Re: Bots was Re: [Asrg] Email service assumptions and making system-wide changes

[Barry Shein <[e-mail]>]

On January 17, 2006 at 12:07 [e-mail] (Tom Petch) wrote:
 >What I do see is a lack of evidence in the form of articles
 > written on technology in serious newspapers, particularly those advising on the
 > use of technology.  The concept of bots does not figure, so either these
 > professional journalists are ignorant or our view is skewed or ...

I think you're beginning to see a reaction from those involved in this
field that you must not be paying attention.

But I'll admit that's unsatisfying so here are some significant and
recent articles for your edification. I tried hard to favor major and
popular news sources:

  1. Study: Nearly a Quarter Million PCs Turned Into 'Zombies' Daily
     http://www.technewsworld.com/story/Zyd9zlwZK6bxGL/Study-Nearly-a-Quarter-Million-PCs-Turned-Into-Zombies-Daily.xhtml

  2. Shut down Sober-infected PCs, ISPs urged
     http://software.silicon.com/malware/0,3800003100,39155484,00.htm

  3. Spam Slayer: FTC's CAN-SPAM Report Card
     http://abcnews.go.com/Technology/PCWorld/story?id=1424942

     Tip of the Month Don't let your PC become a zombie: Industry
     experts estimate 60 percent of all spam is sent from zombie PCs
     whose owners have no idea their PCs are being used for such
     purposes...

   4. Don't ignore newly found booby trap in Windows
      http://www.baltimoresun.com/technology/bal-bz.himowitz05jan05,1,4817689.column?track=mostemailedlink

      ...The flaw allows programmers to execute malicious code on your
      computer when you view a booby-trapped graphic known as a
      Windows Metafile. Once you've done that, the hacker can
      literally take over your PC. He can steal critical information,
      download additional spyware or turn the machine into a "zombie"
      that attacks other systems and delivers millions of spam
      e-mails...

   5. Spammer faces up to two years in jail
      http://news.zdnet.com/2100-1009_22-6026708.html

      Daniel Lin, of West Bloomfield, along with three other men from
      West Bloomfield, was charged in April 2004 with sending spam
      over compromised computers belonging to the likes of Ford,
      Unisys and the U.S. Army Information Center...

   6. Detroit spammer faces slammer
      http://www.channelregister.co.uk/2006/01/13/detroit_spam_case/

      A US spammer likely faces at least two years in jail next week
      after he admitted using networks of compromised PCs to
      distribute junk mail messages...

      The group made in excess of $100K, according to reports...

(bzs: that last sentence is interesting...only $100K?! Now think about
the economics of spamming and why these guys have to steal resources.)

   7. Dutch extortion botnet
      http://p2pnet.net/story/7394

      ...The botnet comprised some 100,000 computers, according to the
      authorities, he says, but, "The actual number was 1.5 million
      computers" and, "I've heard reports from reputable sources that
      the actual number was 'significantly higher' " and may still be
      growing...

      ..."The bots continually scan the network and try to infect other
      machines," states Schneier...

    8. Virus disguises itself as MSN Messenger
       http://www.sfgate.com/cgi-bin/article.cgi?file=/chronicle/archive/2005/12/28/BUG18GDQSJ1.DTL&type=business

      ..."It also connects your machine to a botnet server," F-Secure
      warned, meaning that a person's computer can be controlled
      remotely to attack other machines or send spam...

    9. eBay hacker pleads guilty
       http://www.tgdaily.com/2005/12/28/ebay_hacker_pleadsguilty/

       ...Anthony Clark, the hacker who launched a massive Denial of
       Service Attack on eBay in 2003, has pleaded guilty. Clark had
       taken control of 20,000 computers and formed a "botnet". He
       redirected traffic coming from the controlled computers to eBay
       and temporarily made the popular Internet auction house
       unreachable. The twenty-one year old Oregon man could face up
       to ten years in prison.

(bzs: ok, this botnet was used in a DoS attack but I think it
underscores the general theme that they exist, are dangerous, numbers
of PCs involved (20,000 in this case), and becoming legally dangerous
to their operators.)

   10. TECH NOTES
       http://www.timesdispatch.com/servlet/Satellite?pagename=RTD%2FMGArticle%2FRTD_BasicArticle&c=MGArticle&cid=1128769030716&path=!business&s=1045855934855

       ...Spam-detection experts say these pitches are emerging as
       scam rings become more savvy at using "zombie" PCs -- regular
       people's computers surreptitiously compromised by viruses and
       other vulnerabilities.

I hope that begins to make the point.

 > By comparison, suggestions that most spam came from a small number of people or
 > that there was an increase in spam from former communist states has been backed
 > up by statistics, by reference to web sites etc.

These two observations are not in any way incompatible.

A) The spammers' exploit of choice are massive armies of virus
infected zombie pcs numbering from the tens of thousands to probably
something over a million in number.

B) The number of individuals/gangs using these exploits effectively is
probably somewhat low. ROKSO (www.spamhaus.org) maintains that less
than 200 individuals (and that includes multiple members of the same
gangs) are responsible for the vast majority of spam, and at some
cut-off it's probably signficantly less than that, perhaps dozens.

But A doesn't in any way contradict B, it's merely the description of
the situation.

-- 
        -Barry Shein

The World              | [e-mail]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 800-THE-WRLD        | Login: Nationwide
Software Tool & Die    | Public Access Internet     | SINCE 1989     *oo*

_______________________________________________
Asrg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/asrg