Slashdot Mirror
Zeus Botnet Dealt a Blow As ISPs Troyak, Group 3 Knocked Out
itwbennett writes "Ninety of the 249 Zeus command-and-control servers were knocked offline overnight when two ISPs, named Troyak and Group 3, were taken offline. Whoever was behind the takedown 'just decided to knock out a large area of cyber-crime, and this was probably one of the easiest ways to do it,' said Kevin Stevens, a researcher with SecureWorks. As with the McColo takedown of just over a year ago, Troyak's upstream providers seem to have knocked it off the Internet, Cisco said in a statement. 'The ISP was "De-peered,"' Cisco said. 'Troyak's upstream network providers effectively pulled the plug on Troyak's router, refusing to transmit its traffic.'"
What about the other 150?
I have a difficult time understanding how Zeus is *still* around; it started in mid 2007! According to WP, it has more than 3.6 Million infected PCs.
There is no reasonable stance that defends the existence or the activities of botnets either legally or morally. How is it that we know there are 150 other command nodes, presumably that we can also discover their IP addresses, but law enforcement has been unable to bring them down?
While I understand there are differences in laws, and with what is legal and what is accepted in different jurisdictions, but this seems patently absurd. If an ISP provides service to a verified botnet control node, and refuses to quickly turn them off, I would expect immediate upstream action like this. Why hasn't this happened even more?
Remember that thing? It's not a search engine though, its a computational knowledege engine. That took off like a lead balloon.
Read that, figured it was Nine, read the article, 90 of 249
I'm not sure exactly how many Niney is, but it sounds like a lot!
Niney n. The amount of drinks it takes to say this word correctly.
knocked offline...taken offline....takedown...knock out.......have knocked it off..."De-peered,"'...pulled the plug... refusing to transmit
I'm sorry, you're going to have to repeat that; what happened? Were they somehow removed from the internet?
We don't need no stinkin' commies on this here AMERICAN internet.
Might as well call it by its name: Internet Death Penalty
John Chambers thinks he's John Wayne.
Violation of network neutrality?
Because the spammers and such are paying good money for such "bullet-proof" hosting sites.
Meanwhile, the more legitimate ISP's don't want to spend the money to block the command/control servers individually on their networks.
All I have to say is, "Bout time"!
In Russia, Chuck Norris knocks out your bot net niney times , as he turns seveny.
I smell my karma burning.
According to this article: "Just hours after Internet service providers severed network connectivity to Troyak, an ISP associated with the Zeus botnet, the ISP has regained connectivity after peering with a new upstream Internet service provider."
As far as I can tell, Cisco wasn't involved in the decisions. It looks like the writer went to the two ISPs for comment, but came up dry--well, except for that one anoymous comment. Then the writer asked Cisco what they thought about the whole thing to fill out the piece. Probably the ISPs are afraid of being targeted in retaliation and want to keep a low profile.
knocked offline...taken offline....takedown...knock out.......have knocked it off..."De-peered,"'...pulled the plug... refusing to transmit
... IT IS A DEAD ISP! </cleese>
When the gods are at war it is us, mere mortals who suffer because of it. Ye best beware the Ides of March will soon be upon us!
Once again, the summary and the linked article neglect to mention the vulnerable OS. Once again, it's Windows. I guess that goes without saying, but it really seems like there's a widespread agreement to refrain from mentioning Microsoft or Windows in articles on viruses and botnets. Seems to me that mentioning the targets, and how to secure them, would be integral to any such story. It could be one sentence and a link, fer chrissakes.
The only way to truely combat cybercrime is to just cut the connection.
When you have a country that willingly harbors criminals - just because they are attacking someone else - the problem ceases to be one of law enforcement or diplomacy. Sure, you can try to send some cops over there and see what can be accomplished. For the most part, not much.
The key is that if Russia, Bulgaria, Romania or whereever wants to have "Internet freedom" for their citizens where they can do whatever they heck they want without any consequences, the only possible response is for everyone else on the planet to just agree to pull the plug.
Now, so far it has been impossible to make this happen. Nobody has cared enough because "well, it is just some virtual land called cyberspace." For the most part, law enforcement doesn't care if people are robbed in cyberspace - it isn't really their jurisdiction. There is no global cop that can go anywhere to track down cybercriminals, and in most of the world a request to please go down and arrest someone because they committed a crime somewhere else is met with guffaws and snickers. So as long as your local law enforcement was willing to turn a blind eye to your activities, you could pretty much get away with anything.
And believe me, in most of the world today, law enforcement has a lot better things to do than deal with any sort of computer crime. So there are zero consequences. Something a lot of people have learned over the last 15 years or so. Of course a few Unix geeks knew that since 1980 or so.
Now, if this sticks and if it can be repeated - both of which are highly doubtful - we might actually get somewhere in having some real consequences for bad actions on the Internet. But I suspect this will all be put back together next week (if not sooner) and there will continue to be zero consequences. Keep this in mind, because if you annoy someone enough on the Internet there is a chance they already know there are no consequences in most of the world. Lori Drew is a case in point. They really wanted to nail her for something, anything. But the rule of cyberspace wins out in the end. The physical world has real consequences, the virtual world has only virtual consequences.
There seems to be an implication that Troyak and Group 3 were somehow complicit with all this botnet activity, yet no such claims are actually being explicitly made - just that the ISPs have been "associated" with these botnets, whatever that means.
Did these ISPs have legitimate customers who have now been cut off because of the criminals alongside them on the ISP's network? Was the ISP asked to deal with the situation first, and either ignored or refused such requests? If these ISPs were fronts for the botnet owners, where's the evidence? Did someone just think, oh, there are a bunch of bad guys on this ISP; let's cut the whole thing off and fuck the rest of their customers?
This action sounds like the IT equivalent of a government blowing up an entire city block because a couple terrorists are renting an apartment there.
If these ISPs have legitimate customers, hopefully they sue the hell out of the upstream for this.
Liberty in your lifetime
In the past, when this sort of thing has been suggested, the cries of "vigilante" and "lawlessness" were cried from the highest mountaintops, and the lowest swamps of the Internet. And anyone who actually DID anything was pilloried and run out of town on a rail.
[sarcasm] What changed, I wonder? [/sarcasm]
Now that the losses are in the hundreds of millions, in several dozen different currencies, those same voices seem to have lost their enthusiasm.
[End Of Line]
36% of their highly redundant infrastructure was made unavailable, leaving 64% of the control servers online and fully capable of servicing the millions of bots under its control.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
Nobody likes to see crooks get away with being crooks but keep in mind if you are championing the forced removal of content like this, then you are also championing the removal of any content deemed objectionable by a governing body.
boycott slashdot February 10th - 17th check out: altSlashdot.org
The same way Turkey took down YouTube
By pushing bogus BGP packets to the backbone routers you have access to. Only the routers the people who dislike botnets have administrative control over are not just inside Turkey.
-- Terry
... hundreds of bot nets were created... but they got 1, they are happy.
cdguru
You are not vary familiar with Linux I hope or work in Redmond WA at worst. There are exactly 0 Linux viruses in the wild to catch. In linux most user aimed distros install with no server based services by default unlike Windows which has the "server" service going just fine so when I bang with Medusa on your little windows network I WILL GET A PASS FROM SOME DAMN BOX and then its game over for your whole windows LAN most likely. A little sniffin and a little pasing the hash around and every damn box will get pwned in no time. It just is not that easy against a linux network.
Windows puts profit and control far above your safety and they like it that way as it supports their "CERTIFIED PARTNERS" like Norton's ( the worst AV that due to ad dollars spent some IT think is good, Hell last thing Symantech made was defrag and that was in the last century ). So for the people who are too stupid to use anything but point and click "Your screwed" try not to go many places or just pay geeksquad 200$ to "Fix" it everytime your kid is surfin for the pron.
For the rest of us lucky few thank god there are other options