10 ms·

The guy takes all the time to put this together, write this up, and is perfectly ok with the outcome, but instead of going to a coffee shop and doing this himse

The guy takes all the time to put this together, write this up, and is perfectly ok with the outcome, but instead of going to a coffee shop and doing this himself, he spends a lengthy amount of time writing up instructions and giving the criminals a chance to fix their injection problems before someone can take down the botnet. Baffling. Not only that, but this guy seems to know what he's doing and instead of someone who knows what they're doing completing the task, he's willing to watch script kids bork the whole thing, or run the risk of russians (or others taking over the whole network and hardening it)

acqq 15y ago
I also don't understand how he expects that the botnet won't be taken over or hardened based on the results he published before it gets shut. I did try to download the images linked in the post, not a single one is as I write replaced with his removal utility, so observing just these few links there's no evidence that somebody already decided to follow his recipe. I'd really like to read some news writeup in a few days.
tedivm 15y ago
To prove a point- the current system of law is completely broken when it comes to dealing with malicious software. Law enforcement is a joke, to the point where reporting a botnet c&c located right in the US to the FBI will result in a six week run around before you finally get a phone call from someone in the right department, and this is assuming you've dealt with them enough to be on their quick list. Guess who moved their servers four weeks ago? Actually taking matters into your own hands, as an individual or a company, opens you up to a ridiculous level of liability and is probably illegal in a number of cases. Hell, even analyzing malicious software itself has the potential to be illegal due to draconian copyright laws (fortunately most malware authors aren't willing to claim owner of their software, so this isn't an active issue). Even once all that is done, more malware will be written, and probably by the same people since it's not like taking the botnet down actually puts people behind bars. This isn't to say the bad guys are winning- I may be a bit bias (I work for Malwarebytes, although this post is my own rambling mess), but a lot of technological strides are being made. There is still a fair bit of frustration out there with law enforcement though, as they continue to impose draconian and orwellian systems but haven't implemented the low hanging fruit in policy changes for actually dealing with this crap.
- peterwwillis 15y ago
  The good thing is Congress is having hearings on cybersecurity, so clearly this will be fixed very soon.
  - gcb 15y ago
    yeah. can't wait to have pipes outlawed. Will have an excuse to drive to California when i need a new sink in the house.
- SODaniel 15y ago
  But download a Justin Beiber album and you get sued for $50k in a matter of days. System works perfectly!
ticks 15y ago
I imagine if you do it from a coffee shop or similar public place, then there is a good chance of being caught on CCTV. Whether the authorities will go after someone to that degree, given what they have potentially done, is another matter.
- inchcombec 15y ago
  Exactly. It seems to be a point that a lot of people forget. A lot of people don't fully trust the Internet security tools, such as TOR, for anonymity. So, they try to add a layer of what is essentially physical security by using an Internet connection that doesn't track back to them. However, a lot of times people don't fully consider that at that point you must now not only secure your Internet security but physical security as well. Ie. Not be seen. I'm not saying it is a bad idea to want to add an extra layer of security/anonymity, but it actually has to be done right. If investigators trace it back to the coffee shop and see on the CCTV that you're the only one sitting there using a laptop for the entire time the attack took place you're screwed. Interestingly enough, all the ways to actually add that layer of physical security are potentially illegal. (depending on local laws) Obviously, the laws can vary a lot, but in a lot of places the methods a person would use to hide themselves are considered unlawful access. Take the coffee shop for example, instead of entering the coffee shop you sit outside it. If it doesn't have cameras outside, the businesses around it very well might have one that can see you, and then there are also the people that see you. (witnesses) Okay then, long range antenna, right? Wrong, still illegal in some places. Even though it is an unsecured wifi that is meant for people to connect to it, it is meant for customers. That means that you either have to go in and buy a coffee (which shows on camera that you were in the area) or to have previously asked permission to use it which means that someone in the coffee shop must know who you are to have given you permission. This caveat actually applies to the parking lot situation too and people really have been charged before for accessing a coffee shop's wifi from the parking lot without actually going in so this isn't just a thought exercise. Generally, if you're doing something online illegal enough to be investigated that fully, illegally accessing some coffee shop's connection is the least of your problems. There are legitimate reasons to want total anonymity though, such as whistle-blowers or individuals living in certain countries. If you're going to try for that level of anonymity it is important to know the local laws and make sure that whatever you're trying to be anonymous about is worth potentially breaking that law if it exists.
daemon13 15y ago
I apologize in advance for the tone, but as a Russian I have a question - are you racist? Since Sergey Brin and Mila Yovovich are "russians", do you imply that Google and Hollywood are part of this botnet? The most famous hacker is Kevin Mitnick [american] and most recent hackers charged/arrested by FBI are also american citizens. Why don't you change "russians" to "americans"? Or may be "new_zealanders" [Kim dot com]? Or may be "brits" [UK kid, extradicted recently to US on copyright violation charges]. If you would change to "americans", I just wonder whether some people will feel offended and how many?
- Tyrannosaurs 15y ago
  Indeed. The word criminals would be more accurate and less pejorative.
  - rplnt 15y ago
    "Russian" is pejorative?
    - Tyrannosaurs 15y ago
      Sorry, my intent was to suggest that the sentence was pejorative towards Russians. I may have been unclear and reading up I may have misused the word - can pejorative apply to a sentence or just to a word or phrase?
      - rplnt 15y ago
        Yeah, I was just not sure if you were using it on the whole comment or making a silly joke. And I think it's a word only, at least in a language I speak naturally. That is not English however.
    - aqme28 15y ago
      Any word can be a pejorative if used as such, you hacker.
- icebraining 15y ago
DanBC 15y ago
Who should he tell? If any of the victims are in the UK he could try the Police Central e-crime Unit. (It's all 'cyber', a word which feels strangely quaint.) (http://www.met.police.uk/pceu/ http://www.met.police.uk/pceu/) Or he could try Microsofts digital crime unit. (http://www.microsoft.com/government/ww/safety-defense/initiatives/Pages/dcu-economic-crime.aspx http://www.microsoft.com/government/ww/safety-defense/initia...) Any other contact addresses?
stuaxo 15y ago
Not really baffling, just obviously sarcasm + he couldn't legally say for anyone to use the tools.
rickdangerous1 15y ago
What makes you think that he didn't post this and then immediately do it himself? It's called plausible deniability.
- gcb 15y ago
  this actually will make it harder for him, as he just defined motive and means to the prosecution
  - regularfry 15y ago
    Only if the act itself were traceable to him. If he's the only one who knows how to do it, and it happens, then "of course" he did it. If everyone knows how to do it, who knows who might have been responsible?

acqq 15y ago

I also don't understand how he expects that the botnet won't be taken over or hardened based on the results he published before it gets shut. I did try to download the images linked in the post, not a single one is as I write replaced with his removal utility, so observing just these few links there's no evidence that somebody already decided to follow his recipe. I'd really like to read some news writeup in a few days.

tedivm 15y ago

To prove a point- the current system of law is completely broken when it comes to dealing with malicious software. Law enforcement is a joke, to the point where reporting a botnet c&c located right in the US to the FBI will result in a six week run around before you finally get a phone call from someone in the right department, and this is assuming you've dealt with them enough to be on their quick list. Guess who moved their servers four weeks ago? Actually taking matters into your own hands, as an individual or a company, opens you up to a ridiculous level of liability and is probably illegal in a number of cases. Hell, even analyzing malicious software itself has the potential to be illegal due to draconian copyright laws (fortunately most malware authors aren't willing to claim owner of their software, so this isn't an active issue). Even once all that is done, more malware will be written, and probably by the same people since it's not like taking the botnet down actually puts people behind bars. This isn't to say the bad guys are winning- I may be a bit bias (I work for Malwarebytes, although this post is my own rambling mess), but a lot of technological strides are being made. There is still a fair bit of frustration out there with law enforcement though, as they continue to impose draconian and orwellian systems but haven't implemented the low hanging fruit in policy changes for actually dealing with this crap.

peterwwillis 15y ago
The good thing is Congress is having hearings on cybersecurity, so clearly this will be fixed very soon.
- gcb 15y ago
  yeah. can't wait to have pipes outlawed. Will have an excuse to drive to California when i need a new sink in the house.
SODaniel 15y ago
But download a Justin Beiber album and you get sued for $50k in a matter of days. System works perfectly!

ticks 15y ago

I imagine if you do it from a coffee shop or similar public place, then there is a good chance of being caught on CCTV. Whether the authorities will go after someone to that degree, given what they have potentially done, is another matter.

inchcombec 15y ago
Exactly. It seems to be a point that a lot of people forget. A lot of people don't fully trust the Internet security tools, such as TOR, for anonymity. So, they try to add a layer of what is essentially physical security by using an Internet connection that doesn't track back to them. However, a lot of times people don't fully consider that at that point you must now not only secure your Internet security but physical security as well. Ie. Not be seen. I'm not saying it is a bad idea to want to add an extra layer of security/anonymity, but it actually has to be done right. If investigators trace it back to the coffee shop and see on the CCTV that you're the only one sitting there using a laptop for the entire time the attack took place you're screwed. Interestingly enough, all the ways to actually add that layer of physical security are potentially illegal. (depending on local laws) Obviously, the laws can vary a lot, but in a lot of places the methods a person would use to hide themselves are considered unlawful access. Take the coffee shop for example, instead of entering the coffee shop you sit outside it. If it doesn't have cameras outside, the businesses around it very well might have one that can see you, and then there are also the people that see you. (witnesses) Okay then, long range antenna, right? Wrong, still illegal in some places. Even though it is an unsecured wifi that is meant for people to connect to it, it is meant for customers. That means that you either have to go in and buy a coffee (which shows on camera that you were in the area) or to have previously asked permission to use it which means that someone in the coffee shop must know who you are to have given you permission. This caveat actually applies to the parking lot situation too and people really have been charged before for accessing a coffee shop's wifi from the parking lot without actually going in so this isn't just a thought exercise. Generally, if you're doing something online illegal enough to be investigated that fully, illegally accessing some coffee shop's connection is the least of your problems. There are legitimate reasons to want total anonymity though, such as whistle-blowers or individuals living in certain countries. If you're going to try for that level of anonymity it is important to know the local laws and make sure that whatever you're trying to be anonymous about is worth potentially breaking that law if it exists.

daemon13 15y ago

I apologize in advance for the tone, but as a Russian I have a question - are you racist? Since Sergey Brin and Mila Yovovich are "russians", do you imply that Google and Hollywood are part of this botnet? The most famous hacker is Kevin Mitnick [american] and most recent hackers charged/arrested by FBI are also american citizens. Why don't you change "russians" to "americans"? Or may be "new_zealanders" [Kim dot com]? Or may be "brits" [UK kid, extradicted recently to US on copyright violation charges]. If you would change to "americans", I just wonder whether some people will feel offended and how many?

Tyrannosaurs 15y ago
Indeed. The word criminals would be more accurate and less pejorative.
- rplnt 15y ago
  "Russian" is pejorative?
  - Tyrannosaurs 15y ago
    Sorry, my intent was to suggest that the sentence was pejorative towards Russians. I may have been unclear and reading up I may have misused the word - can pejorative apply to a sentence or just to a word or phrase?
    - rplnt 15y ago
      Yeah, I was just not sure if you were using it on the whole comment or making a silly joke. And I think it's a word only, at least in a language I speak naturally. That is not English however.
  - aqme28 15y ago
    Any word can be a pejorative if used as such, you hacker.
icebraining 15y ago

DanBC 15y ago

Who should he tell? If any of the victims are in the UK he could try the Police Central e-crime Unit. (It's all 'cyber', a word which feels strangely quaint.) (http://www.met.police.uk/pceu/ http://www.met.police.uk/pceu/) Or he could try Microsofts digital crime unit. (http://www.microsoft.com/government/ww/safety-defense/initiatives/Pages/dcu-economic-crime.aspx http://www.microsoft.com/government/ww/safety-defense/initia...) Any other contact addresses?

stuaxo 15y ago

Not really baffling, just obviously sarcasm + he couldn't legally say for anyone to use the tools.

rickdangerous1 15y ago

What makes you think that he didn't post this and then immediately do it himself? It's called plausible deniability.

gcb 15y ago
this actually will make it harder for him, as he just defined motive and means to the prosecution
- regularfry 15y ago
  Only if the act itself were traceable to him. If he's the only one who knows how to do it, and it happens, then "of course" he did it. If everyone knows how to do it, who knows who might have been responsible?