Researchers Take Down a Spam Botnet 207
The Register is reporting on the takedown of a botnet once responsible for 1/3 of the world's spam. The deed was done by researchers from the security firm FireEye, who detailed the action in a series of blog posts. PC World's coverage estimates that lately the botnet has accounted for 4% of spam. From the Register: "After carefully analyzing the machinations of the massive botnet, alternately known as Mega-D and Ozdok, the FireEye employees last week launched a coordinated blitz on dozens of its command and control channels. ... Almost immediately, the spam stopped, according to M86 Security blog. ... The body blow is good news to ISPs that are forced to choke on the torrent of spam sent out by the pesky botnet. But because many email servers already deployed blacklists that filtered emails sent from IP addresses known to be used by Ozdok, end users may not notice much of a change. ... With [the] head chopped off of Ozdok, more than 264,000 IP addresses were found reporting to sinkholes under FireEye's control..."
Wrong title, not 'taken down' (Score:5, Interesting)
and
Re: (Score:2)
Until now attempts to actually trace and shut down have not been fruitful. I think the face that something was done is very positive.
Re:Wrong title, not 'taken down' (Score:5, Funny)
Re: (Score:2)
Sounds also like a damn good reason why it's futile trying to rely solely on US law enforcement to take these bad boys down.
I bet several of them are hosted in countries that don't give a flying fuck about the US.
Iran being one of them.
I wouldn't be surprised if some governments even look the other way on purpose just to spite the west.
And meanwhile... (Score:4, Insightful)
Stop talking sense man! (Score:2)
Next thing you know we'll take the same approach to murder, theft, gangs, drugs, etc and soon we'll end up with a utopia... then how will the billionaires get $100 bills to light their $500 cigars???
Re: (Score:2)
Come on, it's not that hard to get one hundred pesos [wikipedia.org].
Re:And meanwhile... (Score:5, Interesting)
Spam isn't so much an economics problem as a "some people are just dicks" problem. A lot of the problem with spam is the current system we use for email. It was never intended for such widespread use and has little-to-none in the way of authentication or security measures. You can encrypt emails for security sure, but it doesn't help get around the problem of spam..
Re:And meanwhile... (Score:5, Insightful)
Spam isn't so much an economics problem as a "some people are just dicks" problem
That statement is accurate only for those who believe that spam is sent out to piss you off. Perhaps the spam you receive is somehow different from the spam that is sent to me? The spam that is sent to my addresses is sent to sell various products or services. And why is the spam sent to sell products? Because someone is paying the spammer to send it.
Spam is a product that people are willing to pay for.
Hence spam is a economic problem, because there is economic incentive to send it. Billions or trillions of spam messages can be sent at nearly no cost to the spammer; very little business needs to come from those spam messages to make them incredibly profitable.
A lot of the problem with spam is the current system we use for email. It was never intended for such widespread use and has little-to-none in the way of authentication or security measures.
I have yet to see a proposed replacement for the existing email system that actually suggests anything that would make a bit of meaningful difference for spam issues.
You can encrypt emails for security sure, but it doesn't help get around the problem of spam..
I agree with you on that. Encryption isn't worth squat in regards to spam.
Re: (Score:2)
Joe jobs, for one. Sending spam advertising someone without their consent is a pretty damning smear tactic.
I'd say to go after anyone that profits from spam. Considering how big a business it is (enough to have 95 percent of all emails be spam), there's probably quite a few stakeholders getting a piece of the pie.
I say to give all those stakeholders some laxative and make them disgorge their ill-gotten dirty money.
At the top of the list, ISPs that sign pink contracts and, in exchange for whopping payments
Re: (Score:2, Insightful)
Not only would the spammer ultimately save bandwidth in this case by only sending the full mails to those who "requested" them by reacting to the notification, but he would get first class information about validity of email adresses. In addition, the receiver would have to
Re: (Score:2)
I wouldn't be so sure about that. I seem to remember a year or so ago reading about someones honeypot experiment. One of the first things done to the machine after the hacker got access was to close several common vulnerabilities.
I don't know about this botnet, but if I were an evil bastard who managed to take over your computer, the first thing I would do would be to make sure your computer stayed mine.
In fact from time to time
Re: (Score:2)
In fact from time to time I have considered the possibilities of a virus that would format the hard disk.
As a time bomb, you see.
But I always think about the grannies losing the family photos and I give up.
Or it could be distributed only through porn.
Nothing against porn. But that would select out (most) grannies, leaving the stupid fucks who hunt for porn in IE6.
Humm. I'm getting bitter. Better stop with the porn and get sex.
Re: (Score:2)
How exactly does one fight the economic problem? And does it involve giving everyone a pony?
Re:And meanwhile... (Score:5, Insightful)
The way to stop spam is to fight it as the economic problem that it is; if people continue to go after the symptoms of spam like this they will continue to find themselves quickly thwarted.
Sure. Let's educate every farking idiot on the face of the earth. Just like we did with consumers the world over in every single city across the fruited plain. It's worked well for hundreds of years! "Buyer beware" and Heaven help you if you should get defrauded...
What's that you say? We didn't do that? Instead, we instituted "consumer protection" laws that require vendors to adhere to minimal standards of conduct and safety? Laws that prevent manufacturers from making unsafe cars and selling poisoned food? You mean, I can go into pretty much any restaurant and be confident that I probably won't get some terrible disease from poorly cooked food and un-refrigerated meats?
Yes, on the 'net, it's the wild, wild west, all over again. But now problems "over there" have become problems "over here", and suddenly, things like the sorry legal state of Nigeria and Somalia are in our face. Will we fix it overnight? No, but we will fix it. Sure, we'll never get rid of it completely - the Mafia still exists, and gangs still thrive in areas of the mostly controlled First World. (We can get greatly mitigate the gangs by legalizing their primary revenue stream, the drugs, but while related, that's another post)
The thing is that by legally controlling the terms of commerce, we promote healthy commerce. Outlawing commerce altogether has roughly the same effect of not regulating it at all - fraud and crime sets in, legitimate business moves out. To control spam, we need to control commerce, world wide. And that's a big, big problem that will take at least a generation or two to handle.
Re: (Score:2)
Sure. Let's educate every farking idiot on the face of the earth. Just like we did with consumers the world over in every single city across the fruited plain. It's worked well for hundreds of years! "Buyer beware" and Heaven help you if you should get defrauded
If you somehow took what I said to mean that I wanted to do what you are suggesting, then I ask you to go back to read it again.
To control spam, we need to control commerce, world wide. And that's a big, big problem that will take at least a generation or two to handle.
That is a bit closer to what I was suggesting, but going from the opposing side of the same coin.
A little known fact about security firm "FireEye" (Score:3, Funny)
At company picnics, employees are encouraged to take part in "Whack-a-mole" competitions during summertime, and ice sculpting during the winter.
Comment removed (Score:5, Insightful)
Re: (Score:3, Funny)
Because its actually the government who creates and controls these 'botnets'. They're used to spy on us since they have a computer on each end of each router meaning they can reliably trace data streams in foreign countries to their true original source.
Ok, so that wasn't necessarily accurate. But, I've heard on the low-down that the fellows who were working on Titan Ra
Re: (Score:3, Insightful)
Exactly we hear about "researchers" even broadcasters doing this. But never about regular law enforcement...
Governments don't appear interested it dealing with this. Probably because it isn't the (alleged) profits of the entertainments industry being affected.
In the words of Riddick... (Score:3, Interesting)
"You keep what you kill."
Now... what to do with this enormous botnet?
Legality? (Score:2, Interesting)
I'm not against taking down a botnet. But I still think that basic laws are more important. If we don't apply the same rights on really everybody, those "rights" become meaningless.
FireEye isn't exactly a police or government agency. How exactly can they raid zombie computers of private people? I can't think of any way that this is legal. Which does not make them better than what they are "prosecuting" (A term, that when associated with a private company, usually makes a crime itself.)
Is it like Blackwater?
Re:Legality? (Score:4, Insightful)
From reading all the FireEye blog posts on the operation, I can't find any point where they broke the law or even behaved in a way that violated anybody's rights.
What they did was to coordinate things so that ISPs and domain registrars followed existing procedures to shut down sites and revoke domain names. They also found some domain names that were programmed to be used as fallbacks but had not yet been registered, then registered those.
It looks like at no time did they actually hack anybody or penetrate computers, either innocent bystanders or guilty people, nor did they use the botnet themselves, so there's no legal or ethical problem here -- assuming their reports are complete and correct, obviously.
Re: (Score:3, Informative)
Re: (Score:2)
So what laws do you think are being broken? And how would any government prosecute someone or even collect evidence to be used in a prosecution? They might have an IP address, but we have just spent a few years proving in courts that an IP address cannot be connected to an individual.
In most of the places where the people who are running these things are located it simply isn't against the law to do so. You might be surprised at how many places it is legal to defraud and steal from US citizens when it is
I for one.... (Score:2)
I for one welcome our new botnet masters.
That's great, but... (Score:4, Interesting)
Re: (Score:2)
If any of those control servers were in the UK, I'd be writing to my MP to illustrate this point and calling for extradition of all employees which engaged in this activity. Garry McKinnon performed no such actions of damage, with no intent to deny access to any system whatsoever, unlike these "security researchers" (crackers).
Troll? No, just looking for some
What to do with the zombies (Score:3, Insightful)
We really need an analysis done and report made to the public security community. This is a unique chance to discover what are the real vulnerabilities to the mass of computing power on which criminals prey.
A federal or state level court needs to authorize the researchers to do such an analysis. Even a single state would be enough, if the zombie IPs can be reliably mapped to that state. I would envision the analysis to include:
- Make a full study of many individual zombie PCs: What antivirus, firewall, OS, applications, etc. are installed, including version numbers and a fingerprint (to identify whether they are super-vulnerable copies from warez sites, infected OEMs, etc.).
- Monitor usage of a small number of PCs to identify what user habits lead to zombification, based on the theory that these PCs will become zombies of another botnet soon probably. What should be monitored, and for how long?
- Contact (with law enforcement assistance) a small number of individual users to interview them. Publish anonymized interviews for representative cases so the public can better learn what constitutes dangerous habits.
- Report anonymized individual representative cases, trends and statistics.
Discuss whether the defanged botnet should be used to destroy other botnets. Too much discussion would alert the other net owners. People could opt in based on a message sent to infected PCs, if the authorities support it, but unless those bots are hardened they might open the owners to retaliatory attacks.
At least, let's find out if antivirus really doesn't work, what habits led to botnet creation, and how can we alert zombie owners so they adopt more secure practices.
Do more,.....do more! (Score:3, Interesting)
>more than 264,000 IP addresses were found reporting to sinkholes under FireEye's control
It's not enough, those 264k IP adresses, should be sent out to a sort of ISP provider sanctuary where
they need to contact the people who have the infected pcs, and tell them to clean their machines, just
leaving the machines with a ongoing malware pinging back home, might still be able to get owned.
They need to take down those infected that they know is infected, and force those users to update or get fixed.
They are a threat to the internet, and need to be delt with...maybe cutting them off the internet for awhile would make them call in
their ISP and then they could be warned they had been owned, and need to clean their pcs.
Any further attempts on their machines parts to contact that same "hole" would force them again to be locked out...until such time
they fixed their machines, no?
Re: (Score:2)
So it took them how long between the time it was generating 30% and now when it is generating 4%?
That's a little too late guys.
Re: (Score:2)
So, what happened? Did its volume drop from 33.3% to 4%, or did its volume stay the same and the total spam problem got that much larger?
Re: (Score:2)
Well 1/3 is hard to express as a percentage.
Re: (Score:2)
Approximately 33.3% is SO difficult to write after all!
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
I'm going to fall back to my backup argument: writing 1/3 is easier and quicker than writing 33.3%.
Re: (Score:2)
Ahhh... touche, at least someone else here is thinking.
Re: (Score:2)
Re: (Score:2, Interesting)
On a more related note, would this be classed as vigilante justice? Justified?
I think its a cool idea for universities with security classes to study this kind of thing and 'bring it down - safely' as a project. I know I'd enjoy it.
Re:good work (Score:4, Insightful)
It'd be a great project, though you do want to be careful, some of these viri are designed to do harm if disabled improperly, and some of these computers could be in situations where their failure could cause the loss of lives.
Again, not saying don't do it...saying do it carefully.
Re: (Score:2)
Identifying exactly what is infected and where would be a colossal task. Especially when you consider that you have to identify 'mission critical' hardware.
Re: (Score:2)
Because, dumbass, then we'd just have more OSX viruses. And we all know how fast Apple is at fixing flaws.
Re: (Score:2)
some of these viri are designed to do harm if disabled improperly, and some of these computers could be in situations where their failure could cause the loss of lives.
If you have a computer that could fail in such a way that lives could be lost, and the computer is in a situation where it has enough connectivity to the internet to form part of a botnet, then all bets are off anyway.
IMHO, the best way to resolve the botnet is to overwrite the bootsector (but not the partition table) and do a hard reboot. Easy to recover from and minimises the further damage that could be done. Also resolves the "lives could be list" problem.
Re: (Score:3, Insightful)
Re: (Score:2)
Oh indeed. But guess what: They are. Maybe in the obvious stupid way, maybe it's a computer that used to be an office machine and got repurposed (intentionally or accidentally) without a reimage. Maybe there's a firewall snafu.
Although loss of life is the obvious example of oh-shit resulting from computer failure, there are many, MANY situations where it could lead to tremendous loss of capital (remember back when the LSE went down for a day due to using MS software a few months ago?
Re: (Score:2)
I would argue that if the system is THAT critical, it should have been kept virus free. The fact that it's part of a botnet could be taken to mean the owner doesn't particularly care if it fails somehow. Those of us who actually bother to look in on our servers from time to time are really tired of "OMG the indoor dog potty" and such coming from those who don't.
Re: (Score:2)
It'd be a great project, though you do want to be careful, some of these viri are designed to do harm if disabled improperly, and some of these computers could be in situations where their failure could cause the loss of lives.
Well then hopefully harm will be done, and users whos machines have been sending me spem for the past three years will lose a shitload of data and learn to implement better security in future. Sorry, but I really do thing the only way people learn to adopt a more responsible attitude to IT security is when it is thumped into them why they should.
Re: (Score:2)
some of these viri are designed to do harm if disabled improperly, and some of these computers could be in situations where their failure could cause the loss of lives.
Wow. What is the motivation behind this? Hoping that people will be afraid to run cleanup on their infected computers, keeping the botnet from shrinking? Some bullshit like "my victims deserve to be screwed over so I'm going to make sure to do as much damage after I'm done with them?"
Re: (Score:2)
Re: (Score:2)
Not always intentionally so designed, though that can be a cause. The crippling effects are just as often a result of the elaborate things viri do to hide themselves and prevent removal.
For example, suppose a virus is designed to patch a system DLL so that it includes a copy of the virus. Now suppose that the patch basis it's using disagrees from thecurrent version of the DLL. GNU Patch would refuse to do the patch if it couldn't be done safely, but the viruses doing binary patches on DLLs may not be so con
Re: (Score:2)
For example, suppose a virus is designed to patch a system DLL so that it includes a copy of the virus. Now suppose that the patch basis it's using disagrees from thecurrent version of the DLL. GNU Patch would refuse to do the patch if it couldn't be done safely, but the viruses doing binary patches on DLLs may not be so concerned with data integrity.
Funnily enough, that's exactly why Blaster resulted in so many crashes - it was written to patch the RPC Subsystem, and on virtually every copy of Windows current at that time it patched with the wrong addresses (as the library was updated between the time of the virus writing and its release), causing the service to crash. When it crashed, Windows would immediately initiate a reboot, as the RPC service is considered critical.
Re: (Score:2)
Whoopdedoo, now we have high tech learning how to take hostages.
Don't negotiate with terrorists.
I hear that abductions in china (by non government entities at least) are rare because the chinese authorities are ruthless and give no quarter, so the bad guys know they can't win just by taking a hostage.
Re:good work (Score:5, Interesting)
You would be amazed at the volumes of e-mail ISP's get. More then 98% of it is crap you don't want to receive.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
This is a key point.
They don't actually filter all your incoming mail for you for spam content, they only check all the mail you send from your mail server or any of your mail clients.
I do actually maintain an email server for the company I work for. The ammount of spam that is blocked daily from getting into our network (blocked at the perimeter by IPCop) is truly amazing. And that's only for an average SM
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Which means they also provide a service for spammers to find out what is likely to get through spam filters. (Or at least through Telstra's).
Re: (Score:3, Insightful)
How much of it actually passes an integrity/authorization check like dkim or spf?
Maybe if those were made more widespread we could do a good bit better job tracing and jailing these bastards... ...or blacklisting accomplice ISPs that don't give a rat's arse about the spam they are sending.
Forgery allows spammers to operate anonymously.
Re: (Score:2)
Just on my tiny little server I run at home for a handful of friends and family, with one single domain, I block an average of 416 SMTP connections per day based solely on DNSRBLs plus another 876 per day based on a slew of custom rules I've developed. After that, SpamAssassin blocks 82 messages per day and quarantines 48 more.
That's something in the neighborhood of one spam attempt EVERY MINUTE of every day, 24/7/365, on a tiny little personal server hosting only one domain for a small handful of users.
Re: (Score:2)
I notice that the article is tagged with "vigilante". While we're at it, let's go the next step:
"What are you!?!"
"I'm Botman."
Re:Good! (Score:5, Funny)
Now I don't have to worry about throttled torrent downloads.
Uh right, problem solved there. In other news, once you get an oil change in your car you no longer have to rotate the tires.
Re: (Score:2)
Re: (Score:2)
Uh right, problem solved there. In other news, once you get an oil change in your car you no longer have to rotate the tires.
Obviously you've never worked with Windows users.
Re: (Score:2)
Re: (Score:2)
That is, until botnet operators start using BitTorrent (or a derivative of it) to transmit commands and Comcast gets a new excuse to throttle torrents.
Re: (Score:2, Insightful)
Well... first you have to find their command and control channels. Then you have to figure out how they work. Many times the command and control is both distributed and encrypted so it is very hard to "chop the head off"
Re: (Score:2)
Especially if they have a mccolo type back door to run away through.
Re: (Score:2)
Re: (Score:2)
Why does it have to be done legitimately and legally?
When the law is habitually incapable of solving a problem, it should be solved extralegally.
Re: (Score:2)
Re: (Score:2)
When the law is habitually incapable of solving a problem, it should be solved extralegally.
"The law" has plenty of weapons available. As well as being able to act "creativly" when it wants to.
If the police can raid (and shut down) a business which might be using a few too many copies of some obscure piece of software they can most certainly do the same kind of thing to the likes of McColo.
Re:Any more? (Score:5, Interesting)
Eh, depends what you're looking at. Other Botnets have been taken down, usually by physically arresting the hacker who started it. I'm sure that they've tried to stop other Spam Botnets before. They didn't actually STOP Ozdok, they just dented it a bit.
It's difficult to track how these things start because essentially you've got about a million breadcrumbs to go through.
Lets say you've got 3 computers, A, B, and C. A infects B, B infects C. There is no direct correlation between A and C, so you have to work your way all the way up the chain. Now imagine you've got a million infected PC's. Who infected who? How do you work your way backwards? There's lots of ways to do this, most simple of which is to look at the contacts and determine which of the contacts is infected. Then determine the time and date of which the infection occured (Date Modified/Date Created on the file). Whoever was first was who infected the others.
The problem with killing it is that it has a "multi layered fallback mechanism" - which is a fancy way of saying it replicates itself. It can do this by either having a secondary program or script copy itself back onto the infected PC when it detects the original infection is gone, or it can do this by RE-infecting any of the computers it was sent to infect in the first place.
I hope thats enough to make you stagger and wonder exactly how much damage they could have possibly done to this botnet.
Re: (Score:2)
---
Computer Security [feeddistiller.com] Feed @ Feed Distiller [feeddistiller.com]
Re: (Score:2)
Re: (Score:3, Interesting)
Not to mention a lot of people would be seriously PISSED and you'd be in deep legal shit for messing with other people's computers.. I'm sure these guys could still face possible trouble even for just admitting they've brought down the head of the botnets, but IMO they're pretty justified to do that. Wiping people's machines, while tempting, is just a no-no. If we want vigilante justice to become more acceptable in these situations, then it's best to be 'nice' about it.
Re: (Score:2)
I'm sure these guys could still face possible trouble even for just admitting they've brought down the head of the botnets
And what exactly have they done that's illegal? They registered some domain names. They reported domain names used by spammers to their registrars, with documentation, and those registrars cut off the domains. They reported IP addresses used by spammers to their hosts, and those hosts cut off the IP addresses. They have received botnet requests at their sinkhole, but they are merely logging IP addresses, not returning commands to the botnet. They'll use the IP addresses to one-by-one have the ISPs noti
Re: (Score:2)
In all likelihood, they couldn't send commands even if they wanted to: modern botnets typically check incoming data against an internally held digital signature, and so forging commands is extremely difficult (basically impossible) without the private key which corresponds to the signature.
Re: (Score:2)
It was the wording of the summary led me to believe they'd actively attacked the control channels rather than doing everything legally, my bad.
Re: (Score:2)
Not to mention a lot of people would be seriously PISSED and you'd be in deep legal shit for messing with other people's computers.. I'm sure these guys could still face possible trouble even for just admitting they've brought down the head of the botnets, but IMO they're pretty justified to do that. Wiping people's machines, while tempting, is just a no-no. If we want vigilante justice to become more acceptable in these situations, then it's best to be 'nice' about it.
I was about to post a "yes, take the bots down, destroy them" comment -- then thought, hey - that sword cuts two ways. If one group gets away with vigilante destruction of targeted systems, then what's the difference if a group we don't agree with - say, the RIAA or MPAA - starts using this precedent as justification and starts taking down systems themselves? Slippery slope doesn't *begin* to describe it.
The problem is - once you start bypassing the justice system for good reasons, it becomes easier to
Makes you wonder, doesn't it? (Score:3, Interesting)
If we want vigilante justice to become more acceptable in these situations, then it's best to be 'nice' about it.
Ever read Frank Herbert's The White Plague? It's about a scientist on a trip to Ireland who loses his family in an IRA bombing. He goes nuts and engineers a virus to kill every woman on the planet, figuring "if it has to happen to me, then I'm going to share my misery with the world."
Where am I going with this?
We have some pretty epic hackers on the planet. Guys who can disassemble code
Re: (Score:2)
I'm not debating the morality of any of it - just noting that the skill sets are the same. If you can break commercial software, breaking botnets is certainly within your ability. Both require patience, insight, and some skill with a disassembler.
And some day some uberhacker (white hat or black hat - don't care which) is going to get fed up with all this spam. And do something...epic.
Re:Makes you wonder, doesn't it? (Score:4, Interesting)
No no no! You've missed my point. *I* won't be the one to do any of this. I am not Mr. I-am-going-to-fix-it. Holy crap no! I have a career and a family. I'm way too old for lulz. I'm just saying human nature being what it is, someone eventually will.
And when that someone does, then it'll become a thing. Others will follow. Cowboy justice for anyone who can't secure their systems. It won't happen in a single stroke. One botnet will get hit. Others will get the idea and hit other botnets. It'll become the next new internet game. Used to be cracking DVD protections was enough sport to keep these guys busy. Now it's on to bigger game, so back up your data files everyone.
What I'm saying is that right now, there is a teenaged kid somewhere. Probably in the Netherlands or some other hacker friendly country where if you do something like this you get a couple of years of community service. It's snowing, he's bored, and all the women are wearing parkas so there is nothing to do. And he keeps having to reconfigure his mail server. Whitelists, blacklists, pattern matching...it's pissing him off.
Then he's gonna have an idea.
A couple of weeks later some botnet is going to be completely in the hands of someone who has bigger ideas than spam. He's gonna nuke them. The whole thing.
Honestly I really am surprised it hasn't happened yet. Botnets are a beautiful hack target.
Re: (Score:2)
Well, I'm pretty sure I've read of botnets actaully attacking each other, but usually for their own gain rather than to actually reduce the spam load. I've always liked the idea of taking these down myself, but I've never really looked into security in a big way, especially from a blackhat perspective. The chances of someone being both skilled, motivated and altruistic enough to just take all the zombies down seems pretty low. Especially considering most of the motivation for this stuff is money. We'd need
Re: (Score:2)
Better yet, just wipe the hard drives. The users might think harder about security if something other than their net connection gets abused.
Easier yet would be to add those infected machines to the block lists. That would get people's attention just as well and keep them from infecting others.(as a side effect, most ISPs would find their entire cable modem DNS ranges blocked, but no big loss there... might actually prompt them to get serious about spam, even.)
Re: (Score:3, Funny)
Since the bots all deserve to be botted, I might set up a beowulf cluster with them and distributed render Big Buck Bunny for the fun of it. =)
Re: (Score:2)
Re: (Score:2)
Re:What OS? (Score:4, Interesting)
http://www.symantec.com/security_response/writeup.jsp?docid=2008-021215-0628-99 [symantec.com]
100%, minus controllers, that might run on any OS
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:3, Informative)
once responsible for an estimated third of the world's spam
lately the botnet has accounted for 4% of spam
Re: (Score:2)
The 'net used to account for 1/3, but since that time it has either shrunk due to patches or other 'nets have vastly outpaced it. That caught me off guard, too.
-b
Re: (Score:2)
It was _once_ responsible for 1/3 of the spam. By the time the researchers got to it and took it out it had already dropped to only 4% for other reasons.