Slashdot Mirror
Microsoft Leads Sting Operation Against Zeus Botnets
wiredmikey writes "Microsoft, in what it called its 'most complex effort to disrupt botnets to date,' and in collaboration with partners from the financial services industry, has successfully taken down operations that fuel a number of botnets that make up the notorious Zeus family of malware. In what Microsoft is calling 'Operation b71,' Microsoft and its co-plaintiffs, escorted by U.S. Marshals, seized command and control (C&C) servers in two hosting locations on March 23 in Scranton, Pennsylvania and Lombard, Illinois. The move was to seize and preserve data and evidence from the botnets for the case. In addition to seizing the C&C servers, the group took down two IP addresses behind the Zeus command and control structure, and secured 800 domains that Microsoft is now monitoring and using to help identify computers infected by Zeus."
It seems that Microsoft has become a good guy while Apple is rapidly becoming a goat. ... Or have I spoken too soon?
Welcome to America, where the state is a Corporation
As a linux fanboi it sticks in my throat but well done Microsoft.
The US Marshals performed the seizures. Did you not RTFA?
A corporation did not seize private property. The government did: http://www.zeuslegalnotice.com/images/TRO_Seizure_Order_Part_1.pdf
Keep the tinfoil handy though!
Well it says they had US Marshals with them. In the same was as a bank can come with the local Sheriff to repossess a home from folks that haven't been paying. It isn't even an issue; it is the way this stuff works. It is interesting that you think it is an issue though. Would you - as a private party or as an agent of a corporation - want to send a Marshal or Sheriff to get some item without having your representative on scene to be sure it was the right item and that it wasn't damaged?
You know how you can punch someone in the face and then they can sue you to take all your stuff? That's how. The people running these things are causing damage to Microsoft and its customers. A better question is why is this question asked every time Microsoft takes down a botnet?
I wouldnt' doubt that it'd be that hard to get a warrant in this case with microsoft helping to gather the information.
TFA:
Microsoft has conducted physical seizures
Since when can a CORPORATION perform seizures of private property???
When it gets a court order and has proper officials (in this case, US Marshals) with them, like it appears happened.
Be seeing you...
Since when can a CORPORATION perform seizures of private property???
Maybe the warrant was written that way, or perhaps the authorities used them as specialists. However, as tow truck drivers seize private property every day, I suspect that it's not as big of a hurdle as you believe.
The force that blew the Big Bang continues to accelerate.
First
Your botnet proxy was surely seized for your post to be so not first.
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
Welcome to America, where the state is a Corporation
Welcome to the United* Corporations of America.
*United only in the idea that people live to make them profits.
Be seeing you...
.. now Microsoft takes the servers down completely. As if I haven't got enough problems to get C&C:Generals to play on-line as it is.
If there is one thing to be learned on slashdot, it has to be sarcasm.
Remember, these botnets are using the hacked PCs against the owners will, without their knowledge. I don't have a problem with the police seizing the controllers.
Scranton PA? Surely those guys over at Dunder Mifflin didn't have anything to do with it!
There ya go, lazy-ass AC.
I probably shouldn't be admitting this online- but I am part of Microsoft's counter-terror department. We are a highly trained SWAT team that risks our life daily raiding LINUX farms. Our safety demands daily communication using Windows phones; it is one of the most dangerous jobs in the country.
We are highly trained in many ways to take on any situation needed. Even take out the Prez if he threatens to sign any bill that would not be favourable of Microsoft. We constantly run into our major foe, Apple, and fight hand-to-hand combat in the street and the patent office.
After announcing this initiative, I am in grave danger. Within a few weeks I will be tracked by other operatives by the GPS on my windows phone... if the battery doesn't die first.
"That's the way to do it" - Punch
www.youtube.com/watch?v=szhJzX0UgDM
I don't think there is a rule expressing that an outside entity can do the search, if they enter with the appropriate Warrent. I mean we can have Private Investigators do searches, it would make sense when investigating digital data that law enforcement brings experts to let them know what to look for. Otherwise you get a bunch of cops tare a building apart and not really know what to use and what to ignore.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Microsoft and its co-plaintiffs, escorted by U.S. Marshals
It also contains this :P
...old news? http://yro.slashdot.org/story/11/03/18/1228227/microsoft-conducts-massive-botnet-takedown-action
Mostly harmless.
Have to remain vague to be in accordance of NDAs, but I've been part of such a sting before. On the "good" side, don't get your panties in a knot. It's not as glamorous as it may look at first (it's decidedly NOT like on TV to raid a server hoster). We went in, we cashed in the servers, we went back out, all with the aid of the hoster who, in turn, didn't do anything wrong but was required to cooperate, and did so quite easily. You wave that warrant in front of their nose and they do whatever you want (as long as it's in the warrant, of course).
Before we had the servers dissected and analyzed, the bot herders rerouted to other controlling servers. It's like playing whack-a-mole. The time wasted to get every kind of evidence collected so everything's in order and you get the necessary paperwork ready is a billion times what's needed for the other side to switch over to new servers. And they know that bloody well.
Before you get the wrong idea, the solution is NOT to eliminate due process and let me go nuts on every server hoster in the country, seizing servers as I please. This is not going to do any good. Or rather, do more ill than good. The solution is on the client's side. It's trivial to come up with something that can analyze network traffic and identify bot traffic. Of course, such a device has to be under the control of the customer. Not the ISP. The field for abuse is even wider there. Require people to monitor their traffic. Net access is no more a right than the right to drive a car, and here you have to make sure that your car does not cause trouble to other participants in traffic, why should that not apply for the internet?
This can easily be rolled into a little box that gets updates regularly from its maker, with the current markers for bot traffic, not unlike how we deal with malware on computers already. Just that this time the box is not prone to user idiocy, clicking "yeah, go on" whenever some trojan wants a new home.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Ah, so you have a Windows phone! Now we just need to figure out who the other guy is.
If you were blocking sigs, you wouldn't have to read this.
Aaahh..
So you've probably faced the man with the long beard and two katanas? You probably have, you cant miss his friend with the red cape in the balloon.
I had a linux server owned (rootkitted, had to reinstall completely), and it became part of a spam sending botnet.
So, fuck you.
You should've updated your system, check logfiles, run chkrootkit on a regular basis etc. Else, you're no better than people running unpatched Windows desktops.
Even take out the Prez if he threatens to sign any bill that would not be favourable of Microsoft.
Microsoft has a British Counter-Terror Department?
My cover is as a British person.
"That's the way to do it" - Punch
In law enforcement, a sting operation is a deceptive operation designed to catch a person committing a crime.
http://en.wikipedia.org/wiki/Sting_operation
Whoossshh...
In law enforcement, a sting operation is a deceptive operation designed to catch a person committing a crime.
Again, in what way was this a sting? There was no deception involved, at least none that was mentioned in the article. The headline says it was a sting, but nowhere in the article is there any mention of any sort of deception. In fact the article really says nothing at all about how they identified the C&C hosts that were seized. Typically researchers locate C&C servers by analyzing the network traffic to/from a compromised server. How does network analysis equate to deception?
When they are escorted by U.S. Marshals, presumably with a valid search warrant.
You realize that what you're suggestion is tens of thousands of felonies, right? Try to control your zealotry and apply some rational thought before posting idiocy like this.
Not elevated at all - bots only need to get in at the user level, and a moron can just as easily infect a Linux machine in the same way. The problem is the users, not the OS.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
When non-government representatives set foot on what is essentially an alleged crime scene, they could tamper with the evidence and/or taint the crime scene (even inadvertently). Having LEO on the scene is no guarantee this won't happen.