Forgot your password?
typodupeerror
Botnet Crime Security Spam IT

Researchers Cripple Pushdo Botnet 129

Posted by timothy
from the nothing-wrong-with-the-word-cripple dept.
Trailrunner7 writes with this from ThreatPost: "Researchers have made a huge dent in the Pushdo botnet, virtually crippling the network, by working with hosting providers to take down about two thirds of the command-and-control servers involved in the botnet. Pushdo for years has been one of the major producers of spam and other malicious activity, and researchers have been monitoring the botnet and looking for ways to do some damage to it since at least 2007. Now, researchers at Last Line of Defense, a security intelligence firm, have made some serious progress in crushing the botnet's spam operations. After doing an analysis of Pushdo's command-and-control infrastructure, the researchers identified about 30 servers that were serving as C&C machines for the botnet. Working with the hosting providers who maintained the servers in question, the LLOD researchers were able to get 20 of the C&C servers taken offline, the company said."
This discussion has been archived. No new comments can be posted.

Researchers Cripple Pushdo Botnet

Comments Filter:
  • Legal hacking? (Score:5, Interesting)

    by Creepy Crawler (680178) on Sunday August 29, 2010 @01:05AM (#33407352)

    I wonder if the courts would issue an order that would legalize hacking of unstoppable network computers to prevent ongoing attacks?

    Other normally illegal tactics can be utilized legally, if a judge deems them necessary or in a court of law. You know, 1st degree murder vs E-Chair?

    • Re:Legal hacking? (Score:5, Insightful)

      by Ethanol-fueled (1125189) * on Sunday August 29, 2010 @01:23AM (#33407384) Homepage Journal
      Don't know if you got the memo, but the feds pay others to do the dirty work for them.

      Fed: "Wanna work with the FBI, Fido? Wanna help us catch bad guys?"
      Snitch: "Yeahyeahyeahyeahyeahyeah!
      Fed: "There's an athiest group that looks suspicious. I think they're laundering money to fund their picnics. You need to infiltrate them, earn their trust, and if you don't find anything make something up so we have a good excuse to raid their headquarters. You will get a pat on the head and a nice, big doggy bone if we get convictions. Snitch: "Yeahyeahyeahyeahyeah!

      [ Months later, a number of the atheist group's members are arrested for child pornography for unwittingly having nude pics of their 17 year-old sons and daughters who kept them stored "privately" in facebook ]

      Fed: "Bad news, Fido. The D.A. wants to charge you with computer crimes. You're expected to do 5 years in the pen."
      Snitch: *whimper*
      Fed: "It's okay, you helped us save the children. Just suck it up and don't drop the soap."
      • Re:Legal hacking? (Score:4, Interesting)

        by WrongSizeGlass (838941) on Sunday August 29, 2010 @07:11AM (#33408216)
        I'm sorry to be the one to tell you this, but your little 'story' is very reminiscent of the ABC After School Special "When Good Dogs Do Bad Things (And Hard Time) For Good Reasons". Be on the look out for a little 'invitation' to a court party being held in your honor thrown by the ASSAA and their affiliated legal teams. ;-)
    • Re:Legal hacking? (Score:5, Insightful)

      by Martin Blank (154261) on Sunday August 29, 2010 @03:12AM (#33407640) Journal

      There's no legal authority for the courts to order such actions. Even execution orders are authorized by the legislative body, approved by the chief executive, and carried out by subordinates to the executive (subject to the lack of intervention by the judicial body). Any offensive action against spammers/hackers would require a similar path.

      • by dimeglio (456244)

        A simple legislation can give more powers to ISPs and policing agencies to perform such actions. Provided of course they are constitutional.

        • by jack2000 (1178961)
          I think ISPs can already just null route you if they so wish.
          And if an isp is reluctant to null route a known CNC machine for a spam network just have the upstream ISPs null route it.
    • Re:Legal hacking? (Score:5, Interesting)

      by FriendlyLurker (50431) on Sunday August 29, 2010 @04:30AM (#33407874)
      If it hasn't happened already - how long before they control the biggest botnets on the block (they being "security intelligence firm's"), to meet the Cyber-defense budget laid down by American taxpayers. Personally I prefer to setup a few spam filters on my servers over having Goverments use their shady "security intelligence firm's" to take websites like wikileaks offline.
    • by WrongSizeGlass (838941) on Sunday August 29, 2010 @07:15AM (#33408226)
      What you're looking for is the B-Team, a team of anti-botnet soldiers of fortune on the run from the RIAA after being branded as criminals for a "download they didn't commit."
  • by ysth (1368415) on Sunday August 29, 2010 @01:09AM (#33407360)
    I would love to see stories like this publishing a full list of the providers who didn't take down a server.
    • Re: (Score:3, Interesting)

      by mysidia (191772)

      So would I like to see that.

      So I could switch to those providers, and know they wouldn't be messing with my server without talking to me just because some er "researcher" decided they thought the server might be some sort of C&C

      I imagine there could be some legal concerns of the researchers were to publish such a list... it might seem like extortion "Take down that server, or we'll publish your name!"

      Or it might attract more business to those providers.. the, er, bad guys, would also know s

      • by rastos1 (601318) on Sunday August 29, 2010 @02:59AM (#33407614) Homepage

        So I could switch to those providers, and know they wouldn't be messing with my server without talking to me just because some er "researcher" decided they thought the server might be some sort of C&C

        I assume that the providers were just notified by the researcher and were able to see for themselves whether the server is doing something malicious or not. In addition every ISP I've dealt with, has a contract clause that allows them to cancel the service if you use it to violate the laws of the country - which is often the case when sending SPAM. You are then free to sue them if you believe that terminating the service was not justified.

        • by nacturation (646836) * <nacturation AT gmail DOT com> on Sunday August 29, 2010 @03:54AM (#33407764) Journal

          I assume that the providers were just notified by the researcher and were able to see for themselves whether the server is doing something malicious or not.

          And when they look into it, they'll probably see a bunch of SSL-secured HTTP requests.

          In addition every ISP I've dealt with, has a contract clause that allows them to cancel the service if you use it to violate the laws of the country - which is often the case when sending SPAM. You are then free to sue them if you believe that terminating the service was not justified.

          A command and control server doesn't send out spam. It only acts as a server for the bots that do all the spam sending.

          • Re: (Score:3, Interesting)

            by Ihmhi (1206036)

            A command and control server doesn't send out spam. It only acts as a server for the bots that do all the spam sending.

            Replace "send out spam" with "store pirated media" and "command and control server" with "torrent-indexing website", and you essentially have the same argument for not interfering with their operations.

            • Replace "send out spam" with "store pirated media" and "command and control server" with "torrent-indexing website", and you essentially have the same argument for not interfering with their operations.

              True, but the 'R' in RIAA doesn't stand for 'Researcher' ...

            • Replace "send out spam" with "store pirated media" and "command and control server" with "torrent-indexing website", and you essentially have the same argument for not interfering with their operations.

              There's a HUGE difference between sending data and storing data.
    • by KiloByte (825081)

      Removing any number but ALL servers does entirely no good. The only effect is slowing the botnet for a day while the zombies fall back to surviving servers.

      And, like an incomplete antibiotics therapy, it gives the botnet's herder a clue -- that he needs to move to more resilient techniques instead of relying on fixed, easy to remove, servers.

      • Re: (Score:1, Informative)

        by Anonymous Coward

        They've done that ages ago. In case these researchers actually did had taken down all the C&C servers, the bots would go into rendezvous mode and based on an algorithm, start generating thousands of domain names per day. Now all the people behind the botnet need to do is to register one of those domains and upload their signed update on it with a list of new C&C servers, and the botnet is back up and running.

        These aren't some 90's irc botnets and the people running them aren't stupid. With these met

      • by ultranova (717540)

        And, like an incomplete antibiotics therapy, it gives the botnet's herder a clue -- that he needs to move to more resilient techniques instead of relying on fixed, easy to remove, servers.

        So... why do they? Wouldn't it make more sense to make the whole thing entirely decentralized, with each bot keeping the addresses of a dozen or so other bots, and broadcasting any incoming commands (that pass the signature check, of course) to them? The bot herder simply runs a bot in his own machine, and injects any com

    • It's certainly better to block the server by having the ISP take it down, but there are other ways to do it.

      • Other ISPs can block IP addresses or address ranges from accessing their users, and getting the few big cable modem and DSL providers to block the botnet's servers doesn't require cooperation of the ISP hosting the servers. (The inefficient way to do blocking is to use Access Control Lists; it's simpler to just route the addresses to a blackhole.)
      • If the botnet servers' ISP's upstream provider will c
    • Re: (Score:2, Funny)

      by symbolset (646467)
      I would love to see stories like this tagged "oldmanyellsatcloud".
  • sadface! (Score:5, Funny)

    by bwayne314 (1854406) on Sunday August 29, 2010 @01:38AM (#33407408)
    Wait, so I wont be getting any more exciting opportunities to add inches to my penis? What about all that steady income I was getting helping out Nigerian bankers!?!? How am I going to feed my family and satisfy my wife?
    • Re: (Score:2, Funny)

      by Anonymous Coward

      How about you sell your wife to some Nigerians and they can satisfy her?

  • Seriously, guys, why does nobody ever link to the original source? ThreatPost [threatpost.com] got it from M86 Security [m86security.com] got it from TLLOD [tllod.com]. Would it kill the submitters to link to the original, or the editors to fix it?
  • by paper tape (724398) on Sunday August 29, 2010 @01:44AM (#33407426)
    Unresponsive providers might be more likely to respond if responsive parties who controlled upstream routers were to stop routing traffic from them.

    All traffic.
    • Pretty much (Score:5, Informative)

      by Sycraft-fu (314770) on Sunday August 29, 2010 @03:05AM (#33407628)

      I think we need to start having more of a "you play nice or don't play on the net" kind of system going on. Providers are not expected to be perfect, nobody is perfect, just to be responsive to complaints/problems. If you aren't you get warned and if you keep ignoring it you just get shut out by all major networks. You then have to prove you took care of the problem and will play nice before you get let back in.

      That's how we do it at work, actually. I work at a university and we have a lot of research labs, some of which are totally independent of our central control. When a system in there gets infected, we see if we can track someone down who can deal with it, if nobody is there or everyone claims ignorance, we shut down all network access. When that happens people get a hold of us surprisingly fast and the person who needs to deal with the system is found. Once they take it offline to be dealt with and promise to behave, network access is restored.

      I think the big network providers need to work out a system like this, where if a given company is unresponsive, you can file a complaint with them. They then warn the company and if they are still unresponsive, cut access. After all the crap causes them problems as well.

      • Re: (Score:2, Interesting)

        by DNS-and-BIND (461968)
        The Internet is a default-accept network. Changing it to a default-deny network would have far-reaching consequences way beyond taking down spam networks. Which would you rather have, the internet of today or "we'll shut you down or else" decisions being made by drunk-on-power nerds?
        • Re: (Score:2, Insightful)

          by ergrthjuyt (1856764)
          Doesn't sound like he was proposing a default-deny network, just proposing actual consequences for breaking the law (which in most jurisdictions requires the disconnection of illegal servers upon notification)
        • by Sycraft-fu (314770) on Sunday August 29, 2010 @05:08AM (#33407984)

          I'm proposing that people deal with their own dirty laundry, and if they won't, that the people above them do. For example if I am causing a problem, my ISP will call me and say "Hey fix your shit." Happened many years ago, a roommate got a virus on his computer. They called me, I turned it off, life was good. Should I refuse, however, the ISP would have shut down my line. They were not interested in sending out viruses all over the place.

          What I'm proposing is that the big bandwidth providers take the same attitude. If some hosting provider has systems doing evil, you contact them. However if they refuse to deal with it, you can then contact the big providers. They can check, if evil is going on they warn the company. If it doesn't stop, they shut down the links.

          I fail to see a problem here. Such a thing wouldn't be done capriciously because it is against a business's best interest. If a customer is paying money and not causing problems of course they want to keep the connection active. They don't want to turn it off for fun (and probably break the contract).

          All lines have AUPs, even big ones. I just think they need a mechanism to allow for complaints and enforcement, and something that is less severe than a total disconnection. Rather than something having to get to the "You cause so much trouble you are in violation of the contract and we stop selling service to you," point instead they can say "You've refused to deal with complaints so you are blocked, fix your shit and promise to listen in the future and we turn you back on."

          The reason I want to see this is first because I want less shit on the net, but also because with many things you find you either self regulate or the government will regulate you. What happens if instead the US government, or a council at the UN gains complete regulatory power and can tell providers who to shut down? I'd much rather have it as a self regulating system.

          It works well for ISPs, and most ISPs do it. As I said, as a university we are an ISP and we do just that. We investigate and respond to claims of malicious network activity. However, we need a higher level to deal with the ISPs that won't respond to the complaints.

          • Re: (Score:3, Interesting)

            by belthize (990217)

            I don' t think that will work so well. The C&C machines are on ISP's who are peered with major ISP's that are much more interested in money than the small amount of traffic coming from C&C. The individual zombie nodes are so distributed that the labor costs of properly determining whether a down stream client is infected, or is not being dealt with fast enough far outweighs the costs of shutting down the network to that client's ISP/owner.

            If they shutdown some site for sending spam or a virus or w

          • by hedwards (940851)
            The main problem there is that back in olden times people pretty much had to know things about computers to get online. These days not so much, anything more complicated than turning it on or accessing the internet (By which I really mean IE) is deemed to be too complicated and time consuming to worry about. And no amount of nagging or information seems to be able to penetrate their minds that it's a very serious risk with potential life changing consequences.
      • Re: (Score:3, Insightful)

        by Plekto (1018050)

        Your proposal would work best, to be honest, if the major backbone providers did this to the entire ISP instead of leaving the ISP to half-assed "police" its members. If a large amount of spam is coming from a provider, shutting it off entirely will get them to comply with their terms(which I can guarantee has terms and conditions concerning malicious use and so on). It's currently entirely within their bounds to do so but to date, they still refuse to do it. It's also not rocket science to see where the

      •       That would result in Russia and China being quarantined from the world network where they could spam each other for commie money.

              I know that isn't politically correct to say but for anyone who looks at the IP addresses where server attacks come from they would know I speak the truth.

          rd

    • And you surely would like it if your business comes to a screeching halt, just because you happen to have your server hosted by a provider who also hosts a server which some researchers claim to be a botnet server, and your provider doesn't believe them.

      • I'm sure there aren't many companies that would put up with that at all. That's why it would be so effective; not many ISPs would remain in business if they failed to protect their customers from such shut-offs.

        • Yeah, it would make it a very effective blackmailing tool. "Nice server you have there for your business. It would be too bad if your provider were told you were controlling a botnet from there ..."

          Yes, you could then get the server up again by proving that you didn't have any botnet activity on it. But until then, you already lost serious money.

          • by Joce640k (829181)

            I"m pretty sure they'd check it out first...this isn't DMCA we're talking about here.

            • How exactly would they check it out? Check that there are indeed bots contacting your server? It should not be hard for the criminal to add your server to some bot's list of servers to contact (the bot will not get any useful response from your server, but that's no problem, the bot will simply ignore any useless replies). How is the provider to distinguish https requests which return useful commands for the botnet from https requests which don't? Note that any user-facing web server handling confidential d

      • by hedwards (940851)
        You have an alternative? An obscene amount of this sort of traffic is served up by a small number of providers. Usually offshore where the authorities don't care and they aren't the kind of ISP that businesses would typically want to be hosted by because any ISP that looks the other way while cybercriminals and in some cases organized crime runs amok, could very easily not notice somebody stealing your data.
    • This reminds of a story that may be more tech myth and legend and if it is not true it should be and it goes something like this:

      Back in the early days of the net when the major interconnects were MAE East and MAE West and other interconnect points had not been established almost everything routed through these two points.

      So the story goes that there was a tech who dutifully monitored the system during his shift. He had noticed that someone from another country was trying to get access to files on a certain server at major university. Now he was curious because he saw the same attempts over and over again over a rather long period of time. Now since we all forget password or thing we know them and then try and try without success this is not that unusual and normally after fumbling around we will just contact the machines owner and ask for the correct password. Now in those days it was still a relatively small group of folks so there were not a whole lot of questions asked.

      But the tech in question started noticing the pattern was limited to times when the people attending these machines would not be there.

      So he sent off an e-mail to the admins he knew and they had not been requested to change or provide any passwords.

      So our intrepid tech sent off an e-mail to the administrators of the location of the seeming intruder and asked that they have him stop. Well the admins said that it was really none of their business anyway and being in a foreign country our admin had no say over what anyone there did. The long and short of it was that the apparent intruder kept it up.

      So one night our intrepid admin had had enough, so he did what he thought might get peoples attention. He simply unplugged the cable that was the source of the problem and effectively disconnecting an entire country from MAE West!

      Well in a few hours phones started ringing into MAE West asking questions and trying to figure out what was wrong? He told them he had asked, many time for the admins of the network that the rude behavior was originating from to kindly ask the owner of the machine to stop and had been rudely rebuffed to say the least.. He also said when the attempted intrusions stop, he would plug them back in. To say the least they stopped in fairly short order and he plugged them back in.

      Now that is a bit far flung because I doubt there is any one cable that could disconnect an entire country but I am pretty sure you could simply route class A's to /dev/null. Perhaps that what it will take to get ISP's to get serious. Just pull their plug until they behave. Everyone peers in someplace so it should not be that hard to go and find that Ethernet cable and simply unplug it and leave it dangling until their behavior changes/

      • You had me going until you said he "simply unplugged the cable". We both know a dissed and powerful nerd would have cut the cable in a classic display of nerd rage. ;-)
        • by dkf (304284)

          You had me going until you said he "simply unplugged the cable". We both know a dissed and powerful nerd would have cut the cable in a classic display of nerd rage. ;-)

          No, he wouldn't, not when it is his job to put the end back on it when the problem is fixed. Unplugging works just as well, and is less hassle personally.

        • by lennier (44736)

          That's not nerd rage, that's BOFHdom. A BOFH does not get angry, he devastates his enemies while smiling.

  • I say we take off and nuke the entire site from orbit. It's the only way to be sure.
  • I seem to be missing something here. Somebody please remind me what Windows Malicious software remover and all those antivirus programs are supposed to be doing.

    • by Cylix (55374) *

      Earning companies billions...

      Duh.

    • Re:"For years..." (Score:5, Informative)

      by rudy_wayne (414635) on Sunday August 29, 2010 @02:31AM (#33407530)

      Somebody please remind me what Windows Malicious software remover and all those antivirus programs are supposed to be doing.

      They don't do anything if you don't use them.

      • by drinkypoo (153816)

        They don't do anything if you don't use them.

        pretty sure I was infected and windows update dropped me an updated malicious software removal tool and cleaned it up. I was having that wacky mouse button behavior, couldn't click to login, clicks closed chrome tabs, and more. some reports say it was the result of an infection, which you could remove with spybot in safe mode. I didn't even get that far (it's just my entertainment PC, and it's not a big deal if someone knows what I watch on netflix) before Microsoft fixed it for me. Well, as far as I can te

        • it's just my entertainment PC, and it's not a big deal if someone knows what I watch on netflix

          What about all the spam it was hammering out? As soon as you believe a machine to be infected the honorable thing to do is unplug it from the Net until you can fix it.

          • by drinkypoo (153816)

            What about all the spam it was hammering out? As soon as you believe a machine to be infected the honorable thing to do is unplug it from the Net until you can fix it.

            It wasn't actually hammering any (significant volume of?) spam out. I can see my bandwidth use, I have a monitor on the single point of in/egress. Pretty sure it was some kind of spy from its interference with input.

    • by Spad (470073)

      Expire 30 days after you purchased the machine and then have all their warnings ignored by their users.

      Alternatively, be forced into permitting the execution of malicious code because their users really, really want to see the dancing bunny.

    • by jimicus (737525)

      I seem to be missing something here. Somebody please remind me what Windows Malicious software remover and all those antivirus programs are supposed to be doing.

      If the people whose PCs are spewing out such garbage were aware of the issue, don't you think they'd have taken steps to resolve it years ago?

      The problem is a combination of ignorance ("How was I to know that?") and technology not meeting expectations ("It's my computer, it can't run anything I don't tell it to!")

      • If every outgoing spam cost them $5 they'd become "aware" very quickly (yes, I know that's impractical and a bad idea for many reasons).

    • by dotwhynot (938895)

      I seem to be missing something here. Somebody please remind me what Windows Malicious software remover and all those antivirus programs are supposed to be doing.

      The biggest problem is people not using them - not using automatic windows update (or very frequently manual) and not having up-to date malware and antivirus (it's free [microsoft.com] and some, like this one, are not the resource hogs fx old Norton was infamous for.)

      Nothing is 100% secure, but boy to this take care of most of it, as you correctly are saying (when I turn my sarcasm detector off :)

      fx Windows had actually Conficker patched quite early, in Windows Update, it became the big ongoing epidemic because of unpa

      • argh.. the correct link to MS' free anti-virus/malware is of course:

        http://www.microsoft.com/security_essentials/ [microsoft.com]

        (when promoting being up to date, linking to an out of date version was a pretty ironic screw-up.. :)

      • (people not doing auto- or frequent updates, for some reason or other).

        Among the reasons for not doing auto updates are patches from Microsoft hosing your system.

        A couple of personal examples:

        An update to IE made it impossible for ANY program to access the internet with that computer. Why an IE update was able to block other programs was never clear but shows why the integration of programs for marketing reasons is a bad idea.

        Another one "updated" a driver for the motherboard to an older version t

    • by hedwards (940851)
      malware removers are great, but they're only a portion of the solution. A proper firewall, sandbox, antivirus and anti-malware is really the bare minimum needed on Windows. Beyond that you need common sense, vigilance and some knowledge of security. The problem is that it's a relatively small number of people that actually go that route.
  • They have been studying this since 2007 and now, three years later, have only managed to take 20 of the 30 control servers offline. Good work, to be sure, but it's not even a dent in terms of amount of malware stopped. How many other worms/viruses have been created in the past three years that are still running? And how much work would it take to bring Pushdo back to full force? Put some other C&C servers online and push out an updated list through the current C&C servers.

    The only reason this wa
    • by Joce640k (829181)

      I'm just reading this doc [trendmicro.com] and the whole thing seems to be an exercise in fail on the part of Windows and antivirus programs:

      * Detection of this is as easy as looking for a file "Rs32net.exe" in the Windows system folder.

      * Subverting Windows' "safe mode" is as simple as writing registry values to "HKLM\SYSTEM\CurrentControlSet\Safeboot\Minimal\[EXEFILENAME]"

      * Making sure you load into memory *before* the antivirus is as simple as this [microsoft.com] (yet somehow the antivirus programs can't use this technique??)

      etc.

    • Concievably, the methods used by these researchers could be examined within their particular community (meaning, in this case, other research labs/firms seeking to eliminate these sorts of threats), and with greater analysis and numbers behind the existing data, adaption and use of this research could be utilised--in an accelerated timeline--against other botnets.

      That said, will the war ever truly be won? Very likely not; hackers, malware authors, and the like will continue to get more ingenious, which wi
      • The battle won't be won because stupid people insist on running Windows and running every attachment mail their way and every pirated software they get from warez sites.

        • Re: (Score:3, Interesting)

          by twidarkling (1537077)

          Stupid people would be stupid on any OS. There is no reason in the world to suspect that if Windows disappeared that virus/malware creators would shrug and go "Oh well, we're fucked, guess we find real jobs," or that stupid people would suddenly go "Gee, that document my friend sent me is asking to install a program, that doesn't seem right." As long as you insist on "It's a Windows problem" rather than "It's a user education problem" the battle will never be won.

          • As long as you insist on "It's a Windows problem" rather than "It's a user education problem" the battle will never be won.

            As long as you insist that it is a "user education problem" the battle will never be won. It's a user motivation problem and no, I don't know how to solve it.

        • by Dekker3D (989692)

          The battle won't be won because stupid people insist on running Windows and running every attachment mail their way and every pirated software they get from warez sites.

          Funny, that. I'm a Windows XP user, and I download quite a bit of questionable software but I haven't had any virus for the last couple of years. The problem is not with Windows, the problem is with stupid people. A bit of education would easily reduce the size of botnets a lot.

          • The battle won't be won because stupid people insist on running Windows and running every attachment mail their way and every pirated software they get from warez sites.

            Funny, that. I'm a Windows XP user, and I download quite a bit of questionable software but I haven't had any virus for the last couple of years. The problem is not with Windows, the problem is with stupid people. A bit of education would easily reduce the size of botnets a lot.

            How can you be sure? Botnet viruses try to make themselves as unnoticeable as possible.

          • by Joce640k (829181)

            That's what you think...but how do you know for sure?

          • Education cures ignorance, not stupidity.

    • by Patch86 (1465427)

      Correct me if I'm wrong, but wouldn't adding new C&C servers be as simple as pushing an update to the bots? If there are still remaining C&C servers to update with (let alone still a third), that should be pretty routine for them.

      Shutting down 20 out of 30 servers seems worse than useless to me. If you need to get all 30 at once, all that has been achieved is that they're back to square one.

      • Re: (Score:3, Interesting)

        by SL Baur (19540)

        Correct me if I'm wrong, but wouldn't adding new C&C servers be as simple as pushing an update to the bots? If there are still remaining C&C servers to update with (let alone still a third), that should be pretty routine for them.

        Not in this case. This botnet apparently can spread other client side malware, but doesn't attempt to infect new servers.

        That's a very hard problem and I guess that's good.

        New servers can be added manually though. Part of their protocol involves the client receiving updated lists of servers. That's why even though this was first detected in 2007, had the servers attacked repeatedly over the years as in this article, the botnet is still around.

        The associated articles only discuss how the client side works

  • It takes ONE (1) command/control server to keep the botnet functioning.

    TEN (10) were left up.

    NOTHING was "seriously crippled" nor was the botnet affected. This is a perfect example of a non-story about a good attempt that failed.

    They've been "Trying since 2007" and can't take down 30 servers. Fair enough. There are lots of countries that don't cooperate with self-styled "authorities". How is this a story?

    Did some widdle person need to publish something to get their widdle higher degree?

    This is not a suc

    • by PatPending (953482) on Sunday August 29, 2010 @03:10AM (#33407638)

      NOTHING was "seriously crippled" nor was the botnet affected. This is a perfect example of a non-story about a good attempt that failed.

      "Nothing?" "Attempt that failed?"

      Look at their graph: from a high of 1,400 on 3 Aug to 0 on 26 Aug. -- that ranks as both a "seriously crippled" and "success" in my book.

      So while you chose to belittle their achievements, I for one chose to say a silent "Thank you! Well done!" for their years of persistence in fighting this war.

      • We don't know what really went on. Maybe the botnet operators have a second botnet, and after detection of the attack they decided to temporally only use the other one in order to make the attacker think the attacked botnet were dead and lose interest in it.

      • Look at their graph: from a high of 1,400 on 3 Aug to 0 on 26 Aug. -- that ranks as both a "seriously crippled" and "success" in my book.

        So while you chose to belittle their achievements, I for one chose to say a silent "Thank you! Well done!" for their years of persistence in fighting this war.

        I did. Color me unimpressed. This isn't the first time that this botnet's servers have had their numbers reduced.

        I didn't see any analysis of what is going on server side and that is where all the interesting code is.

        Their client/server protocol is self-repairing in that servers can propagate new IP lists of servers to clients. According to the various articles, (some of) the servers have been taken down before.

        Apparently nothing is known about what is going on server side.

        This botnet puts a high priorit

      • by Joce640k (829181)

        Come back with next week's numbers and we'll see if this was a "success" or not...

      • by ildon (413912)

        It's not silent anymore after you say it.

  • So they take down 2/3rds of the C&C servers and by tomorrow the entire net will be redirected to 30 brand new C&C servers.

  • "Cripple" sounds entirely too optimistic. Maybe "somewhat inconvenience" is the right term here. C&C servers can be added easily, if the design is right. In fact, if the operators know their business, they will have standby-servers that can be activated within minutes.

    And again some "security researchers" vastly overstate their success. I find that highly unethical.

  • sure, sure (Score:1, Interesting)

    by Anonymous Coward

    researchers

    No, you aren't. I don't know why people working in IT security have the ego to always add the word "researcher" to their title. Just because your job involves problem solving it doesn't mean you're a "researcher" as the term is understood everywhere else. Anyway, where does your R&D budget come from for this team of "researchers", and what do you get back?

    at Last Line of Defense

    Who? So many overgrown hax0rs slapping a stupid name on their activities and calling themselves a business, using inflated claims of leet-sounding ach

  • I wonder why the police did not just add spying logging equipments, kept silent and followed wires (IP addresses ) and money transfers. (obviously, someone paid for the servers, even with stolen cards). Shutting down 2/3rd of C&C is like 2/3rd done job. The organized crime behind this is still runing fine.

    • by jimicus (737525)

      My guess would be that people running large botnets do not tend to contact hosting providers and pay for a years' hosting with a legitimate credit card which they own and is registered to their home address.

      • by green1 (322787)

        That's not even a problem for law enforcement to deal with. they can track fake cards and fake addresses, that part is easy and done on a daily basis.

        The hard part is that the people running large botnets aren't kind enough to run all the control servers in a single jurisdiction that a) has the appropriate laws to do something, b) has the resources to do something, and c) cares to do something.

        Like any other business they shop around for countries with laws favourable to their business model.

        • by jack2000 (1178961)
          Those countries still peer with other countries. You can still null route those ips there.
          • by green1 (322787)

            You certainly could, but that is not what was being discussed by the OP here (that was discussed by a different poster further up) The OP here was asking why the police haven't solved this, and that is what I answered.

            The idea of null-routing at the other end of the pipe has a lot of merit, but is unfortunately not something that the big providers are willing to do it seems, they are more interested in the $$$ coming in than the cyber-crime they are enabling.

            As to whether we want to legislate that the big p

  • Pushdo, botnet. A network barely alive. Gentlemen, we can rebuild him. We have the technology.

    Or in other words; if you can't kill it off in one strike, it's just going to evolve into a better, stronger botnet..

Optimization hinders evolution.

Working...