Feds lead biggest botnet takedown ever, end massive clickjack fraud
Cripples 'DNS Changer' botnet of 4 million machines allegedly controlled by Estonians
Computerworld - The botnet takedown announced Wednesday by the U.S. Department of Justice was the biggest in history, according to a security company that worked with authorities to identify the alleged criminals.
Dubbed "DNS Changer," the collection of compromised computers numbered over four million machines, or more than twice the size of the Rustock botnet that Microsoft and U.S. law enforcement officials brought to its knees last March.
About a quarter of the bots were Windows PCs and Macs based in the U.S.
Feike Hacquebord, a senior threat researcher at Trend Micro, called the operation the "biggest cybercriminal takedown in history" in a blog post yesterday.
Trend Micro was one of several companies and organizations credited by the FBI for contributing to the investigation leading to the takedown. Others included Mandiant, Neustar, Spamhaus and the University of Alabama at Birmingham's computer forensics research group.
Preet Bharara, the Manhattan-based U.S. District Attorney in charge of the case, said the fraud conducted with the botnet was "massive and sophisticated."
On Wednesday, the DOJ charged seven men -- six Estonians and one Russian -- with 27 counts of wire fraud, money laundering and illegal computer access, alleging that the group operated a lucrative clickjacking scheme that generated over $14 million during a four-year period.
The malware responsible for hijacking users' clicks -- which were then redirected to hacker-created sites that resembled the real domains -- came in a variety of forms, said researchers and authorities.
According to the Internet Storm Center, some of whose security experts were part of a working group that advised the DOJ, the botnet was created with several malware families, including the pernicious TDSS rootkit -- also known as "Alureon" -- as well as Trojan horses crafted for Mac OS X.
The federal indictment said that the gang infected personal computers by luring users to malicious websites or by duping them into downloading and installing purported video codecs that the scams claimed were necessary to view videos.
Trend Micro, which said it had been tracking the DNS Changer botnet since 2006, added that the alleged criminals updated the malware daily to change the DNS (domain name system) settings of each bot.
- Nine charged with distributing Zeus malware
- The new security perimeter: Human Sensors
- Cyberattacks could paralyze U.S., former defense chief warns
- Security Manager's Journal: Thousands of dollars in phone calls? Management hates that.
- Everything You Know About Enterprise Security Is Wrong
- UK man charged with hacking Federal Reserve
- McAfee Offers Global Response to Nationalized Malware
- Tech Industry Praises Cybersecurity Framework From White House
- Ransomware like Cryptolocker uses Bitcoin, other virtual currencies for payment
- Trial for alleged Silk Road creator Ross Ulbricht set for November
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts