Slashdot Mirror

← Back to Stories (view on slashdot.org)

Researchers Hijack Mebroot Botnet, Study Drive-By Downloads

Posted by ScuttleMonkey on from the hijack-and-inject-vaccine dept.

TechReviewAl writes "Researchers at the University of California at Santa Barbara hijacked the Mebroot botnet for about a month and used it to study drive-by downloading. The researchers managed to intercept Mebroot communications by reverse-engineering the algorithm used to select domains to connect to. Mebroot infects legitimate websites and uses them to redirect users to malicious sites that attempt to install malware on a victim's machine. The team, who previously infiltrated the Torpig botnet, found that at least 13.3 percent of systems that were redirected by Mebroot were already infected and 70 percent were vulnerable to about 40 common attacks."

6 of 130 comments (clear)

  1. 70% by matt4077 · · Score: 2, Funny

    Isn't IE marketshare about 70%? What a coincidence!

    --
    Fleur de Sel
    1. Re:70% by tsm_sf · · Score: 5, Funny

      I've never really understood the whole Mac vs. WIndows debate, and it's even more pointless now that you can have Mac, Win, and Linux running on the same box at the same time. Now, vi vs. emacs is a legitimate jihad.

      ((vi is better))

      --
      Literalism isn't a form of humor, it's you being irritating.
    2. Re:70% by chiguy · · Score: 3, Funny

      Now, vi vs. emacs is a legitimate jihad. ((vi is better))

      Sure, that's because you haven't figured out elisp. It should be

      (setq vi better)
      or
      (setq is-vi-better (better vi emacs))

      --
      passetspike!
  2. Re:arrest them by jdgeorge · · Score: 3, Funny

    It's the principle of the thing. Botnet creators are entitled to a reasonable expectation of privacy, under the law, right? Besides, if it were YOUR botnet they were infiltrating, you would be pissed, too.

  3. Re:Great idea, narrowly averted by catmistake · · Score: 3, Funny

    What if that vulnerable system was responsible for something critical and hadn't been patched because the patch broke the application, for instance?

    Ah, I've seen you've read the Admin Handbook: "Even if your critical system has been compromized and is a zombie in some malicious botnet, do not patch the vulnerability if the patch might compromise your critical system."

    /sarcasm yes, if it's not broken, don't fix it... then again, your definition of broken appears to be broken

    --
    The Admin and the Engineer
  4. Re:This could be avoided. by theArtificial · · Score: 3, Funny

    Windows Genuine Exploits?

    --
    Man blir trött av att gå och göra ingenting.