Feds lead biggest botnet takedown ever, end massive clickjack fraud
Cripples 'DNS Changer' botnet of 4 million machines allegedly controlled by Estonians
Computerworld - The botnet takedown announced Wednesday by the U.S. Department of Justice was the biggest in history, according to a security company that worked with authorities to identify the alleged criminals.
Dubbed "DNS Changer," the collection of compromised computers numbered over four million machines, or more than twice the size of the Rustock botnet that Microsoft and U.S. law enforcement officials brought to its knees last March.
About a quarter of the bots were Windows PCs and Macs based in the U.S.
Feike Hacquebord, a senior threat researcher at Trend Micro, called the operation the "biggest cybercriminal takedown in history" in a blog post yesterday.
Trend Micro was one of several companies and organizations credited by the FBI for contributing to the investigation leading to the takedown. Others included Mandiant, Neustar, Spamhaus and the University of Alabama at Birmingham's computer forensics research group.
Preet Bharara, the Manhattan-based U.S. District Attorney in charge of the case, said the fraud conducted with the botnet was "massive and sophisticated."
On Wednesday, the DOJ charged seven men -- six Estonians and one Russian -- with 27 counts of wire fraud, money laundering and illegal computer access, alleging that the group operated a lucrative clickjacking scheme that generated over $14 million during a four-year period.
The malware responsible for hijacking users' clicks -- which were then redirected to hacker-created sites that resembled the real domains -- came in a variety of forms, said researchers and authorities.
According to the Internet Storm Center, some of whose security experts were part of a working group that advised the DOJ, the botnet was created with several malware families, including the pernicious TDSS rootkit -- also known as "Alureon" -- as well as Trojan horses crafted for Mac OS X.
The federal indictment said that the gang infected personal computers by luring users to malicious websites or by duping them into downloading and installing purported video codecs that the scams claimed were necessary to view videos.
Trend Micro, which said it had been tracking the DNS Changer botnet since 2006, added that the alleged criminals updated the malware daily to change the DNS (domain name system) settings of each bot.
- Arrests made after international cyber-ring targets StubHub
- International police operation disrupts Shylock banking Trojan
- Spamhaus pushes for arrests of alleged DDoS participants
- Accused Russian point-of-sale hacker arrested, will face U.S. charges
- No-IP regains control of some domains wrested by Microsoft
- Microsoft legal action cramping other hacking campaigns, Kaspersky says
- Microsoft admits technical error in IP takeover, but No-IP still down
- QuickPoll: Why hasn't Windows XP come under attack from hackers?
- Cybercrime losses top $400 billion worldwide
- U.S., foreign agents disrupt Gamover Zeus botnet
- Data Protection eGuide In this eGuide, CSO and sister publications IDG News Service, Computerworld, and CIO pull together news, trend, and how-to articles about the increasingly...
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!