Feeds

Botnet used to boost online gaming scores

Randex worm shenanigans

  • alert
  • submit to reddit

Providing a secure and efficient Helpdesk

Exclusive Teenagers convicted last week of setting up a huge network of compromised Windows PCs used it to gain an unfair advantage in online gaming - not to send spam.

Detective Sergeant Steve Santorelli, of Scotland Yard's Computer Crime Unit, said the two principal suspects were members of a gaming clan which used illicit access to an estimated 30,000 PCs to generate clicks and therefore gain more points in a game called Outwar.

Suspects in the case used the Randex worm to establish a 30,000 strong botnet used to carry out "low profile DDoS attacks" and steal the CD keys for games, he explained. "They had a huge weapon and didn't use as much as they could have done," Santorelli told El Reg. "The main damage caused in the case is down to the cost of cleaning up infected PCs."

The case began earlier this year with a tip-off from Germany c't magazine to Scotland Yard's Computer Crime Unit that virus writers in the UK were selling the IP addresses of PCs infected with Trojans to would-be spammers. Subsequent investigations by Scotland Yard along with Federal Bureau of Investigation and the Royal Canadian Mounted Police assisted by Microsoft identified a number of suspects: two in the US, one in Canada and one in the UK.

The main suspects responsible for the botnet were in the UK and Canada. They were both aged fifteen at the time of the offences and can't be named for legal reasons. The UK suspect last week received a six month "referral order" from South Cheshire juvenile court in Crewe. The Canadian suspect was arrested in May 2004 and subsequently sentenced to nine months probation.

Now that all legal proceedings are concluded, investigators are free to talk about the particulars of the case for the first time refuting early reports that the botnet was used to distribute spam.

Det. Sgt. Santorelli explained: "At the time of the arrest of the UK suspect, some 9,500 clients were logged into the IRC server that was controlling the botnet.

Due to the dynamic nature of the network, in that machines would have been logging in and out throughout the day as they were booted up and shut down by their legitimate users, we estimate that the total number of infected machines was at least 30,000 and probably more during the lifetime of this particular botnet. This botnet was not used for any particularly nefarious purpose but it shows how law enforcement, industry and other organisations are working together to combat these networks of infected machines." ®

Related stories

Teenage British Trojan distributor escapes jail
Rise of the Botnets
Telenor takes down 'massive' botnet
Property tycoon buys fantasy island

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.