Zeus Botnet Dealt a Blow As ISPs Troyak, Group 3 Knocked Out

itwbennett writes "Ninety of the 249 Zeus command-and-control servers were knocked offline overnight when two ISPs, named Troyak and Group 3, were taken offline. Whoever was behind the takedown 'just decided to knock out a large area of cyber-crime, and this was probably one of the easiest ways to do it,' said Kevin Stevens, a researcher with SecureWorks. As with the McColo takedown of just over a year ago, Troyak's upstream providers seem to have knocked it off the Internet, Cisco said in a statement. 'The ISP was "De-peered,"' Cisco said. 'Troyak's upstream network providers effectively pulled the plug on Troyak's router, refusing to transmit its traffic.'"

Comments

Good

[drDugan]

What about the other 150?

I have a difficult time understanding how Zeus is *still* around; it started in mid 2007! According to WP, it has more than 3.6 Million infected PCs.

There is no reasonable stance that defends the existence or the activities of botnets either legally or morally. How is it that we know there are 150 other command nodes, presumably that we can also discover their IP addresses, but law enforcement has been unable to bring them down?

While I understand there are differences in laws, and with what is legal and what is accepted in different jurisdictions, but this seems patently absurd. If an ISP provides service to a verified botnet control node, and refuses to quickly turn them off, I would expect immediate upstream action like this. Why hasn't this happened even more?

Re:Good

[c 0xFF]

From the article:

Troyak is based in Kostanay, Kazakhstan, according to whois records.

Taking down the servers is a political matter, not a technical one (in general). But I would imagine that clearly harboring illegal activity would be sufficient motivation for anybody. Imagine if we classified servers like we do countries that support terrorism?

But even if we got all 249, it's like playing whack-a-mole or cutting off the head of a hydra.

Re:Good

[shentino]

And for once it WOULD be a good idea.

Just look at what happened to Blue Security. They put spam down so well that a pissed off spammer lobbed an electronic nuke at them.

The guys that took out Blue were able to do so because they had a freaking ARMY of computers. An army, by the way, that they built up through illegal means. Now, accumulating firepower through theft, that does sound like a form of terrorism to me.

Re:Good

[Attila Dimedici]

Any system that can reliably take botnets offline can also be (mis)used to reliably take something like wikileaks offline.

Re:Good

[jd2112]

There is no reasonable stance that defends the existence or the activities of botnets either legally or morally.

"We can make money off of it" seems to work for a lot of people.

Re:Good

[HungryHobo]

Ya I'm not really seeing the victory here.

If 90 of their command and control servers are knocked off can't they just push an update out through one of their other 159 command servers to the botnet to add another 1000 potential command and control servers scattered around the internet?

Re:Good

[Hadlock]

Pretty much obliterated Blue Security, I had to google them to figure out what the hell he was talking about. He used a fairly generic term, but the end result is the same.

Re:Good

[hairyfeet]

As a PC repairman allow me to explain why Zeus is still around, it is because the OEMs suck ass, that's why. You see ever since XP Sp2 (and some even earlier) the OEMs have been loading PCs with images that have the absolute worst default security policies you can possibly imagine, hell a junior HS student could do better. They set up an obvious username with no password, like "HP_User" and then go and turn autoupdates to OFF. In fact in 6 years I don't think I've seen an OEM PC with autoupdates activated. Just yesterday I had one cross my desk that the patches only went to SP2, that was...what 7 years ago? Hell no wonder there are so many botnets, the OEMs make it so any script kiddie can own millions of PCs!

As for TFA, my guess is that many of the C&C servers are hosted in some idoncareistan, where a nice fat bribe will make all those problems go bye bye. Just look at Nigeria, where scamming is practically a noble profession. And it isn't like they can't find plenty of sleazeballs here in the USA that will be happy to do business with them as long as the money is green.

Ultimately if we are gonna turn the tide I think it has to start with the OEMs before the customer ever picks up the PC. We need to demand some basic common sense, like having the user pick a password on first launch, having automatic updates set to on as default, and having some rules with regards to the crapware AVs they install, such as having it refuse to start if it is no longer good, so the user won't have a false sense of security. If I had my way it would give the user a list of AVs on first run, including free ones, like Windows 7 did on first start, but since I haven't had any OEM Windows 7 machines cross my desk yet I'm sure the OEMs disabled that as well. But expecting the customer to know their machine is crippled from the factory, as well as the steps to fix it, is just insane when so much can be done at the factory to negate this problem IMHO.

Re:Good

[mikael_j]

Well, a bunch of guys (spammers) from specialham decided that BlueFrog was working a bit too well at killing spam so they basically threw everything they had at Blue security while simultaneously launching a massive propaganda and FUD campaign online (where they made all sorts of unsubstantiated claims about Blue Security and the BlueFrog software).

This kind of behaviour from spammers is one of the reasons I wouldn't be the least bit upset if the top 10 spammers in the world were all found one morning with holes in their heads, hopefully it would at least dissuade others (and stop these particular asshats).

Re:Good

[mikael_j]

Well, most legit ISPs regardless of size tend to put a clause in their ToS about their customers not being allowed to do things that disrupt the network, and spamming and DDoS attacks seem like good enough reasons for claiming someone is disrupting the network. Hell, when I worked the abuse desk for an ISP we would warn residential customers after we got the first indication or complaint about them, disconnect them and send them a letter the second time and only reconnect when they contacted us and verified that they had fixed the problem, if there were any further complaints we would often just cut them off completely (sometimes giving them the option to present us with a receipt from a computer store showing that they'd had their computer looked at by someone there before finally cutting them off).

No reason to make this about laws that tell ISPs what they must police in their networks, if the respectable and serious ISPs start taking their own Terms of service seriously and actually act on them even when the customer is another ISP then we'd have a lot fewer problems with botnets and spam.

Re:Good

[Anonymous Coward]

Now, accumulating firepower through theft, that does sound like a form of terrorism to me.

Despite what the talking heads on TV or the politicians have told you to think, terrorism does not mean "anything illegal" or "anything against the interests of the country". Terrorism is an activity that is designed to accomplish its goals through the use of fear and paranoia against the general population.
Stockpiling a supply of bombs does not make you a terrorist, using or threatening to use them against a target such as a school does.

Niney

[Evelas]

Read that, figured it was Nine, read the article, 90 of 249

Niney

[jamesyouwish]

Niney n. The amount of drinks it takes to say this word correctly.

Words

[Threni]

knocked offline...taken offline....takedown...knock out.......have knocked it off..."De-peered,"'...pulled the plug... refusing to transmit

I'm sorry, you're going to have to repeat that; what happened? Were they somehow removed from the internet?

Re:Words

[chadenright]

The Internet Service Providers providing internet service to the 90 zeus command nodes suddenly (and involuntarily) stopped providing internet service. TFA attributes this to "anonymous community action". Basically, someone got irritated at the bot net and blacked out a fair chunk of Kazakhstan in order to damage it.

Re:Words

[Anonymous Coward]

Troyak and Group 3 were like car dealerships, who sold cars to evil customers, who ran car-botnets. The suppliers of Troyak and Group 3 decided to stop supplying cars to them, so they couldn't resell the cars.

Re:Words

[__aajfby9338]

this has to be the worst car analogy ever.

You might say it's like the Yugo of car analogies.

Re:Words

[Angst Badger]

TFA attributes this to "anonymous community action".

Of which there might be more if someone would be thoughtful enough to publicly post the IP addresses of the command and control nodes of major botnets on a regular basis.

Internet Death Penalty

[Anonymous Coward]

Might as well call it by its name: Internet Death Penalty

The short answer? Money.

[khasim]

Why hasn't this happened even more?

Because the spammers and such are paying good money for such "bullet-proof" hosting sites.

Meanwhile, the more legitimate ISP's don't want to spend the money to block the command/control servers individually on their networks.

Re:The short answer? Money.

[Nefarious Wheel]

Meanwhile, the more legitimate ISP's don't want to spend the money to block the command/control servers individually on their networks.

I suspect the "expense" they're afraid to incur would most likely be in the form of legal costs. Give a decent sysadmin any size list of culprits and he'll script a way to block them within a day, max. Fighting lawsuits, OTOH, is quite expensive, bogus or otherwise.

Re:The short answer? Money.

[Anonymous Coward]

This is called a pink contract.

http://catb.org/jargon/html/P/pink-contract.html

Re:Niney!?

[LikwidCirkel]

It comes after atey and before teny

Re:Niney!?

[SimonTheSoundMan]

I think it's after twelfty.

Re:Violation of network neutrality?

[Anonymous Coward]

Their network has been neutralized alright.

Update: Troyak is back online

[angry tapir]

According to this article: "Just hours after Internet service providers severed network connectivity to Troyak, an ISP associated with the Zeus botnet, the ISP has regained connectivity after peering with a new upstream Internet service provider."

Re:Update: Troyak is back online

[NiteMair]

They say only sixeyate made it back online though...

Re:Windows again

[cdrguru]

The target is a "user". Anyone that doesn't understand system administration and security that is left alone with a computer can defeat anything that the OS does. If your grandma wants to install something like WeatherBug on Linux and the software to do this exists, she will succeed. If it requires root access and she has it, she will provide it in copious amounts for the malware application. Whatever is needed will be provided. Because she knows she wants to install this, for some utterly unknown reason.

Now, if you have a computer that it is impossible for the user to install stuff on, well then you have a much more secure platform. Unfortunately, this requires an administrator for those cases where something is really needed and actually should be installed. Once the user and the administrator are the same person, you have just lost any semblance of security.

99% of the Windows machines in homes out there do not have an administrator other than the user themselves. If these were magically replaced by Linux machines with the same administrator, this wouldn't solve anything. Sure, the user would need to do sudo or su in order to really screw things up, but if the application they thought they wanted to install asked for it, they would do it.

And these ISP's other customers...?

[J'raxis]

There seems to be an implication that Troyak and Group 3 were somehow complicit with all this botnet activity, yet no such claims are actually being explicitly made - just that the ISPs have been "associated" with these botnets, whatever that means.

Did these ISPs have legitimate customers who have now been cut off because of the criminals alongside them on the ISP's network? Was the ISP asked to deal with the situation first, and either ignored or refused such requests? If these ISPs were fronts for the botnet owners, where's the evidence? Did someone just think, oh, there are a bunch of bad guys on this ISP; let's cut the whole thing off and fuck the rest of their customers?

This action sounds like the IT equivalent of a government blowing up an entire city block because a couple terrorists are renting an apartment there.

If these ISPs have legitimate customers, hopefully they sue the hell out of the upstream for this.

Re:PININ' for the FJORDS?!

[plover]

Mr Praline walks into a datacenter.
He walks to a desk where a sysadmin tries to hide below a tape rack.

PRALINE: Hello, I wish to register a complaint... Hello? Miss?

SYSADMIN: What do you mean, miss?

PRALINE: Oh, I'm sorry, I have a cold. I wish to make a complaint.

SYSADMIN: Sorry, we're closing for patch Tuesday.

PRALINE: Never mind that my lad, I wish to make a complain about this hosting service what I leased not half an hour ago from this very datacenter.

SYSADMIN: Oh yes, the Kazakhstan Big Blue Blade Server package. What's wrong with it?

PRALINE: I'll tell you what's wrong with it. It's offline, that's what wrong with it.

SYSADMIN: No, no it's connecting, look!

PRALINE: Look my lad, I know a dead host when I ping one and I'm pingin' one right now.

SYSADMIN: No, no sir, it's not dead. It's syncing.

PRALINE: Syncing?

SYSADMIN: Yeah, remarkable host the Kazakhstan Big Blue, beautiful rackmounting job, innit?

PRALINE: The rackmountin' don't enter into it - it's stone dead.

SYSADMIN: No, no - it's just syncing.

PRALINE: All right then, if it's syncing I'll sync with it. (shouts into cabinet) Hello Khaki! I've got a nice piece of Cat 6 for you when you wake up, Khaki!

SYSADMIN: (jogging rack) There it blinked.

PRALINE: No it didn't. That was you yankin' the wire.

SYSADMIN: I did not.

PRALINE: Yes, you did. (unplugs wire from cabinet, shouts into the end of the ethernet cable) Hello Khaki, Khaki (whips it against counter) Khaki host, wake up. Khaki. (throws it in the air and lets it fall to the floor) Now that's what I call a dead host.

SYSADMIN: No, no it's stunned.

PRALINE: Look my lad, I've had just about enough of this. That host is definitely depeered. And when I leased it not half an hour ago, you assured me that its lack of connectivity wad due to it being tired and shagged out after delisting a porn site.

SYSADMIN: It's probably pining for the fjords.

PRALINE: Pining for the fjords, what kind of talk is that? Look, why did it refuse to connect the moment I got home?

SYSADMIN: The Kazakhstan Big Blue prefers connecting via SSL. Beautiful host, lovely rackmounting.

PRALINE: Look, I took the liberty of examining that host, and I discovered that the only reason that its lights were blinking in the first place was that there was a flashlight taped inside the case.

SYSADMIN: Well of course it was taped there. Otherwise it would roll out the back and voom.

PRALINE: Look matey (picks up cable) this host wouldn't voom if I put four thousand volts through it. It's bleeding offline.

SYSADMIN: It's not, it's pining.

PRALINE: It's not pining, it's unplugged. This host is no more. It has ceased to be. Its license has expired. This is a late host. It's a brick. Bereft of electrons, it rests in peace. And if you hadn't taped a flashlight inside the case, the only cycles it would ever see from here on out are re-cyclers. It's dropped out of DNS and unjoined the internet invisible. This is an ex-host.

SYSADMIN: Well, I'd better replace it then.

PRALINE: (to camera) If you want to get anything done in this country you've got to complain till you're blue in the mouth.

SYSADMIN: Sorry guv, we're right out of blade servers.

PRALINE: I see. I see. I get the picture.

SYSADMIN: I've got a PC running Windows.

PRALINE: Does it scale?

SYSADMIN: Not really, no.

PRALINE: Well, it's scarcely a replacement, then is it?

Re:Windows again

[cortesoft]

Now, if you have a computer that it is impossible for the user to install stuff on, well then you have a much more secure platform.

What you have is a damn iPad

Re:PININ' for the FJORDS?!

[L4t3r4lu5]

Excuse me for a moment, I have to go change my trousers.