Jesus. If getting that many bots in an evening is so easy, it's a wonder botherders spend so much effort on exploiting vulnerabilities in apps or engaging in phishing. Granted, Linux boxes probably aren't going to have the banking or email info you could grab off a Windows machine, but at the very least you could generate a decent number of bitcoins for very little effort. Actually, for that matter, 420k bots could launch a pretty nasty DDoS were the herder so inclined. That's enough firepower to take out some fairly large services, which I'm sure someone would be willing to pay for.
Which is why everyone needs to learn about HSTS (my new favorite thing). There's room for a stripping attack upon first connecting and being redirected from http to https but from then on you've mitigated most of the problem.
You use webmitm[1] or ettercap[2] to get the traffic. Sure users will get a cert warning, but you are going to at least catch a few people that click through it.
Well done, sir. Even so, I think once a user is shown a cert warning it becomes their problem, not the site owner's(in the sense of who's responsible that is). When it comes to security, everyone has their part to play.
Comments
Jesus. If getting that many bots in an evening is so easy, it's a wonder botherders spend so much effort on exploiting vulnerabilities in apps or engaging in phishing. Granted, Linux boxes probably aren't going to have the banking or email info you could grab off a Windows machine, but at the very least you could generate a decent number of bitcoins for very little effort. Actually, for that matter, 420k bots could launch a pretty nasty DDoS were the herder so inclined. That's enough firepower to take out some fairly large services, which I'm sure someone would be willing to pay for.
> If getting that many bots in an evening is so easy
According to the report, designing the botnet took six months.
Given the number of these that are some form of router, why waste time bitcoin mining? Just MITM everyone.
HTTPS would tend to rob you of anything interesting, though.
For many users and many sites, SSL stripping is still quite a significant vulnerability.
http://www.thoughtcrime.org/software/sslstrip/
Assuming DNSSEC isn't in use, controlling someone's DNS settings is enough to carry out an SSL stripping attack!
Which is why everyone needs to learn about HSTS (my new favorite thing). There's room for a stripping attack upon first connecting and being redirected from http to https but from then on you've mitigated most of the problem.
You use webmitm[1] or ettercap[2] to get the traffic. Sure users will get a cert warning, but you are going to at least catch a few people that click through it.
[1] http://manned.org/webmitm/8187425a
[2] http://samiux.blogspot.com/2011/05/howto-sniffing-ssl-with-e...
Amusingly the general classes of "users who leave default passwords" and "users who click through a warning" are going to have a big intersection.
Well done, sir. Even so, I think once a user is shown a cert warning it becomes their problem, not the site owner's(in the sense of who's responsible that is). When it comes to security, everyone has their part to play.
Only if anyone actually looks at the SSL cert warnings instead of just clicking through them.