Internet under attack by zombie computers

UPI ^ | 1/7/07 | Unattributed

[George Smiley]

written any code for VMS boxes?

[Jeff Chandler]

It's the end of the world, we're all gonna die!

Not before we roast to death from Global Warming.

[Gideon7]

There are criminal gangs in Eastern Europe (Romania, Bulgaria, Slovkia, Russia, etc) who are being hired by a handful of big spam gangs.

Something like 80%+ of all spam comes from just fewer than 200 people, located mainly in the US. These kingpins outsource their spam to Eastern Europe, who receive contracts just like a business.

This is the very definition of a racket. The FBI needs to dust off the anti-racketeering statutes and go after them.

[ShadowAce]

[ChinaThreat]

Yup. There is a mac anti-virus product out there called sophos or sofos.

[SauronOfMordor]

It does when you consider there aren't many, if any, viruses for OS X. The thing's been out for, what, six years? You'd think by now someone would've written a few just for the sake of saying it's possible.

OS/X is a varient of Unix. And Unix has been banged at by college hackers since the 70's.

[scott7278]

That's true -- I fixed virus and spyware-ridden computers in rural NW Missouri on the side at a tremendous price value. The people bringing them in would give me a puzzled look if I asked them if they had a firewall or antivirus program.

I contacted the ISP -- the ONLY one -- and let them know that they should be educating people when they send their technicians out to first hook people up.

Of course, that would probably cut into their service calls. Now that I think about it, they probably didn't care for me too much.

[Calpernia]

And AOL applications carry the interface program!

[Calpernia]

Depending on how you get interfaced, many go right under the firewall.

[geopyg]

reminder to self to check this kind of stuff!

[relictele]

I certainly don't want any government involvement, but if you use ANY brand of computer, OS and/or Internet you owe it to the rest of the world to demonstrate at least a working knowledge of security and take precautions to keep your computer safe (i.e., not becoming a zombie delivering spam, spyware and hogging bandwidth!).

[NotJustAnotherPrettyFace]

PING for later reference.

[dayglored]

> The current Mac operating system is a version of Berkley Linux. It uses the standard Linux code to access the Internet.

Geez, dude. "Berkley Linux"? If you're gonna spew uncertainties and so forth, ya gotta be more careful. Mac OS-X is a BSD UNIX variant, which pre-dates Linux by decades. BSD is an outstandingly robust operating system. Linux isn't too shabby either, these days.

Windows is something else entirely.

> It was easy to learn how Linux accesses the 'net. I just down loaded the open source Berkley Code and read it.

Two completely different code bases. BSD was prominent in the early 80's, on VAXes and such; Linux didn't get written until the 90's, on i386 PCs.

I can't imagine how you confused those two. Seriously, you completely undermined whatever else you said with that.

[Sundog]

Hi Common Tator,

Looks like we are in the same field of work.

I wrote a program in 1994, before the internet was widely in use, to allow two customers of mine, who were both interested in the same piece of IC layout data, to open two viewers at different sites and share graphics data across the net. One could markup data, the other could view the markups realtime. This was long before the common data sharing programs and remote X windows tools we have now on Unix / Linux. That tool eventually sold 6,000 + copies into the different IC layout design and manufacturing plants around the world. As the net became faster, that tool came into its own. I added encryption and lots of bells and whistles. It could be configured to work through firewalls, access common file systems if any (intranet style), and work across different hardware architectures. It was in use on files of 600+ GB of data at the end, far too large for normal data transport tools. It was ported to AIX, HP-UX, Solaris, and Red Hat Linux. IC design and layout data will always remain on the hairy edge of what hardware and software can support, as it is data at the hairy edge of design complexity for hardware.

My question was really a much more simple one than a question of internet access code for Mac vs. Windows, rather, it was a curiosity of how one would get malicious code onto a Mac. Since retiring, I am getting current on Mac programming, especially Cocoa, since I have been doing Motif / X windows stuff since it was new from MIT. In watching the discussions on Free Republic, I have generally had good confidence in the Mac being resistant to malicious code, but this seems to infer a Mac vulnerability. If one were to get onto a computer, and know a port and the services to reach another computer, one could easily establish a connection and reach system services, trojan horse style. I suppose the article takes it as a given that such a connection exists. Then, it is reasonable to assume the rest of the zombie behavior could be established.

Thanks for the insight into the Windows internet access code. I am always impressed how the early Unix developers had considerable foresight.

[DB]

Windows is susceptible because network security was an after thought at Microsoft. It wasn't until XP that their software didn't advertise its presence with numerous ports to the Internet. Many of which that could easily be compromised. Incredibly dumb.

And even now, one wrong click on attachment and you've opened yourself up for disaster. Other systems don't allow and operator to accidentally click on something and have it gain full access to your system. You have to be logged in as an administrator to install things which is not the normal state of using the computer. For Windows based systems anything less than administrator level is pretty much useless.

[Gideon7]

Waitasec. I worked on the first firewall for Windows NT back in '96. You're talking gibberish ("Berkeley Linux"). The NT IP stack was _not_ "purchased to use the Berkeley Linux (sic) code in Windows", but rather was licensed from a sui generis commercial stack (from Spider Systems) that was based on the AT&T System V STREAMS code.

Granted, it uses many of the same concepts and algorithms for its stack, as described in the Best Practices RFCs for IP and TCP, such as the Nagle Algorithm. But the implementation is nothing like BSD, and cetainly is nothing like you describe ("changing one parameter").

Windows Sockets is a translation layer atop TDI and NDIS, which are protocol-agnostic APIs originally used for NETBUI and Novell NPX. Native TCP sockets were added to Windows late in the design cycle for Windows 95. Most of the implementation in in a filter driver between TDI and NDIS (AFD.SYS). It is most decidedly _not_ anything like the BSD stack.

Please check your facts.

BTW, the whole TCP stack has been re-written mostly from scratch in Vista.

[glorgau]

It turned out Microsoft had purchased the right to use the Berkley Linux code in Windows.

It ain't the port functions that are the big vunerability. It's the layers on top that call those functions - and the interface between those layer and the implementing applications. A good example is Visual Basic being hooked into all sorts of Windows Apps - like Outlook, etc.

[Turbopilot]

Internet under attack by zombie computers

[Swordmaker]

"While some zombie computer crimes have been linked to computers running Linux or Macintosh operating systems, officials have warned that Windows systems are the most susceptible."

With no credible reports of any Mac being turned into a Zombie NetBot without its owner's knowledge, this article is a "Them, too!" FUD article! PING!

If you want on or off the Mac Ping List, Freepmail me.

[Swordmaker]

How is it they cite Macintosh among the target computers? Have you heard of this?

It's "Them, Too!" FUD. There are no credible reports for anything that can invade an OS X Mac and turn it into a Zombie Bot. However, that does not mean that someone cannot be deliberately using a Mac as a SPAM sending platform.