The HOLLYWOOD sign as multi-user access-control system

business, security / /

From Bruce Schneier’s “Hollywood Sign Security” (Crypto-Gram: 15 January 2005):

In Los Angeles, the “HOLLYWOOD” sign is protected by a fence and a locked gate. Because several different agencies need access to the sign for various purposes, the chain locking the gate is formed by several locks linked together. Each of the agencies has the key to its own lock, and not the key to any of the others. Of course, anyone who can open one of the locks can open the gate.

This is a nice example of a multiple-user access-control system. It’s simple, and it works. You can also make it as complicated as you want, with different locks in parallel and in series.

The HOLLYWOOD sign as multi-user access-control system Read More »

When people feel secure, they’re easier targets

business, security, technology / /

From Bruce Schneier’s “Burglars and “Feeling Secure” (Crypto-Gram: 15 January 2005):

This quote is from “Confessions of a Master Jewel Thief,” by Bill Mason (Villard, 2003): “Nothing works more in a thief’s favor than people feeling secure. That’s why places that are heavily alarmed and guarded can sometimes be the easiest targets. The single most important factor in security — more than locks, alarms, sensors, or armed guards — is attitude. A building protected by nothing more than a cheap combination lock but inhabited by people who are alert and risk-aware is much safer than one with the world’s most sophisticated alarm system whose tenants assume they’re living in an impregnable fortress.”

The author, a burglar, found that luxury condos were an excellent target. Although they had much more security technology than other buildings, they were vulnerable because no one believed a thief could get through the lobby.

When people feel secure, they’re easier targets Read More »

Examples of tweaking old technologies to add social aspects

history, social software, tech in changing society, technology / /

From Clay Shirky’s “Group as User: Flaming and the Design of Social Software” (Clay Shirky’s Writings About the Internet: 5 November 2004):

This possibility of adding novel social components to old tools presents an enormous opportunity. To take the most famous example, the Slashdot moderation system puts the ability to rate comments into the hands of the users themselves. The designers took the traditional bulletin board format — threaded posts, sorted by time — and added a quality filter. And instead of assuming that all users are alike, the Slashdot designers created a karma system, to allow them to discriminate in favor of users likely to rate comments in ways that would benefit the community. And, to police that system, they created a meta-moderation system, to solve the ‘Who will guard the guardians’ problem. …

Likewise, Craigslist took the mailing list, and added a handful of simple features with profound social effects. First, all of Craigslist is an enclosure, owned by Craig … Because he has a business incentive to make his list work, he and his staff remove posts if enough readers flag them as inappropriate. …

And, on the positive side, the addition of a “Nominate for ‘Best of Craigslist'” button in every email creates a social incentive for users to post amusing or engaging material. … The only reason you would nominate a post for ‘Best of’ is if you wanted other users to see it — if you were acting in a group context, in other words. …

Jonah Brucker-Cohen’s Bumplist stands out as an experiment in experimenting the social aspect of mailing lists. Bumplist, whose motto is “an email community for the determined”, is a mailing list for 6 people, which anyone can join. When the 7th user joins, the first is bumped and, if they want to be back on, must re-join, bumping the second user, ad infinitum. … However, it is a vivid illustration of the ways simple changes to well-understood software can produce radically different social effects.

You could easily imagine many such experiments. What would it take, for example, to design a mailing list that was flame-retardant? Once you stop regarding all users as isolated actors, a number of possibilities appear. You could institute induced lag, where, once a user contributed 5 posts in the space of an hour, a cumulative 10 minute delay would be added to each subsequent post. Every post would be delivered eventually, but it would retard the rapid-reply nature of flame wars, introducing a cooling off period for the most vociferous participants.

You could institute a kind of thread jail, where every post would include a ‘Worst of’ button, in the manner of Craigslist. Interminable, pointless threads (e.g. Which Operating System Is Objectively Best?) could be sent to thread jail if enough users voted them down. (Though users could obviously change subject headers and evade this restriction, the surprise, first noted by Julian Dibbell, is how often users respect negative communal judgment, even when they don’t respect the negative judgment of individuals. [ See Rape in Cyberspace — search for “aggressively antisocial vibes.”])

You could institute a ‘Get a room!’ feature, where any conversation that involved two users ping-ponging six or more posts (substitute other numbers to taste) would be automatically re-directed to a sub-list, limited to that pair. The material could still be archived, and so accessible to interested lurkers, but the conversation would continue without the attraction of an audience.

You could imagine a similar exercise, working on signal/noise ratios generally, and keying off the fact that there is always a most active poster on mailing lists, who posts much more often than even the second most active, and much much more often than the median poster. Oddly, the most active poster is often not even aware that they occupy this position (seeing ourselves as others see us is difficult in mediated spaces as well,) but making them aware of it often causes them to self-moderate. You can imagine flagging all posts by the most active poster, whoever that happened to be, or throttling the maximum number of posts by any user to some multiple of average posting tempo.

Examples of tweaking old technologies to add social aspects Read More »

Clay Shirky on flaming & how to combat it

history, social software, tech in changing society / /

From Clay Shirky’s “Group as User: Flaming and the Design of Social Software” (Clay Shirky’s Writings About the Internet: 5 November 2004):

Learning From Flame Wars

Mailing lists were the first widely available piece of social software. … Mailing lists were also the first widely analyzed virtual communities. …

Flame wars are not surprising; they are one of the most reliable features of mailing list practice. If you assume a piece of software is for what it does, rather than what its designer’s stated goals were, then mailing list software is, among other things, a tool for creating and sustaining heated argument. …

… although the environment in which a mailing list runs is computers, the environment in which a flame war runs is people. …

The user’s mental model of a word processor is of limited importance — if a word processor supports multiple columns, users can create multiple columns; if not, then not. The users’ mental model of social software, on the other hand, matters enormously. For example, ‘personal home pages’ and weblogs are very similar technically — both involve local editing and global hosting. The difference between them was mainly in the user’s conception of the activity. …

… The cumulative effect is to make maximizing individual flexibility a priority, even when that may produce conflict with the group goals.

Netiquette and Kill Files

The first general response to flaming was netiquette. Netiquette was a proposed set of behaviors that assumed that flaming was caused by (who else?) individual users. If you could explain to each user what was wrong with flaming, all users would stop.

This mostly didn’t work. The problem was simple — the people who didn’t know netiquette needed it most. They were also the people least likely to care about the opinion of others …

… Addressing the flamer directly works not because he realizes the error of his ways, but because it deprives him of an audience. Flaming is not just personal expression, it is a kind of performance, brought on in a social context.

… People behave differently in groups, and while momentarily engaging them one-on-one can have a calming effect, that is a change in social context, rather than some kind of personal conversion. …

Another standard answer to flaming has been the kill file, sometimes called a bozo filter, which is a list of posters whose comments you want filtered by the software before you see them. …

… And although people have continually observed (for thirty years now) that “if everyone just ignores user X, he will go away,” the logic of collective action makes that outcome almost impossible to orchestrate — it only takes a couple of people rising to bait to trigger a flame war, and the larger the group, the more difficult it is to enforce the discipline required of all members.

The Tragedy of the Conversational Commons

Briefly stated, the tragedy of the commons occurs when a group holds a resource, but each of the individual members has an incentive to overuse it. …

In the case of mailing lists (and, again, other shared conversational spaces), the commonly held resource is communal attention. The group as a whole has an incentive to keep the signal-to-noise ratio high and the conversation informative, even when contentious. Individual users, though, have an incentive to maximize expression of their point of view, as well as maximizing the amount of communal attention they receive. It is a deep curiosity of the human condition that people often find negative attention more satisfying than inattention, and the larger the group, the likelier someone is to act out to get that sort of attention.

However, proposed responses to flaming have consistently steered away from group-oriented solutions and towards personal ones. …

Weblog and Wiki Responses

… Weblogs are relatively flame-free because they provide little communal space. In economic parlance, weblogs solve the tragedy of the commons through enclosure, the subdividing and privatizing of common space. …

Like weblogs, wikis also avoid the tragedy of the commons, but they do so by going to the other extreme. Instead of everything being owned, nothing is. Whereas a mailing list has individual and inviolable posts but communal conversational space, in wikis, even the writing is communal. … it is actually easier to restore damage than cause it. …

Weblogs and wikis are proof that you can have broadly open discourse without suffering from hijacking by flamers, by creating a social structure that encourages or deflects certain behaviors.

Clay Shirky on flaming & how to combat it Read More »

Word of the day: creative destruction

business, language & literature, word of the day / /

From Wikipedia’s “Creative destruction” (13 July 2006):

Creative destruction, introduced by the economist Joseph Schumpeter, describes the process of industrial transformation that accompanies radical innovation. In Schumpeter’s vision of capitalism, innovative entry by entrepreneurs was the force that sustained long-term economic growth, even as it destroyed the value of established companies that enjoyed some degree of monopoly power. …

There are numerous types of innovation generating creative destruction in an industry:

New markets or products
New equipment
New sources of labor and raw materials
New methods of organization or management
New methods of inventory management
New methods of transportation
New methods of communication (e.g., the Internet)
New methods of advertising and marketing
New financial instruments
New ways to lobby politicians or new legal strategies

Word of the day: creative destruction Read More »

Why the US toppled Chile’s government

history, politics / /

From Robert Sherrill’s “100 (Plus) Years of Regime Change” (The Texas Observer: 14 July 2006):

Kissinger, then secretary of state, was certain he detected the odor of communism in the election of Salvador Allende Gossens to the presidency of Chile. …

Chile was one of the most stable countries in South America, with a high literacy rate, a relatively large middle class, and a strong civil society. But millions of its people lived in desperate poverty, and Allende made no secret of his ambition to lift that class – and to do it by controlling some of the giant corporations operating in Chile but owned by yanquis.

Topping his hit list, besides consumer-product companies like PepsiCo Inc., were the world’s two largest copper mining companies, Kennecott Corp. and Anaconda Mining Co., and International Telephone and Telegraph Co., all owned by U.S. interests. Allende wanted the Chilean government to take them over. …

Kinzer’s account of these rebellious years ends with the death of Allende in La Moneda, the presidential palace and traditional seat of Chilean democracy. He had been president for 1,042 days. He refused an offer of free passage out of the country and committed suicide.

So Kissinger and Nixon and Rockefeller and their friends got what they wanted: a Chile run by Gen. Augusto Pinochet, who took office after the coup of September 11, 1973.

Why the US toppled Chile’s government Read More »

Why the US toppled Guatamala’s democratic government

history, politics / /

From Robert Sherrill’s “100 (Plus) Years of Regime Change” (The Texas Observer: 14 July 2006):

At roughly the same time Secretary of State Dulles was destroying democracy in Iran, he was also busy destroying democracy in Central America, and once again it was on behalf of a renegade industry: United Fruit Co. …

“Few private companies have ever been as closely interwoven with the United States government as United Fruit was during the mid-1950s,” writes Kinzer. For decades, Dulles had been one of its principal legal counselors. (At one time Dulles negotiated an agreement with Guatemala that gave United Fruit a 99-year lease on a vast tract of land, tax free.) Dulles’ brother – Allen, the CIA Director – had also done legal work for the company and owned a big block of its stock. So did other top officials at State; one had previously been president of United Fruit. The head of our National Security Council was United Fruit’s former chairman of the board, and the president of the International Bank for Reconstruction and Development was a former board member.

These fine chaps and their numerous colleagues in our government were, not surprisingly, very upset when between 1944 and 1954, Guatemala entered what would be known as its “democratic spring,” denoting the presidencies of Juan José Arevalo and – after the first peaceful transfer of power in Guatemalan history – Jacobo Arbenz.

What those two did was nothing less than breathtaking. Under Arevalo, the National Assembly was persuaded to establish the first social security system, guarantee the rights of trade unions, fix a 48-hour workweek, and even slap a modest tax on the big landholders – meaning three American companies: a huge electric monopoly, a rail monopoly, and, of course, United Fruit, which controlled the other two.

Arbenz was even bolder. He persuaded the National Assembly to pass the Agrarian Reform Law, which gave the government the power to seize and redistribute uncultivated land on estates larger than 672 acres. United Fruit owned more than 550,000 acres, about one-fifth of the country’s arable land, but cultivated less than 15 percent – while many thousands of Guatemalans were starving for land. So in 1953, Arbenz’s government seized 234,000 uncultivated acres of United Fruit’s land, for which the government offered in compensation (one can imagine the vengeful hilarity this must have stirred in Arbenz’s circle) a paltry $1.185 million – the value United Fruit had declared each year for tax purposes. …

Arbenz was forced into exile and replaced by Col. Carlos Armas, who promptly canceled reforms and established a police state.

Why the US toppled Guatamala’s democratic government Read More »

Why the US toppled Iran’s government

business, history, politics / /

From Robert Sherrill’s “100 (Plus) Years of Regime Change” (The Texas Observer: 14 July 2006):

In 1953 the brutal, venal shah of Iran, Mohammad Reza Pahlavi, was pushed into exile by Mohammad Mossadegh, the democratically elected prime minister. …

Iranians loved Mossadegh. He made clear that his two ambitions were to set up a lasting democracy and to strengthen nationalism – by which he meant get rid of the Anglo-Iranian Oil Co., which had been robbing Iran for half a century. Indeed, the British company had been earning each year as much as all the royalties it paid Iran over 50 years. Mossadegh intended to recapture those riches to rebuild Iran.

In a scheme to get rid of Mossadegh, the British enlisted Secretary of State [John Foster] Dulles; he in turn enlisted his brother, CIA Director Allen Dulles, and what ensued was a truly masterful piece of skullduggery. … The CIA plotters ousted Mossadegh and restored the shah to his Peacock Throne.

For Secretary of State Dulles and his old law clients – including Gulf Oil Corp., Standard Oil Co. of New Jersey, Texaco Inc., and Mobil Corp., who were subsequently allowed to take 40 percent of Iran’s oil supply – the shah’s return was a happy and very lucrative event.

Why the US toppled Iran’s government Read More »

14 governments the US has overthrown in 110 years

history, politics / /

From Robert Sherrill’s “100 (Plus) Years of Regime Change” (The Texas Observer: 14 July 2006):

[Stephen Kinzer’s] Overthrow is an infuriating recitation of our government’s military bullying over the past 110 years – a century of interventions around the world that resulted in the overthrow of 14 governments – in Hawaii, Cuba, the Philippines, Puerto Rico, Vietnam, Guatemala, Nicaragua, Honduras, Panama, Chile, Iran, Grenada, Afghanistan, and … Iraq. …

Most of these coups were triggered by foreign combatants and then taken over and finished by us. But four of them, in many ways the worst of the lot, were all our own, from conspiracy to conclusion. American agents engaged in complex, well-financed campaigns to bring down the governments of Iran, Guatemala, South Vietnam, and Chile. None would have fallen – certainly not in the same way or at the same time – if Washington had not acted as it did.

Each of these four coups was launched against a government that was reasonably democratic (with the arguable exception of South Vietnam) …. They led to the fall of leaders who embraced American ideals, and the imposition of others who detested everything Americans hold dear. They were not rogue operations. Presidents, cabinet secretaries, national security advisers, and CIA directors approved them …. The first thing all four of these coups have in common is that American leaders promoted them consciously, willfully, deliberately, and in strict accordance with the laws.

14 governments the US has overthrown in 110 years Read More »

Politics as pathology

history, politics / /

From Charles Platt’s “The Profits of Fear” (August 2005):

It seems to me axiomatic that most primary actors on the global stage are disturbed people, because an obsessive lust for power is itself a pathology, and in a competition among thousands or millions of power seekers, only the most pathological are likely to win. …

I think Bush understood very clearly a fundamental fact of politics: Our leaders are less valuable to us at times when we feel more secure.

Politics as pathology Read More »

The neutron bomb as the most moral weapon possible

commonplace book, history, politics, tech in changing society / /

From Charles Platt’s “The Profits of Fear” (August 2005):

Sam Cohen might have remained relatively unknown, troubled by ethical lapses in government and the military but unable to do anything about them, if he had not visited Seoul in 1951, during the Korean war. In the aftermath of bombing sorties he witnessed scenes of intolerable devastation. Civilians wandered like zombies through the ruins of a city in which all services had ceased. Children were drinking water from gutters that were being used as sewers. “I’d seen countless pictures of Hiroshima by then,” Cohen recalls, “and what I saw in Seoul was precious little different. . . . The question I asked of myself was something like: If we’re going to go on fighting these damned fool wars in the future, shelling and bombing cities to smithereens and wrecking the lives of their surviving inhabitants, might there be some kind of nuclear weapon that could avoid all this?”

Here was a singularly odd idea: To re-engineer the most inhumane and destructive weapon of all time, so that it would _reduce_ human suffering. Cohen’s unique achievement was to prove that this could in fact be done.

His first requirement was that wars should be fought as they had been historically, confining their damage to military combatants while towns and cities remained undamaged and their civilian inhabitants remained unscathed. …

Ideally he wanted to reduce blast damage to zero, to eliminate the wholesale demolition of civilian housing, services, and amenities that he had witnessed in Seoul. He saw a way to achieve this if a fusion reaction released almost all of its energy as radiation. Moreover, if this radiation consisted of neutrons, which carry no charge, it would not poison the environment with residual radioactivity.

The bomb would still kill people–but this was the purpose of all weapons. _If_ wars were liable to recur (which Cohen thought was probable), soldiers were going to use weapons of some kind against each other, and everyone would benefit if the weapons minimized pain and suffering while ending the conflict as rapidly as possible.

Cohen came up with a design for a warhead about one-tenth as powerful as the atomic bombs dropped on Japan. If it was detonated at 3,000 feet above ground level, its blast effects would be negligible while its neutron radiation would be powerful enough to cause death within a circle about one mile in diameter. This was the battlefield weapon that came to be known as the neutron bomb.

Such a weapon obviously would be more civilized than large-scale hydrogen bombs, and would also be more humane than conventional bombs, because it would create an all-or-nothing, live-or-die scenario in which no one would be wounded. A stream of neutrons cannot maim people. It will not burn their flesh, spill their blood, or break their bones. Those who receive a non-lethal dose will recover after a period of intense nausea and diarrhea, and Cohen estimated that their risk of subsequent cancer would be no greater than the risk we experience as a result of exposure to second-hand cigarette smoke. As for the rest, death would come relatively quickly, primarily from shock to the central nervous system. As he put it in his typically candid style, “I doubt whether the agony an irradiated soldier goes through in the process of dying is any worse than that produced by having your body charred to a crisp by napalm, your guts being ripped apart by shrapnel, your lungs blown in by concussion weapons, and all those other sweet things that happen when conventional weapons (which are preferred and anointed by our official policy) are used.”

After assessing every aspect and implication of his concept, he reached his modest conclusion: “The neutron bomb has to be the most moral weapon ever invented.”

The neutron bomb as the most moral weapon possible Read More »

The Cold War as game theory

history, politics, science / /

From Charles Platt’s “The Profits of Fear” (August 2005):

Game theory began with the logical proposition that in a strategic two-player game, either player may try to obtain an advantage by bluffing. If the stakes are low, perhaps you can take a chance on trusting your opponent when he makes a seemingly fair and decent offer; but when the penalty for being deceived can be nuclear annihilation, taking a chance is out of the question. You work on the principle that the person you are dealing with may be utterly ruthless, unethical, and untrustworthy, no matter how peaceful his intentions may seem. You also have to assume that he may be smart enough to use game theory just like you; and therefore, he will assume that _you_ are ruthless, unethical, and untrustworthy, no matter how peaceful _your_ intentions may seem. In this way a supposedly rational system of assessment leads to a highly emotional outcome in which trust becomes impossible and strategy is based entirely on fear. This is precisely what happened during the decades of the Cold War.

The Cold War as game theory Read More »

3 English words with the most meanings

history, language & literature / /

From Tim Bray’s “On Search: Squirmy Words” (29 June 2003):

First of all, the words that have the most variation in meaning and the most collisions with other words are the common ones. In the Oxford English Dictionary, the three words with the longest entries (i.e. largest number of meanings) are “set,” “run,” and “get.”

3 English words with the most meanings Read More »

Language & grammar types: inflected, agglutinative, & analytic

language & literature / /

From Tim Bray’s “On Search: Squirmy Words” (29 June 2003):

Of course, the way that words twist and turn around is highly language-dependent. English is what’s called an “inflected” language, which is to say words change their form depending on their grammatical role: verb conjugation, singular/plural, and so on. (Interestingly, “inflection” has a common variant spelling: “inflexion”.) Other languages (for example Turkish and Finnish) are “agglutinative”, where words are formed by combining “morphemes.” The third most common category of languages is “analytic” or “isolating”, where words do not change and grammatical roles are established by sequences of words. The best-known example is written Chinese.

Language & grammar types: inflected, agglutinative, & analytic Read More »

What bots do and how they work

security, technology / /

From The Honeynet Project & Research Alliance’s “Know your Enemy: Tracking Botnets” (13 March 2005):

After successful exploitation, a bot uses Trivial File Transfer Protocol (TFTP), File Transfer Protocol (FTP), HyperText Transfer Protocol (HTTP), or CSend (an IRC extension to send files to other users, comparable to DCC) to transfer itself to the compromised host. The binary is started, and tries to connect to the hard-coded master IRC server. Often a dynamic DNS name is provided … rather than a hard coded IP address, so the bot can be easily relocated. … Using a special crafted nickname like USA|743634 or [UrX]-98439854 the bot tries to join the master’s channel, sometimes using a password to keep strangers out of the channel. …

Afterwards, the server accepts the bot as a client and sends him RPL_ISUPPORT, RPL_MOTDSTART, RPL_MOTD, RPL_ENDOFMOTD or ERR_NOMOTD. Replies starting with RPL_ contain information for the client, for example RPL_ISUPPORT tells the client which features the server understands and RPL_MOTD indicates the Message Of The Day (MOTD). …

On RPL_ENDOFMOTD or ERR_NOMOTD, the bot will try to join his master’s channel with the provided password …

The bot receives the topic of the channel and interprets it as a command: …

The first topic tells the bot to spread further with the help of the LSASS vulnerability. … the second example of a possible topic instructs the bot to download a binary from the web and execute it … And if the topic does not contain any instructions for the bot, then it does nothing but idling in the channel, awaiting commands. That is fundamental for most current bots: They do not spread if they are not told to spread in their master’s channel.
Upon successful exploitation the bot will message the owner about it, if it has been advised to do so. …

Then the IRC server (also called IRC daemon, abbreviated IRCd) will provide the channels userlist. But most botnet owners have modified the IRCd to just send the channel operators to save traffic and disguise the number of bots in the channel. …

The controller of a botnet has to authenticate himself to take control over the bots. …

… the “-s” switch in the last example tells the bots to be silent when authenticating their master. …

… Once an attacker is authenticated, they can do whatever they want with the bots … The IRC server that is used to connect all bots is in most cases a compromised box. … Only beginners start a botnet on a normal IRCd. It is just too obvious you are doing something nasty if you got 1.200 clients named as rbot-<6-digits> reporting scanning results in a channel. Two different IRC servers software implementation are commonly used to run a botnet: Unreal IRCd and ConferenceRoom:

  • Unreal IRCd (http://www.unrealircd.com/) is cross-platform and can thus be used to easily link machines running Windows and Linux. The IRC server software is stripped down and modified to fit the botnet owners needs. Common modifications we have noticed are stripping “JOIN”, “PART” and “QUIT” messages on channels to avoid unnecessary traffic. … able to serve 80.000 bots …
  • ConferenceRoom (http://www.webmaster.com/) is a commercial IRCd solution, but people who run botnets typically use a cracked version. …

What bots do and how they work Read More »

Different types of Bots

security, technology / /

From The Honeynet Project & Research Alliance’s “Know your Enemy: Tracking Botnets” (13 March 2005):

… some of the more widespread and well-known bots.

  • Agobot/Phatbot/Forbot/XtremBot

    … best known bot. … more than 500 known different versions of Agobot … written in C++ with cross-platform capabilities and the source code is put under the GPL. … structured in a very modular way, and it is very easy to add commands or scanners for other vulnerabilities … uses libpcap (a packet sniffing library) and Perl Compatible Regular Expressions (PCRE) to sniff and sort traffic. … can use NTFS Alternate Data Stream (ADS) and offers Rootkit capabilities like file and process hiding to hide it’s own presence … reverse engineering this malware is harder since it includes functions to detect debuggers (e.g. SoftICE and OllyDbg) and virtual machines (e.g. VMWare and Virtual PC). … the only bot that utilized a control protocol other than IRC. A fork using the distributed organized WASTE chat network is available.

  • SDBot/RBot/UrBot/UrXBot/…

    This family of malware is at the moment the most active one … seven derivatives … written in very poor C and also published under the GPL.

  • mIRC-based Bots – GT-Bots

    We subsume all mIRC-based bots as GT-bots … GT is an abbreviation for Global Threat and this is the common name used for all mIRC-scripted bots. … mIRC-scripts, often having the extension “.mrc”, are used to control the bot.

  • DSNX Bots

    Dataspy Network X (DSNX) bot is written in C++ and has a convenient plugin interface. … code is published under the GPL. … one major disadvantage: the default version does not come with any spreaders.

  • Q8 Bots

    only 926 lines of C-code. … written for Unix/Linux systems.

  • kaiten

    … lacks a spreader too, and is also written for Unix/Linux systems. The weak user authentication makes it very easy to hijack a botnet running with kaiten. The bot itself consists of just one file.

  • Perl-based bots

    … very small and contain in most cases only a few hundred lines of code. They offer only a rudimentary set of commands (most often DDoS-attacks) … used on Unix-based systems.

Different types of Bots Read More »

Uses of botnets

business, security, technology / /

From The Honeynet Project & Research Alliance’s “Know your Enemy: Tracking Botnets” (13 March 2005):

“A botnet is comparable to compulsory military service for windows boxes” – Stromberg

… Based on the data we captured, the possibilities to use botnets can be categorized as listed below. …

  1. Distributed Denial-of-Service Attacks

    Most commonly implemented and also very often used are TCP SYN and UDP flood attacks. Script kiddies apparently consider DDoS an appropriate solution to every social problem. … run commercial DDoS attacks against competing corporations … DDoS attacks are not limited to web servers, virtually any service available on the Internet can be the target of such an attack. … very specific attacks, such as running exhausting search queries on bulletin boards or recursive HTTP-floods on the victim’s website.

  2. Spamming

    open a SOCKS v4/v5 proxy … send massive amounts of bulk email … harvest email-addresses … phishing-mails

  3. Sniffing Traffic

    use a packet sniffer to watch for interesting clear-text data passing by a compromised machine. … If a machine is compromised more than once and also a member of more than one botnet, the packet sniffing allows to gather the key information of the other botnet. Thus it is possible to “steal” another botnet.

  4. Keylogging
  5. Spreading new malware

    In most cases, botnets are used to spread new bots. … spreading an email virus using a botnet is a very nice idea

  6. Installing Advertisement Addons and Browser Helper Objects (BHOs)

    setting up a fake website with some advertisements … these clicks can be “automated” so that instantly a few thousand bots click on the pop-ups. … hijacks the start-page of a compromised machine so that the “clicks” are executed each time the victim uses the browser.

  7. Google AdSense abuse

    … leveraging his botnet to click on these advertisements in an automated fashion and thus artificially increments the click counter.

  8. Attacking IRC Chat Networks

    attacks against Internet Relay Chat (IRC) networks. … so called “clone attack”: In this kind of attack, the controller orders each bot to connect a large number of clones to the victim IRC network.

  9. Manipulating online polls/games

    Online polls/games are getting more and more attention and it is rather easy to manipulate them with botnets.

  10. Mass identity theft

    Bogus emails (“phishing mails”) … also host multiple fake websites pretending to be Ebay, PayPal, or a bank …

Uses of botnets Read More »

Who runs botnets?

business, security, technology / /

From The Honeynet Project & Research Alliance’s “Know your Enemy: Tracking Botnets” (13 March 2005):

An event that is not that unusual is that somebody steals a botnet from someone else. … bots are often “secured” by some sensitive information, e.g. channel name or server password. If one is able to obtain all this information, he is able to update the bots within another botnet to another bot binary, thus stealing the bots from another botnet. …

Something which is interesting, but rarely seen, is botnet owners discussing issues in their bot channel. …

Our observations showed that often botnets are run by young males with surprisingly limited programming skills. … we also observed some more advanced attackers: these persons join the control channel only seldom. They use only 1 character nicks, issue a command and leave afterwards. The updates of the bots they run are very professional. Probably these people use the botnets for commercial usage and “sell” the services. A low percentage use their botnets for financial gain. …

Another possibility is to install special software to steal information. We had one very interesting case in which attackers stole Diablo 2 items from the compromised computers and sold them on eBay. … Some botnets are used to send spam: you can rent a botnet. The operators give you a SOCKS v4 server list with the IP addresses of the hosts and the ports their proxy runs on. …

… some attackers are highly skilled and organized, potentially belonging to well organized crime structures. Leveraging the power of several thousand bots, it is viable to take down almost any website or network instantly. Even in unskilled hands, it should be obvious that botnets are a loaded and powerful weapon.

Who runs botnets? Read More »

An analysis of botnets

security / /

From The Honeynet Project & Research Alliance’s “Know your Enemy: Tracking Botnets” (13 March 2005):

A botnet is a network of compromised machines that can be remotely controlled by an attacker. … With the help of honeynets we can observe the people who run botnets … Due to the wealth of data logged, it is possible to reconstruct the actions of attackers, the tools they use, and study them in detail. …

We have identified many different versions of IRC-based bots … The bot joins a specific IRC channel on an IRC server and waits there for further commands. This allows an attacker to remotely control this bot and use it for fun and also for profit. Attackers even go a step further and bring different bots together. Such a structure, consisting of many compromised machines which can be managed from an IRC channel, is called a botnet. IRC is not the best solution since the communication between bots and their controllers is rather bloated, a simpler communication protocol would suffice. But IRC offers several advantages: IRC Servers are freely available and are easy to set up, and many attackers have years of IRC communication experience.

… Even a relatively small botnet with only 1000 bots can cause a great deal of damage. These 1000 bots have a combined bandwidth (1000 home PCs with an average upstream of 128KBit/s can offer more than 100MBit/s) that is probably higher than the Internet connection of most corporate systems. In addition, the IP distribution of the bots makes ingress filter construction, maintenance, and deployment difficult. In addition, incident response is hampered by the large number of separate organizations involved. Another use for botnets is stealing sensitive information or identity theft: Searching some thousands home PCs for password.txt, or sniffing their traffic, can be effective.

The spreading mechanisms used by bots is a leading cause for “background noise” on the Internet, especially on TCP ports 445 and 135. … These malware scan large network ranges for new vulnerable computers and infect them, thus acting similar to a worm or virus. … most traffic targets the ports used for resource sharing on machines running all versions of Microsoft’s Windows operating system …

The traffic on these four ports [445/TCP, 139/TCP, 137/UDP, 135/TCP] cause more then 80 percent of the whole traffic captured. …

Lessons Learned

  • Number of botnets

    … able to track little more than 100 botnets during the last four months. … at the moment we are tracking about 35 active botnets.

  • Number of hosts

    During these few months, we saw 226,585 unique IP addresses joining at least one of the channels we monitored. … If an IRCd is modified not to show joining clients in a channel, we don’t see IPs here. Furthermore some IRCds obfuscate the joining clients IP address and obfuscated IP addresses do not count as seen, too. … this would mean that more then one million hosts are compromised and can be controlled by malicious attackers.

  • Typical size of Botnets

    Some botnets consist of only a few hundred bots. In contrast to this, we have also monitored several large botnets with up to 50.000 hosts. … botnets with over several hundred thousands hosts have been reported in the past. … We know about a home computer which got infected by 16 (sic!) different bots, so its hard to make an estimation about world bot population here.

  • Dimension of DDoS-attacks

    From the beginning of November 2004 until the end of January 2005, we were able to observe 226 DDoS-attacks against 99 unique targets.

  • Spreading of botnets

    “.advscan lsass 150 5 0 -r -s” and other commands are the most frequent observed messages. Through this and similar commands, bots spread and search for vulnerable systems.

  • Harvesting of information

    … harvesting of information from all compromised machines. With the help of a command like “.getcdkeys” the operator of the botnet is able to request a list of CD-keys (e.g. for Windows or games) from all bots.

  • “Updates” within botnets

    … observed updates of botnets quite frequently. … bots are instructed to download a piece of software from the Internet and then execute it. … bots can be dynamically updated and be further enhanced. … In total, we have collected 329 binaries. … Most of the other binary files are either adware …, proxy servers … or Browser Helper Objects.

An analysis of botnets Read More »

Prescription drug spending has vastly increased in 25 years

business, history, politics, tech in changing society, technology / /

From Clifton Leaf’s “The Law of Unintended Consequences” (Fortune: 19 September 2005):

Whatever the answer, it’s clear who pays for it. You do. You pay in the form of vastly higher drug prices and health-care insurance. Americans spent $179 billion on prescription drugs in 2003. That’s up from … wait for it … $12 billion in 1980 [when the Bayh-Dole Act was passed]. That’s a 13% hike, year after year, for two decades. Of course, what you don’t pay as a patient you pay as a taxpayer. The U.S. government picks up the tab for one in three Americans by way of Medicare, Medicaid, the military, and other programs. According to the provisions of Bayh-Dole, the government gets a royalty-free use, forever, of its funded inventions. It has never tried to collect. You might say the taxpayers pay for the hat–and have it handed to them.

Prescription drug spending has vastly increased in 25 years Read More »