:1) Wednesday June 13, @10:28PM
Re:My conspiracy theory (Related) by Adambomb (Score:2) Thursday June 14, @12:02AM
NSA? (Related) by bill_mcgonigle (Score:2) Wednesday June 13, @06:19PM
1 reply (Related)
beneath your current threshold.Re:Why not shut them down? (Related) by Nikker (Score:2) Wednesday June 13, @05:14PM
Re:Why not shut them down? (Related) by DamonHD (Score:1) Wednesday June 13, @05:29PM
how many computer users dont patch/update their computers or use a very old version? how many of those wouldnt know if they were infected or have an infected computer as it is?
They didn't say that's *all* the zombies (Related) by billstewart (Score:3) Wednesday June 13, @04:29PM
Re:They didn't say that's *all* the zombies (Related) by philpalm (Score:1) Wednesday June 13, @08:13PM
Warn the kids and wake the neighbors. Be suspicious of any e-mail posing as the FBI and wanting a response by clicking an URL, fbi.gov or otherwise.
beneath your current threshold.
Your computer has been determined to be infected by a malicious program that gives control to another person. Please double-click on the link to find out how to get your computer disinfected.
FBI
No. Really.
Re:Solution (Related) by berashith (Score:1) Wednesday June 13, @05:04PM
Re:Solution (Related) by n3tcat (Score:1) Thursday June 14, @03:40AM
Re:Solution (Related) by trolltalk.com (Score:2) Wednesday June 13, @02:17PM
Re:Solution (Related) by mr100percent (Score:3) Wednesday June 13, @02:24PM
Re:Solution (Related) by blhack (Score:2) Wednesday June 13, @02:27PM
Re:Solution (Related) by A nonymous Coward (Score:2) Wednesday June 13, @03:01PM
1 reply (Related)
beneath your current threshold.Re:Solution (Related) by zCyl (Score:2) Wednesday June 13, @06:09PM
fdisk (Related) by bill_mcgonigle (Score:2) Wednesday June 13, @06:23PM
Re:Solution (Related) by dodobh (Score:2) Thursday June 14, @03:02AM
by jadin (65295) (Related)
on Wednesday June 13, @02:14PM (#19494723 (Related) )
(http://www.pepper-land.net/ (Related) )
Re:Anyone else? (Related) by patrikor_007 (Score:1) Wednesday June 13, @05:34PM
Re:Anyone else? (Related) by jadin (Score:1) Wednesday June 13, @03:35PM
1 reply (Related)
beneath your current threshold.
Who is the real victim here?
A botnet is a collection of compromised computers under the remote command and control of a criminal "botherder." Most owners of the compromised computers are unknowing and unwitting victims. They have unintentionally allowed unauthorized access and use of their computers as a vehicle to facilitate other crimes, such as identity theft, denial of service attacks, phishing, click fraud, and the mass distribution of spam and spyware.
Hmm... I didn't realize that the FBI was investigating the RIAA and their anti-P2P tactics!
Likewise, if i leave a completely unprotected winbox up on the internet and it gets rooted, should Microsoft be held responsible (which seems to be what some of you think)?
In both cases harm has been caused by my negligence, and i should be held accountable for both.
Re:Accountability (Related) by Nilych (Score:1) Wednesday June 13, @02:56PM
Re:Accountability (Related) by man_ls (Score:2) Wednesday June 13, @11:21PM
Re:Accountability (Related) by swb (Score:2) Wednesday June 13, @02:57PM
Re:Accountability (Related) by blhack (Score:2) Wednesday June 13, @03:01PM
Re:Accountability (Related) by kalirion (Score:2) Wednesday June 13, @03:10PM
Re:Accountability (Related) by eqreed (Score:1) Wednesday June 13, @03:00PM
1 reply (Related)
beneath your current threshold.Re:Accountability (Related) by z80kid (Score:1) Wednesday June 13, @03:01PM
Re:Accountability (Related) by Orlando (Score:2) Wednesday June 13, @03:05PM
Re:Accountability (Related) by wilec (Score:1) Thursday June 14, @02:18AM
Re:Accountability (Related) by thejynxed (Score:1) Wednesday June 13, @08:04PM
5 replies (Related)
beneath your current threshold.
by dpbsmith (263124) (Related)
on Wednesday June 13, @02:29PM (#19494943 (Related) )
(http://www.dpbsmith.com/ (Related) )
I just did some Googling on things like "bad Gartner predictions" and "missed Gartner predictions" or '"Gartner predictions" scorecard' hoping that someone had tried to keep tabs on them, but found to my disappointment virtually no relevant hits. Everyone discusses them in the months after they're released, nobody seems to check back even as recently as a year.
Of course, with predictions like these for 2002 (Related) [gartner.com]... "During 2002, leading-edge businesses will exploit application integration to generate business innovation...." how the heck would anyone ever figure out whether or not it was fulfilled?
I can't believe people pay Gartner for this stuff.
"The analysts have no clothes!" (Related) by 6031769 (Score:2) Wednesday June 13, @07:19PM
Re:Yes, and never forget Gartner predicted... (Related) by PPH (Score:2) Wednesday June 13, @03:55PM
Re:Yes, and never forget Gartner predicted... (Related) by AncientPC (Score:1) Wednesday June 13, @04:56PM
Re:Yes, and never forget Gartner predicted... (Related) by cswiger (Score:1) Wednesday June 13, @07:36PM
by toby (759) (Related) * (Related)
on Wednesday June 13, @02:32PM (#19494995 (Related) )
(http://www.telegraphics.com.au/ (Related) | Last Journal: Friday June 08, @10:37PM (Related) )
When the monopoly is finally busted, I guess it will no longer be implicit that "We're talking about Windows, of course."
IE says it right in the window title (Related) by KeyboardMonkey (Score:1) Wednesday June 13, @11:57PM
by twitter (104583) (Related)
on Wednesday June 13, @02:39PM (#19495093 (Related) )
(http://lists.clickers.org/linuxsig/index.html (Related) | Last Journal: Tuesday June 12, @07:20PM (Related) )
That they are looking into the problem is a good start. Gmen reading are advised to consult with the Honeynet Project (Related) [honeynet.org] and regard vector vendor "help" with suspicion. It would also be nice to see them call a spade a spade and abandon the false OS neutrality that keeps them for doing so. This is a Windows problem and the relative risks should be published. Otherwise they are lying to us and keeping information we can all use locked away. Most importantly, though, they need to clean their own house.
I don't know what "the relative risks" means, but since none of my Windows machines are in a botnet, and there are millions and millions of them that are not, this is not a Windows problem. It's a basic user education problem. Windows may have more attack vectors than other OSes, but that doesn't mean they are not known or are impossible to avoid. Simple common sense goes a long way. People get infected with botware because they download things they shouldn't or don't bother to keep their machines up to date by turning on automatic updates so they don't have to worry about anything.
If you think one chmod +x is an insurmountable obstacle to turning your shiny Linux or OS X box into a bot, remember that people get infected by executables in password protected ZIP files and that all of the most massively distributed worms have all required significant user intervention to propagate. Maybe one of these days you'll inherit 800 million completely clueless users, and maybe then you'll call it a "Linux problem"?
Re:getting a clue. (Related) by Macthorpe (Score:2) Wednesday June 13, @04:12PM
Linux bots, seldom seen. (Related) by twitter (Score:2) Wednesday June 13, @04:38PM
Who are you? (Related) by Anonymous Coward (Score:1) Wednesday June 13, @04:46PM
Re:Linux bots, seldom seen. (Related) by Macthorpe (Score:3) Wednesday June 13, @04:50PM
Re:Linux bots, seldom seen. (Related) by dedazo (Score:2) Wednesday June 13, @04:51PM
Re:getting a clue. (Related) by dedazo (Score:2) Wednesday June 13, @04:39PM
...none of my Windows machines are in a botnet (Related) by Larry_Dillon (Score:2) Wednesday June 13, @03:52PM
Re:It's good to see the FBI getting a clue. (Related) by dodobh (Score:2) Thursday June 14, @03:07AM
The advice they are giving home users. (Related) by twitter (Score:2) Wednesday June 13, @02:59PM
by Animats (122034) (Related)
on Wednesday June 13, @03:01PM (#19495427 (Related) )
(http://www.animats.com (Related) )
Skipping the ad-heavy page linked in the article, here's the FBI press release (Related) [fbi.gov].
As usual, no mention of Microsoft.
by athloi (1075845) (Related)
on Wednesday June 13, @03:05PM (#19495483 (Related) )
(http://www.dionysius.com/ (Related) | Last Journal: Tuesday June 05, @11:05AM (Related) )
I would like to suggest that, whatever operating system we put on the desktop for the average person, there be some initiative to educate them in best practices computing, even if only for the 4-10 common tasks (email, websurfing, games, mp3s, pr0n, quicken, word processing) they will use. I volunteer to design and write the curriculum if there's some rational initiative to get it out there to the human herd.
1 reply (Related)
beneath your current threshold.
Re:Tools for checking for Bot activity (Related) by charlesnw (Score:1) Wednesday June 13, @05:57PM
by Bob9113 (14996) (Related)
on Wednesday June 13, @03:34PM (#19495919 (Related) )
(http://www.traxel.com/ (Related) )
by codepunk (167897) (Related)
on Wednesday June 13, @03:48PM (#19496155 (Related) )
(http://www.codepunk.com/ (Related) )
I think they are full of it, I am willing to bet with a linux box jacked into a mirrored port in the core that I can find bots and malware on more like 95% or better of windows based enterprises. There is not a network I have looked
at in the last two years that is not owned, botted etc in some fashion.
Microsoft and the Botnet Task Force have also helped out the FBI.
Yes, it's true - without microsoft, this wouldn't have been possible.
Think about it...
If bots are the new viruses, why not let the established tools treat them as such? Can't the FBI just turn the entire codebase over to Symantec, McAffee, etc, etc, etc? Seems like this would help a lot of people in the short term...
Or, if this is already being done and the users aren't using any kind of AV software, I would think they have chosen this route, have they not?
Would the study then be saying that 75% of companies aren't using up-to-date virus software? Or even 95% as a poster above suggests? I'd think the reverse is more likely, that AV is being run, but isn't effective at detecting the botware.
beneath your current threshold.
by MrCopilot (871878) (Related)
on Wednesday June 13, @04:25PM (#19496789 (Related) )
(http://www.mrcopilot.com/ (Related) | Last Journal: Tuesday August 02, @11:10AM (Related) )
by nurb432 (527695) (Related)
on Wednesday June 13, @04:44PM (#19497119 (Related) )
(http://slashdot.org/~nurb432/ (Related) | Last Journal: Friday August 27, @04:24PM (Related) )
Hear that RIAA? Millions of people .. Millions.
became ubiquitous. That and the fact that Microsoft Windows
is a huge security hole, is what has allowed the botnets
and spam to proliferate.
If all Microsoft machines were disconnected from the
Internet, the problems disappear.
All the windows boxes dissapear, so the bot-lovers would start targeting linux and OSX.
Don't think that just because there isn't a very active threat against those platforms doesn't mean that one isn't possible.
Re:Botnet (Related) by dc29A (Score:2) Wednesday June 13, @03:03PM
Re:Botnet (Related) by Knara (Score:2) Wednesday June 13, @03:05PM
Re:Botnet (Related) by PitaBred (Score:2) Wednesday June 13, @05:29PM
Re:Botnet (Related) by Knara (Score:2) Wednesday June 13, @03:09PM
Re:Botnet (Related) by Pojut (Score:2) Wednesday June 13, @03:11PM
Re:Botnet (Related) by 99BottlesOfBeerInMyF (Score:2) Wednesday June 13, @03:25PM
MOD PARENT UP! (Related) by Futurepower(R) (Score:2) Thursday June 14, @12:19AM
Re:Botnet (Related) by Skrynesaver (Score:3) Wednesday June 13, @04:37PM
Re:Botnet (Related) by dave562 (Score:2) Wednesday June 13, @05:41PM
1 reply (Related)
beneath your current threshold.
Windows was ubiquitous long before botnets became a problem.
Botnets became a problem as full-time internet access by unsophisticated home users became more ubiquitous, and Windows was the primary target because it was the main OS used by the targeted users. If there had been a Mac OS or Linux monoculture instead, people would have been tricked into install malicious software on those platforms instead.
Re:Botnet (Related) by rob1980 (Score:2) Wednesday June 13, @02:48PM
Re:Botnet (Related) by secPM_MS (Score:2) Wednesday June 13, @03:24PM
Re:Botnet (Related) by Noga Rosenthal (Score:1) Wednesday June 13, @07:13PM
2 replies (Related)
beneath your current threshold.4 replies (Related)
beneath your current threshold.
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2007 SourceForge (Related) , Inc.
No comments:
Post a Comment