Feeds

'Quarter' of TWO-MILLION-strong zombie PC army lured to their deaths

Pied piper Symantec says it led infected computers into sinkhole

Protecting against web application threats using SSL

Symantec has claimed credit for luring a significant lump of the powerful ZeroAccess botnet into a sinkhole.

ZeroAccess has been active since 2011 and is one of the largest known botnets in existence: it has upwards of 1.9 million infected computers forming its army, all remotely controlled by miscreants. This swarm of PC robots is put to work generating tens of millions of dollars annually, it is estimated.

It's claimed crooks make money from the infected Windows machines by instructing the computers to virtually (and fraudulently) click on web adverts, thus ramping up income for an affiliate ad network, or (to a lesser extent) mine for new Bitcoins.

By subverting the communications system used by the bots to organise, Symantec has sinkholed - gained control or disabled, in other words - more than half a million bots, we're told.

This will have made a serious dent in the number of zombie drones under the thrall of the ZeroAccess gang. Symantec said it is working with ISPs and government computer security teams (CERTs) worldwide to help get infected machines cleaned up.

ZeroAccess infects Microsoft-powered computers caught up in drive-by-downloads: booby-trapped websites attempt to exploit security holes in web surfers' machines to install the malware. It then uses a rootkit to hide itself from the operating system and the victim, set itself up on a secret file system, downloads yet more software nasties, connects to other infected systems and opens up backdoor access.

The ZeroAccess botnet is sophisticated and resilient, using a peer-to-peer architecture to communicate. Thus, it enjoys a high degree of redundancy and no central command-and-control server for the good guys to target. As a result nobody is under any illusions that Symantec's action has finally put paid to the zombie network.

More details on the takedown effort can be found in a blog post by Symantec here. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.