Feeds

Feds move to uninstall bot that hit banks, airports, cops

Drainage of Coreflood continues

Build a business case: developing custom apps

The notorious Coreflood botnet has penetrated a veritable who's who of sensitive organizations, including banks, state and local governments, airports, defense contractors, and a police department, an FBI agent said in sworn testimony.

An executive of one compromised hospital healthcare network found that 2,000 of its 14,000 computers were infected with malware, which sniffs out banking passwords and other sensitive data and sends them to servers controlled by thieves. The agent said some 35 colleges and universities and hundreds of businesses have been hit by the decade-old Coreflood, which government investigators estimate infects more than 413,000 computers.

The written testimony from Special Agent Briana Neumiller was submitted in the FBI's unprecedented legal effort to dismantle Coreflood by taking over the servers and hundreds of domain names it uses to send commands to infected PCs under its control. Neumiller's declaration came in the government's request for a preliminary injunction extending the government's authority to issue “stop” commands to the zombie machines that disable the Coreflood malware until the next reboot.

US District Judge Vanessa Bryant of Connecticut granted the motion on Monday.

The stop commands are intended to be an interim step designed to prevent Coreflood from regrouping until a permanent fix can be put in place. It involves taking down the botnet's command-and-control system that doles out instructions and malware updates when infected machines report to it. In its place, the government has installed two substitute servers that respond with the stop commands.

It is the first time government authorities have ever issued commands to infected PCs in an attempt to take down a botnet. They are intended to prevent the Coreflood operators from regaining control of the infected machines by sending their own set of commands that instruct them to report to a new set of command-and-control servers.

So far, the maneuver appears to be working, Neumiller said. Within 72 hours of the Coreflood seizure, beacons sent from infected computers fell from almost 800,000 per day to some 150,000, and by Friday, that number sank below 100,000 for the first time since the operation began.

With the issuance of the preliminary injunction allowing the operation to continue, the government can now move to its second step, which is intended to permanently remove the Coreflood malware from the hundreds of thousands of computers it has infected. The disinfection involves tracking down the individual owners and getting their permission to issue an “uninstall” command from the substitute servers.

“Removing Coreflood in this manner could be used to delete Coreflood from infected computers and to 'undo' certain changes made by Coreflood to the Windows operating system when Coreflood was first installed,” Neumiller wrote. “The process does not affect any user files on an infected computer, nor does it require physical access to the infected computer or access to any data on the infected computer.”

FBI researchers have successfully used the procedure on test computers, but a waiver that infected machine owners are asked to sign releases the feds from any legal liability should things go wrong.

The government is now in the process of sifting through what is likely millions of IP addresses and correlating them to public and ISP records to identify and contact the US-based owners of the infected machines. It is also collecting the IP addresses of owners believed to be located outside US borders and referring them to authorities in foreign countries.

At no point do federal authorities have any control over infected computers or access to personal data residing on them, and owners who want to opt out of the disinfection routine may do so. ®

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
Plug and PREY: Hackers reprogram USB drives to silently infect PCs
BadUSB instructs gadget chips to inject key-presses, redirect net traffic and more
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?