Slashdot Mirror
Researchers Cripple Pushdo Botnet
Trailrunner7 writes with this from ThreatPost: "Researchers have made a huge dent in the Pushdo botnet, virtually crippling the network, by working with hosting providers to take down about two thirds of the command-and-control servers involved in the botnet. Pushdo for years has been one of the major producers of spam and other malicious activity, and researchers have been monitoring the botnet and looking for ways to do some damage to it since at least 2007. Now, researchers at Last Line of Defense, a security intelligence firm, have made some serious progress in crushing the botnet's spam operations. After doing an analysis of Pushdo's command-and-control infrastructure, the researchers identified about 30 servers that were serving as C&C machines for the botnet. Working with the hosting providers who maintained the servers in question, the LLOD researchers were able to get 20 of the C&C servers taken offline, the company said."
I wonder if the courts would issue an order that would legalize hacking of unstoppable network computers to prevent ongoing attacks?
Other normally illegal tactics can be utilized legally, if a judge deems them necessary or in a court of law. You know, 1st degree murder vs E-Chair?
I would love to see stories like this publishing a full list of the providers who didn't take down a server.
Wait, so I wont be getting any more exciting opportunities to add inches to my penis? What about all that steady income I was getting helping out Nigerian bankers!?!? How am I going to feed my family and satisfy my wife?
Seriously, guys, why does nobody ever link to the original source? ThreatPost got it from M86 Security got it from TLLOD. Would it kill the submitters to link to the original, or the editors to fix it?
Unresponsive providers might be more likely to respond if responsive parties who controlled upstream routers were to stop routing traffic from them.
All traffic.
If you bother to RTFS, you'll note that they worked with the content providers - they shut the servers down themselves. No hacking involved.
They don't do anything if you don't use them.
I think we need to start having more of a "you play nice or don't play on the net" kind of system going on. Providers are not expected to be perfect, nobody is perfect, just to be responsive to complaints/problems. If you aren't you get warned and if you keep ignoring it you just get shut out by all major networks. You then have to prove you took care of the problem and will play nice before you get let back in.
That's how we do it at work, actually. I work at a university and we have a lot of research labs, some of which are totally independent of our central control. When a system in there gets infected, we see if we can track someone down who can deal with it, if nobody is there or everyone claims ignorance, we shut down all network access. When that happens people get a hold of us surprisingly fast and the person who needs to deal with the system is found. Once they take it offline to be dealt with and promise to behave, network access is restored.
I think the big network providers need to work out a system like this, where if a given company is unresponsive, you can file a complaint with them. They then warn the company and if they are still unresponsive, cut access. After all the crap causes them problems as well.
NOTHING was "seriously crippled" nor was the botnet affected. This is a perfect example of a non-story about a good attempt that failed.
"Nothing?" "Attempt that failed?"
Look at their graph: from a high of 1,400 on 3 Aug to 0 on 26 Aug. -- that ranks as both a "seriously crippled" and "success" in my book.
So while you chose to belittle their achievements, I for one chose to say a silent "Thank you! Well done!" for their years of persistence in fighting this war.
What one fool can do, another can. (Ancient Simian Proverb)
I take your multiple ^Hs and raise you a ^W
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Stupid people would be stupid on any OS. There is no reason in the world to suspect that if Windows disappeared that virus/malware creators would shrug and go "Oh well, we're fucked, guess we find real jobs," or that stupid people would suddenly go "Gee, that document my friend sent me is asking to install a program, that doesn't seem right." As long as you insist on "It's a Windows problem" rather than "It's a user education problem" the battle will never be won.
Canada: The US's more awesome sibling.
Correct me if I'm wrong, but wouldn't adding new C&C servers be as simple as pushing an update to the bots? If there are still remaining C&C servers to update with (let alone still a third), that should be pretty routine for them.
Not in this case. This botnet apparently can spread other client side malware, but doesn't attempt to infect new servers.
That's a very hard problem and I guess that's good.
New servers can be added manually though. Part of their protocol involves the client receiving updated lists of servers. That's why even though this was first detected in 2007, had the servers attacked repeatedly over the years as in this article, the botnet is still around.
The associated articles only discuss how the client side works. All the fascinating code is on the server side and apparently has not been broken.
If you need to get all 30 at once, all that has been achieved is that they're back to square one.
True. The loss of 2/3 is a minor setback and one that's happened before. This isn't the Black Knight. Servers can be added to this botnet, while limbs cannot be regrown.
In case it isn't obvious by now, this botnet was done by someone who has some experience in (Soviet) military network programming (C3I). What will happen when (laid off, down on their luck, etc. etc.) US C3I experts turn to the dark side?
I wonder why the police did not just add spying logging equipments, kept silent and followed wires (IP addresses ) and money transfers. (obviously, someone paid for the servers, even with stolen cards). Shutting down 2/3rd of C&C is like 2/3rd done job. The organized crime behind this is still runing fine.
Léa Gris
Look at their graph: from a high of 1,400 on 3 Aug to 0 on 26 Aug. -- that ranks as both a "seriously crippled" and "success" in my book.
So while you chose to belittle their achievements, I for one chose to say a silent "Thank you! Well done!" for their years of persistence in fighting this war.
I did. Color me unimpressed. This isn't the first time that this botnet's servers have had their numbers reduced.
I didn't see any analysis of what is going on server side and that is where all the interesting code is.
Their client/server protocol is self-repairing in that servers can propagate new IP lists of servers to clients. According to the various articles, (some of) the servers have been taken down before.
Apparently nothing is known about what is going on server side.
This botnet puts a high priority on not being detected (according to TFAs).
All that is happening now is a reconfiguration. Lay low, infect new servers, then it's business as usual.
Oh and my threat estimate of this botnet is very high. It's MS Windows only at the moment, of course, but the analysis seems to indicate that with not much additional work, could function in a heterogeneous network.
I'm proposing that people deal with their own dirty laundry, and if they won't, that the people above them do. For example if I am causing a problem, my ISP will call me and say "Hey fix your shit." Happened many years ago, a roommate got a virus on his computer. They called me, I turned it off, life was good. Should I refuse, however, the ISP would have shut down my line. They were not interested in sending out viruses all over the place.
What I'm proposing is that the big bandwidth providers take the same attitude. If some hosting provider has systems doing evil, you contact them. However if they refuse to deal with it, you can then contact the big providers. They can check, if evil is going on they warn the company. If it doesn't stop, they shut down the links.
I fail to see a problem here. Such a thing wouldn't be done capriciously because it is against a business's best interest. If a customer is paying money and not causing problems of course they want to keep the connection active. They don't want to turn it off for fun (and probably break the contract).
All lines have AUPs, even big ones. I just think they need a mechanism to allow for complaints and enforcement, and something that is less severe than a total disconnection. Rather than something having to get to the "You cause so much trouble you are in violation of the contract and we stop selling service to you," point instead they can say "You've refused to deal with complaints so you are blocked, fix your shit and promise to listen in the future and we turn you back on."
The reason I want to see this is first because I want less shit on the net, but also because with many things you find you either self regulate or the government will regulate you. What happens if instead the US government, or a council at the UN gains complete regulatory power and can tell providers who to shut down? I'd much rather have it as a self regulating system.
It works well for ISPs, and most ISPs do it. As I said, as a university we are an ISP and we do just that. We investigate and respond to claims of malicious network activity. However, we need a higher level to deal with the ISPs that won't respond to the complaints.
Editors? I don't think that word means what the editors think it means.
Don't fight for your country, if your country does not fight for you.