Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please do not take down the Sality botnet

seclists.org

Post reply on HN
Print view View original

131–140 of 148 posts

Re: Please do not take down the Sality botnet

#131

Post by dennisgorelik »

freehunter wrote: post #95
daemon13 wrote: post #60

Earlier quoted context omitted.

I apologize in advance for the tone, but as a Russian I have a question - are you racist? Since Sergey Brin and Mila Yovovich are "russians", do you imply that Google and Hollywood are part of this botnet? The most famous hacker is Kevin Mitnick [american] and most recent hackers charged/arrested by FBI are also american citizens. Why don't you change "russians" to "americans"? Or may be "new_zealanders" [Kim dot com…

I work in information security, and I can give you a rough breakdown on botnet sites we've run into over the last year. (rough numbers) 25% have been Chinese (or linked to Chinese hackers, but using distributed hosting of hijacked servers around the world) 5% have been US-based. 10% have been Indian. 10% have been "other", including Canada/Mexico/Latin America, Africa, and Western Europe (like the German(?) Conficker…

You forgot to mention that the level of technical educational in Russia is quite high. Combined with mediocre quality of Russian business managers it produces oversupply of tech specialists. That in turn fuels rapid development of botnet ecosystem.

Re: Please do not take down the Sality botnet

#132

Post by daemon13 »

icebraining wrote: post #101
daemon13 wrote: post #72

Earlier quoted context omitted.

thank you :-) Just to point to a couple of facts:- 1. From the same article: "Why does every hacking and cyberscam story – real or fictional – seem to have a Russia connection? In part, it is prejudice and laziness. The stereotype of the Russian hacker has become such a common media trope that it gets recycled again and again. It also offers a handy update for those looking for new ways to perpetuate the ‘Russian thr…

>"Skilled but under-emplored programmer in Russia" is like Bigfoot [also known as sasquatch] - everyone heard about him/her, but noone saw. It is a legend... Well, Group-IB (a Russian computer security company) seems to disagree: In Russia the situation is additionally worsen by a great amount of technical universities graduates and by unstable home economy situation as the result of which the mentioned specialists c…

True, but sometimes perceptions are becoming self-fullfilling profecies :-(

Re: Please do not take down the Sality botnet

#133

Post by daemon13 »

s_henry_paulson wrote: post #93
daemon13 wrote: post #72

Earlier quoted context omitted.

thank you :-) Just to point to a couple of facts:- 1. From the same article: "Why does every hacking and cyberscam story – real or fictional – seem to have a Russia connection? In part, it is prejudice and laziness. The stereotype of the Russian hacker has become such a common media trope that it gets recycled again and again. It also offers a handy update for those looking for new ways to perpetuate the ‘Russian thr…

It looks like most people have already responded. While my comment was poorly worded, statistically the majority of large botnets like Coreflood, Storm, BredoLab, Rustock, Kelihos are of Russian origin. Even the botnet we are discussing was first seen in Russia. To comment on a couple of your points 2 - With Stuxnet, I think everyone agrees that US/Israel is to blame. The Russian connection is made because aside from…

Appreciate your intent.

You are correct on #4. I've heard some stories about hrackers storing piles of cash under the couch [this case was in Ukraine], made from cracking banks/ATMs. Definitely, black activities are much more profitable. But I do not think that [in real life] those that crack get most of the money, with few exceptions. Biggest pile usually goes to those who organize or cover (underworld Board/CEO equivalent).

However, the start-up fever, which started in Russia appr. 1-1.5 years ago, is getting traction, as well as tech industry. This provides more opportunities and better risk/reward ratio and shall result in that more and more people will be moving to bright side.

And yep, the smart brain has no nationality.

Re: Please do not take down the Sality botnet

#134

Post by daemon13 »

rdtsc wrote: post #88
daemon13 wrote: post #72

Earlier quoted context omitted.

thank you :-) Just to point to a couple of facts:- 1. From the same article: "Why does every hacking and cyberscam story – real or fictional – seem to have a Russia connection? In part, it is prejudice and laziness. The stereotype of the Russian hacker has become such a common media trope that it gets recycled again and again. It also offers a handy update for those looking for new ways to perpetuate the ‘Russian thr…

> "Skilled but under-emplored programmer in Russia" is like Bigfoot [also known as sasquatch] - everyone heard about him/her, but noone saw. It is a legend... Pretty good observation. I think most people are operating on 10-12 year old data when they think that. They think "fall of the Soviet Union" with now hungry scientists slowly turning to the dark side to become less hungry mad scientists who will inflict pain a…

Perceptions are funny thing [except when from yr boss]...

I recall that in 1997-1998, when I was helping Coca-Cola establish plant in Vladivostok (Far East near Japan, 0.5 mil population), some people were concerned to go there because of tigers and bears wandering in the streets...

Re: Please do not take down the Sality botnet

#135

Post by daemon13 »

jiggy2011 wrote: post #115
icebraining wrote: post #67

Earlier quoted context omitted.

I agree that it is a prejudice and should be avoided, but it's not completely groundless: According to industry analyses, Russia accounts for about 35 percent of global cybercrime revenue, or between $2.5 and $3.7 billion. That’s wildly out of proportion with the country’s share of the global information technology market (which is around 1 percent). http://themoscownews.com/siloviks_scoundrels/20111121/189221... It'…

Yes, when I was setting up a server I eventually had to apply a separate and more draconian set of firewall rules to IP addresses in Russia and China to avoid my logs just filling up with Junk, failed logins , attempts to access shady looking URLs which did not exist and HTTP requests filled with fragments of shell or SQL script. To be fair I'm sure this only represents a minority of the people in these countries but…

> in Russia it probably looks like an attractive get rich quick for anyone with tech skills.

It is attractive. But again this is about risk/reward ratio. With increase of risk/complexity and other, legal, opportunities more people shall switch... I think...

Re: Please do not take down the Sality botnet

#136

Post by daemon13 »

ChuckMcM wrote: post #117
icebraining wrote: post #98

Earlier quoted context omitted.

No. "Racism is the belief that inherent different traits in human racial groups justify discrimination". If it's based on the current social or economical situation of Russia, it's prejudice, but not racism. Remember that Russians are "citizens of Russia", not a particular ethnic group.

I applaud your efforts at education! I observe however that their is an emergent definition of 'racism' which is quite a bit more broad than yours. Basically it is this "Assuming specific or stereotypical attributes about an an individual or group, based on that individual or group's membership in a definable group." This removes the typical restriction that it involve 'race specific traits' so things like 'Bankers a…

Good point re 'telecommuting criminals'.

I presume it is inherently and practically more difficult to investigate identity of someone renting servers in US vs Russia, Ukraine or China, in part because of language, legal system and political differences.

Re: Please do not take down the Sality botnet

#137

Post by daemon13 »

tomelders wrote: post #68
daemon13 wrote: post #60

Earlier quoted context omitted.

I apologize in advance for the tone, but as a Russian I have a question - are you racist? Since Sergey Brin and Mila Yovovich are "russians", do you imply that Google and Hollywood are part of this botnet? The most famous hacker is Kevin Mitnick [american] and most recent hackers charged/arrested by FBI are also american citizens. Why don't you change "russians" to "americans"? Or may be "new_zealanders" [Kim dot com…

I think you're playing the race card and ignoring the facts. Which is pretty lame. As a brit, I fully appreciate and understand why some people in the world hate all britons. We've done some bad things as a nation in recent years and people have a right to tar us all with the same brush. I understand why it would be unsafe for me to walk the streets of Kabul or Baghdad. If any brit has a problem with the way other pe…

What exactly is lame?

Pointing to possible misuse of race/nationality angle?

I do not think so.

Re > it's their job as a citizen in a democracy to affect the change they want to see in people's attitude towards this country and it's people.

I believe that my job is to take care of my family and myself, because noone else, and no any government, will do this.

Re: Please do not take down the Sality botnet

#139

Post by daemon13 »

freehunter wrote: post #95
daemon13 wrote: post #60

Earlier quoted context omitted.

I apologize in advance for the tone, but as a Russian I have a question - are you racist? Since Sergey Brin and Mila Yovovich are "russians", do you imply that Google and Hollywood are part of this botnet? The most famous hacker is Kevin Mitnick [american] and most recent hackers charged/arrested by FBI are also american citizens. Why don't you change "russians" to "americans"? Or may be "new_zealanders" [Kim dot com…

I work in information security, and I can give you a rough breakdown on botnet sites we've run into over the last year. (rough numbers) 25% have been Chinese (or linked to Chinese hackers, but using distributed hosting of hijacked servers around the world) 5% have been US-based. 10% have been Indian. 10% have been "other", including Canada/Mexico/Latin America, Africa, and Western Europe (like the German(?) Conficker…

Another reason (4) is that quite a lot of people [majority] download audio/video content and install cracked software on their Windows! home PCs.

I agree that external environment provided much more fertile ground for criminal activities [incl tech] in former USSR.

The key words are "fashionable" and "Western media". We all can observe the influence of media on people's perceptions of events, countries, nationalities...

Re: Please do not take down the Sality botnet

#140

Post by ucho »

acqq wrote: post #44

Reading README in the linked zip file, inside is, first, an executable which is a QBFC ( http://www.abyssmedia.com/quickbfc ) packaged and slightly modified version of AVG's Sality Removal Tool ( http://free.avg.com/us-en/remove-sality ) to automate the removal of the Sality virus. Then, there is the encrypted version of the same executable, so it will run properly when downloaded by the Sality virus. And finally, th…

Allow people check for themselves http://uploadmirrors.com/download/1DQGRXOQ/byesality.zip
Post reply on HN