Slashdot Mirror
Microsoft Secretly Beheads Notorious Waledac Botnet
Barence writes "Microsoft has quietly won court approval to deactivate 277 domain names that are being used to control a vast network of infected PCs. The notorious Waledac botnet is being used by Eastern European spammers to send 1.5 billion spam messages every day, and infect hundreds of thousands of machines with malware. In a suit filed in the US District Court of Eastern Virginia, Microsoft accused 27 unnamed defendants of violating federal computer crime laws. It further requested that domain registrar Verisign temporarily deactivate the domains, shutting down the control servers being used to send commands to the machines. The request was secretly approved by District Judge Leonie Brinkema, allowing the action to be taken covertly, preventing Waledac's operators from switching domains."
Just gotta love euphemisms.
It's like in Australia, whenever a Lebanese Muslim commits a crime, the media describe the suspect of being "of Middle Eastern appearance".
They're not "East Europeans". THEY'RE RUSSIANS. Just cut to the chase please.
...but where will I get all my v14gra now??
Cue comments about how this is somehow evil...
This is nice (if reactionary) but how long before we can get a court order to legally fight the botnet by 'infecting' the target computers with a patch, or at least some sort of message that warns the user to seek help?
Would Microsoft ever go that far? Would that be admitting that the only solution to the holes in Windows is vigilantism?
Eat the snnnow Ballmer Eat the snnow !
Even if the control machines loose DNS resolution, might not the botnet be configured to fall back to connecting to well known IP addresses to accept commands? Seems like the logical thing to do if you are creating an illegal network...
Probably a one off - botnet designers will now write in contingencies so that access can be re-established in the event of visible domains being taken off-line. In fact - i'd be surprised if Waledac didn't rise from the dead.
Presumably if Microsoft have done their homework, they have identified every possible machine that these bots could try to contact to receive new instructions (such as new SPAM messages to send) and had VeriSign disable every domain name so it cant be registered or used.
Does this mean the botnet is dead?
If so, great. And lets hope people are working to repeat the excercise and block the domain names used for control of any other botnets that talk to specific servers by name for instructions.
While I applaud all serious efforts to take down botnets; the fact that it was all done secretly by private corporations (and a little government nod) smacks of corporate warfare, and I have to wonder what kind of president this sets.
FreeBSD.org - The power to serve
I do not think that word means what you think it means.
STOP . AMERICA . NOW
If i was a botnet author, i would keep a list of my zombies and code the bots in a way they respond to a secret password.
Thus it doesn't really matter if a command center is down, i could just start a new one and it reclaims all orphaned zombies.
Cutting a few command centers is futile.
The only solution is to burn all zombies overnight and prevent reinfection.
Patents Drive Free Software as Hurricanes Drive Construction Industry
if Waledac's been so successful (and is still valuable), how hard would it be for the authors to push out some DNS hijacking hacks that quietly redirect those domains to another host?
body massage!
What a title! At first glance, I thought Microsoft was outed cutting off people's heads, but no, they just shut down a botnet.
Wouldn't it be nice if law enforcement successfully operated on the intertubes? Why does it take a lawsuit by Microsoft to perform this kind of action? Why does my mail server still have 95% of incoming mail criminal in nature?
A man can dream...
1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
The internet is being taken over by Government and their corporate buddies.
Welcome to 1984.
I wonder if the spammers follow Slashdot?
that VeriSign is not going to approve.
The largest prime factor of my UID is 263267.
1,5 billions of spam messages per day. Multiply each message by 10 seconds of working time it takes to activate e-mail window and delete the spam-message, and it becomes clear what damage to the word economy it brings. Let alone disrupted work-flow.
It is the weapon of mass economic destruction.
Such spammers should be warned, once, twice, and if they do not cool down a drone should come above their building and shoot a "Hellfire" missile right into the server room.
Or at least black-clad agents should enter the server room and sprinkle some special solution into the spam-servers, which becomes conductive after some time and shortcut.
This I would call a mild government response.
New set of domains acquired and botnet spamming again in 3..2..1..
... but HOORAY FOR MICROSOFT!
I hate printers.
So Microsoft secretly filed a suit against 27 unnamed individuals, and got a secret order taking 277 domain names away from them, all based on a mere accusation.
Oh, but since we're fighting spam, I guess that's okay.
Wait until Microsoft starts doing this to go after copyright violations. Will y'all be cheering then?
Liberty in your lifetime
No one knows they exist.
And sometimes, that's a good thing...
Ever heard of Malicious Software Removal Tool that is rolled out in in the monthly patch cycle. It kills software MS deems bad. No court approval for that.
1. Write crappy software 2. Wait for it to get taken over by botnets 3. Sue to get the infected machines off the internet 4. ??? 5. Profit!
PlusFive Slashdot reader for Android. Can post comments.
Is today the day we like Microsoft?? I just want to make sure I have that right. Its not some trick to cover them acting like vigilantes is it??
I am Slashdot. Are you Slashdot as well?
As glad as I am when botnets are crippled or shut down, I can't help but ask: Why is Microsoft the one pursuing this in court, rather than the government? Under what legal principle does Microsoft, a private corporation, have standing to sue for control of these domain names?
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
that "secret" and "covert" might not be the right choice of words since Microsoft blogged about the whole thing?
In the words of Inigo Montoya: "You keep using that word. I do not think it means what you think it means."
At least that is what the headline could be. Disabling foreign internet service is a big deal.
Could be a serves them right for registering as .com rather than .country. But this is one branch of the US government disabling some foreign infrastructure.
I was going to say...
Filling court orders to block "control" domains (whatever you call them won't work).
Next bot shall include, say, 5000 SHA-256 cryptographic hash of domains that haven't been registered yet and that are impossible to guess and very unlikely to be registered by anyone except the bot owner (impossible to guess unless you can break SHA-256, in which case the world at large is in trouble).
Then if the bot cannot contact the last domain(s) he got orders from for more than 'x' hours/days/whatever the bot will enter into a "find new domains mode".
The bot owner shall publish new domains on a resource that MS cannot shut down. Like Usenet or making sure that Google shall crawl the new domain dome, or Twitter, or Reddit. Whatever. Even in a /. comment.
The bot shall parse "source that cannot be shutdown" and find all the domain names. He'll take the SHA-256 of them. The ones that matches of his 5000 hashes shall become new "control" domain.
This is now how MS should fix its mess. MS should fix its mess by making a security a priority but sadly it's too busy refining its endless upgrade/milking scheme (scheme into which machine getting owned is serving MS a great purpose so...).
its actually pretty hard. you have to be a committed passionate demagogue
sure, if you are in politics, its easy to rip people off
however, its very hard to get in that position in the first place
so, just as the post you are responding to says, it is easier to make money legally than illegally
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
as usual microsoft doesn't like competition. mabey the botnet writers should file a complaint with the FTC that people should have their choice amongst botnets instead of having to use microsoft's default one.
I think it's kind of ironic how both the courts and Microsoft wanted to keep this secret, but slashdot here has no respect for that. Does it occur to anyone here that there was a reason they wanted it to be secret? Maybe they didn't want these organizations retaliating? This kind of reminds me of the one time a news reporter was being held hostage. The government wanted to keep the fact that she was hostage out of the public eye in order to lower the ransom fee. However, wikipedia editors thought it better to post to it to the public.
277 NEW domain names will be created, computers will get reinfected, and the real problem will still exist. Nice that MS wants to clean up, but it doesn't mean much if the cause isn't dealt with.
If you break your leg tomorrow. Were is your money coming from? Right, your boss. Sick leave. Burglers haven't got it.
Neither can you boss turn out to be carrying a gun and blow your brains out rather then pay you.
If you botch up your work, you won't land in a small cell with a guy named Bubba who likes you very very much.
You ex-gf can't turn you into your boss, even if you really screwed up.
A live of crime sound easy, but it isn't. If it was, more people would do it.
Take the pirates of somalia, sounds like easy money, but how many regular sailors can have their brains blown out by a sniper and nobody gives a damn? And if you think it sucks that your wife wants your wages, wait till you have to deal with the crime hierarchy. They are like the IRS, but not as nice. Oh, and then there is the IRS who can hook you up with Bubba again if you can't account for every penny in your pocket.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Going by the microsoft graphic of the operation, they could just arrest people who wear dark sunglasses and colored head scarves.
"Waste not one watt!" - CZ
The headline notes: " allowing the action to be taken covertly, preventing Waledac's operators from switching domains".
So now its on slashdot. Gee, thanks.
"Waste not one watt!" - CZ
"The request was secretly approved by District Judge Leonie Brinkema, allowing the action to be taken covertly, preventing Waledac's operators from switching domains."
That is, till they figure out they don't have those domains anymore, and go to their backup DNS server. Like they don't have a way to switch control with or without warning.
Sometimes I wonder if MS had planners like these criminals, we might actually get a decent OS from them...
Be seeing you...
It's all part of our new 'Fair and Balanced' reporting initiative.
One day a year we publish something pro-Microsoft. That way when accused of bias we can say 'see, we published the one good thing you did last year, we are just still waiting on something this year.'
So Microsoft secretly filed a suit against 27 unnamed individuals, and got a secret order taking 277 domain names away from them, all based on a mere accusation.
Oh, but since we're fighting spam, I guess that's okay.
Wait until Microsoft starts doing this to go after copyright violations. Will y'all be cheering then?
My fiancée IAL working in a federal district court. I have mod points, but I guess it's more illuminating to reply than mod down this ridiculous comment.
Stuff is filed under seal in court all the time. The idea is that you don't want the defendant you're pursuing to know you're pursuing them if there's a high chance they can cover their tracks. You can't just make a "mere accusation" and get a court to do whatever you want. That, of course, would be silly.
Most judges are really quite reasonable about the decision to keep things sealed. In any event, all the docs will become unsealed relatively quickly -- and if you think the court was *unreasonable*, that they abused their discretion somehow, you can take your complaint to the appellate court.
Court proceedings are slow, but some crooks (especially intelligent, well-funded crooks) can move fast. This is the balance we've found between thinking things through carefully, and satisfying the public's right to this information, while still prosecuting agile crooks.
In copyright infringement cases, the plaintiff would probably have a hard time convincing the judge that docs need to stay sealed.
Believe it or not, the system actually works pretty well sometimes.
Look, I'm all for an intelligent discussion of the shortcomings of the legal system, of which there are plenty. But you should really try to learn something about it before criticizing it. Otherwise you're just wasting everyone's time.
Because idiots are amazingly inventive, persistent, and breed at a rate so ferocious that rabbits are envious.
Come up with a "foolproof" way for securing a system and some imbecile will find a way around it.
Not to mention all the inconveniences such a lockdown method would inevitably entail.
Chas - The one, the only.
THANK GOD!!!
This has nothing to do with US control of DNS.
They went to the domains' REGISTRAR (GoDaddy) and got THEM to disable the domains.
Control of DNS could be in the hands of Bumblefuckistan and they still could have done this.
Chas - The one, the only.
THANK GOD!!!
For a secret lawsuit filed in a secret court that resulted in a secret action being taken, everyone sure seems to know a lot about what happened.
"Even if the control machines loose DNS resolution"
I didn't know you could loose DNS resolution on anyone.... is that kind of like loosing the hounds on their ass?
Even if the control machines loose DNS resolution, might not the botnet be configured to fall back to connecting to well known IP addresses to accept commands? Seems like the logical thing to do if you are creating an illegal network...
That is exactly the root of the problem, they need *tighter* DNS resolution not loose DNS reolsution. DNSSEC ftw!
If a/the government authority was enabled to declare an infected PC as a weapon, they could then come up with some pretext to attack it. Not suggesting this though, as the cure might well be worse than the disease. Thinx: since US Border Security can seize almost any device having data storage, with no evidence, why do they quibble about finding & disabling real threats that operate within their borders?
The internet was originally called ARPANET (Advanced Research Projects Agency Network).
It was funded by a government agency, DARPA (Defense Advanced Research Projects Agency).
Chas - The one, the only.
THANK GOD!!!
Yep. Because operating systems shouldn't run programs at all. Ever.
I'm sure security in an OS would be much simpler if this were true.
Chas - The one, the only.
THANK GOD!!!
Dammm thoze acteevist librawl judges and their antie-entrailpranewership soshallizm. stooping the freedumb of the true amariken hard workin man to make an eazy livin. TeaBaggers rule! (or maybe just drool a lot)
No, it's the combination. On most OSes, it's harder for a user to shoot themselves in the foot, than it is on Microsoft's OSes.
One big difference that leaps to mind, is that Microsoft OSes use the filename to decide whether or not something is executable. Have a user save malware.exe and then click on it, and it will run.
On Linux and MacOS, after the user saves malware, they have to chmod +x malware, and then they can run it. Right there, when the user has to explicitly enable the malware, they know it's not a harmless media file; they are having to acknowledge that it's a program. And programs, unlike media files, can do whatever the fuck they want to do.
MS also has application problems. Ok, so this isn't the OS' fault, but when you get into things like MS Word and MS Excel, the apps are remarkably bad. Who would have thought that a word processor needs the ability to execute a script (written in a fully-expressive language and executed without a sandbox!) embedded inside a document, automatically when the document loads? So MS blurred the line between media and programs.
It's a really bad platform for security, not just because it happens to be widely deployed, but because it's just plain bad, compared to any average normal OS (I'm not even trying to hold it up against OpenBSD or something like that).
You do not want non-geeks using it. Windows is a platform only suitable for computer experts, which is pretty funny since no computer expert wants to have anything to do with it.
Speaking as a FLOSS supporter -- Microsoft, and Bill Gates, have a strong line in support of proprietary software, against free software. I think FLOSS is one of the greatest ideas ever successfully put into practice, and so I'm at odds with Microsoft, et. al., on that issue.
That doesn't make Microsoft *evil*, as such. It's not like Gates ever killed anybody for his wealth -- and there are enough powerful and wealthy people and organizations around who have killed for it, that it seems a bit hyperbolic that Gates and Microsoft get singled out as evil so often.
The victory condition I hope for is not the destruction of Microsoft, but rather, Microsoft opening their source code.
so, today, a us controlled, us based corporation disabled 277 frigging domain names owned by foreigners, upon orders of a U.s. court which decided upon a suit filed by a u.s. corporation based in u.s. so, it was for fight against spam, and so it was a 'good' thing. and all the fools are cheering up now.
then tell me how long until some other organization or individual or political party files a lawsuit under u.s. law to do the same thing to foreign domain names on different justification, say, 'copyright' issues, or patent issues, or maybe, political correctness, private interests, or some other godfrigging long forgotten state law (like the ones you can find in conservative states, reminiscent of 19th century), and some judge just happens to give a verdict to that end ?
what do you think will happen to the global and transborder nature of internet at that point ? how will it affect the entire internet, and all the markets and professional fields contained in it ?
nobody on the internet is subject or tributary to u.s. laws, apart from u.s. citizens. it seems that this foolery just happened will start the move towards taking the control of domain names out of u.s.'s hands, through a consortium of countries, or u.n., god knows.
but its evident that it can no longer be let to continue this way, given the rate things are going in u.s., with those private interests trying to control the net through moves against net neutrality, acta, and lobbying like in the recent news about trying to get open source labeled piracy.
Read radical news here
They crunch the competition with illegal acts, they bribe governments to steal people's money, they also bribe governemnts to bring bad legislation, that makes everybody less secure, and have a nice plot to destroy freedom of expression once and for all (it has no chance of working on practice, but they have it).
They are evil. They are just lessen evil than people that murder for their benefit (altought, destroying freedom of expression may be more evil, you may discount non-working plans if you like).
Rethinking email
1) This will not end botnets
2) Microsoft doesn't care about ending botnets
3) Microsoft will never cede control over their user's machines
4) MS Security patches will always be a finger in a leak
5) A good rootkit is one that still lets my Windows boot
6) MS doesn't really care if the Windows on my 6-yr-old laptop has suddenly become non-genuine but WGA still needs those updates
7) Windows 8 will be about like Windows 7
8) The average Microsoftie is a bing-blastin', zune totin', IE8 browsin', xbox smokin' sort of a guy.
9) There is no hope for a better tommorrow...only a more expensive one
...that VeriSign fully approves and is actively cooperating (but even if they don't they will "cooperate" with the judge).
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
How do you register a domain in such a way that you can't be tracked down if your domains are used as malware servers? How do you pay the registration fee?
Do these guys lie about their name, address, e-mail, etc. then pay the bill by using a stolen credit card or forwarding the money to the registrar via Western Union or something?
I thought this action was interesting. Today I learned that MS did something I agree with via domain locking. Yesterday I learned that MS did something I disagreed with via domain locking (http://yro.slashdot.org/story/10/02/24/1939257/Cryptome-in-Hot-Water-Again).
I'm not quite sure how I feel about the totality of this...
Yes, but unfortunately sometimes companies like to slip in things with an update that they don't bother to mention. If you want the security added by the "security update" then you end up accepting the new version of DRM that's been slipped into surreptitiously as well. MS did this at one point I believe, but I have no doubt that they are not alone.
If software manufacturers were under some legal obligation to tell the truth and act in their user's interests it might be different, but I often get the feeling that having bought their product, I am now a "marketing unit" and serve the double purpose of being analyzed, exploited and becoming the target of further marketing by their corporate friends.
"The first time I got drunk, I got married. The second time I bought a chimpanzee, after that I stayed sober" Arian Seid
Tell that to people who have grown used to clicking on icons and expecting everything to work just like magic.
And if something does not work as expected blame the third-party device driver.
Car maintenance is something like "tail /var/log/messages". Preventive maintenance is installing rkhunter and chkrootkit. That's what mechanics do, not the owner.
If it was a secret, it wouldn't be on slashdot ; )
Don't kid yourself. It's the size of the regexp AND how you use it that counts.
. . . that word. I do not think it means what you think it means.
Why unnamed? Why the secrecy? Bring the cockroaches out into the light.
The request was secretly approved by District Judge Leonie Brinkema, allowing the action to be taken covertly, preventing Waledac's operators from switching domains.
So they did not switch domains until now. And are in the process of switching right now. Probably being done by tomorrow.
Wow. A whole day of a bit less spam. That really changed things... ;)
Any sufficiently advanced intelligence is indistinguishable from stupidity.
I'm pretty sure someone will find a way how to get the control back or salvage large number of zombie-PCs even without those domains. It happened before: https://infosecurity.us/?p=6262
The only reason Microsoft cares about this botnet because it "was responsible for sending 651 million spam e-mails to Hotmail addresses over an 18-day period last month".
You know it is funny that they should have to ask to be able to shut them down as they own the software that most is run on, and could somehow figure out how to shut them down through their loopholes the way they do people with legit copies of windows, and have to prove they have legit copies of windows, I also find it funny that they contacted verisign about this, seeing as they have the mass of dns servers online and could have sent out an easy fix in the actual firmware of their product to do more filtering of these sites then worry about getting verisign in on something they could have at some point said no to....but in the end, I enjoy the fact that they still did a good deed. Way to go M$, taking a step in the right direction.