Slashdot Mirror
Creators of Massive Botnet Arrested
DigitumDei writes "Dutch police has nabbed 3 men (aged 19,22, & 27) who alledgedly used the toxbot trojan to create a botnet of over 100000 machines. The trio conducted a DDOS attack against an unnamed US company in an extortion attempt, as well as using phishing tactics to hijack PayPal and eBay accounts.
From the article: 'Police seized computers, cash, a sports car, and bank accounts at the three men's residences, and additional arrests are expected. The three were to be taken before a magistrate in Breda, a city approximately 25 miles south of Rotterdam, on Friday.
The botnet was dismantled, prosecutors said, with help from the Dutch National High Tech Crime Center; GOVCERT.NL, the Netherlands' Computer Emergency Response Team; and several Internet service providers, including the Amsterdam-based XS4ALL.'"
/Godfather music in background
I hereby declare a new metric for measuring the size of botnets: The MegaBot. 1 MegaBot==10E6 Bots.
Best Slashdot Co
A city-wide Thieves Guild is understandable, but a National Crime Center is just going too far.
Sheesh, evil *and* a jerk. -- Jade
the creators of the slashdot network are still at large tho :)
This will also give them pause when hiring former hackers. They might think "Is this guy going to give extortionists inside info?"
On the other hand, security folks may have a budget windfall thrown their way. Considering '"Each time the Trojan was stopped by anti-virus defenses, they made a new version," he said. "This was not just a one-off. The sheer number of variants shows this wasn't a crime they committed just once."' Those security people better get to it.
"MY APOCALYPTIC TENOR HAS NOT BEEN DISPELLED!" - T-Rex, qwantz.com
I get so many of these zombie machines trying things everyday and never hear about anyone getting caught. Hope they get sentenced to ten years of Windows XP.
...who alledgedly used the toxbot trojan to create a botnet of over 100000 machines.
It seems a little harsh to get arrested for only infecting 32 machines.....
"For Great Justice."
What's the point when you can just put in your maximum bid and eBay raises your active bid as the bidding warrants?
Surely those computers are still vulnerable to the toxbot trojan at best, or just waiting for somebody to give the right commands at worst.
Unless you use the trojan to patch the system of course, but that would be illegal.
When I was in uni, we had a guy from the Belgian Computer Crime Unit (CCU) come and talk to us about computer criminality. We asked a load of questions, including whether they actually actively went after casual downloaders. Basically they said they were so swamped going after child pornography sites, they did not have any resources at all for those kind of activities.
Most police "cybercrime" units are still very underfunded.
Coca-Cola, sometimes War.
I wonder what it would take to convince the world that these unsecured machines are an actual security threat, rather than an annoyance?
The botnet was dismantled, prosecutors said, with help from...
Why didn't I think of that! That's 100,000 lusers that won't be getting infected again soon, unless they learn enough to reassemble their boxen, by which point...*sigh* What am I thinking? They'll probably just buy new systems and throw the piles of parts out. They'll be back on bot nets by this weekend.
What they need to do is dismantal the owners!
--MarkusQ
Comment removed based on user account deletion
The government said themselves that making file sharing a criminal offence just turns a large portion of the population into criminals for no real benefit. This is similar to the drugs policy. From Wikipedia:
So no, the government tends to go after real criminals, rather than waste time on teenagers with too much free time.Comment removed based on user account deletion
I saw that as 1000,000 machines, but it's only 100,000 machines. So it's a 0.1 megabot botnet, not a full megabot botnet.
Best Slashdot Co
It seems to me that unpatched Windows boxes are becoming an environmental problem ;-)
http://www.dieblinkenlights.com
I forsee the day when bot nets are a thing of the past. While I admit that currently most police forces couldn't catch a virus by opening infected email things seem to be changing.
The scale of setting up a useful botnet is such that there are thousands of tiny ways that you could screw up and leave a drity great big flag pointing out your location / identity. Even the most carefully created botnet will contain some useful information to track down it's owner. In fact the very nature of the beast means that at some point you will have to contact it which potentially gives away your location. Ok you can run through proxies and use other methods to hide you identity but it only takes one slip up which someone technical is watching. Of course you also have the problem of collecting you payments. While you might be able to hide in the online world hiding from the banking world is much harder. At some point you have to collect you money.
All in all I think it would be easier to just go into kidnapping or drug dealing. The profit margin has got to be higher.
I used to have a better sig but it broke.
I always thought that Americans were just plain ignorant about European geography. Now I know it's because you've been going round telling them that Madrid is close to London.
Does this info really help? How many Americans know Rotterdam?
Rotterdamn....that sounds vaguely familar.. Oh yeah now I remember it was one of my options for music in Ridge Racer for Play Station.
As to not be marked off-topic, the question really becomes not what to do with those behind the botnet, but what to do with the botnet itself. One could patch the entire network via the use of the very trojan that created it (which we know is illegal), but I think this might be a good change to get some extra cycles for SETI. I can just see Team Dutch National High Tech Crime Center moving up the rankings now.
Because real studies have shown that stiff sentences do wonders besides making the pitchfork carying mob happy?
Secure messaging: http://quickmsg.vreeken.net/
Unfortunately I am not.
Blushing profusly right now; amazing how previewing twice just meant I read "has" as "have" in my mind twice.
East Coast Brewers
Are Linux boxes invulnerable? Is the gauntlet being thrown at our feet? (lol)
I'm happy they did get nabbed though. There are plenty of fun things to do in life instead of extortion.
Cogito Ergo Sum
I know the ideas and reasoning behind stiff sentences, that doesn't mean it works.
Like amputating a hand after stealing, very scary but does it actually make crime rates go down?
If one isn't afraid of getting caught the sentence doesn't matter.
Secure messaging: http://quickmsg.vreeken.net/
It is, Madrid is only 786 miles from London. That's less than the distance between New York and Chicago.
interesting stats there. [ 144 thousand times * holland = canada ]. hello dont believe this.
It's more like 240 * Holland = Canada.
Listen, here's a hot tip if you ever want to get on a cops good side ( such as when they are giving you a traffic ticket or whatever ). All you have to do is ask them loudly "Why aren't you out catching the real criminals eh ?" and they will instantly feel warm and friendly towards you and treat you with the deference, courtesy and respect you deserve.
OK I'm a bit late on this story, but maybe some mods will be late too ;)
.ident ) or just on the channel, the PRIVMSG will be sent to every bot. Now 100k bots in a channel is a lot but I have seen 30k already.
;). Who would want to be part of the botnet ? :)
As an IRC admin for few years, I saw many botnet channels. The botnet masters enjoy putting their bots on IRC (on a secret channel) because it's a third party who provides the communication support, IRC is a good message demultiplexer, and they think it's safe since they only log on IRC with a proxy.
They can identify themselves with a given bot by going private (PRIVMSG
The bots had random nicks so we just put a bot of ours with a random nick in the channel, logged everything and then get the login/pass (I guess in this case Dutch police had the login/pass pair from the PCs they seized). Then we looked out for the bot version, looked on the web for commands (usually, the bot masters are script kiddies and just build the bot from an "automatic" builder they download on the web... they wouldn't even build from the sources).
All of the bots I encountered disposed of attacks commands et al, but also a clean removal command. That's what we used.
Now I don't know about the bot in this story, but most likely the botnet masters HAD a mean to contact them all (now is it IRC-like with a big channel, or distributed among the bots à la DNS, I don't know... But even if the removal command isn't here, there's still a way to tell the bot to execute a given binary they download from a given URL).
And I don't think that would really be illegal, remember, the PC owners rarely know they are infected or don't care. They won't know or won't care either if someone removes the bot for them. And if they say something, just sue them since it means they were part of the attack knowingly
Anyway I hope we could shut down more of these networks (and MS should pay for their dismantle since nearly all zombies networks are running Windows).
What is the real identity of this Dutch ISP XS4ALL? Fighting spammers (though losing appeal), defending the rights of clients to hyperlink and refusing to be bullied by court orders, and now taking down BotNets. Apparently the founders sold out for millions, but they seem to go well beyond the Google "do no evil" philosophy to pro-actively defending the rights of their customers at considerable risk to themselves. It's the kind of company the deserves to win an awful lot of business.
Phillip.
Property for sale in Nice, France
Do the Dutch really have a Justice system based on gobbledegook?
Computers are useless. They can only give you answers.
-- Pablo Picasso
GRAMMATICAL, damn it!
"Is this Winkhorst a nova criminal?" "No just a technical sergeant wanted for interrogation."
Because bidding on an item calls attention to it. If bidding activity on an item is fierce and heavy, sniping has no benefit. But imagine a situation where you are vying for an item with only one other person. You do not want to set your maximum bid right away, because the other guy's valuation of the item is probably similar to yours -- he'll bid up right away. The other person, of course, follows the same logic and also starts with a lowball bid. Now, since neither party is using automatic bidding, they have to keep checking on the item to see if they've been outbid. What sniping does is allows the other person to become complacent, and not set their actual maximum bid. You can then come in at the last second and bid slightly over them and get the item before they can react.
The reason bidders behave this way is because they are hoping the other guy doesn't know the "true value" of the item. Placing a realistic maximum bid would only drive the price up. But if you are knowledgable of an item's true value and conceal that from the other participants by bidding low at the beginning, you have a better chance of getting the item at a lower price.
So there's been some effect. The spammers are becoming afraid. Not very afraid. Yet. But afraid. It's becoming hard to spam without committing multiple felonies. Those felonies are leading to a few arrests and jail sentences. Not many, but enough to scare off many spammers. The remaining spammers look more and more like traditional crooks.
There's plenty of stuff on SpecialHam for law enforcement to go after. "Special Hurricane Katrina Promotions". "Offshore bank accounts for sale". Anyone active against spam should be looking there.
The October 10 New Yorker magazine has a nice companion piece to this story, "The Zombie Hunters: On the trail of cyberextortionists" by Evan Ratliff. The article describes the tactics of the extortionists and those who track them down or thwart their attacks. Probably nothing new to the /. crowd, but a good read nonetheless. Here's a link.
1 010fa_fact
http://www.newyorker.com/fact/content/articles/05
To the making of books there is no end, so let's get started