Feeds

Sality botnet takedown plans posted online

Valid attack could seize infected machines

Protecting against web application threats using SSL

Updated A self-describer "law-abiding citizen" has posted attack plans against the Sality botnet on the Full Disclosure security mailing list, along with a tongue-in-cheek warning not to enact them since that would be illegal.

"It has come to my attention that it is not only possible but easy to seize control of version three of the botnet, and, more importantly, take it down. Sadly, doing so would require breaking the law. For this reason, I have to request that nobody perform the steps I am about describe," the author says, with more than a hint of irony.

The details of the plan are in an online archive and contain SQL injection tools that can be used to add a copy of an encrypted version of the AVG Sality removal utility into the botnet. It also has a Python script that, the author claims, will get an updated list of targets from the botnet's P2P network. The author also suggests the paranoid should open the file via a locked down virtual system to avoid any possibility that this is a hoax designed to infect security researchers.

The posted plans are for attacking version three of the Sality code, but security companies report the botnet controllers have already started to upgrade to a new version, so even if the attack works, the effect would be muted. The current version installs a keylogger, VoIP cracking tools, spam relays, and some experimental malware combinations

The Sality botnet is one of the bigger botnets, thought to be about the same size as Rostock, and was first spotted in June 2003, according to a recent a white paper from Symantec. It was apparently named after the Russian town of “Salavat City”, although the command and control servers are thought to be in the US, UK, and the Netherlands.

There are removal tools out there for it, but some people aren't using them. In terms of its hosts, Symantec reports over a fifth of the infected PCs that form the botnet are in Romania, with Brazil and India the next most common. ®

Update

An examination of the exploit package posted on Full Disclosure suggests it could work at taking down the Sality botnet, but could also be used to take it over and use it for other purposes.

"From what I've read, the attack looks valid, and if performed it's likely that they would work – but whether it would be an efficient takedown or just give the operators a blip in the system I'm not sure," Liam O Murchu, manager of operations for Symantec's Security Response team, told The Register.

The attack seeks to inject a virus cleaning system into the botnet, essentially ordering it to wipe itself, but this isn't necessarily the payload that could be used he warned. If someone scripted their own attack code then it would be possible to take over those machines in the botnet and use then for any purpose. Stealing machines in this way is an increasingly common tactic in the malware industry he said.

While there's no way of knowing how many of the machines in the Sality botnet are still using the vulnerable version three of the malware, he cautioned about users taking the law into their own hands and attacking the botnet. The potential knock on effects to infected systems and networks could be large and this kind behavior has often caused more trouble than it solved in the past.

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.