Schneier on Security

FWIW, the article's mention "With no C&C server to target..." for the new malware struck me as coding in "leaderless resistance" concept of decentralised command.

Some info on the "leaderless resistance" concept from an essay by Simson Garfinkel:
http://www.firstmonday.org/issues/issue8_3/...

Nothing surprising per se, but still an interesting development in code paralleling human organisational practices.

Bruce,

In a certain way this is old news, having being discussed since early March... guess you had been spending too much time reading about Homeland security. :-)

It was obvious that all serious botnet developers would move quickly to encrypted P2P communications, and as the mentioned target notes, that botnets would move to a "professional development cycle"

This was smartly addressed on a Blackhat Europe 2007 presentation by 3 Brazilian guys.

http://www.blackhat.com/presentations/...

Indeed few of their predictions are already fact:

Encrypted P2P;
XML messaging;
OTP communications for C&C.

I strongly recommend the reading. It's not the best paper ever but worths the time, the thing is almost like a crystal ball. :-)

http://xkcd.com/364/

Could you please post a direct link to documents linked above?

Hmmm, the referenced article bothers me - it seems to be written more for the press than anyone else. High on FUD, low on facts.

Googling Nugache brings up the Symantec pages, which have a lot more 'nitty-gritty', which isn't as 'high level' as Dave's article, but comparing the vague strategies of several bits of malware isn't very enlightening - especially when the thrust of the article underlines that the malware and white-hats are in a continual war of attrition.

I the fact that malware authors actually develop malware, and don't just wrote one and never wrote another, is obvious.
The fact that malware authors examine their [malware] competitors performance, is also obvious. Personally I think it's _very_ unlikely that the developers share ideas willingly - they are, after all, in fierce competition with each other - unless their is proof of a 'co-op' regime?

"...would be virtually impossible to stop." Pah. That's not a very scientific statement. e.g. blocking all forms of executable entering your network would sort this out, as would tight sandboxing (HIDS) etc. etc. etc. Their are lots of countermeasures, and many can be applied at the ISP level.

I'd really like to see someone do a proper 'Morris worm' [aka 'Internet Worm' !!!] reverse-engineering job on such beasts, as this would start to properly undercover the (100+) available attack vectors, and therefore possible countermeasures, or at least areas to heavily monitor.

I know that Dave is smart, I just think this article is too heavily dumbed-down. I think his time would have been better spent writing about expected malware strategies for 2008/2009, than this piece. :-(

Scary! But the thing that is worse is that we do not see any hope in the future!

"Hmmm, the referenced article bothers me - it seems to be written more for the press than anyone else. High on FUD, low on facts."

I know. The :login; articles are better.

Hasn't encrypted p2p been around ever since Filetopia came on the seen, many years ago now?

Damn! I wish I could spell scene.

More and more things like this make me want to work on creating a new OS. I've been tossing the idea around for a while, and I've come up with a number of things I'd like to see incorporated into it, with the primary focus being on security (things like a randomly generated private key used to sign all apps that's generated when you install the OS). If I could just take a year or two off and work only on that project I'm sure I could come up with something usable.

"but the amount of specificity and customization involved in the code and the ways in which the author changed it over time are what have researchers worried."

Worried because they fail to counter with Beta Creative Code?

That would suggest all that they need is a Beta Creative Code XXXX Writer with AI Network for InterNetworking Myriad CyberIntelAIgently Designed Information Feeds....... AI VXXXXine against Binary Shenanigans, no less.

I Kid U Not. Bots B AI Ware. Alien Territory Dead aHead.

It is unreasonable to think to manage Knowledge as Secrets to Hide away whenever the Solution is to Traffic them so that they can Evolve and Grow and Generate ControlLed Power

... wow, amanfrommars made the leap from theregister to here. Is this his first time, or has he been on this site before? I must confess I don't read the comments much, so maybe this is just the first time I've seen him on here.

Worse is yet to come...

Am I the only one that's surprised it took so long for them to get to this point? Anyway, perhaps it has finally become clear that fighting an unending arms race isn't the answer to the current malware/spam/phishing underground problem?

Sure, we can try to improve laws and do better enforcement, increasing the risk to the bad guys, but the real issue is their reward. Sending spam works. Stealing credit card numbers and other identity info works. Apparently very well. Just like selling illegal drugs--or booze during the prohibition.

Rather than focusing on the next escalation of technology to combat the problem tactically, perhaps all the bright minds should be thinking about how to tilt the risk vs reward equation in a more favorable direction by focusing on the reward side of things. Not that I've spent a lot of time thinking about this but probably some big (read infeasible) changes are required.

Crazy, off the cuff example: suppose that using a credit card required some dynamic, unpredictable info, like one time password? Point being, if static info about the credit card wasn't sufficient to use it, how might the CC# black market fare, I wonder? With this source of funding throttled, I wonder where else they'd turn...

Aw heck, it's probably hopeless.

These botnets and their herderds are challenging adversaries. However, they don't seem to introduce any new innovative technologies themselves. We've seen only semi-smart use of technologies that are many years old and already there. When did P2P come up first time? Yep, it's been there for a long time.

.. or is it so that they are really not that smart anyway?

@Orclev
Yeah, I was also surprised to see him and had to double check what site I was on. :-\ Not that I am complaining as his writing as often illegible as it is, is usually entertaining.

What was the lineage Dittrich was talking about between them, I didn't think some of them were related?

@Orclev

Good luck to you on your quest to create a new OS....

But the number of OSes is shrinking rapidly.
e.g. IBM used to support abiut 38 OSes but now suipport about 7 (plus support for two Lini although they werent written by them!).

Very few of the recently written OSes have taken off, and some excellent attempts (BeOS, Plan 9 etc. ) have bitten the dust.

Even the Mighty MS is struggling to get VISTA out of the door.

Like I said Good Luck.

New threats like Nugache and Storm do seem like the next level in malware. Since they adapt and are relentless (and since 'the next generation' is overused) maybe they should be called Borg class malware. Good luck to all of us fighting these things.

What vectors are these Trojans usings for compromising a system? Are they all in essence stemming from some kind of social engineering weakness? (hey stupid user...click here...download me...)...or is there a specific software vulnerability thats being exploited? (Activ X controls...new XMLHttpRequests()...MSMxml2.XMLHTTP...or Microsoft.XMLHTTP....) What kind of encryption are they using? give us some specifics...
What about using Geotracking...

Regarding the secure OS mini thread, why not just use OpenBSD? And, if you think that something in it needs changing or tweaking you could just change or tweak it and re-compile.

"...attack toolkits to the specifications of their customers."

I always thought that virus/worm propagators are lonely programmers out to attract much 'wanted' self attention. From, the statement in quotes above, they now look more like assassins for hire. Now that's scary.