Skunkx DDoS Bot Nationality

Jose Nazario provides an excellent summary on the Arbor blog of a bot that spreads via USB and instant messenger. He starts with a note on anti-Sino bias often found in American security analysis.

Lest you think all of the DDoS bots we focus on come only from China, we found one that appears to be from the US.

It appears to be from the US, but it still has links to the countries where it is easier to evade law enforcement.

His servers that he has used go back to “Net-0x2a: Zharkov Mukola Mukolayovuch” in the Ukraine, and also “PIRADIUS” in Malaysia. This is someone familiar with underground hosting, it seems.

It sounds much less American now. Don’t let it slip away Jose.

Inspection of the bots we captured show a handful of user-agents (my favorite is the Cyberdog one!) and HTTP headers that appear distinctive, enabling us to detect its traffic selectively. The author appears to have imported Slowloris’ attack method without any modification.

We have also been sinkholing this botnet. Inspection shows hundreds of bots checking in from around the world, with most in the US.

Aha! I can’t overstate the importance of including the lineage in an attack analysis. But even more to the point, Cyberdog is an obviously American reference. I remember in the late 90s when Steve Jobs said he put a “bullet through the head” of Cyberdog.

And now Cyberdog is back, as a zombie! I bet Steve didn’t see that coming.

But seriously, a Chinese user-agent is unlikely to be Cyberdog. It might be ç‹—å±  or maybe called Sundog, if Chinese, but I doubt Cyberdog.

Even more seriously, the speculation about nationality just forces me to wonder if the common definition of a nation is being pushed too far to fit these scenarios.

It’s relevant to law enforcement and financial take-down operations but, when it comes to explaining where a bot is “from”, are we at risk of shoving a square peg into a round hole?

Maybe I’m getting stuck on this idea of nationality linked to a product because it brings to mind how some say Budweiser is from America, instead of the Czech Republic. I mean Cheddar cheese has to be from Cheddar, England, right?

Louder Than a Bomb

Louder Than a Bomb is a new documentary film about young spoken-word competitors — an intimate look at how they spin lessons from life into poetry.

Rather than emphasize individual poets and performances, the structure of Louder Than a Bomb demands that kids work collaboratively with their peers, presenting, critiquing, and rewriting their pieces. To succeed, teams have to create an environment of mutual trust and support. For many kids, being a part of such an environment—in an academic context—is life-changing.

The film centres around a team format. Yet, as with athletic teams, there are individual highlights like this 2008 performance by Nate Marshall.

Hack the Lexus CT 200h

No, I don’t mean the electronics. I mean the design. No need to blow it up and start over. Just rip out the weak excuse for an engine and put in a real one. A diesel.

Here’s proof that Lexus is only half-heartedly entering the efficiency market.

First, they replaced the engine when they put it in an endurance competition.

The race car uses the same hybrid drive system as a road-going CT200h, which means it can save fuel by turning off its gasoline engine when braking for turns, and receive a boost from its electric motor when accelerating. Lexus says the car will use less fuel and produce fewer toxic emissions than other race cars, but we suspect this is primarily a marketing push.

The stock CT’s 1.8-liter engine is thrifty but a bit feeble, so it has been replaced with a 2.4-liter unit of undisclosed output. Otherwise, the car is essentially the same hybrid that you can buy

Ouch. Apparently the “feeble” engineering sacrificed too much performance. It should not have to be a trade-off. What is with the secret 2.4-liter gasoline engine? Does it have better engineering or are they too embarrassed to admit that it’s a giant gas-guzzler?

Second, consider a Lexus CT 200h heavily modified by Fox Marketing. It attaches an Eaton supercharger to the “feeble” engine to reach 300 horsepower.

A factory CT 200h is able to achieve only 40 mpg. Adding a supercharger (either roots or centrifugal) is not going to help that number. If a driver pushes the engine they will be consuming additional fuel to achieve more power so…I would guess it’s back down in the 20s. Compare that regression in engineering to the Volvo V60 diesel-electric hybrid, which reaches 125 mpg yet provides 285 horsepower and 472 pound feet of torque.

Would you give fifteen horses to get over a 100 miles more per gallon? If you want the top average speed possible, you will say yes.

Naughty Diesel Volvo

So the bottom-line is that Lexus already can be found ripping up their design and throwing out the engine on the CT200h, as if they don’t even believe their own mistake.

I have to point out that their marketing campaign also is a bit familiar.

A brown sport wagon that boasts 40mpg…been there, done that seven years ago. I guess it’s ok to call it brown now. VW called their paint “Red Samoa” in 2004:

The CT200h mpg could have been acceptable in 2004. Even then, however, it would lack flexibility of fuel sources and wouldn’t give the performance necessary to haul people and gear. I still would have to hack it like the Hobbit Prius (netcat prius?), which could be fun but a waste of time compared to just buying a 2004 diesel.

Today I would expect an industry leader to offer nothing less than 60 mpg with over 300 pound feet of torque. After all, the 2012 model diesel cars like the V60 above are selling over 100 mpg without sacrificing performance or power.

My question to Lexus is if they’re going to do all this work to squeeze out some more performance every time they really want to drive it or put it in a showroom then why not also maintain efficiency by dropping a Lexus 200d under the hood (2.2 liters, 45 mpg, 177 horsepower, 300 pound feet of torque).

Yes, 45 mpg with plenty of power even before they add a hybrid system.

Lexus 200d

I would buy that in a hybrid…unless Ford offers something from their diesel Jaguar experience first.

Lexus should step their game up.

Email Breaches Ruled as “Significant Harm”

The Office of the Information and Privacy Commissioner of Alberta, Canada has published a news release with a decision on the Epsilon data breach.

Commissioner [Frank] Work reviewed the incident reports by Best Buy and Air Miles and concluded that although the information at issue (name, email addresses and organization membership (in the Best Buy case) was relatively minor compared to other data breaches which involve the unauthorized access of financial or other sensitive information, the sheer magnitude of the breach and the evidence that the information will likely be used for malicious purposes indicated there was a real risk of significant harm to affected individuals.

[…]

The Commissioner stated that the number of affected individuals increases the likelihood that spear phishing attempts will be successful and significant harm to individuals could occur as a result of the breach.

If you can find the missing parenthesis you win.