Slashdot Mirror
Zeus Botnet Dealt a Blow As ISPs Troyak, Group 3 Knocked Out
itwbennett writes "Ninety of the 249 Zeus command-and-control servers were knocked offline overnight when two ISPs, named Troyak and Group 3, were taken offline. Whoever was behind the takedown 'just decided to knock out a large area of cyber-crime, and this was probably one of the easiest ways to do it,' said Kevin Stevens, a researcher with SecureWorks. As with the McColo takedown of just over a year ago, Troyak's upstream providers seem to have knocked it off the Internet, Cisco said in a statement. 'The ISP was "De-peered,"' Cisco said. 'Troyak's upstream network providers effectively pulled the plug on Troyak's router, refusing to transmit its traffic.'"
What about the other 150?
I have a difficult time understanding how Zeus is *still* around; it started in mid 2007! According to WP, it has more than 3.6 Million infected PCs.
There is no reasonable stance that defends the existence or the activities of botnets either legally or morally. How is it that we know there are 150 other command nodes, presumably that we can also discover their IP addresses, but law enforcement has been unable to bring them down?
While I understand there are differences in laws, and with what is legal and what is accepted in different jurisdictions, but this seems patently absurd. If an ISP provides service to a verified botnet control node, and refuses to quickly turn them off, I would expect immediate upstream action like this. Why hasn't this happened even more?
knocked offline...taken offline....takedown...knock out.......have knocked it off..."De-peered,"'...pulled the plug... refusing to transmit
I'm sorry, you're going to have to repeat that; what happened? Were they somehow removed from the internet?
Because the spammers and such are paying good money for such "bullet-proof" hosting sites.
Meanwhile, the more legitimate ISP's don't want to spend the money to block the command/control servers individually on their networks.
It comes after atey and before teny
According to this article: "Just hours after Internet service providers severed network connectivity to Troyak, an ISP associated with the Zeus botnet, the ISP has regained connectivity after peering with a new upstream Internet service provider."
The target is a "user". Anyone that doesn't understand system administration and security that is left alone with a computer can defeat anything that the OS does. If your grandma wants to install something like WeatherBug on Linux and the software to do this exists, she will succeed. If it requires root access and she has it, she will provide it in copious amounts for the malware application. Whatever is needed will be provided. Because she knows she wants to install this, for some utterly unknown reason.
Now, if you have a computer that it is impossible for the user to install stuff on, well then you have a much more secure platform. Unfortunately, this requires an administrator for those cases where something is really needed and actually should be installed. Once the user and the administrator are the same person, you have just lost any semblance of security.
99% of the Windows machines in homes out there do not have an administrator other than the user themselves. If these were magically replaced by Linux machines with the same administrator, this wouldn't solve anything. Sure, the user would need to do sudo or su in order to really screw things up, but if the application they thought they wanted to install asked for it, they would do it.
Mr Praline walks into a datacenter.
He walks to a desk where a sysadmin tries to hide below a tape rack.
PRALINE: Hello, I wish to register a complaint... Hello? Miss?
SYSADMIN: What do you mean, miss?
PRALINE: Oh, I'm sorry, I have a cold. I wish to make a complaint.
SYSADMIN: Sorry, we're closing for patch Tuesday.
PRALINE: Never mind that my lad, I wish to make a complain about this hosting service what I leased not half an hour ago from this very datacenter.
SYSADMIN: Oh yes, the Kazakhstan Big Blue Blade Server package. What's wrong with it?
PRALINE: I'll tell you what's wrong with it. It's offline, that's what wrong with it.
SYSADMIN: No, no it's connecting, look!
PRALINE: Look my lad, I know a dead host when I ping one and I'm pingin' one right now.
SYSADMIN: No, no sir, it's not dead. It's syncing.
PRALINE: Syncing?
SYSADMIN: Yeah, remarkable host the Kazakhstan Big Blue, beautiful rackmounting job, innit?
PRALINE: The rackmountin' don't enter into it - it's stone dead.
SYSADMIN: No, no - it's just syncing.
PRALINE: All right then, if it's syncing I'll sync with it. (shouts into cabinet) Hello Khaki! I've got a nice piece of Cat 6 for you when you wake up, Khaki!
SYSADMIN: (jogging rack) There it blinked.
PRALINE: No it didn't. That was you yankin' the wire.
SYSADMIN: I did not.
PRALINE: Yes, you did. (unplugs wire from cabinet, shouts into the end of the ethernet cable) Hello Khaki, Khaki (whips it against counter) Khaki host, wake up. Khaki. (throws it in the air and lets it fall to the floor) Now that's what I call a dead host.
SYSADMIN: No, no it's stunned.
PRALINE: Look my lad, I've had just about enough of this. That host is definitely depeered. And when I leased it not half an hour ago, you assured me that its lack of connectivity wad due to it being tired and shagged out after delisting a porn site.
SYSADMIN: It's probably pining for the fjords.
PRALINE: Pining for the fjords, what kind of talk is that? Look, why did it refuse to connect the moment I got home?
SYSADMIN: The Kazakhstan Big Blue prefers connecting via SSL. Beautiful host, lovely rackmounting.
PRALINE: Look, I took the liberty of examining that host, and I discovered that the only reason that its lights were blinking in the first place was that there was a flashlight taped inside the case.
SYSADMIN: Well of course it was taped there. Otherwise it would roll out the back and voom.
PRALINE: Look matey (picks up cable) this host wouldn't voom if I put four thousand volts through it. It's bleeding offline.
SYSADMIN: It's not, it's pining.
PRALINE: It's not pining, it's unplugged. This host is no more. It has ceased to be. Its license has expired. This is a late host. It's a brick. Bereft of electrons, it rests in peace. And if you hadn't taped a flashlight inside the case, the only cycles it would ever see from here on out are re-cyclers. It's dropped out of DNS and unjoined the internet invisible. This is an ex-host.
SYSADMIN: Well, I'd better replace it then.
PRALINE: (to camera) If you want to get anything done in this country you've got to complain till you're blue in the mouth.
SYSADMIN: Sorry guv, we're right out of blade servers.
PRALINE: I see. I see. I get the picture.
SYSADMIN: I've got a PC running Windows.
PRALINE: Does it scale?
SYSADMIN: Not really, no.
PRALINE: Well, it's scarcely a replacement, then is it?
John