Microsoft Looks To Courts For Botnet Takedowns 93
angry tapir writes "Microsoft has seen a dramatic drop in the number of computers infected with Waledac, a piece of malicious software affiliated with a botnet that was once responsible for a massive amount of spam. In the second quarter of this year, the company cleaned only 29,816 computers infected with Waledac, down from 83,580 computers in the first quarter of the year. The drop in the number of infected machines shows the success of the legal action Microsoft took earlier in the year, according to the company."
Right goal. Wrong tool. (Score:2, Insightful)
Re: (Score:3, Insightful)
It would be the exact same issue on Linux and Mac OS X too.
Then why isn't it? While it's easy to shift blame onto the user, this completely overlooks the fact that a system designed with the capability of executing foreign code without any kind of privilege escalation check is just asking for trouble. No one should have to worry about those puppies or that porn in the first place.
Re: (Score:3, Insightful)
Because Windows is installed on 95% of computers and all the casual users are there. Linux users mostly, at least somewhat, know better what they are doing. On the other hand, there has been similar trojans on Mac OS X too.
And privilege escalation? Why would sending email or keylogging the current user need root access? It doesn't.
Re: (Score:1, Insightful)
Oh, I almost forgot. This is slashdot and you cannot !(badmouth) Microsoft.
Re: (Score:1)
There's no shortage of security holes found in linux.
Given a linux distro that's even moderaly out of date it's almost trivial to find an exploit.
The main reasons we see less malware for linux is that the average linux user tends to know what they're doing and know what they shouldn't do.
There's also the small matter of windows being the dominant OS.
I don't know about you but if I was writing a virus I'd put my effort into attacking the most common system, not something that has a couple of percent of the m
Re:Right goal. Wrong tool. (Score:5, Insightful)
Not just that:
1) software is not acquired through random internet downloads but through a package manager
2) random internet downloads are harder to install, you don't just double click and have to make them executable
3) windows has shown again and again that it makes infection easy: auto running things from cd/usb stick, easy running of executables, hiding filename extensions. None of those problems extend to Linux and they've been the most common way for these things to spread.
4) a user has a level of proficiency before they're happy to open a terminal and run random commands from the internet, and by that point they're likely to know what the commands do
5) most linux distros don't need the command line for day to day operation, it's only there for advanced users
6) Linux distros keep themselves and all software on them up to date. It's not something handled by the user or by each piece of software having it's own updater.
Linux could have problems, but the security holes found are much harder to exploit due to the way everything is set up by default, and how the system is used. A lot of Windows security problems have been "as designed".
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:1)
I could not agree with you more, as this is what makes the linux, vs M$ argument so easy to win, you look at how quick a patch comes out for linux, and how quick if at all (some still aren't) for windows....however, the sheer number of windows users, make it hard for any linux user to purely use linux, as it is a commercial preference, and therefor needs to be used by most homes as well....something to do with not wasting time looking for things because you do not know your system.
Re: (Score:1)
While it's easy to shift blame onto the user, this completely overlooks the fact that a system designed with the capability of executing foreign code without any kind of privilege escalation check is just asking for trouble. No one should have to worry about those puppies or that porn in the first place.
It's the dancing bunnies problem [codinghorror.com] in computer security. The nutshell is that even with Linux, users will open up a terminal and follow the magic script which includes all these bizarre cryptic invokations like gunzip, tar, chmod, sudo, and other weird things because they want to see their dancing bunnies, dammit!
Re: (Score:3, Insightful)
And Windows DOES have a privilege escalation check. It's called UAC. Lots of people disable it because of poorly-written software that needs admin rights all the time, but it is there.
The problem is the dancing bunnies problem [codinghorror.com]. And there's only one way around that - an iOS-style walled garden, where Microsoft approves every Windows app that can run manually.
Re: (Score:2)
There are millions of Macs shipped yearly. That seems like a pretty lucrative target to me, especially considering Linux and Mac users' sense of invulnerability (Guilty as charged, I use Linux).
Windows users have it hammered into their heads over and over how vulnerable their systems are. It's impossible that marketshare is the only reason those platforms aren't targeted.
Re: (Score:3, Insightful)
Yes, but while (say) 90% of computers are running Windows, what's the point of making the effort to do a Mac or Linux version of a virus/trojan, even if you could?
If you're shooting fish in a barrel, you don't care about the little ones you may miss because they're hiding under the big uns on top.
Re:Right goal. Wrong tool. (Score:4, Informative)
If linux or macos had a dominant market share the same problem would occur, but it wouldn't be anywhere near as bad...
Linux/Mac users are already used to running as an unprivileged user, providing an extra obstacle for any malware (sure malware can still do bad things without root, but it's much more difficult to hide and make itself difficult to remove), windows is only just starting to move towards this decades old best practice.
On a unix box, files are not deemed executable based on their name alone, if you download a file by default it will not be executable and an extra step is required to make it so.
Unix boxes not only don't rely on file extension to determine if a file is executable, they also don't hide the file extensions by default... A common attack on windows systems is to create a file called picture.jpg.exe and assign it an icon which looks like the default windows icon for a jpeg file, windows will dutifully hide the .exe part so users only see picture.jpg, assume its a picture and try to open it. Clever malware will even embed a picture inside the binary and when you run it, will save the embedded picture to a temporary location and spawn a viewer to display it. Using file extensions to determine file type, and then hiding those extensions by default is an extremely stupid and very dangerous flaw.
Unix systems also don't execute anything by default which is stored in an inserted piece of media, simply inserting the media won't infect you, you would have to explicitly go and execute the malware - which would result in very low infection rates.
So sure, if linux or mac had 95% of the market people would be looking to attack them, but the lack of many of the inherent security flaws in windows would make these attacks far less effective.
That said, linux having a 95% marketshare would be almost as undesirable as windows having it, diversity is extremely important - if there are 3 common systems with 30% market share each the job of a malware author becomes much harder and less profitable.
I do however predict, that in a 30/30/30 windows/linux/mac marketshare split, malware authors would still primarily target windows because it represents a softer target.
Re: (Score:2)
Well, when all you've got is a hammer every problem looks like a ...
Oh, wait. In this instance, where it is Microsoft as the problem solver, and digital security as the problem, it is more like the guy who dropped his keys in the darkest corner of the parking lot, but is looking for them 20 yards away, because that area is lit by a street light.
Re: (Score:1)
Maybe what Microsoft wants is to separate all the botnet computers from all the other computers. And if you are going to go that far, you might as well also move the most likely computers targeted to join these botnets.
So, 2 internets. One for computers running any Microsoft OS. And the other, the real one with all the good porn, for all the other computers.
Re: (Score:2)
If a patch has been released and people refuse to install it, the courts can make software secure.
Using the law to fix technical shortcomings (Score:3, Interesting)
So Microsoft has found that using lawyers and courts is a more effective way for them to combat malware and botnets than building good security into their products.
Why am I not surprised?
On a related matter, I am starting to see more reports of the possibility of malware in the Linux ecosystem. So far it is mostly a matter of an increase in security patches for Ubuntu and Debian apps, to fix vulnerabilities that no one has managed as yet to exploit to any significant degree. So its not really an issue, simply a minor annoyance that I've been saying okay to more automated updates in the last month or so than I was seeing this time last year.
Re:Using the law to fix technical shortcomings (Score:5, Insightful)
You're not surprised because you don't know what you're talking about. How exactly would they prevent a user from literally running an EXE someone randomly mails them?
I'll tell you what, I'll mail you a Linux binary and you just go ahead and run it for me. Also, have 50k of your friends run it for me too. Then tell me how surprised you are.
Technical shortcoming.... right.
Re:Using the law to fix technical shortcomings (Score:4, Insightful)
I don't know what planet you are living in.
No amount of security can ever stop a user who is determined to see the latest dancing baby screensaver from opening an exe. Linux is safe for now because it's technically competent using it, people who go to the effort to install and use it and not your every day user. If you throw a couple of million mums, dads and teenagers on it I would like to see your stats then.
Nobody is arguing that *nix isn't inherently more secure, it is, but the reality is that nothing is unbreakable with enough time and effort. Malware creators invest time where there is a reward and that just isn't the *nix world right now.
Even if Microsoft did a complete ground up security re-design a few thousand Malware creators will invest 2x the amount of time Microsoft did in creating it and still overcome it. The best solution is to thin that population of creators out by throwing them in jail or removing the monetary reward (through the form of legal fees) until the number of people developing the malware is less than the number of guys defending against it.
Re: (Score:2, Insightful)
Let's admit it, it's easier to hack a windows machine. Not because it's wildly used. But because it lacks fundamentals in its design. Their closed design and monopolistic approaches never let any kind of software repository to be build. So people got used to install software downloading from the Internet and double click on them. They don't have central update mechanism so that vendors can push their up
Re: (Score:2)
Re: (Score:1)
Unix is owner-friendly, Windows is pwner-friendly.
Re: (Score:2, Insightful)
No reward? I'd prefer to own thousands of linux servers for my botnet, not thousands of windows servers.
Thousands of Linux servers do not store peoples credit card information in text files on their desktop. The reality is that end users are a much juicier target after a cost-benefit-risk analysis.
Let's admit it, it's easier to hack a windows machine. Not because it's wildly used. But because it lacks fundamentals in its design. Their closed design and monopolistic approaches never let any kind of software repository to be build. So people got used to install software downloading from the Internet and double click on them. They don't have central update mechanism so that vendors can push their updates easily. They tried to be "user friendly" but it's evident that they created something "hacker friendly".
Nobody will dispute the fact that Windows has a lack of security in its fundamental design. I think it is a bad claim to make that the lack of a software repository is responsible for it, as well, since apt has only been around since 1998 and *nix still did not breed the same type of users Windows does. That being s
Re: (Score:2)
No, the best solution is to get rid of the monoculture which ensures the malware creators get such a high return on their investment...
If you have 4-5 different platforms with equal marketshare, malware authors need to invest significantly more to see the same level of returns.. Also competition between platforms would significantly increase the improvement work being done. As you point out, unix is inherently more secure but microsoft have no reason to match or exceed unix because people are still buying w
Re: (Score:2)
If you have 4-5 different platforms with equal marketshare, malware authors need to invest significantly more to see the same level of returns..
Then you would likely see more attacks coming from common elements of those very different platforms, such as Flash, Acrobat, or other plug-ins that would have different code bases but similar designs on all platforms. Or Office, or via Javascript, or Java, or CSS or any other common element.
Someone pointed out above that part of the issue is that Linux users thems
Re: (Score:2)
Actually, that's probably why we're seeing so much more attacks via PDF and
Re: (Score:2)
No, the best solution is to get rid of the monoculture which ensures the malware creators get such a high return on their investment
If the market were split evenly between Apple, MS, and Linux, there would still be millions of computers on each platform to infect (and botnetware writers would still target Windows). Market share is irrelavent in malware; Apple has something like 10% but that's still millions of computers for malware writers to infect.
As you point out, unix is inherently more secure but micro
Re: (Score:2)
First, there is a difference between clicking on dancing_bunnies.gif and dancing_bunnies.exe, and it is possible to teach many users that. However, with extensions hidden they're likely to click on dancing_bunnies.gif.exe. That's a problem with MS Windows that I don't think exists elsewhere.
Second, while there aren't a couple million mum, dads, and teenagers with Linux boxen, there are quite a few million Macs out there, and a lot of them are owned by people who don't know much about computers - in fac
Re: (Score:1)
First, there is a difference between clicking on dancing_bunnies.gif and dancing_bunnies.exe, and it is possible to teach many users that. However, with extensions hidden they're likely to click on dancing_bunnies.gif.exe. That's a problem with MS Windows that I don't think exists elsewhere.
The average user doesn't know the difference between a gif and an exe. If show extensions was on by default and the website they downloaded dancing_bunnies.exe off told them to run the .exe because they would get fantastic dancing bunnies, they would do it.
You need the piece of education in the middle that drums in to their head that exe's are bad. This is fundamentally a people problem, one that transcends operating system boundaries.
Re: (Score:1)
I guess it works both ways, it's the users who don't know anything about security and will run every script and executable to get their rocks off on some twinkeling-stars-and-nice-cute-bunny-free-game-with-an-option-to-win-an-iPad-program. But i've used Linux since slackware 7.1 through 12.1 and then switch shortly to Debian and then to Ubuntu. Since i made the switch from Slack I never downloaded any scripts if i wanted to install a program. With Slack i did that sometimes when it made installation and/or
Re: (Score:2)
I'll tell you what, I'll mail you a Linux binary and you just go ahead and run it for me.
Silly person. Why would he?
Last I checked, downloading programs from untrusted sources is something that only Windows users do. The relative merits, whys and wherefors aren't nearly as relevant as the recognition that doing so defines (outside of strictly controlled corporate environments) what it means to be a Windows user.
Re: (Score:3, Insightful)
I don't believe any linux mail client will provide a facility to execute directly from the client...
You will have to explicitly save the file somewhere, and then you will need to change its permissions to make it executable..
Then in order to properly embed itself into the system and hide itself, it will also require a working privilege escalation exploit, or for you to run it as root which requires you to perform yet another additional step.
Sure, most people on slashdot know how to do that, but then most pe
Re: (Score:2)
Hmm, lemme see...
1) save attached file somewhere, try to click it
[system complains that it does not know what program to use to open an 'application/octet-stream' file]
2) click again, dammit!
[the same complain arises]
Usually Joe Random User will give up now, muttering that 'this damn Linux is worth no shit'.
Of course the crux here is that in Linux you can not just 'run' downloaded (or attached, same thing) files as they don't have execute permission. You need to explicitly add these permissi
Re: (Score:3, Interesting)
Re: (Score:2)
Why would I run any Linux binary that you might mail to me?
Security issues aside, it requires more technical skills and time to prepare and run such a binary in Linux than it does to simply download the same binary from my distro's repositories. Which are rather more closely guarded by persons with security skills than what any Joe Sixpack or even I could do. If what you sent me isn't in a repository, then it would be kind of suspect to even the greenest newbie. Again, even if he trusted you fully and had
Re: (Score:2)
How exactly would they prevent a user from literally running an EXE someone randomly mails them?
That's one of Windows' vulnerabilities -- EXEs always run. In *nix, the extension has nothing to do with whether or not the file will execute. On top of that, there are different Windows extensions that WILL run. On top of that, the extension is hidden by default, so virus.jpg.exe will be shown as virus.jpg (IMO a really stupid move on MS's part).
I'll tell you what, I'll mail you a Linux binary and you just go ah
Re: (Score:2)
I predict now that the iOS AppStore model will become the new PC norm, much to our dismay. The ability to run random binaries without a curator overseeing will be gone for most folks in about 5 years. There will of course, be jailbreaking, open builds (pro OS) and such, but instead of virus-scanning taking the bulk of your computer's idle processor, it will be iTunes/Steam or the equivalent ensuring that your Ap
Re: (Score:3, Funny)
*checks process list*
Nope. Nothing. Maybe you, or your distro, just suck?
Or maybe you're just a troll.
Re: (Score:2)
Now that depends on your distro, linux gives you a choice... there are distros designed to be lightweight, there are distros like gentoo which are designed to place decisions like this in the hands of the user etc... There is nothing inherent in the linux kernel which requires consolekit.
Windows does not, you have to have IE, outlook express, media player, directx and all kinds of other stuff, even if you have the supposed "server" versions of windows.
Re: (Score:2)
Erm, no.
I don't know if it's still the case (I'm using kubuntu these days) but Mandriva had you choose EVERY app on OS install; LILO or GRUB? (bootloaders), KDE, Gnome, or whatever that other desktop was; at least five choices of browser, etc.
N
In Soviet Russia... (Score:2, Insightful)
Foot in the door... (Score:5, Insightful)
Seems Interesting... (Score:1)
Re: (Score:3, Insightful)
Re: (Score:1)
Re: (Score:1, Informative)
Because it's not? Let me know how well Ubuntu runs after you gsudo-elevate my trojan executable, which places a new entry in init.d, or attaches itself to /bin/login.
Re: (Score:2)
Convincing a clueless user to save an emailed piece of malware somewhere, change the permissions to make it executable and then execute it via gsudo is a much longer process than that required to convince them to click an executable inside of their windows based email client which is already running with elevated privileges.
The more complicated your social engineering instructions, the greater chance that the user will fail or start to smell a rat somewhere along the lines.
Re: (Score:2)
You have forgotten that, because it is a bit more complicated to install applications in Linux, a newbie using Linux won't be surprised that the social engineering instructions are a bit more complicated too.
Re: (Score:1)
Right. OK, how about I mail you a simple text file attachment, and include instructions "this will make your linux system you barely understand work much better. Instructions: Please save this file as ~/.login. Thank you.
Once I've got access to Joe User's home directory file, I pwn them. I can install a keylogger, I can install a non-root agent that waits for me to send it information about how to escalate to root via one of the many Linux local vulnerabilities, etc...
Linux's only saving graces are that
Re: (Score:2)
But what's going to happen when they can't sue people because malware propagates itself far more quickly than Microsoft can detect its origin?
More to the point, when US judges realize that foreign courts aren't obliged to enforce US verdicts despite their billion dollar "awards", and that really extradition only applies to criminal, not civil cases...
Removal! (Score:1)
Not about poor MS Security... (Score:5, Insightful)
Before people bleat about this being about poor MS security do remember how many dumb folks there are out there. Lots of attacks come from dumb folks using things like Bittorrent and then executing something that they really shouldn't do without having decent virus protection on their machine.
So good on Microsoft for doing this, yes they also need to clean up their security act, which they have been doing, but also coping with the dumb people who buy their products is a decent thing to do.
Re: (Score:2)
Re: (Score:2)
I have sometimes been asked to perform incident response work on behalf of clients, these are typically corporate users and every single system i've inspected has had up to date antivirus from one of the major vendors and almost all systems were up to date with microsoft patches.. Yet they still got infected.
Sometimes the particular strain of malware is not detected by the AV they use but is picked up by others, sometimes nothing picks it up yet. AV will just protect you against lingering traces of long aba
Re: (Score:2)
Re: (Score:2)
I disagree. It isn't that MS has poor security, it's the fact that the MS design philosophy lends itself well to getting a computer infected. Even assuming that the people who run Linux were book smart, but virus dumb, getting a virus to run reliably an any given Linux system while being able to propagate itself would be a logistics nightmare. I wouldn't say that it couldn't happen, or that MS is necessarily worse because of it. It's the very things that make MS user friendly that make it such an easy targe
What an unprecedented pile of crap (Score:2)
I don't know if it's the story or the report that's full of holes, but this makes no causal sense whatsoever.
Notwithstanding the basic "correlation does not equal causality" tenet, where is the connection between the forcible shutting-down of botnet-controlling domains, and the botnets themselves? A p2p-vectored botnet's growth has nothing to do with the purposes for which that botnet is employed.
Furthermore, stating that "the company cleaned fewer machines" is not equivalent to stating "their are fewer m
for once... (Score:2)
For once Microsoft is using its legal muscle for a good cause.
I'm shocked.
Malware comes and goes... (Score:2)
What microsoft fails to understand, is that the people operating these malware networks are not large slow monolithic corporations, just because a piece of malware which was common a few months ago is now dying out doesn't mean the problem is gone, it just means that the authors of that malware have moved on to their latest creations...
After all, why would you continue pushing an old piece of malware which has been reverse engineered and is detectable by every anti malware program out there, when you can wr
Prior Art (Score:2)
Without reading TFA, I can imagine that Microsoft is suing on the grounds that it should have the copyright on malware. There have actually been similar patents that MS has taken out before. I wouldn't be too surprised.