Slashdot Mirror
Massive Botnet "Indestructible," Say Researchers
CWmike writes "A new and improved botnet that has infected more than four million PCs is 'practically indestructible,' security researchers say. TDL-4, the name for both the bot Trojan that infects machines and the ensuing collection of compromised computers, is 'the most sophisticated threat today,' said Kaspersky Labs researcher Sergey Golovanov in a detailed analysis on Monday. Others agree. 'I wouldn't say it's perfectly indestructible, but it is pretty much indestructible,' Joe Stewart, director of malware research at Dell SecureWorks and an internationally-known botnet expert, told Computerworld on Wednesday. 'It does a very good job of maintaining itself.' Because TDL-4 installs its rootkit on the MBR, it is invisible to both the operating system and more, importantly, security software designed to sniff out malicious code. But that's not TDL-4's secret weapon. What makes the botnet indestructible is the combination of its advanced encryption and the use of a public peer-to-peer (P2P) network for the instructions issued to the malware by command-and-control (C&C) servers. 'The way peer-to-peer is used for TDL-4 will make it extremely hard to take down this botnet,' said Roel Schouwenberg, senior malware researcher at Kaspersky. 'The TDL guys are doing their utmost not to become the next gang to lose their botnet.'"
Yeah, it'll piss off every Grandma and Grandpa with an infected computer, but really.. the best way to deal with these massive botnets is to have the ISPs disable those accounts and contact the owners.
Putting the thing in the MBR just means you can't intercept it during boot.
It doesn't for a second mean it's invisible.
Collect botnet creators. Apply one bullet to head. In public.
Repeat.
Nothing else will stop the leeches.
I do not fail; I succeed at finding out what does not work.
"per the usual", eh? Cocky much?
Take a moment to cogitate on where the "root" in rootkit comes from.
Isn't command and control the antithesis of indestructability? Any software that can be patched can be destroyed.
> What if someone wrote malware that would run a VM from the boot sector, and
> then ran your existing OS from the VM?
You would notice when your 3D performance began to suck ass. And when either all of your devices became virtual ones or all other performance (net, disk, etc) also began to suck ass. Unless you assume a genius who can create a VM environment that works perfectly transparently, has almost zero overhead and otherwise breaks major new ground in the science; and that they waste their time on a virus instead of kicking VMWare, RedHat, QEMU, etcs ass and seizing a multi-billion dollar red hot market segment.
Democrat delenda est
I work at a computer repair shop.
We frequently encounter computers that are kitted up with boot and rootkits, TDL-4 included. Kaspersky's TDSS killer does a pretty good job of removing this stuff, and it's pretty easy to tell if the MBR as been modified. Just fire up a copy of GMER and you'll be able to tell pretty quickly. I see a lot of people posting stuff about having to wipe drives and start over from scratch. That is simply not necessary. The only reason TDL-4 is such a pain in the ass is because it is decentralized, only communicates with a handful of its infected counterparts at a time and modifies the MBR. Even then, it's not impossible to detect or even remove. Just gotta use the right tools...
Sure you got rid of the TDL-4, but what about all the other crap it downloaded? Seriously, if the computer got owned, you can't trust it anymore. You'd never be able to find all the little things like permissions changes and registry tweaks even if you got rid of the trojan's executables. Copy your data files off, scan them really well before introducing them elsewhere, and then reformat the disk. Nuking it from orbit is the only way to be sure.
I do the same kind of work that AC does, and he's right. Its not impossible. Also, I'd like to introduce you to the Real World(TM) where wiping a machine at the drop of the hat isn't always an option.
Nobodies Prefect
Tidbits for Techs Technology Blog
I would still nuke it from orbit, and the reason is very very simple: after a machine has been infected in the wild, you must treat it as untrusted. You must treat all accounts you've ever accessed with it as compromised. You don't know what it might have downloaded in the background. You don't know if they've already keylogged you or stolen other data. You don't know what new capabilities might have come out in the last 24 hours. There are entirely too many unknowns. I know security companies will tell you otherwise, but they have a product to sell. If people stopped believing their product was 100% effective and instead resorted to formatting (which IS 100% effective when done properly) then they'd be out of business. Of COURSE they say you can keep using your system afterwards.
For me, "cleaning" a virus out is merely a way to get access to files in preparation for a format. I will NOT simply "fix" a virus infection for anyone these days, knowing that they could remain quietly compromised and later fall victim to identity theft or worse. It's just not worth chancing it.
ALWAYS nuke an infected system after recovering uninfected data files from it. Without exception.