Feeds

Microsoft seizes Chinese dot-org to kill Nitol bot army

Takedown after infected new computers sold to victims

5 things you didn’t know about cloud backup

Microsoft has disrupted the emerging Nitol botnet - and more than 500 additional strains of malware - by taking control of a rogue dot-org website. The takedown is the latest in Microsoft's war against armies of hacker-controlled PCs.

The Windows 8 giant's Operation b70 team discovered crooks were selling computers loaded with counterfeit software and malware - including a software nastie that takes control of each machine to carry out orders from the Nitol central command server.

Operation b70 uncovered the industrial-scale scam during an investigation into insecure supply chains [PDF]. Microsoft blames corrupt but unnamed resellers in China.

Computers in the Nitol botnet would communicate with a command server whose DNS was provided by Chinese-run 3322.org, which has been linked to malicious activity since 2008. Microsoft investigators also discovered that other servers using 3322.org, which offers its services for free, harboured more than 500 different strains of malware across more than 70,000 sub-domains. These nasties included key-stroke loggers and banking Trojans.

Microsoft obtained a US court order to seize control of 3322.org - a site Google's Safe Browsing system warned was home to "malicious software including 1609 exploits, 481 trojans and 6 scripting exploits". The order instructs the US-based Public Interest Registry, which operates the DNS for all .org domains, to redirect internet traffic for 3322.org to the Redmond giant's servers.

Sub-domains associated with the malware have been blocked while legitimate domains have been allowed to stay online, as a statement from Microsoft on the takedown explains:

On Sept 10, the court granted Microsoft’s request for an ex parte temporary restraining order against Peng Yong, his company and other John Does. The order allows Microsoft to host the 3322.org domain, which hosted the Nitol botnet, through Microsoft’s newly created domain name system (DNS). This system enables Microsoft to block operation of the Nitol botnet and nearly 70,000 other malicious subdomains hosted on the 3322.org domain, while allowing all other traffic for the legitimate subdomains to operate without disruption.

DNS security firm Nominum helped in the legal case, filed in the US District Court for the Eastern District of Virginia, as well as assisting Microsoft in filtering the 3322.org domain traffic.

The operation was part of the ongoing Project MARS (Microsoft Active Response for Security), which previously led to the successful takedown of the Waledac, Rustock and Kelihos botnets. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
HP: NORKS' cyber spying efforts actually a credible cyberthreat
'Sophisticated' spies, DIY tech and a TROLL ARMY – report
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.