Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
Security The Internet IT

Torpig Botnet Hijacked and Dissected 294

Posted by timothy
from the why-would-you-want-to-get-rid-of-it dept.
An anonymous reader writes "A team of researchers at UC Santa Barbara have hijacked the infamous Torpig botnet for 10 days. They have released a report (PDF) that describes how that was done and the data they collected. They observed more than 180K infected machines (this is the number of actual bots, not just IP addresses), collected 70GB of data stolen by the Torpig trojan, extracted almost 10K bank accounts and credit card numbers worth hundreds of thousands of dollars in the underground market, and examined the privacy threats that this trojan poses to its victims. Considering that Torpig has been around at least since 2006, isn't it time to finally get rid of it?"
This discussion has been archived. No new comments can be posted.

Torpig Botnet Hijacked and Dissected

Comments Filter:
  • uuh..yeah. (Score:5, Interesting)

    by Anonymous Coward on Monday May 04, 2009 @12:44AM (#27812717)

    why dont they just send a self destruct/uninstall command and kill it or would that be too simple ?

    • Re:uuh..yeah. (Score:5, Insightful)

      by shentino (1139071) on Monday May 04, 2009 @12:51AM (#27812747)

      Funny thing is, if you do a favor for someone you don't even get thanked, but screw it up even a bit and you get slapped with a lawsuit.

      • Re:uuh..yeah. (Score:5, Insightful)

        by DragonDru (984185) on Monday May 04, 2009 @01:03AM (#27812791)
        I feel so conflicted. It is good they got enough information to tell law enforcement who the victims are, but I feel sad they did not do more to stop the botnet. However, there would be lawsuits if they had done more. Also, the bot masters now know exactly who was messing with their system (even their email addresses and their technique). Net effect, a botnet will go down slowly and some researches will get a *lot* of spam.
        • Re: (Score:2, Insightful)

          by Swift2001 (874553)

          We need the full weight of the law to come down on these creeps. How is this any better than a pickpocket, or a den of thieves? Answer, not at all. I understand that we like the freedom of the internet. But making a bot of somebody's computer is akin to rape. Stealing 10,000 credit cards warrants a life sentence, and governments must fund efforts to detect and arrest the people responsible. Plus, our banks and stores and so on must get smarter security.

          • Re:uuh..yeah. (Score:5, Insightful)

            by Tenebrousedge (1226584) <tenebrousedge AT gmail DOT com> on Monday May 04, 2009 @04:06AM (#27813475)

            Wow. The sentiment is unarguable, but the rest of your post is amazingly uninformed.

            What is a den of thieves? Do thieves nest in the rafters of seedy pubs or something? Did anyone imply that credit card theft was "better" than some other kind of theft?

            I understand that we like the freedom of the internet. But making a bot of somebody's computer is akin to rape.

            Non sequitur. Also, the analogy is not appropriate: there is no physical harm being done.

            ...governments must fund efforts to detect and arrest the people responsible.

            They do. Perhaps you can improve on that suggestion with some further content.

            Plus, our banks and stores and so on must get smarter security.

            Smarter than what? As long as they have massive amounts of valuable information, they are targets. However, that's not really the subject of TFA, which is the low-hanging fruit consisting of people using insecure browsers and operating systems. The people running Torpig didn't need to hack a bank, they just relied on people being idiots. Vista and Win7 may be steps towards a more secure desktop environment, but they're not a cure for the root issue: PEBKAC.

            PEBKAC being ubiquitous, we should not expect a solution to the botnet issue any time soon. Just try and think of it as another idiot tax.

            • Re:uuh..yeah. (Score:5, Insightful)

              by WhatAmIDoingHere (742870) <sexwithanimals@gmail.com> on Monday May 04, 2009 @05:32AM (#27813793) Homepage

              They do. Perhaps you can improve on that suggestion with some further content.

              Problem is that a lot of countries DON'T care about these kinds of crimes. Laws tend to have a hard time keeping up with technology.

            • Re: (Score:3, Insightful)

              by X0563511 (793323)

              I understand that we like the freedom of the internet. But making a bot of somebody's computer is akin to rape.

              Non sequitur. Also, the analogy is not appropriate: there is no physical harm being done.

              You could argue that no physical harm is being done in either case*. Most (if not all) harm is psychological. Assuming another crime is not commited at the same time (assault the victim is not rape. They just happened at the same time).

              * STDs make this a bit more confusing. Until STD infection is a crime in and of itself, it will continue to complicate it.

      • Re:uuh..yeah. (Score:4, Interesting)

        by RiotingPacifist (1228016) on Monday May 04, 2009 @02:27AM (#27813133)

        Fine, use geo-IP to only uninfect computers that are in countries that:
        1) Aren't sue friendly (e.g not the US)
        2) Don't have any jurisdiction in your country (e.g not the US)

      • Re: (Score:2, Insightful)

        by davester666 (731373)

        But who do they know to sue?

        If you're smart enough to hack into this botnet and make it do your bidding, your smart enough to not have commands sent to it traced back to you.

      • by erroneus (253617)

        It just occurred to me. I have made the argument countless times that the true victims of all this "identity theft" are banks and large financial institutions and I still believe that is the case regardless of how much "big money" attempts to shift the blame and responsibility onto the people. What occurred to me is that if there were an interest larger than government that could get Microsoft to change its ways and fix its stuff, it would be "big money." I wonder if big money has even considered this?

        • Re: (Score:3, Interesting)

          by Zero__Kelvin (151819)

          "What occurred to me is that if there were an interest larger than government that could get Microsoft to change its ways and fix its stuff, it would be "big money." I wonder if big money has even considered this?"

          Yes, they have. It is called a security landscape. Banks calculate that it is cheaper to allow the fraud and compensate than implement security measures that would stop the problem. You can read more about this [amazon.com] if you want to know.

          Disclaimer: I am not Bruce Schneier, nor do I play him on Slas

      • Funny thing is, if you do a favor for someone you don't even get thanked, but screw it up even a bit and you get slapped with a lawsuit.

        Even if you don't screw up, the recipients of your favours will probably be outraged if they find out. If they've got a bot-ridden unpatched box connected to the net, they're quite likely to be assholes in other ways also.

        To fight an asshole, you must be an asshole. The researchers should first provision a "legal fund" by milking the financial data they apparently recovered. Then launch lawsuits against the dummies whose PCs were participating in the botnet as accomplices to said financial crime (e.g. ac

      • Re: (Score:3, Insightful)

        by Anenome (1250374)

        This is where we need hackers with a 'license to kill... botnets'. Something like 007 for the digital age. The idea that killing a botnet can get you convicted of something is so ludicrous. The damage imposed by killing a botnet is miniscule compared to leaving the botnet open to prey on wider society. Where's the white hackers with a set of balls on 'em? Excuses, excuses, let's see action.

    • Re: (Score:3, Interesting)

      by Fwipp (1473271)
      Obligatory car analogy: If you owned a rental car company, would you outfit your fleet with a self-destruct procedure that could be initiated remotely?
      • by NoobixCube (1133473) on Monday May 04, 2009 @01:07AM (#27812809) Journal

        Yes, if it were an illegally operated rental car company, or if I were using the rental cars to smuggle banned substances or stolen goods. Turn the car into a smoking pile of twisted metal, and all the coke hidden in the seats suddenly isn't there anymore.

      • Re: (Score:2, Interesting)

        by navyjeff (900138)
        If you were watching a group that stole a fleet of cars, then figured out how to make keys for a bunch of their cars, would you pour sugar in the gas tanks after you were done joyriding to make sure they wouldn't be drivable again?
        • Assuming the trojan is represented by the cars, what exactly would the users computer be? Or are you planning on destroying the computers themselves?
    • Re:uuh..yeah. (Score:5, Insightful)

      by LackThereof (916566) on Monday May 04, 2009 @01:01AM (#27812777)

      why dont they just send a self destruct/uninstall command and kill it or would that be too simple ?

      Because that would be highly illegal. Just as illegal as creating the botnet in the first place. You can't just make modifications to 180,000 computers without their owners knowledge or consent.

      Some governmental agency should man up and do it, though. Researchers have been hijacking botnets to study them for a while now, they almost have it down to a science. Someone in Homeland Security should just grow some balls and hire a team of professionals to hijack and destroy botnets.

      • Re:uuh..yeah. (Score:5, Insightful)

        by corsec67 (627446) on Monday May 04, 2009 @01:03AM (#27812789) Homepage Journal

        Some governmental agency should man up and do it, though. Researchers have been hijacking botnets to study them for a while now, they almost have it down to a science. Someone in Homeland Security should just grow some balls and hire a team of professionals to hijack and destroy botnets.

        What is to keep that agency from just hijacking and *keeping* the botnet? Suddenly you have a government agency with a trojan installed on many computers.

      • Re:uuh..yeah. (Score:5, Insightful)

        by Opportunist (166417) on Monday May 04, 2009 @01:04AM (#27812793)

        "If YOUR homeland security fiddles with MY government computer, get ready for international troubles."

        Here's your reason why they don't.

        • Re: (Score:3, Interesting)

          "If YOUR homeland security fiddles with MY government computer, get ready for international troubles."

          Link the IP to a location, then only fix bots in computers that are in your country, this has the additional advantage that you become more secure while your enemies get weaker. Alternatively, and i know that the American's about may find this crazy, you could ask permission of other countries to take out their bots too (as it benefits you that the bot net is dead). Ideally you could come to an agreement that protects you from prosecution of the laws you break, probably in exchange for the logs or some othe

        • Re: (Score:2, Interesting)

          "If YOUR homeland security fiddles with MY government computer, get ready for international troubles."

          I would assume that the computer hacking side of government security does have their own form of black ops? A building/fake business with an internet connection under a false name. Of course any such "fiddling" would not remove the black op connection to your government system but merely the botnet that would be likely to be found eventually.

        • by wvmarle (1070040)
          I totally agree. Having a botnet on your government's computers is enough of trouble already I'd say. It's quite sad that even governments can not keep their computers safe.
    • Re:uuh..yeah. (Score:5, Informative)

      by VValdo (10446) on Monday May 04, 2009 @01:01AM (#27812779)

      Although we could have sent a blank conguration le to potentially remove the web sites currently targeted by Torpig, we did not do so to avoid unforeseen consequences (e.g., changing the behavior of the malware on critical computer systems, such as a server in a hospital). We also did not send a conguration le with a different HTML injection server IP address for the same reasons. To notify the affected institutions and victims, we stored all the data that was sent to us, in accordance with Principle 2, and worked with ISPs and law enforcement agencies, including the United States Department of Defense (DoD) and FBI Cybercrime units, to assist us with this effort. This cooperation also led to the suspension of the current Torpig domains owned by the cyber criminals.

      FTFA, they snaked a domain name they knew the botnet was going to use before the bad guys could, then just collected info sent to them by all the compromised systems.

      The submission header and the body are encrypted using the Torpig encryption algorithm (base64 and XOR)

      Torpig encryption algorithm: base64 and XOR. In contrast, Conficker uses all kinds of crypto (RC4, RSA, and MD-6 [sri.com]).

      W

    • which had already been registered by the criminals. Although we could have sent a blank conïguration ïle to potentially remove the web sites currently targeted by Torpig, we did not do so to avoid unforeseen consequences (e.g., changing the behavior of the mal-ware on critical computer systems, such as a server in a hospital). We also did not send a conïguration ïle with a different HTML injection server IP address for the same reasons.

      I'm also under the impression that they couldn't uninstall the bots as they didn't have enough control. However i don't see why they couldn't change the page that is injected to a huge "your computer is infected, criminals have your bank details" and perhaps a url to a tool to remove the bot.

      • Re: (Score:3, Interesting)

        by asdf7890 (1518587)

        Many would ignore such a message thinking it is yet another advertising scam. Those that would blindly follow the instructions are the ones who have so much crap on the machine from blindly following messages like this ("you may be infected, install SpamKillaBot now!!!!") in the first place that removing just one worm from their machine.

        The only way to make most listen and do something about their PC security is to actually break something, and that definitely would be a moral no-no. Even then, some would j

        • Re:uuh..yeah. (Score:4, Interesting)

          by RiotingPacifist (1228016) on Monday May 04, 2009 @04:57AM (#27813671)

          The injection normally happens on bank websites, I'd hope few would ignore a big scary message they saw when entering their bank details! Or they could inject it into ALL websites (the injection happens based on a whitelist of URLS) If they user got the warning at the top of EVERY page they viewed (Across all browsers), they'd soon get fed up and do something about it!

  • yes (Score:5, Funny)

    by mofag (709856) on Monday May 04, 2009 @12:45AM (#27812723)

    no, maybe, oh I don't know. Why do I get all the hard questions?

  • 3 years? Pfffft. (Score:5, Insightful)

    by Opportunist (166417) on Monday May 04, 2009 @01:08AM (#27812815)

    Take a machine. Install Windows XP SP1. Hook it to an unfiltered intenet access. Watch Sasser install. Mean time before infection: 30 seconds.

    That nuisance is 5 years old and still running rampart. Now, far from being the threat that Torpig is, but it shows you just how hard it is to get rid of something. And unlike Torpig, it's not really "in use" anymore. Its maker is gone, it doesn't get any updates or new variants to faciliate infection. We're talking about the same old crapware that every single AV kit knows and removes by now. Worse, it's a threat that any halfway decently patched machine is not susceptible to.

    And you want to get rid of Torpig?

    • by socsoc (1116769) on Monday May 04, 2009 @01:23AM (#27812885)
      Let's say I reinstall XP SP1 and somehow MS manages to have included a nic driver for my card. I then need that Internet access to download AV from my uni, patches from MS, etc. How do you expect a consumer to have a machine fully patched prior to the initial network connection?
      • Re:3 years? Pfffft. (Score:5, Informative)

        by Hurricane78 (562437) <deleted@@@slashdot...org> on Monday May 04, 2009 @01:28AM (#27812903)

        Give him a CD with XP which includes SP3 and all patches up to now, and he should be good for some time.

        Give him Linux, and he will be good for a looong time.

        • by socsoc (1116769) on Monday May 04, 2009 @01:58AM (#27813023)

          Yes, consumers with their Dell OEM CD from seven years ago have easy access to slipstreamed SP3 CDs and know how to use Linux.

          He'll be good until iTunes or some niche piece of software doesn't install and then he'll just be pissed at you.

          We know better and we try to educate Joe Consumer, but Joe Consumer doesn't have our skills or knowledge, which was the point of my original post. The consumer is not to blame.

          • by value_added (719364) on Monday May 04, 2009 @03:28AM (#27813363)

            We know better and we try to educate Joe Consumer, but Joe Consumer doesn't have our skills or knowledge, which was the point of my original post. The consumer is not to blame.

            Sorry, but the consumer is to blame. They may not, at the present time, have any legal obligations, and may not suffer any direct liabilities while remaining blissfully oblivious of the consequences of their actions or inactions, but we're free and justified for assessing the blame on them as we are on the malware authors as both share responsibility for their actions or omissions. To use a cliche, it always takes two to tango.

            I don't care whether you're talking about a guy handing over money to an unscrupulous investor (or worse, trying to invest it themselves), someone doing home wiring without understanding electricity or codes, someone driving a car who ignores the relationship between speed and stopping distances, or someone who bought a product that doesn't do work as well as it was advertised, the blame rests ultimately with the individual who fucked up. That should come as no surprise given that individuals who do fuck rarely need encouragement or a convincing argument to admit they fucked up.

            The standard here is one of reasonableness.

            Is it reasonable to assume that computers are complex beasts and that malware is problem? Yes. The former is self evident and the latter is a also truism that can be cited by most Windows users or gleaned from the local news by everyone else. Then WTF is Joe Average doing trying to install an operating system? Or manage it? He has lots of alternatives including hiring the kid down the block or taking it the local shop.

            Is it reasonable to assume that Macs are also complicated but Mac users can do without requisite knowledge or skill? Yes. The reasons for that are as numerous as why Windows users continue to suffer problems.

            You can go on about complexity and missing skillsets, but none of those justify anything. If you're trying to comfort those who fucked up, you're doing them a disservice. If you're conceding that the battle is lost and ha ha this is the way things are and always will be, then you're being irresponsible and contributing nothing to the discussion or solution.

            Personally, I'd go so far as to say that anyone who trots out the "poor user" argument (usually in combination with the "Everyone is using Windows so everyone is doing it, too!" argument) is they participate in extending the current state of affairs and are therefore part of the problem.

            Why pay lip service to user education advocacy when responsibility and blame are pre-requisites? Start blaming. Blame everyone involved, but don't skip the person ultimately responsible. We'll all be better off for it.

          • Re: (Score:3, Insightful)

            by Zumbs (1241138)
            You're right, relying on the user for basic security is a pretty stupid security strategy in todays world, where many computer users are functionally illiterate. When it comes to setting up a new computer, I usually download an up-to-date firewall and anti-virus program before reinstalling Windows, and install these programs before connecting to MS Update. If Joe is able to install an OS on his own, Joe should be able to figure out how to install a firewall and anti-virus programs.
        • by jonaskoelker (922170) <jonaskoelker@NoSPAM.gnu.org> on Monday May 04, 2009 @02:22AM (#27813117) Homepage

          Give him a CD with XP which includes SP3

          I'm curious: how would I go about producing such a CD, without any of my boxes getting "sassered"?

          I have: a Linux box. An OS-less laptop. Some XP recovery disks.

        • Re: (Score:3, Funny)

          by Anne Thwacks (531696)
          Give him a Pirate CD with XP which includes SP3

          There, fixed that for you.

          • Re: (Score:3, Insightful)

            by Opportunist (166417)

            I have used many selfmade CDs of XP, all of them legitimate.

            Say about MS what you want, but they got one thing straight that many other manufacturers of software seem to forget all to easily: Whether it's legal depends on your license. Not your medium.

      • Re: (Score:2, Insightful)

        by Wingman 5 (551897)
        Any form of firewall, even a basic NAT from a home router would be sufficient to protect you until you are up to date on patches
      • Re: (Score:2, Informative)

        by GroovyTrucker (917003)
        Easy, just download the SP2 file and the SP3 iso from Microsoft and burn them to CDs. Disconnect the computer from the net and after XP SP1 install, just run the SP2 and SP3 updates. I recently did it. Anyone else can.
    • by Yvanhoe (564877)
      Some times I wonder if a vigilante approach à la code green (which mimicked the code red transmission but patched machines afterwards) isn't what we need. There are no authorities with a wide enough jurisdiction to prevent worms to happen or to cure them, so if one state begins to produce its own counter-worms, who could protest ?
      • by KlaymenDK (713149)

        "Unsolicited white hat hacking" is rarely welcome, regardless that you might well be helping them out. Would you be unequivocally glad to see a stranger mowing your back yard lawn when you came home from work? With your own lawnmower, which was supposed to be in your shed. He's just helping out...

        While there may not be an organisation to protest all of your, say, 300.000 patches, there may very well be an organisation willing to protest the 14 patches that hit their machines. The world of pain you'd be in w

        • by Yvanhoe (564877)
          I'd rather see no one in my backyard but if it is insufficiently secured, I'd rather see someone mowing my lawn with my own lawnmower than someone coming to steal it. In fact it would give me a better opinion of humanity.

          And I'd buy a better lock the very next day.
  • Suggested punishment (Score:5, Interesting)

    by rossz (67331) <ogre@geek b i k e r.net> on Monday May 04, 2009 @01:09AM (#27812821) Homepage Journal

    How about we make the punishment for infecting a computer $100 and one day in jail for each system you infect. This way, someone who does something stupid but isn't actually malicious pays a few hundred dollars and spends a few days in jail while the real criminals pay big bucks and spend years in jail. For 180k systems, that's an eighteen million dollar fine and nearly five hundred years of jail time.

    Of course, the problem is catching these bastards who tend to live in countries where the government doesn't care or is actively involved in these illegal activities (I'm looking at you Russia).

    • How do you know it isn't the CIA, pretending to be Russian hackNO CARRIER...
    • by syousef (465911)

      How about we make the punishment for infecting a computer $100 and one day in jail for each system you infect. This way, someone who does something stupid but isn't actually malicious pays a few hundred dollars and spends a few days in jail while the real criminals pay big bucks and spend years in jail. For 180k systems, that's an eighteen million dollar fine and nearly five hundred years of jail time.

      You'd hit incompetent virus writers as hard as the big criminals. Think of the Melissa worm. Written for a

    • Re: (Score:3, Interesting)

      Do that and I might start writing viri

    • by Kaboom13 (235759) <kaboom108@@@bellsouth...net> on Monday May 04, 2009 @02:22AM (#27813121)

      It's already illegal. We don't need to run around making new laws. The problem is law enforcement world wide does not care. Even if the perpetrators of a major botnet are in their grasp, they will do their best to ignore it. If it happens on the internet, that means it's an international problem. Which means it's not their problem. They are too busy busting 19 year olds trying to sleep with 17 year olds, and "drug busts" of people licensed and permitted by their state government to grow marijuana, and harassing random people with the same name as a suspected "terrorist". Has anyone seen the FBI actually even investigate an identity theft case? We aren't talking criminal masterminds here, most of them could be tracked down with minimal effort.

      The only solution to crap like this will have to be technical. I suspect for the internet to survive, enforcement will have to come at the ISP level. Automated detection of botnets and ddos attacks in progress is possible. What should happen is when it's detected you are infected, your upload is heavily throttled, and you are contacted to correct it. Failure to do so results in suspension of service. ISPs that don't implement it should face having all their packets dropped by everyone else. It won't stop the latest and greatest, but years old botnets could easily be stopped. The potential for false positives will suck, as will the temptation for ISP's to abuse it, but currently theres several botnets out there that could easily take down critical infrastructure if they decide to ddos it.

    • by rolfwind (528248)

      Wouldn't that mean Bill Gates would have to give most of his money back and be in jail for eons - seems a bit harsh :(

    • How about we make the punishment for infecting a computer $100 and one day in jail for each system you infect. This way, someone who does something stupid but isn't actually malicious pays a few hundred dollars and spends a few days in jail while the real criminals pay big bucks and spend years in jai

      So Great Aunt Mildred opens an email with the subject "Mildred, Improtant News From An Old Friend!!1!", gets a worm, and winds up infecting the 30 people in her outlook contacts list.

      She has to pay three gr

  • Let me get this straight. They took over a botnet, which consists of computers they are unauthorized to access. Not only did they commit a felony but then they wrote a paper about it?

    The reason that nobody else has done this before is not because they are incapable of doing it. The reason nobody has done this before is because it is illegal

    • by SydShamino (547793) on Monday May 04, 2009 @01:20AM (#27812867)

      No, they purchased a domain name, set up servers to accept data sent to that domain, then collected that data. That their research had told them that the domain would be used by the botnet is incidental. If you mail your credit-card information to my domain, I haven't committed any crime if I accept it and turn it over to the authorities.

      • by QuantumG (50515) *

        The first host that sends a reply that identifies it as a valid C&C server is considered genuine,

        They sent information.. that means they were illegally accessing a computer system.

        • The first host that sends a reply that identifies it as a valid C&C server is considered genuine,

          They sent information.. that means they were illegally accessing a computer system.

          If that were true then any webserver replying to a request for a web page would also be illegally accessing the requester's computer system.

          Seems legally sound to me that if you ask a question, you've consented to receiving a reply.

          • Re: (Score:2, Insightful)

            by QuantumG (50515) *

            Umm.. no, they deliberately sent a message that said "send me the confidential information you have collected". There isn't a court in the land that wouldn't convict these bozos. All they have to rely on is that the majority of people infected with this ancient malware are not going to go after them, cause they're too stupid to know they are infected.

            • by jamesh (87723)

              Umm.. no, they deliberately sent a message that said "send me the confidential information you have collected"

              They only reverse engineered the software for interoperability reasons though. Botnet's are a monopoly so I think it's reasonable to allow them to develop a competing product, especially for research purposes :)

              Who would bring criminal charges against the researchers though...

              The botnet operators? Unlikely.

              The owners of the computers that were unknowingly running the botnet trojans? Also unlikely, e

            • Umm.. no, they deliberately sent a message that said "send me the confidential information you have collected".

              Ummmmmmm...... no. All they EVER sent was the string "okn" - no matter what the bot asked for, that's all they ever sent in return.

      • Re: (Score:3, Insightful)

        For that to be even remotely true I would have to be able to do exactly the same thing.

        Something tells me that if I was to go and setup a domain to receive information stolen from home computers which I did not originally infect that it would still be a crime.

        Just because the FBI is not going to go after them for it does not make it either legal or moral.

    • by JoeBuck (7947)
      What are you going to charge them with? It appears that what they did was to register a domain that the botnet wanted to use and intercept the traffic. They didn't load code onto anyone's computer, or issue any commands to the botnot. So where's the felony?
    • by Pecisk (688001)

      Is it really illegal? Or people who are scared that goverment will use this excuse to mangle some exploited Windows XP for their own use says so? :)

      More to point, afaik what they done borders with illegal, but it would be very very hard to convince that harm to society is done (which is basis of *any* conviction, ask any lawyer).

      And also all situation is farse - botnet owners and operators are laughing all the way to the bank, no one can shut them down because it is illegal (someone is stealing money and st

    • The reason nobody has done this before is because it is illegal

      "The proper authorities are helpless against the criminal scum plaguing the Internet. I shall become become a costumed vigilante hacker, but I need a sign...wait was that a frigging BAT that just hit the basement window...? What the hell? Now, wait...where was I...Oh, yes, I need a sign. I HAVE IT! I SHALL BECOME GOATSEE MAN!"

      Ok hacker nerds, here is your chance to live out the fantasy. You have the talents, become a heroic hacker vigilan
  • Is the whole notion of a hacker that acts on behalf of the "public good" by shutting these things down (i.e. gray hat) just a myth?

    Yeah, it's probably technically illegal, but I thought there were folks out there doing it. I'd be interested to know if any /.ers have ever engaged in trying to kill one of these things.

    Speaking for myself... I haven't because of the technically illegal nature of the work (at least I think it'd be technically illegal). Plus, without ever doing it, I don't know enough
  • by david.emery (127135) on Monday May 04, 2009 @01:31AM (#27812911)

    What bothered me after reading this paper is nowhere does this paper come out and say that the infected machines are all running Windows, although this is strongly implied by the description of how the virus works. The reader is left to wonder whether machines other than Microsoft Windows were infected.

    Instead, the paper leaves the impression that all computing has the same architectural vulnerabilities. I thought that was a surprising defect, sufficient to make me wonder what else isn't captured/stated/analyzed in the paper.

  • This I feel is a good analogy to old fashioned snail mail.

    A package gets delivered by mistake to your house, it is obviously intended (addressed) for someone else, but you open it anyway.

    Regardless of whether the contents are legal or illegal (drugs, fake currency, or just a birthday card) etc., you are still comitting a crime by opening it. You'd be hard pressed to use the "I'm a researcher" defense on that one.

    I mean, that implies that anyone intercepting a botnet's stolen data can simply claim "they didn

  • Torpig (Score:5, Funny)

    by Nom du Keyboard (633989) on Monday May 04, 2009 @02:03AM (#27813043)
    Why does this sound like a cross between an Onion and Swine Flu?
  • Greetings and Salutations...
    I have to say that the level of misunderstanding exhibited by MOST of the folks posting to this thread boggles the mind. Considering the alleged level of IT sophistication of the readers of /., it is even more amazing.
    I read the researcher's report, and, I have to say that I found it a well-reasoned and interesting analysis of a terrible problem on the Internet. However, without following their methodo

  • by golodh (893453) on Monday May 04, 2009 @04:45AM (#27813627)
    First I'd like to express my admiration and gratitude for the researchers who pulled this one off, and the poster. This is truly illuminating stuff which (to my knowledge) provides the first solid and high-quality information on botnets in the public domain.

    It's quite probable that this information (and particularly the techniques used to hijack the botnets) are also new and valuable to law-enforcement agencies. Such agencies tend to be desperately short of intelligence (both kinds), under-equipped to do research, and usually operate in a purely reactive way ("show us the bodies and we'll investigate").

    And yes, I think that the researchers did fine by hijacking a botnet in the first place and secondly by not destroying it but instead contacting law-enforcement agencies. Researchers are neither law enforcement officers nor sysadmins for the infected systems. They have their own work to do (which law-enforcement agencies could not or would not do, or the Torpig botnet would have been cleaned up long ago).

    It is interesting to note that *all* of the infected machines seem to be MS Windows based. Even though many of the targeted clients (Firefox, Skype) also run on Linux machines. If I had to guess I'd say that under Linux the need to have root access to either modify the MBR or to write downloaded malware code to the targeted executables on disk provides an effective barrier to infection (provided you don't surf the net with root privileges of course).

    Unfortunately the publication of this sort of research may lead botnet administrators and designers to address the authentification weakness the researchers exploited. Ah well, such is life.

  • This research paper gives the botnet people some more ideas on where their weaknesses are.

    It's like a security researcher turning up at the underground base of an evil tyrant and finding a way in then writing a publicly available paper on where his defenses are weak.

    • Several others already noted that botnet admins and designers might use the insights described in the paper to shore up their C&C communication. That's a minus, but a small one.

      First of all, the whole exercise was cut short because the botnet admins updated the Mebroot toolkit, causing the researchers to loose contact. That happened before publication, ok? Secondly it shows that the easiest way to protect your botnet is to update Mebroot once a week (or sooner), and savvy botnet admins already knew th

Building translators is good clean fun. -- T. Cheatham

Working...