Feeds

Feds move to uninstall bot that hit banks, airports, cops

Drainage of Coreflood continues

Top 5 reasons to deploy VMware with Tegile

The notorious Coreflood botnet has penetrated a veritable who's who of sensitive organizations, including banks, state and local governments, airports, defense contractors, and a police department, an FBI agent said in sworn testimony.

An executive of one compromised hospital healthcare network found that 2,000 of its 14,000 computers were infected with malware, which sniffs out banking passwords and other sensitive data and sends them to servers controlled by thieves. The agent said some 35 colleges and universities and hundreds of businesses have been hit by the decade-old Coreflood, which government investigators estimate infects more than 413,000 computers.

The written testimony from Special Agent Briana Neumiller was submitted in the FBI's unprecedented legal effort to dismantle Coreflood by taking over the servers and hundreds of domain names it uses to send commands to infected PCs under its control. Neumiller's declaration came in the government's request for a preliminary injunction extending the government's authority to issue “stop” commands to the zombie machines that disable the Coreflood malware until the next reboot.

US District Judge Vanessa Bryant of Connecticut granted the motion on Monday.

The stop commands are intended to be an interim step designed to prevent Coreflood from regrouping until a permanent fix can be put in place. It involves taking down the botnet's command-and-control system that doles out instructions and malware updates when infected machines report to it. In its place, the government has installed two substitute servers that respond with the stop commands.

It is the first time government authorities have ever issued commands to infected PCs in an attempt to take down a botnet. They are intended to prevent the Coreflood operators from regaining control of the infected machines by sending their own set of commands that instruct them to report to a new set of command-and-control servers.

So far, the maneuver appears to be working, Neumiller said. Within 72 hours of the Coreflood seizure, beacons sent from infected computers fell from almost 800,000 per day to some 150,000, and by Friday, that number sank below 100,000 for the first time since the operation began.

With the issuance of the preliminary injunction allowing the operation to continue, the government can now move to its second step, which is intended to permanently remove the Coreflood malware from the hundreds of thousands of computers it has infected. The disinfection involves tracking down the individual owners and getting their permission to issue an “uninstall” command from the substitute servers.

“Removing Coreflood in this manner could be used to delete Coreflood from infected computers and to 'undo' certain changes made by Coreflood to the Windows operating system when Coreflood was first installed,” Neumiller wrote. “The process does not affect any user files on an infected computer, nor does it require physical access to the infected computer or access to any data on the infected computer.”

FBI researchers have successfully used the procedure on test computers, but a waiver that infected machine owners are asked to sign releases the feds from any legal liability should things go wrong.

The government is now in the process of sifting through what is likely millions of IP addresses and correlating them to public and ISP records to identify and contact the US-based owners of the infected machines. It is also collecting the IP addresses of owners believed to be located outside US borders and referring them to authorities in foreign countries.

At no point do federal authorities have any control over infected computers or access to personal data residing on them, and owners who want to opt out of the disinfection routine may do so. ®

Remote control for virtualized desktops

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.