Microsoft Cybercrime Shutdown Hit Users Says DDNS Provider • Hacker News Board

Re: Microsoft Cybercrime Shutdown Hit Users Says DDNS Provider

#21

Post by spindritf » Tue, Jul 01, 2014, 2:34 PM UTC

rmrfrmrf wrote: post #4

I get really irritated with companies that put absolutely no effort into cleaning up their services on their own. When nearly 20,000 of No-IP's accounts are being used for malicious purposes, crying about how Microsoft didn't give them any warning just makes them seem incompetent. There was another article recently on HN about some free tunneling service whose creator tried to automate account shutdowns whenever his…

They claim it was 2k out of 4M.

Goguen said while Microsoft claimed that there were more than 18,000 malicious hostnames involved, no-ip.com could only find a little more than 2,000 from that list that were still active as of Monday morning.

http://krebsonsecurity.com/2014/07/microsoft-darkens-4mm-sit...

Re: Microsoft Cybercrime Shutdown Hit Users Says DDNS Provider

#22

Post by bitJericho » Tue, Jul 01, 2014, 2:41 PM UTC

the_ancient wrote: post #20

danielweber wrote: post #18

Earlier quoted context omitted.

Fine, did any party before the court attempt to serve No-IP.com? If No-IP.com avoided service like Charles Carreon, I have little sympathy. If there was no attempt at service, that's a different story.

Perhaps one should read my full post, as I answer this question in my "Further" second paragraph I think you are just grasping to find any justification for what MS and the courts have done here... There are none.

Read the order, it's floating around on the other thread. The justification is laughable at best, purjury at worst.

Re: Microsoft Cybercrime Shutdown Hit Users Says DDNS Provider

#23

Post by DanBC » Tue, Jul 01, 2014, 2:47 PM UTC

the_ancient wrote: post #20

danielweber wrote: post #18

Earlier quoted context omitted.

Fine, did any party before the court attempt to serve No-IP.com? If No-IP.com avoided service like Charles Carreon, I have little sympathy. If there was no attempt at service, that's a different story.

Perhaps one should read my full post, as I answer this question in my "Further" second paragraph I think you are just grasping to find any justification for what MS and the courts have done here... There are none.

HN has an international audience. Many people here do not speak English as a first language and you could help those people by being a bit clearer with your communication.

Re: Microsoft Cybercrime Shutdown Hit Users Says DDNS Provider

#24

Post by Someone1234 » Tue, Jul 01, 2014, 2:49 PM UTC

wfjackson wrote: post #14

pling wrote: post #10

Earlier quoted context omitted.

Lets be honest about the problem and this isn't some slashdot-esque rant: a) Windows is a piece of crap when it comes to staying clean. If it wasn't, Microsoft wouldn't have to go after people like this. Not joking but I clean out a fair number of PCs every year and they are crawling with malware. b) Users are dumb and install any old crap on kit if prompted to. Microsoft's SmartScreen did very little to prevent this…

>They're a pretty easy target as the architecture of Windows is incredibly complicated and they're playing plug the holes rather than designing it properly to start with. For ref, I know the NT kernel, win32 and CLR inside out and no longer would I poke it with a stick. Not sure what you mean by that. Does Linux have any protections beyond Windows to stop malware? Why does Android have a malware problem? This is the…

> Not sure what you mean by that. Does Linux have any protections beyond Windows to stop malware? Why does Android have a malware problem?

This is the key question that I'd like to hear the answer to.

People often claim Linux/OS X/et al are more secure but they struggle to explain WHY. What technical mechanism is in place in those systems that is not in place in [current] Windows? A few years ago you could definitely name a few things (i.e. before UAC, and a few other things) but now?

I'm certain something like SELinux or AppArmor makes for a more secure system, but last time I installed a consumer distro (namely Mint and Ubuntu) they weren't shipped as standard and often broke quite a lot of default packages upon their installation.

As an aside: In my experience Windows has become less "malware ridden" since XP. Vista, 7, and 8 often survive much longer without anything bad happening. It does still happen, it just isn't as common as it used to be (e.g. 1/5 consumer PCs now instead of 3/5 or more).

Re: Microsoft Cybercrime Shutdown Hit Users Says DDNS Provider

#25

Post by BitMastro » Tue, Jul 01, 2014, 2:55 PM UTC

wfjackson wrote: post #14

pling wrote: post #10

Earlier quoted context omitted.

Lets be honest about the problem and this isn't some slashdot-esque rant: a) Windows is a piece of crap when it comes to staying clean. If it wasn't, Microsoft wouldn't have to go after people like this. Not joking but I clean out a fair number of PCs every year and they are crawling with malware. b) Users are dumb and install any old crap on kit if prompted to. Microsoft's SmartScreen did very little to prevent this…

>They're a pretty easy target as the architecture of Windows is incredibly complicated and they're playing plug the holes rather than designing it properly to start with. For ref, I know the NT kernel, win32 and CLR inside out and no longer would I poke it with a stick. Not sure what you mean by that. Does Linux have any protections beyond Windows to stop malware? Why does Android have a malware problem? This is the…

1) Linux and other unixes were created with the idea of privilege separation and permission baked in. Windows had to add it later, while keeping compatibility

2) Linux has a variety of kernels and libraries versions across its base, making it difficult to exploit it uniformly

3) MS is indeed capable of making secure OSes, I don't deny it, but you should not use Xbox, Windows Phone and RT as examples, since all three of them can ONLY install approved software (less for RT, but it's not used by end users in the same way)

4) MS could have used the same approach used by Linux and Android (and partially OSX): have a central approved and monitored repository of software, but giving the possibility to add external software by jumping a few hoops, i.e. inserting a password, or checking a couple of checkboxes before allowing untrusted installations.

5) To prove the point, Android has malware almost exclusively outside of the google play store. Never heard of someone getting malware by using android, while I know an handful of people getting malware on windows (this is anecdotal experience, but I don't have any other data)

6) The shitstorm was raised because on some Secure Boot implementations it was impossible to disable it

Re: Microsoft Cybercrime Shutdown Hit Users Says DDNS Provider

#26

Post by okasaki » Tue, Jul 01, 2014, 3:06 PM UTC

Someone1234 wrote: post #24

wfjackson wrote: post #14

Earlier quoted context omitted.

>They're a pretty easy target as the architecture of Windows is incredibly complicated and they're playing plug the holes rather than designing it properly to start with. For ref, I know the NT kernel, win32 and CLR inside out and no longer would I poke it with a stick. Not sure what you mean by that. Does Linux have any protections beyond Windows to stop malware? Why does Android have a malware problem? This is the…

> Not sure what you mean by that. Does Linux have any protections beyond Windows to stop malware? Why does Android have a malware problem? This is the key question that I'd like to hear the answer to. People often claim Linux/OS X/et al are more secure but they struggle to explain WHY. What technical mechanism is in place in those systems that is not in place in [current] Windows? A few years ago you could definitely…

Ubuntu ships with AppArmor enabled. Fedora ships with SELinux. It's been that way for a long time. Other distributions like Arch come with packages for other frameworks, including grsecurity.

But I think the primary "technical mechanism" that makes Linux more secure is the fact that users install software from distribution repositories, rather than from the web. The repos are basically impenetrable since packages are signed and contributor identities confirmed with WoT (I've never heard of there being malware in a major distribution) and security updates are deployed to everybody very quickly.

Re: Microsoft Cybercrime Shutdown Hit Users Says DDNS Provider

#27

Post by Omniusaspirer » Tue, Jul 01, 2014, 3:13 PM UTC

rmrfrmrf wrote: post #4

I get really irritated with companies that put absolutely no effort into cleaning up their services on their own. When nearly 20,000 of No-IP's accounts are being used for malicious purposes, crying about how Microsoft didn't give them any warning just makes them seem incompetent. There was another article recently on HN about some free tunneling service whose creator tried to automate account shutdowns whenever his…

I don't think I could possibly disagree with you more.

It is in no way No-IP's job to protect Microsoft from malware yet by all accounts they employed both automated detection as well as a (very timely) manual reporting option. How can you possibly sit back and claim they're "incompetent" when you have absolutely zero knowledge of what happened within the company to address this issue? Microsoft wants to complain No-IP wasn't doing their job to their standards as if how they feel about it matters in the slightest.

Oh, and from the numbers I saw it was 12,000 accounts were deemed to be complicit in malware distribution by a 3rd party security firm. Another user posted they have ~4 million accounts total. If those numbers are accurate that means only .003% of total accounts had anything to do with malware; Sounds like a damn good job from the No-IP guys to me.

Even if you manage to delude yourself into thinking Microsoft is in the right in their domain seizure then you still can't justify the sneaky way they approached this with no forewarning to No-IP customers or even No-IP themselves. Had they actually established a dialogue maybe I wouldn't be experiencing any outages since they could have actually set up sufficient infrastructure in advance to handle the No-IP server load.

And yes, I actually used No-IP domains myself for completely legitimate purposes and am still unable to make use of any of the seized domains. No-IP is absolutely not responsible for this, that blame falls 100% on Microsoft and I honestly think you'd need to be misinformed or a Microsoft employee to feel otherwise.

Re: Microsoft Cybercrime Shutdown Hit Users Says DDNS Provider

#28

Post by anon1385 » Tue, Jul 01, 2014, 3:19 PM UTC

pling wrote: post #10

rmrfrmrf wrote: post #4

I get really irritated with companies that put absolutely no effort into cleaning up their services on their own. When nearly 20,000 of No-IP's accounts are being used for malicious purposes, crying about how Microsoft didn't give them any warning just makes them seem incompetent. There was another article recently on HN about some free tunneling service whose creator tried to automate account shutdowns whenever his…

Lets be honest about the problem and this isn't some slashdot-esque rant: a) Windows is a piece of crap when it comes to staying clean. If it wasn't, Microsoft wouldn't have to go after people like this. Not joking but I clean out a fair number of PCs every year and they are crawling with malware. b) Users are dumb and install any old crap on kit if prompted to. Microsoft's SmartScreen did very little to prevent this…

>Windows is a piece of crap when it comes to staying clean. If it wasn't, Microsoft wouldn't have to go after people like this.

It doesn't help that Google is making money from infecting their users with malware. It's basically impossible for people to find popular Windows software though Google without begin directed to malware.

For example if you do a Google search for 'firefox', usually the top result (actually an ad) , will be a link to a site that downloads a copy of Firefox bundled with malware. This is from a search I did a few moments ago: http://i.imgur.com/lzKU3FO.png

It would be trivial for Google to block these malware sites and Adwords accounts - a lot of the ads that show up look to be pointing to the same sites as they were 6 months ago. Adwords has manual review of ads and the sites they link to. There is just no way that they don't know about these heavily profitable Adwords accounts that are running on hugely popular keywords.

This isn't a new problem, I've mentioned it time and time again: https://news.ycombinator.com/item?id=7101939 , https://news.ycombinator.com/item?id=7335401 , https://news.ycombinator.com/item?id=7089727

Re: Microsoft Cybercrime Shutdown Hit Users Says DDNS Provider

#29

Post by pling » Tue, Jul 01, 2014, 3:27 PM UTC

anon1385 wrote: post #28

pling wrote: post #10

Earlier quoted context omitted.

Lets be honest about the problem and this isn't some slashdot-esque rant: a) Windows is a piece of crap when it comes to staying clean. If it wasn't, Microsoft wouldn't have to go after people like this. Not joking but I clean out a fair number of PCs every year and they are crawling with malware. b) Users are dumb and install any old crap on kit if prompted to. Microsoft's SmartScreen did very little to prevent this…

>Windows is a piece of crap when it comes to staying clean. If it wasn't, Microsoft wouldn't have to go after people like this. It doesn't help that Google is making money from infecting their users with malware. It's basically impossible for people to find popular Windows software though Google without begin directed to malware. For example if you do a Google search for 'firefox', usually the top result (actually an…

That's a pretty scary thing really when you think about it. Thanks for outlining it. Good job I stick adblock on every machine I ship so these things don't even get seen.

Re: Microsoft Cybercrime Shutdown Hit Users Says DDNS Provider

#30

Post by BitMastro » Tue, Jul 01, 2014, 3:44 PM UTC

Someone1234 wrote: post #24

wfjackson wrote: post #14

Earlier quoted context omitted.

>They're a pretty easy target as the architecture of Windows is incredibly complicated and they're playing plug the holes rather than designing it properly to start with. For ref, I know the NT kernel, win32 and CLR inside out and no longer would I poke it with a stick. Not sure what you mean by that. Does Linux have any protections beyond Windows to stop malware? Why does Android have a malware problem? This is the…

> Not sure what you mean by that. Does Linux have any protections beyond Windows to stop malware? Why does Android have a malware problem? This is the key question that I'd like to hear the answer to. People often claim Linux/OS X/et al are more secure but they struggle to explain WHY. What technical mechanism is in place in those systems that is not in place in [current] Windows? A few years ago you could definitely…

I'll give it a try:

privilege separation and permission since the beginning

only super user was allowed to install new software

(simplifying) different distros and different versions created diversity making it difficult for an attack area to be widespread across all installations

typing a password for additional privileges requires more attention than clicking a button

apparmor has been enabled by default since a couple of years, it used to break some stuff but not anymore

(simplifying) new files are not executable, and they don't rely on extensions to determine the associated program

since linux is not the default it requires a learning curve that people using windows don't have, so users are more tech savvy

since the source code is available, more people COULD have a look at security vulnerabilities, and in case of emergency the don't have to wait for someone else to provide a patched binary

That said, I don't consider security on windows to be a disaster. It certainly is improving and in general they also pay a lot more attention to security.