Spam-Bot Intrusion Caught — Now What? 76
An anonymous reader wonders: "I've recently detected and halted an intrusion on my home computer, taken some actions to prevent further intrusions, and located the software that was running a bot agent. Cursory examination showed that the bot software is intended for acting as an agent for spamming. Configuration files distinctly point at the user/host/domain of several bot-herders — damning evidence. Nothing would please me more than to see this botnet to be caught and disassembled, I'm sure much of the internet-using community would support this. Thanks in advance for your suggestions. So, to whom should I disclose this information for appropriate investigation, follow up, and countermeasures? "
one word (Score:5, Informative)
Re: (Score:2)
No accounting for idiots I guess!
Re: (Score:3, Informative)
If somebody's ISP is blindly rejecting mails due to nothing more than a positive Spamhaus hit then that's the fault of the ISP!
This is like discussing religion or OS preference...
What would you have ISPs do to stop spam? Spamassassin, properly tuned, does a decent job, but it doesn't solve the underlying problem. If an ISP allows *every* incoming connection and relies on spamassassin to detect and mark mail, then they have to ensure that there is sufficient storage for the spam. In most cases, the amount of spam incoming to a system is over ten times more than normal mail.
Using something like spamhaus helps out considerably bec
Re: (Score:2)
Done.
My ISP does this by default, and I sure noticed when they did as I could no longer reach my mailserver. A (not so) quick call to support got the port re-opened, but there is no reason why you can't have a block port25 by default and open on request. 99.9% of home internet users would likely never notice.
-nB
Re: (Score:2)
Re: (Score:1)
I agree with the improved client, but as long as MS Outlook (express) is the target (and yes, that includes Thunderbird) I'm not very hopeful about email. I also very much agree with secure channels, and that email alone makes mail trusted, as how could they encrypt if they didn't have a key. I've actually thought about something along this line for a while, but it's a tediou
Re: (Score:2)
Re: (Score:2)
Spamassassin has all that stuff built into it already. You may need to install some SPF and DKIM perl modules.
Re: (Score:2)
As for SPF, yes it might be an industry
Re: (Score:2, Funny)
Re: (Score:1, Insightful)
-- Thomas Jefferson, 1764
"This year will go down in history.
For the first time, a civilized nation has full gun registration.
Our streets will be safer, our police more effic
Places to report to... (Score:5, Insightful)
2) As for US gov't agencies, if you or the attacker seem to be in the US, http://www.ic3.gov/ [ic3.gov] is likely to be interested. http://www.cert.org/csirts/national/contact.html [cert.org] can also put you in touch with nationial computer security incident response teams, who will also be interested (you only need to contact the one local to you, please don't shotgun complaints to all of them.)
3) As for private companies and research organizations, if the bot isn't already clearly and specifically detected by antivirus, report it to them, following their reporting guidelines. Shadowserver (http://www.shadowserver.org) seems to be interested in researching and gathering intelligence on botnets also.
Re:Places to report to... (Score:5, Interesting)
The spirited attack on and destruction of Blue Security [securitylandlives.com] and the spam flood that followed, does not support that assertion. Somebody wanted them gone badly, for a reason.
Re:Places to report to... (Score:4, Interesting)
This is a far cry from when botnets were controlled "in the open" on public IRC networks - the kiddies are clearly learning something with each iteration, and they are sharing that knowledge amongst themselves. Also of note is more use of packers, executable encryption and anti-debugger routines, which were completely absent from early botnet executables. Use of rootkits, as well as secondary backdoors (to regain access after the system owner detects the intrusion) are also on the rise.
Re:Places to report to... (Score:5, Funny)
I disagree. If you could determine the physical location of such bot herders and disclose that to the internet at large, I'm sure that there would be a final solution applied that people would be willing to turn their backs on. Especially if you could post photographs, names, and physical addresses.
You could always try private sector... (Score:4, Informative)
Re: (Score:2)
Note that they don't actually "do anything" to the botnets. They study them and gather information, but they l
Re: (Score:1)
As an aside: How did you detect the infection?
I would think that ALL of the various A/V companies would be interested in your findings, as well.
In Soviet Russia... (Score:1, Funny)
Re: (Score:1, Funny)
--
No sig
Re: (Score:3, Insightful)
What actions? (Score:5, Insightful)
Preaching to the converted here but I'm amazed how many people do not realise that an owned computer is exactly that - there is nothing at all you can trust absolutely so you have to look at what is on the disk with something else and have to wipe it and start again. On *nix script kiddies love to put things in unexpected spots in the init scripts like in /etc/init.d/functions or the equivalent, or replace things like ntpd that you expect to talk to the outside world - so they would have control well before you get a shell. Some linux rootkits changed the generally useless ext2/ext3 file attributes in a cute effort to make cleaning up harder for those prone to try - it made it trivial to find their stuff becuase it would be the only thing on the volume with attributes set. Even then you can't trust that is all they did - it's just an obvious sign that you cannot trust anything on the machine.
Re: (Score:2)
She hates it but I could not trust her computer at all anymore.
All she ever does is yahoo mail, popcap games, and surf internet sites. The bot got on there and it was so well hidden only way I noticed was huge traffic on my router and you can see it going to certain sites and downloading the "tasks"
Law enforcement comes to mind first (Score:1)
If that fails (maybe because law enforcement does not have enough manpower to deal with it), then posting all inform
Re: (Score:1)
Re: (Score:3, Insightful)
It's not that the nets would be unknown. Every security researcher worth his salt has a fairly good idea where those botnets are and how they work. The problem is, nobody with the legal muscle to do anything about it would care.
Name and shame (Score:3, Interesting)
Re: (Score:1)
"Oh golly me, how did that happen..."
Publicity (Score:1, Insightful)
contact the ISP/registrar (Score:4, Interesting)
Whois is your friend.
Re:contact the ISP/registrar (Score:4, Insightful)
No, the best thing to do here is kill the whole problem. All the machines in the botnet need to be cleaned and updated so that they don't get re-infected, otherwise they will get taken over by someone else (Yes, I know most people when they infect a system DO update it so that someone else can't take over, but they leave back doors). The person running the botnet needs to see the beak (Judge). It might be that the beak decides that a slap on the wrist is the appropriate action, but I think just cutting off one point of access / control of a bot net which I am sure that they have other control over is just silly.
Re: (Score:2)
I say we lift off and nuke the site from orbit. It's the only way to be sure.
Re: (Score:3, Informative)
1) There is a properly listed contact for abuse reports to whom I send the complete relevant log entries in text format. I usually don't hear from them again, but I also don't see any further network abuse from that netblock owner.
2) The owner of the IP block is a complete and utter joke. Examples: they don't correctly configure their reverse DNS, so they will claim t
Rule 1 (Score:1, Troll)
Then, you need to stay on top of security issues. You run appear to run Windows so you'l have to work 10x as hard to do that. windows is a big steaming pile of goats shit when it comes to security. All the sh1t that MS claim protects you does nothing more than inconvenience normal users and slow their boxes down to buggery.
You're not likely t
Depends on the country (Score:2)
The appropriate action probably depends on the country you are in and the country hosting the herders.
From a list of things to be done, I would contact the ISP last. They will probably contact the perpatrators directly and remove them from service, but that will do nothing to take them out of circulation. That requires something more. Alternatively, you might ask your ISP for advice on how to procede. But make it clear the intentions with them. They might not have a clue what you've captured.
Use your government (Score:5, Funny)
Hack into the US Navy weapons control website.
Search for a file called "city-coords.txt".
Find out what the lat and long is of the spammer.
Change the line "Al Queda Base 4:xxx" to reflect the new coordinates.
Dress as Osama and make a press release with a big "Base 4" sign behind you. Use a good make-up artist if you want.
Two days leater and BAM!!! the spammer is gone. Your tax dollars at work for you!
Re: (Score:2, Funny)
Re: (Score:2)
Tststs, always those little minds who only care about their personal gain, when the well being of the whole population is at stake. Ask what you can do for your country and all that shit, you know...
Re: (Score:1)
Re: (Score:1)
The sad answer: Nothing (Score:3, Insightful)
What could you do? You could inform your local law enforcement. Which will invariably end up in a file cabinet within moments because they have no clue how to deal with it.
You could go a step higher and contact your country's equivalent of some sort of "internet police". Most countries have that today. They will look at the info, find out where the spammer sits and depending on where he sits it goes different roads. Either he is in a country within reach, i.e. your country or one where Interpol/Europol actually has some muscle. In this case, they will maybe even go through the hassle of dealing with the provider hosting the spam controller, and within 2-3 weeks they finally got all the papers necessary to shut the machine down. A day later, the spammer opens up a new one and the party continues.
If the machine is somewhere in Russia, far east or some country ending in -stan, nothing is being done and it just continues from the same machine.
The spammer himself (or rather, the individual registering the server) is invariably sitting in some of the countries mentioned in the previous paragraph and thus untouchable anyway.
In short, the best you can achive is to annoy a spammer. Just in case the server switch wasn't due anyway because you can only use a spamcontroller for a certain amount of time before the ISP gets interested and starts to "persuade" you to move.
Was in similar situation (Score:4, Informative)
I did get a thank you from Yahoo. But, the first one was clueless, ignoring the content of my letter. I got a second one from them saying thanks. But that they couldn't accept attachments. So couldn't send them the proof.
At any rate, what I did is erase the disk, restore from backup and some checked files, and lose a lot of time. There is probably little more you can do than simply report to one of the links below that you have a botnet address then as quickly as possible erase it.
I also found a number of commands changed in
Moral of the story? If you use a managed hosting service, keep a FULL backup locally. Run tripwire or something similar, I will from now on. Use a hosting service that is not completely clueless. Do not try an upgrade or anything afterwards. Have a portable hard disk you can use - my ipod was very useful. The most annoying thing was having to spend lots of time on the phone with admins, and having my email and website hanging in the air. The answer is to immediately cut all your losses, get another system maybe on another provider. Possibly you could even do this with a local machine and dyndns temporarily but if you're busy the last thing you have time to do is mess with crooks. Best thing that came from it is I discovered several other hosting companies from friendly clients who helped me get my jobs done.
Re:Was in similar situation (Score:4, Informative)
Unless the botnet has caused more then $5k in proven damages, with tangible evidence, law enforcement will not get involved, this is at the federal level, not sure about state and local, as they rarely deal with cyber crimes of this type, they prefer to deal with cyber stalking and threats to individuals in their localities. If you must report a botnet, report it to USCERT (run by DHS), they may not be able to get to the root if its in one of those countries listed, but they can research it, and they are capable, and if something can be done, it will be done in the background.
Re: (Score:2)
As recent threads have noted it pays to spam, which is why this has grown into such a sophisticated industry. It almost (not quite?) seems like spending that time taking revenge
You can try law enforcement, but... (Score:2)
A few years ago I installed a new release of a major vendor's OS. Unbeknownst to me, they had gone from a default secure model to a default open model. Before I finished checking out the security, someone had hacked in, installed a rootkit, and was using my system to attack a major financial institution. Their security guy contacted my ISP who contacted me. I yanked the ethernet cable, tracked everything down, saved the evidence (logs, binaries, etc), finished tightening the s
Just to hit that nail on the head a last time (Score:1)
It's not because ou think you only have a spambot that there's no trojan/backdoor/rootkit lurking in the background.
Be paranoid: do no trust any executable code, and even not your (hopefully) backed-up data.
Otherwise, you might just end up putting back yet another future spam/DDOS/phishbot on the net.
What is this??? (Score:1)
Re: (Score:1)
I have extensive experience with malware r
Botnet mailing list... (Score:1)
--
To report a botnet PRIVATELY please email: c2report@isotf.org
All list and server information are public and available to law enforcement upon request.o /botnets [linuxbox.org]
http://www.whitestar.linuxbox.org/mailman/listinf
SANS (Score:3, Informative)
You can contact them here: http://isc.sans.org/contact.html and see if they are interested or can direct you to the appropriate person or agency contact.