Feeds

Chinese Nitol botnet host back up after Microsoft settles lawsuit

Owner agrees to chuck nasties down the sinkhole

The Essential Guide to IT Transformation

Microsoft has reached a settlement with the Chinese site linked to the Nitol DDoS botnet.

The emerging Nitol botnet was hosted by the 3322.org domain. In order to stem the threat, Microsoft filed a suit to take control of the 70,000 malicious subdomains hosted on 3322.org, gaining control of the domain in mid September.

Redmond uncovered the scam during an investigation (PDF) into insecure supply chains. It seems that corrupt (but unnamed) computer resellers in China were planting malware on victims' machines as a means to make extra money from pay-per-install malware affiliate programs and similar scams.

The 3322.org played host to a multitude of backdoors, Trojans and other strains of malware as well as Nitol prior to the Redmond-initiated enforcement action.

The operator of 3322.org, Peng Yong, recently agreed to work in cooperation with Microsoft and the Chinese Computer Emergency Response Team (CN-CERT) to fight cybercrime. Based on this settlement agreement, Redmond allowed the 3322.org domain to resume operations, on condition that that any sub-domains linked to malware are placed on a "block-list" and redirected to a sink-hole managed by Microsoft. 3322.org also agreed to help identify computer users in China left infected by the earlier spread of the Nitol botnet and other malware strains tied to 3322.org.

"We’re very pleased by this outcome, which will help guarantee that the 70,000 malicious subdomains associated with 3322.org will never again be used for cybercrime," Richard Domingues Boscovich, assistant general counsel at Microsoft's Digital Crimes Unit, writes in a blog post announcing the settlement.

In the 16 days since we began collecting data on the 70,000 malicious subdomains, we have been able to block more than 609 million connections from over 7,650,000 unique IP addresses to those malicious 3322.org subdomains. In addition to blocking connections to the malicious domains, we have continued to provide DNS services for the unblocked 3322.org subdomains. For example, on Sept 25, we successfully processed 34,954,795 DNS requests for 3322.org subdomains that were not on our block list.

Microsoft has passed on its data of infected IP addresses to the Shadow Server Foundation, which is working with Computer Emergency Response Teams (CERTs) and ISPs across the world to clean-up the remnants of the Nitol botnet.

Operation b70 – against the Nitol botnet and other strains of malware previously distributed via the 3322.org domain – was Microsoft’s fifth disruptive action against malware as part of Redmond's ongoing Project MARS (Microsoft Active Response for Security) initiative. Previous botnet takedown operations by Redmond have targeted the Waledac, Rustock, Kelihos and Zeus botnets over the last two-and-a-half years. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.