Feeds

Feds move to uninstall bot that hit banks, airports, cops

Drainage of Coreflood continues

5 things you didn’t know about cloud backup

The notorious Coreflood botnet has penetrated a veritable who's who of sensitive organizations, including banks, state and local governments, airports, defense contractors, and a police department, an FBI agent said in sworn testimony.

An executive of one compromised hospital healthcare network found that 2,000 of its 14,000 computers were infected with malware, which sniffs out banking passwords and other sensitive data and sends them to servers controlled by thieves. The agent said some 35 colleges and universities and hundreds of businesses have been hit by the decade-old Coreflood, which government investigators estimate infects more than 413,000 computers.

The written testimony from Special Agent Briana Neumiller was submitted in the FBI's unprecedented legal effort to dismantle Coreflood by taking over the servers and hundreds of domain names it uses to send commands to infected PCs under its control. Neumiller's declaration came in the government's request for a preliminary injunction extending the government's authority to issue “stop” commands to the zombie machines that disable the Coreflood malware until the next reboot.

US District Judge Vanessa Bryant of Connecticut granted the motion on Monday.

The stop commands are intended to be an interim step designed to prevent Coreflood from regrouping until a permanent fix can be put in place. It involves taking down the botnet's command-and-control system that doles out instructions and malware updates when infected machines report to it. In its place, the government has installed two substitute servers that respond with the stop commands.

It is the first time government authorities have ever issued commands to infected PCs in an attempt to take down a botnet. They are intended to prevent the Coreflood operators from regaining control of the infected machines by sending their own set of commands that instruct them to report to a new set of command-and-control servers.

So far, the maneuver appears to be working, Neumiller said. Within 72 hours of the Coreflood seizure, beacons sent from infected computers fell from almost 800,000 per day to some 150,000, and by Friday, that number sank below 100,000 for the first time since the operation began.

With the issuance of the preliminary injunction allowing the operation to continue, the government can now move to its second step, which is intended to permanently remove the Coreflood malware from the hundreds of thousands of computers it has infected. The disinfection involves tracking down the individual owners and getting their permission to issue an “uninstall” command from the substitute servers.

“Removing Coreflood in this manner could be used to delete Coreflood from infected computers and to 'undo' certain changes made by Coreflood to the Windows operating system when Coreflood was first installed,” Neumiller wrote. “The process does not affect any user files on an infected computer, nor does it require physical access to the infected computer or access to any data on the infected computer.”

FBI researchers have successfully used the procedure on test computers, but a waiver that infected machine owners are asked to sign releases the feds from any legal liability should things go wrong.

The government is now in the process of sifting through what is likely millions of IP addresses and correlating them to public and ISP records to identify and contact the US-based owners of the infected machines. It is also collecting the IP addresses of owners believed to be located outside US borders and referring them to authorities in foreign countries.

At no point do federal authorities have any control over infected computers or access to personal data residing on them, and owners who want to opt out of the disinfection routine may do so. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.