With Rustock, a new twist on fighting Internet crime
IDG News Service - For more than 24 hours this week, it was a question that very few security experts could answer: Who had knocked the world's worst spam botnet offline?
After infecting close to a million computers and spamming out as many as 30 billion unwanted email messages a day, the Rustock botnet went silent around 11 a.m. Eastern Time on Wednesday.
Now we know the reason why: a small group of computer researchers, backed by Microsoft's lawyers, U.S. Marshals and international law enforcement officers executed a number of surgical strikes on the botnet. Hitting it as if it were the mythical Hydra, they cut off Rustock's heads -- its command-and-control servers -- and scorched them to keep them from growing back. And now Microsoft is helping to clean up infected computers before Rustock's owners have a chance to regain control of their botnet.
With seizure warrants in their hands, and U.S. Marshals backing them up, Microsoft's lawyers descended on five hosting providers in U.S. cities such as Kansas City, Scranton, Denver, Dallas, and Chicago on Wednesday and "successfully severed the IP addresses that controlled the botnet, cutting off communication and disabling it," Microsoft said in a blog posting.
Rustock is one nasty piece of software. It gives the criminals control over an infected machine to send spam, attack another computer, or spy on the victim. It's installed by tricking a victim into visiting a malicious Web site or opening a specially coded email attachment -- and it is very difficult to detect and remove.
The botnet is notorious for sending out pharmaceutical spam, and its demise should put a further dent in global spam volumes, which have been down since two other major spamming botnets, Pushdo and Bredolab, were taken offline late last year.
With the Rustock takedown -- the first of several that are now in the works -- the Internet community has polished a technique for getting rid of complex global networks of malicious computers, said Barry Greene, president of the Internet Software Consortium, makers of the BIND Domain Name System (DNS) software. It all started months ago, as a large group of Internet researchers observed Rustock and developed techniques to destroy it. Then a much smaller trusted group was deputized and given the job of managing the takedown with law enforcement.
In this case the action was led by Microsoft, with help from security vendor FireEye, the University of Washington, drug maker Pfizer, and the Dutch police. Instead of using the criminal justice system, Microsoft filed civil suits against Rustock's anonymous operators and got court orders allowing them to seize the servers used to control the botnet, and the Dutch police helped take down servers outside of the U.S.
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!