Researchers Cripple Pushdo Botnet 129
Trailrunner7 writes with this from ThreatPost: "Researchers have made a huge dent in the Pushdo botnet, virtually crippling the network, by working with hosting providers to take down about two thirds of the command-and-control servers involved in the botnet. Pushdo for years has been one of the major producers of spam and other malicious activity, and researchers have been monitoring the botnet and looking for ways to do some damage to it since at least 2007. Now, researchers at Last Line of Defense, a security intelligence firm, have made some serious progress in crushing the botnet's spam operations. After doing an analysis of Pushdo's command-and-control infrastructure, the researchers identified about 30 servers that were serving as C&C machines for the botnet. Working with the hosting providers who maintained the servers in question, the LLOD researchers were able to get 20 of the C&C servers taken offline, the company said."
Legal hacking? (Score:5, Interesting)
I wonder if the courts would issue an order that would legalize hacking of unstoppable network computers to prevent ongoing attacks?
Other normally illegal tactics can be utilized legally, if a judge deems them necessary or in a court of law. You know, 1st degree murder vs E-Chair?
Re:Legal hacking? (Score:5, Insightful)
Fed: "Wanna work with the FBI, Fido? Wanna help us catch bad guys?"
Snitch: "Yeahyeahyeahyeahyeahyeah!
Fed: "There's an athiest group that looks suspicious. I think they're laundering money to fund their picnics. You need to infiltrate them, earn their trust, and if you don't find anything make something up so we have a good excuse to raid their headquarters. You will get a pat on the head and a nice, big doggy bone if we get convictions. Snitch: "Yeahyeahyeahyeahyeah!
[ Months later, a number of the atheist group's members are arrested for child pornography for unwittingly having nude pics of their 17 year-old sons and daughters who kept them stored "privately" in facebook ]
Fed: "Bad news, Fido. The D.A. wants to charge you with computer crimes. You're expected to do 5 years in the pen."
Snitch: *whimper*
Fed: "It's okay, you helped us save the children. Just suck it up and don't drop the soap."
Re:Legal hacking? (Score:4, Interesting)
Re:Legal hacking? (Score:5, Insightful)
There's no legal authority for the courts to order such actions. Even execution orders are authorized by the legislative body, approved by the chief executive, and carried out by subordinates to the executive (subject to the lack of intervention by the judicial body). Any offensive action against spammers/hackers would require a similar path.
Re: (Score:2)
A simple legislation can give more powers to ISPs and policing agencies to perform such actions. Provided of course they are constitutional.
Re: (Score:2)
And if an isp is reluctant to null route a known CNC machine for a spam network just have the upstream ISPs null route it.
Re:Legal hacking? (Score:5, Interesting)
Re:Legal hacking? (Score:5, Funny)
I would love to see... (Score:5, Interesting)
Re: (Score:3, Interesting)
So would I like to see that.
So I could switch to those providers, and know they wouldn't be messing with my server without talking to me just because some er "researcher" decided they thought the server might be some sort of C&C
I imagine there could be some legal concerns of the researchers were to publish such a list... it might seem like extortion "Take down that server, or we'll publish your name!"
Or it might attract more business to those providers.. the, er, bad guys, would also know s
Re:I would love to see... (Score:5, Informative)
I assume that the providers were just notified by the researcher and were able to see for themselves whether the server is doing something malicious or not. In addition every ISP I've dealt with, has a contract clause that allows them to cancel the service if you use it to violate the laws of the country - which is often the case when sending SPAM. You are then free to sue them if you believe that terminating the service was not justified.
Re:I would love to see... (Score:5, Insightful)
I assume that the providers were just notified by the researcher and were able to see for themselves whether the server is doing something malicious or not.
And when they look into it, they'll probably see a bunch of SSL-secured HTTP requests.
In addition every ISP I've dealt with, has a contract clause that allows them to cancel the service if you use it to violate the laws of the country - which is often the case when sending SPAM. You are then free to sue them if you believe that terminating the service was not justified.
A command and control server doesn't send out spam. It only acts as a server for the bots that do all the spam sending.
Re: (Score:3, Interesting)
A command and control server doesn't send out spam. It only acts as a server for the bots that do all the spam sending.
Replace "send out spam" with "store pirated media" and "command and control server" with "torrent-indexing website", and you essentially have the same argument for not interfering with their operations.
Re: (Score:2)
Replace "send out spam" with "store pirated media" and "command and control server" with "torrent-indexing website", and you essentially have the same argument for not interfering with their operations.
True, but the 'R' in RIAA doesn't stand for 'Researcher' ...
Re: (Score:2)
There's a HUGE difference between sending data and storing data.
Re: (Score:2)
Removing any number but ALL servers does entirely no good. The only effect is slowing the botnet for a day while the zombies fall back to surviving servers.
And, like an incomplete antibiotics therapy, it gives the botnet's herder a clue -- that he needs to move to more resilient techniques instead of relying on fixed, easy to remove, servers.
Re: (Score:1, Informative)
They've done that ages ago. In case these researchers actually did had taken down all the C&C servers, the bots would go into rendezvous mode and based on an algorithm, start generating thousands of domain names per day. Now all the people behind the botnet need to do is to register one of those domains and upload their signed update on it with a list of new C&C servers, and the botnet is back up and running.
These aren't some 90's irc botnets and the people running them aren't stupid. With these met
Re: (Score:2)
So... why do they? Wouldn't it make more sense to make the whole thing entirely decentralized, with each bot keeping the addresses of a dozen or so other bots, and broadcasting any incoming commands (that pass the signature check, of course) to them? The bot herder simply runs a bot in his own machine, and injects any com
Blocking the servers without ISP takedown (Score:2)
It's certainly better to block the server by having the ISP take it down, but there are other ways to do it.
Re: (Score:2, Funny)
Re: (Score:3, Informative)
Read the f**king article:
Unfortunately, not all providers were responsive and thus several Command & Control servers are still online at this point," researcher Thorsten Holz wrote.
Re: (Score:2)
The question is, were they unresponsive because they weren't interested in cooperating, or were they unresponsive because their terrible networks dropped the packets containing the request?
Re: (Score:2)
sadface! (Score:5, Funny)
Re: (Score:2, Funny)
How about you sell your wife to some Nigerians and they can satisfy her?
And they never link to the original source...why? (Score:5, Informative)
Re: (Score:2)
Seriously, guys, why is this the only +5 post in the article?
Has the news media finally surpassed Slashdot in news-related facts to such an extent that there is no meaningful commentary which is attached to a story?
WTF?
Should I re-up my subscription to the local dead-trees rag?
Comment removed (Score:4, Insightful)
Unresponsive providers might be more likely... (Score:5, Insightful)
All traffic.
Pretty much (Score:5, Informative)
I think we need to start having more of a "you play nice or don't play on the net" kind of system going on. Providers are not expected to be perfect, nobody is perfect, just to be responsive to complaints/problems. If you aren't you get warned and if you keep ignoring it you just get shut out by all major networks. You then have to prove you took care of the problem and will play nice before you get let back in.
That's how we do it at work, actually. I work at a university and we have a lot of research labs, some of which are totally independent of our central control. When a system in there gets infected, we see if we can track someone down who can deal with it, if nobody is there or everyone claims ignorance, we shut down all network access. When that happens people get a hold of us surprisingly fast and the person who needs to deal with the system is found. Once they take it offline to be dealt with and promise to behave, network access is restored.
I think the big network providers need to work out a system like this, where if a given company is unresponsive, you can file a complaint with them. They then warn the company and if they are still unresponsive, cut access. After all the crap causes them problems as well.
Re: (Score:2, Interesting)
Re: (Score:2, Insightful)
That's not what I'm proposing (Score:5, Insightful)
I'm proposing that people deal with their own dirty laundry, and if they won't, that the people above them do. For example if I am causing a problem, my ISP will call me and say "Hey fix your shit." Happened many years ago, a roommate got a virus on his computer. They called me, I turned it off, life was good. Should I refuse, however, the ISP would have shut down my line. They were not interested in sending out viruses all over the place.
What I'm proposing is that the big bandwidth providers take the same attitude. If some hosting provider has systems doing evil, you contact them. However if they refuse to deal with it, you can then contact the big providers. They can check, if evil is going on they warn the company. If it doesn't stop, they shut down the links.
I fail to see a problem here. Such a thing wouldn't be done capriciously because it is against a business's best interest. If a customer is paying money and not causing problems of course they want to keep the connection active. They don't want to turn it off for fun (and probably break the contract).
All lines have AUPs, even big ones. I just think they need a mechanism to allow for complaints and enforcement, and something that is less severe than a total disconnection. Rather than something having to get to the "You cause so much trouble you are in violation of the contract and we stop selling service to you," point instead they can say "You've refused to deal with complaints so you are blocked, fix your shit and promise to listen in the future and we turn you back on."
The reason I want to see this is first because I want less shit on the net, but also because with many things you find you either self regulate or the government will regulate you. What happens if instead the US government, or a council at the UN gains complete regulatory power and can tell providers who to shut down? I'd much rather have it as a self regulating system.
It works well for ISPs, and most ISPs do it. As I said, as a university we are an ISP and we do just that. We investigate and respond to claims of malicious network activity. However, we need a higher level to deal with the ISPs that won't respond to the complaints.
Re: (Score:3, Interesting)
I don' t think that will work so well. The C&C machines are on ISP's who are peered with major ISP's that are much more interested in money than the small amount of traffic coming from C&C. The individual zombie nodes are so distributed that the labor costs of properly determining whether a down stream client is infected, or is not being dealt with fast enough far outweighs the costs of shutting down the network to that client's ISP/owner.
If they shutdown some site for sending spam or a virus or w
Re: (Score:2)
Re: (Score:3, Insightful)
Your proposal would work best, to be honest, if the major backbone providers did this to the entire ISP instead of leaving the ISP to half-assed "police" its members. If a large amount of spam is coming from a provider, shutting it off entirely will get them to comply with their terms(which I can guarantee has terms and conditions concerning malicious use and so on). It's currently entirely within their bounds to do so but to date, they still refuse to do it. It's also not rocket science to see where the
Re: (Score:2)
That would result in Russia and China being quarantined from the world network where they could spam each other for commie money.
I know that isn't politically correct to say but for anyone who looks at the IP addresses where server attacks come from they would know I speak the truth.
rd
Re: (Score:2)
That's sounds very scary. Who defines what "nice" is? You assume that people are good and won't redefine "nice" to "anything I don't like".
You mean like those who have mod points on /.?
The problem with the somewhat narrow-minded "let's just go vigilante on the bad guys and forget all laws" approach is that it can (and will) be easily abused.
I guess it would require us to pick our poison. Deal with an ISP that gets to deny access if they think you're doing something wrong (besides exceeding undefined bandwidth limits, running a small web server at home, etc) or deal with botnets flooding the internet with spam, malware and all the associated traffic it generates (which uses up some of that precious bandwidth).
It could get messy if a large backbone provider cut off access to a large or mid-sized IS
Re: (Score:1)
And you surely would like it if your business comes to a screeching halt, just because you happen to have your server hosted by a provider who also hosts a server which some researchers claim to be a botnet server, and your provider doesn't believe them.
Re: (Score:2)
I'm sure there aren't many companies that would put up with that at all. That's why it would be so effective; not many ISPs would remain in business if they failed to protect their customers from such shut-offs.
Re: (Score:1)
Yeah, it would make it a very effective blackmailing tool. "Nice server you have there for your business. It would be too bad if your provider were told you were controlling a botnet from there ..."
Yes, you could then get the server up again by proving that you didn't have any botnet activity on it. But until then, you already lost serious money.
Re: (Score:2)
I"m pretty sure they'd check it out first...this isn't DMCA we're talking about here.
Re: (Score:1)
How exactly would they check it out? Check that there are indeed bots contacting your server? It should not be hard for the criminal to add your server to some bot's list of servers to contact (the bot will not get any useful response from your server, but that's no problem, the bot will simply ignore any useless replies). How is the provider to distinguish https requests which return useful commands for the botnet from https requests which don't? Note that any user-facing web server handling confidential d
Re: (Score:2)
Re: (Score:2)
You have an alternative?
Cruise missiles.
With cluster bombs full of AP bomblets. Best way to stop zombies in their tracks.
Re:Unresponsive providers might be more likely... (Score:5, Interesting)
This reminds of a story that may be more tech myth and legend and if it is not true it should be and it goes something like this:
Back in the early days of the net when the major interconnects were MAE East and MAE West and other interconnect points had not been established almost everything routed through these two points.
So the story goes that there was a tech who dutifully monitored the system during his shift. He had noticed that someone from another country was trying to get access to files on a certain server at major university. Now he was curious because he saw the same attempts over and over again over a rather long period of time. Now since we all forget password or thing we know them and then try and try without success this is not that unusual and normally after fumbling around we will just contact the machines owner and ask for the correct password. Now in those days it was still a relatively small group of folks so there were not a whole lot of questions asked.
But the tech in question started noticing the pattern was limited to times when the people attending these machines would not be there.
So he sent off an e-mail to the admins he knew and they had not been requested to change or provide any passwords.
So our intrepid tech sent off an e-mail to the administrators of the location of the seeming intruder and asked that they have him stop. Well the admins said that it was really none of their business anyway and being in a foreign country our admin had no say over what anyone there did. The long and short of it was that the apparent intruder kept it up.
So one night our intrepid admin had had enough, so he did what he thought might get peoples attention. He simply unplugged the cable that was the source of the problem and effectively disconnecting an entire country from MAE West!
Well in a few hours phones started ringing into MAE West asking questions and trying to figure out what was wrong? He told them he had asked, many time for the admins of the network that the rude behavior was originating from to kindly ask the owner of the machine to stop and had been rudely rebuffed to say the least.. He also said when the attempted intrusions stop, he would plug them back in. To say the least they stopped in fairly short order and he plugged them back in.
Now that is a bit far flung because I doubt there is any one cable that could disconnect an entire country but I am pretty sure you could simply route class A's to /dev/null. Perhaps that what it will take to get ISP's to get serious. Just pull their plug until they behave. Everyone peers in someplace so it should not be that hard to go and find that Ethernet cable and simply unplug it and leave it dangling until their behavior changes/
Re: (Score:2)
Re: (Score:2)
You had me going until you said he "simply unplugged the cable". We both know a dissed and powerful nerd would have cut the cable in a classic display of nerd rage. ;-)
No, he wouldn't, not when it is his job to put the end back on it when the problem is fixed. Unplugging works just as well, and is less hassle personally.
Re: (Score:2)
That's not nerd rage, that's BOFHdom. A BOFH does not get angry, he devastates his enemies while smiling.
For the remaining 10 providers: (Score:1, Insightful)
Re: (Score:1, Troll)
Excessive. A satchel charge in each server room would suffice.
"For years..." (Score:2)
I seem to be missing something here. Somebody please remind me what Windows Malicious software remover and all those antivirus programs are supposed to be doing.
Re: (Score:2)
Earning companies billions...
Duh.
Re:"For years..." (Score:5, Informative)
They don't do anything if you don't use them.
Re: (Score:2)
They don't do anything if you don't use them.
pretty sure I was infected and windows update dropped me an updated malicious software removal tool and cleaned it up. I was having that wacky mouse button behavior, couldn't click to login, clicks closed chrome tabs, and more. some reports say it was the result of an infection, which you could remove with spybot in safe mode. I didn't even get that far (it's just my entertainment PC, and it's not a big deal if someone knows what I watch on netflix) before Microsoft fixed it for me. Well, as far as I can te
Re: (Score:2)
What about all the spam it was hammering out? As soon as you believe a machine to be infected the honorable thing to do is unplug it from the Net until you can fix it.
Re: (Score:2)
What about all the spam it was hammering out? As soon as you believe a machine to be infected the honorable thing to do is unplug it from the Net until you can fix it.
It wasn't actually hammering any (significant volume of?) spam out. I can see my bandwidth use, I have a monitor on the single point of in/egress. Pretty sure it was some kind of spy from its interference with input.
Re: (Score:2)
Expire 30 days after you purchased the machine and then have all their warnings ignored by their users.
Alternatively, be forced into permitting the execution of malicious code because their users really, really want to see the dancing bunny.
Re: (Score:2)
I seem to be missing something here. Somebody please remind me what Windows Malicious software remover and all those antivirus programs are supposed to be doing.
If the people whose PCs are spewing out such garbage were aware of the issue, don't you think they'd have taken steps to resolve it years ago?
The problem is a combination of ignorance ("How was I to know that?") and technology not meeting expectations ("It's my computer, it can't run anything I don't tell it to!")
Re: (Score:2)
If every outgoing spam cost them $5 they'd become "aware" very quickly (yes, I know that's impractical and a bad idea for many reasons).
Re: (Score:2)
I seem to be missing something here. Somebody please remind me what Windows Malicious software remover and all those antivirus programs are supposed to be doing.
The biggest problem is people not using them - not using automatic windows update (or very frequently manual) and not having up-to date malware and antivirus (it's free [microsoft.com] and some, like this one, are not the resource hogs fx old Norton was infamous for.)
Nothing is 100% secure, but boy to this take care of most of it, as you correctly are saying (when I turn my sarcasm detector off :)
fx Windows had actually Conficker patched quite early, in Windows Update, it became the big ongoing epidemic because of unpa
corrected link (Score:2)
http://www.microsoft.com/security_essentials/ [microsoft.com]
(when promoting being up to date, linking to an out of date version was a pretty ironic screw-up.. :)
Re: (Score:1)
Among the reasons for not doing auto updates are patches from Microsoft hosing your system.
A couple of personal examples:
An update to IE made it impossible for ANY program to access the internet with that computer. Why an IE update was able to block other programs was never clear but shows why the integration of programs for marketing reasons is a bad idea.
Another one "updated" a driver for the motherboard to an older version t
Re: (Score:2)
Is this really a big deal (Score:2)
The only reason this wa
Re: (Score:2)
I'm just reading this doc [trendmicro.com] and the whole thing seems to be an exercise in fail on the part of Windows and antivirus programs:
* Detection of this is as easy as looking for a file "Rs32net.exe" in the Windows system folder.
* Subverting Windows' "safe mode" is as simple as writing registry values to "HKLM\SYSTEM\CurrentControlSet\Safeboot\Minimal\[EXEFILENAME]"
* Making sure you load into memory *before* the antivirus is as simple as this [microsoft.com] (yet somehow the antivirus programs can't use this technique??)
etc.
Re: (Score:2)
That said, will the war ever truly be won? Very likely not; hackers, malware authors, and the like will continue to get more ingenious, which wi
Re: (Score:2)
The battle won't be won because stupid people insist on running Windows and running every attachment mail their way and every pirated software they get from warez sites.
Re: (Score:3, Interesting)
Stupid people would be stupid on any OS. There is no reason in the world to suspect that if Windows disappeared that virus/malware creators would shrug and go "Oh well, we're fucked, guess we find real jobs," or that stupid people would suddenly go "Gee, that document my friend sent me is asking to install a program, that doesn't seem right." As long as you insist on "It's a Windows problem" rather than "It's a user education problem" the battle will never be won.
Re: (Score:2)
As long as you insist that it is a "user education problem" the battle will never be won. It's a user motivation problem and no, I don't know how to solve it.
Re: (Score:2)
The battle won't be won because stupid people insist on running Windows and running every attachment mail their way and every pirated software they get from warez sites.
Funny, that. I'm a Windows XP user, and I download quite a bit of questionable software but I haven't had any virus for the last couple of years. The problem is not with Windows, the problem is with stupid people. A bit of education would easily reduce the size of botnets a lot.
Re: (Score:1)
The battle won't be won because stupid people insist on running Windows and running every attachment mail their way and every pirated software they get from warez sites.
Funny, that. I'm a Windows XP user, and I download quite a bit of questionable software but I haven't had any virus for the last couple of years. The problem is not with Windows, the problem is with stupid people. A bit of education would easily reduce the size of botnets a lot.
How can you be sure? Botnet viruses try to make themselves as unnoticeable as possible.
Re: (Score:2)
That's what you think...but how do you know for sure?
Re: (Score:2)
Education cures ignorance, not stupidity.
Re: (Score:2)
Correct me if I'm wrong, but wouldn't adding new C&C servers be as simple as pushing an update to the bots? If there are still remaining C&C servers to update with (let alone still a third), that should be pretty routine for them.
Shutting down 20 out of 30 servers seems worse than useless to me. If you need to get all 30 at once, all that has been achieved is that they're back to square one.
Re: (Score:3, Interesting)
Correct me if I'm wrong, but wouldn't adding new C&C servers be as simple as pushing an update to the bots? If there are still remaining C&C servers to update with (let alone still a third), that should be pretty routine for them.
Not in this case. This botnet apparently can spread other client side malware, but doesn't attempt to infect new servers.
That's a very hard problem and I guess that's good.
New servers can be added manually though. Part of their protocol involves the client receiving updated lists of servers. That's why even though this was first detected in 2007, had the servers attacked repeatedly over the years as in this article, the botnet is still around.
The associated articles only discuss how the client side works
Slashdot editors will approve anything... (Score:1)
It takes ONE (1) command/control server to keep the botnet functioning.
TEN (10) were left up.
NOTHING was "seriously crippled" nor was the botnet affected. This is a perfect example of a non-story about a good attempt that failed.
They've been "Trying since 2007" and can't take down 30 servers. Fair enough. There are lots of countries that don't cooperate with self-styled "authorities". How is this a story?
Did some widdle person need to publish something to get their widdle higher degree?
This is not a suc
Re:Slashdot editors will approve anything... (Score:5, Informative)
NOTHING was "seriously crippled" nor was the botnet affected. This is a perfect example of a non-story about a good attempt that failed.
"Nothing?" "Attempt that failed?"
Look at their graph: from a high of 1,400 on 3 Aug to 0 on 26 Aug. -- that ranks as both a "seriously crippled" and "success" in my book.
So while you chose to belittle their achievements, I for one chose to say a silent "Thank you! Well done!" for their years of persistence in fighting this war.
Re: (Score:1)
We don't know what really went on. Maybe the botnet operators have a second botnet, and after detection of the attack they decided to temporally only use the other one in order to make the attacker think the attacked botnet were dead and lose interest in it.
It's not dead yet, it's getting better (Score:3, Interesting)
Look at their graph: from a high of 1,400 on 3 Aug to 0 on 26 Aug. -- that ranks as both a "seriously crippled" and "success" in my book.
So while you chose to belittle their achievements, I for one chose to say a silent "Thank you! Well done!" for their years of persistence in fighting this war.
I did. Color me unimpressed. This isn't the first time that this botnet's servers have had their numbers reduced.
I didn't see any analysis of what is going on server side and that is where all the interesting code is.
Their client/server protocol is self-repairing in that servers can propagate new IP lists of servers to clients. According to the various articles, (some of) the servers have been taken down before.
Apparently nothing is known about what is going on server side.
This botnet puts a high priorit
Re: (Score:2)
Come back with next week's numbers and we'll see if this was a "success" or not...
Re: (Score:2)
It's not silent anymore after you say it.
Swatting At Flies (Score:2)
So they take down 2/3rds of the C&C servers and by tomorrow the entire net will be redirected to 30 brand new C&C servers.
10 C&C server left? Sounds like a lost battle. (Score:2)
"Cripple" sounds entirely too optimistic. Maybe "somewhat inconvenience" is the right term here. C&C servers can be added easily, if the design is right. In fact, if the operators know their business, they will have standby-servers that can be activated within minutes.
And again some "security researchers" vastly overstate their success. I find that highly unethical.
Re: (Score:2)
What about "gently tickle"
Hehehehehe ;=)
sure, sure (Score:1, Interesting)
researchers
No, you aren't. I don't know why people working in IT security have the ego to always add the word "researcher" to their title. Just because your job involves problem solving it doesn't mean you're a "researcher" as the term is understood everywhere else. Anyway, where does your R&D budget come from for this team of "researchers", and what do you get back?
at Last Line of Defense
Who? So many overgrown hax0rs slapping a stupid name on their activities and calling themselves a business, using inflated claims of leet-sounding ach
Surveillance and tracking instead of shut down (Score:4, Insightful)
I wonder why the police did not just add spying logging equipments, kept silent and followed wires (IP addresses ) and money transfers. (obviously, someone paid for the servers, even with stolen cards). Shutting down 2/3rd of C&C is like 2/3rd done job. The organized crime behind this is still runing fine.
Re: (Score:2)
My guess would be that people running large botnets do not tend to contact hosting providers and pay for a years' hosting with a legitimate credit card which they own and is registered to their home address.
Re: (Score:2)
That's not even a problem for law enforcement to deal with. they can track fake cards and fake addresses, that part is easy and done on a daily basis.
The hard part is that the people running large botnets aren't kind enough to run all the control servers in a single jurisdiction that a) has the appropriate laws to do something, b) has the resources to do something, and c) cares to do something.
Like any other business they shop around for countries with laws favourable to their business model.
Re: (Score:2)
Re: (Score:2)
You certainly could, but that is not what was being discussed by the OP here (that was discussed by a different poster further up) The OP here was asking why the police haven't solved this, and that is what I answered.
The idea of null-routing at the other end of the pipe has a lot of merit, but is unfortunately not something that the big providers are willing to do it seems, they are more interested in the $$$ coming in than the cyber-crime they are enabling.
As to whether we want to legislate that the big p
Gentlemen, we can rebuild him. (Score:2)
Or in other words; if you can't kill it off in one strike, it's just going to evolve into a better, stronger botnet..
Re:Cyberterrorism is ok, huh? (Score:5, Informative)
If you bother to RTFS, you'll note that they worked with the content providers - they shut the servers down themselves. No hacking involved.
Re: (Score:2)
I read that as RTS and had questioned the initial benefits.
I eventually realized that I would never understand your comment until I played a few rounds of starcraft.
Which brings me to my next realization....
Re: (Score:2)
Which brings me to my next realization....
... You can only win by zerg rushing the botnet?
Re: (Score:2)
All of those crimes should be punishable by firing squad, drinking or smoking. (possibly taxes)
I know which one I'll pick, but a few will likely make a poor choice.
Re: (Score:1)
Unfortunately, the rumors were greatly exagerated. The nukes didn't find their targets, because the folks who identified the servers were so unkind that they didn't publish the IP addresses^H^H^H^H^H^H^H^H^H^H^H^H coordinates
Re: (Score:3, Funny)
I take your multiple ^Hs and raise you a ^W
Re: (Score:1)
Two ^W, please.
Re: (Score:1)