Slashdot Mirror
International Exploit Kit Angler Thwarted By Cisco Security Team
An anonymous reader writes: Researchers at a Cisco security unit have successfully interrupted the spread of a massive international exploit kit which is commonly used in ransomware attacks. The scientists discovered that around 50% of computers infected with Angler were connecting with servers based at a Dallas facility, owned by provider Limestone Networks. Once informed, Limestone cut the servers from its network and handed over the data to the researchers who were able to recover Angler authentication protocols, information needed to disrupt future diffusion.
"The servers had been hired by cybercriminals using stolen payment details."
Regardless of what was hosted on those servers, how did Limestone allow that many fraudulent accounts to get through? (rhetorical question btw...revenue is revenue if you know what I mean, wink wink)
Btw, here's a very good in-depth description of Angler (i.e. yet another Microsoft Windows exploit):
https://blogs.sophos.com/2015/...
Exactly what kind of 'vigilante justice' are you talking about? There was no such thing in the articles. Cisco informed a service provider they were hosting proxy servers that were part of a malware distribution scheme. Service provider shut down the servers and handed logs to Cisco. Totally their right to do so, and nothing out of the ordinary here.