Feeds

NZ police cuff teenage botnet mastermind suspect

Bot Roast bust

Secure remote control for conventional and virtual desktops

Updated New Zealand police have arrested an 18-year-old suspected of masterminding the compromise of a huge network of one million compromised PCs.

The unnamed teenager, who police have identified only by his online moniker of AKILL, was arrested as part of a larger FBI-led operation aimed at cracking down on the trade in compromised PCs, codenamed Operation Bot Roast.

AKILL is reckoned to be the ringleader of an elite international botnet coding group. Investigators reckon AKILL, who was taken in for questioning in the New Zealand city of Hamilton, began hacking while still at school. The teenager is suspected of leading a gang who used compromised PCs to raid online bank accounts via various phishing scams. Members of the gang also made money by running spam and denial of service attacks, as well as by loading compromised PCs with adware.

The teenager was released on police bail, following a raid on his home, pending further inquiries. If charged, he faces offences punishable on conviction by up to 10 years' imprisonment.

The FBI's update on Operation Bot Roast can be found here, as summarised in our earlier story here.

Since Operation Bot Roast was announced last June, eight individuals (all based in the US) have been prosecuted for crimes related to botnet activity. The ongoing investigative effort has thus far uncovered more than $20m in economic loss and more than one million compromised computers.

In related botnet news, European security agency ENISA estimates that 6m computers worldwide have been hijacked by hackers. It reckons browser exploits are responsible for more than two in three (65 per cent) of the infections that leave compromised PCs under the control of cybercriminals. Email attachments (13 per cent), operating system exploits (11 per cent), and downloaded internet files (9 per cent) are also popular infection methods.

Compromised zombie PCs are used to send spam, mount denial of services attacks, or as resources in various identity theft scams. ENISA reckons the top five locations of infected computers are China, the US, Germany, Spain and France. ENISA has put together a map of botnets and chart of Infection methods here.

Bots are surreptitiously installed and commonly managed remotely via Command & Control servers. An estimated 1,000 command and control servers, each controlling an average of 20,000 zombie clients, are running at any one time. Each zombie client is potentially capable of churning out an estimated 259.000 junk mail messages per day.

ENISA is calling for concerted efforts to counter the botnet threat involving users education (Windoze users running unpatched systems and mindlessly clicking on malicious links remain a leading source of infection) and internationally co-ordinated efforts involving law enforcement agencies to track and takedown zombie PC networks and the cybercriminals behind them. ®

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Free virtual appliance for wire data analytics
The ExtraHop Discovery Edition is a free virtual appliance will help you to discover the performance of your applications across the network, web, VDI, database, and storage tiers.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.