Feeds

US Federal Trade Commission shuts down ISP

Provider accused of harboring malware, child porn

SANS - Survey on application security programs

Federal authorities have shut down what they said was the worst US-based web hosting provider after convincing a judge it actively participated in the distribution of child pornography, spam, malware, and other net-based menaces.

The US Federal Trade Commission obtained the court order against 3FN.net, a service provider with servers mostly located in San Jose, California that also operated under the name Pricewert. Dated June 2, it commanded all companies providing upstream services to 3FN to immediately pull the plug. The order was issued in secret to prevent the operators from being able to destroy evidence or find new hosts, something FTC attorneys said was necessary given the extreme nature of the data it hosted.

"This content includes a witches' brew of child pornography, botnet command and control servers, spyware, viruses, trojans, phishing-related sites, and pornography featuring violence, bestiality, and incest," they wrote in court documents. "In addition to recruiting and willingly distributing this illegal, malicious and harmful content, Pricewert actively colludes with its criminal clientele in several areas, including the maintenance and deployment of networks of compromised computers known as botnets."

This week's action is the most significant shutdown since the shuttering in November of McColo, another Northern California-based service provider with ties to online crime. In the months following the takedown, spam volume dropped by as much as 40 percent.

So far, we're not seeing a similar decline in junk mail this time around, even though 3FN was a major provider for Cutwail, a notorious spam botnet with more than 1 million infected machines under its control, security analysts said.

"We suspect it's been programmed in such a way that when the command and control goes down it just continues to execute" old instructions, said Matt Sergeant, a senior antispam technologist at MessageLabs, which was recently purchased by Symantec. "That gives the spammers time to find a new command and control host. McColo taught spammers that they needed multiple command and controls and not to put all their eggs in one basket."

Court documents alleged a litany of illegal services that 3FN operators actively offered. They include:

  • The site allegedly communicated with malicious software hosted McColo. Investigators who sifted through the contents of the latter shuttered provider found instant message logs in which high-level 3FN employees provided technical support to customers trying to configure botnets with as many as 200,000 nodes.
  • A NASA investigator probing intrusions to the space agency's networks found 22 separate attacks on NASA computers originating from IP addresses controlled by 3FN, including five this year, one as recently as April. NASA estimates it has spent more than $14,000 to repair the damage.
  • A separate investigator managed to peer inside 3FN after reverse engineering malware masquerading as a video player that was hosted by the provider. What he found were logs showing that thousands of computers had been compromised by the malicious code. He also located more than 40 websites hosted by 3FN that are possible hosts of child pornography, some with names such as little-incest.com and littles-raped.com. Using a text-only browser to visit some of the sites, he found text promising "illegal photos of little girls" and "very little schoolgirls raped."

One of the biggest complaints among white hat hackers is the difficulty of shutting down networks that flagrantly violate the law. This week's action is the first time the FTC has used its congressional mandate to protect US consumer to sever a service provider suspected of illegal activity.

The temporary restraining order, issued by US District Judge Ronald M. White of San Jose, also freezes all of the company's assets. A hearing in the case is scheduled for June 15.

Assistance in the case came from a variety of sources including , computer forensics expert Gary Warner from the University of Alabama at Birmingham, NASA's office of the inspector general, the National Center for Missing and Exploited Children, the Shadowserver Foundation, Symantec and the Spamhaus project.

Court documents are available here. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.