How to Steal a Botnet | Hacker News Reader

How to Steal a Botnet

catonmat.net

92 pointspkrumins22 comments

The bank account information is valued at $10.00 to $1,000 per account.

What can hackers do with your, say, checking account info (name and account number, I'm assuming)? Are you liable for any hacker-related losses, if you've done nothing wrong?

I don't know why financial institutions don't all require two-factor authentication these days. Nothing else will stop attacks like this.

c.f. http://www.schneier.com/blog/archives/2005/03/the_failure_of...

Some decent points, but if you require authentication for all transactions the man in the middle attack / trojan won't work. For every transfer have a SMS or phone call triggered to the customer--"We have received a request to transfer $x to Y, to authenticate please press 1." It may get annoying for every transaction, so it could only come into play for transactions to parties that you haven't dealt with in the last X days.

It might be nicer if you made them say "yes" so that replays could be detected. Pressing 1 makes the same tone every time, so malware on smartphones can easily bypass this authentication method.

If you're going to be that paranoid, the phone can't do it; the malware could simply record your voice saying "yes" and replay that recording as needed.

Surely, no real person is going to produce the exact same sound twice. Check the database of previous samples for matches or very close matches.

It's much more difficult to have malware on your computer and on your phone at the same time from the same attacker. But it could be random, do whatever the instructions say (sometimes 1 means yes, sometimes it means no).

Can anyone comment on how effective the common AV packages are at preventing being infected by Torpig and similar know attacks, and once infected, how effective at removing the infection?

Once infected, forget about it.

I've been infected by viruses three times. Twice were before this year, and it takes some quick work, but both times it was no real challenge to stabilize my machine, so beyond feeling really stupid for a few hours, it ended up being kind of fun.

In November, though, I infected my machine again. Three days later, it was still phoning home to Russia and the Ukraine. There was literally nothing I could do - even Malwarebytes and the like would clean it up only to a certain extent, and the viruses were still embedded in the system software. Finally I just gave up and bought a new machine so I could start from scratch, only pulling data from the old machine.

A good AV won't let you get infected - you still shouldn't allow actions that look fishy or unexpected, but at least you're in control. But once you're infected, the botnet can respond in realtime to what you're trying to do to stop it. And they're better than you are at it.

I'm not saying it's impossible to clean up a machine that's fallen into their hands - but I am saying that even with some past success in this under my belt, I was unable to do it in any amount of time that was justified (even in terms of fun).

They're definitely getting nastier. Last week we had our first client system that required a format-and-reinstall. Fortunately, this was a relatively new machine and the client didn't care about any of the data on it. (We have a strict "format-and-reinstall as a last resort only" policy on our flat-rate infected machine cleanups.)

If you can still get the machine to boot, I've had very good luck with ComboFix. (Make sure you get it from bleepingcomputer.com [1], not combofix.org, which is an unauthorized re-distribution.)

Most of the rootkits I'm seeing still aren't working directly on existing system files, a la the computer viruses of old. Instead, they're modifying ini files and then installing some cleverly hidden files in system directories. So, you can use tools like RootKit Revealer [2] to sniff them out. Actually removing any hidden files or hidden registry keys may require some expertise and serious effort -- we have a dedicated diagnostic system set up that we use to handle some of these things, with the drive removed from the client computer.

[1]: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[2]: http://technet.microsoft.com/en-us/sysinternals/bb897445.asp...

Why did you have to buy a new machine? Couldn't you have copied the data to an external disk instead of a new machine, then formatted the hdds, maybe flashed the bios and started over?

Yes. But by that time I'd already spent three days, and wanted to have a Linux box to be sure nothing could possibly execute on it while I was poking in the data, and since this all happened on my birthday to start with, my wife said, "Go out and buy a new machine or two."

So I did, and didn't regret it.

I actually got a tingly feeling in my spine when I watched this lecture. I'm having Terminator's Skynet flashes.

The darkside of internet technology is very interesting... Can you imagine the ingenuity that needs to go into the creation of the software for a botnet? Kind of cool in many ways.

It is utterly cool. I love it, botnets and spam and all. I just wish I had the time to spend with it instead of earning a living.

Some of the interesting parts of botnets have commercial or research value.

As an example... I find it very difficult, in general, to install software onto multiple Windows machines. Different versions of DLLs, differing Windows features, differing filesystem layout, etc. The botnet control system seems to reliably install on all sorts of machines, without needing 3 restarts and without asking lots of dumb questsions.

Making installing real programs this easy and reliable would be quite nice.

I'm guessing the software involved would be fairly simple by comparison and thus there wouldn't be as many complications as in a normal program's installation. Are there any bot nets that use DirectX for example or .Net? I'd doubt it.

These kinds of things are meant to run completely under the radar and take up as little space as possible. Unless they're exploiting an existing .Net or DirectX installation.

Well, true to a certain extent. But if the installation hoses your machine entirely (which it did my daughter's machine), they aren't bothered by customer support calls.

Would using webpages via https also be compromised? Do these botnets also use keylogging?

Yep, using webpages via https would be compromised. The bots hook various DLL to get the content before encryption when it's sent and after decryption when it's received.

They don't seem to use keylogging. They only capture HTML form information.

Reply on news.ycombinator.com