Robert Lemos

Botnet takedown sets legal, not technical, precedent

In the security industry, researchers have often been able to infiltrate botnets. Yet, the next step has always been a big question mark.

Now, defenders may have a new slate of options. The takedown of the Coreflood botnet marks the start of more aggressive stance against botnets, say security experts. Last week, the U.S. Department of Justice obtained a temporary restraining order forcing registrars to reroute requests from infected computers, not to Coreflood's command-and-control servers, but to a substitute server managed by a non-profit group. Under the judge's order, the sinkhole server can issue commands to prevent the bot agents from carrying out normal operations.

The result has been a drop of several orders of magnitude in the activity from the botnet, says Don Jackson, director of threat intelligence for Dell SecureWorks.

CSO Online

Microsoft Builds Legal Weapon to Take Apart Botnets

The take-down of the Rustock botnet in March gave Microsoft another head for its mantle: two in just the last year. That’s an impressive take for any private firm, and one of a string of actions against bot networks in recent years. But security experts say that the company’s success in building a legal basis for moving against botnets is an even bigger achievement.

threatpost.com

Securing All Androids Proves Tricky

With Android, each mobile phone company has its own build of the Android operating system so that it can include its own user interface, graphics, and branding. Although Google released an updated version of Android that fixed the vulnerability soon after it was discovered, at least 42 percent of phones run an older version that is still vulnerable, according to data available on the Android developer site.

Technology Review

DroidDream turns Androids into zombies

The malicious code that led Google to remove more than 50 Trojan applications from the Android Marketplace appears to mainly be a "dropper" -- a program designed to load other code to further compromise the affected smartphone, according to a security firm's analysis.

The code, dubbed "DroidDream," attempts to use two exploits to gain root privilege on a compromised smartphone by breaking out of the sandbox designed to limit what applications can do on Android devices, mobile security firm Lookout stated in its most recent analysis.

CSO Online

Secure best practices no proof against Stuxnet

Companies infected by Stuxnet should not feel bad -- even systems secured to industry best practices had little chance to dodge the pernicious program, according to a recent report.

In the paper, "How Stuxnet Spreads - A Study of Infection Paths in Best Practice Systems," three researchers concluded that the worm's multitude of infection vectors and companies' need for interconnectivity between control systems makes it nearly impossible to defend against a well-constructed, multi-pronged attack such as Stuxnet.

CSO Online

InfoWorld Tech Watch Blog - Week of August 30

Published this week: Breaking the Internet in one easy step • What it takes to shut down a botnet • Skyrocketing viruses, less danger?

InfoWorld Tech Watch Blog - Week of August 23, 2010

Published this week: Pac-Man for president: Hack highlights e-voting flaws • The Pentagon plays security catch-up

Malevolent Zeus

It does not take Alex Heid long to break into the website’s database.

With a run-of-the-mill browser and knowledge of a backdoor in the online portal, Heid makes quick work of the software's security and grabs the targeted data: A database of usernames and passwords for a variety of sites and services, from banks to email to Facebook.

Yet Heid is one of the good guys. The website is one of the many set up by a program known as Zeus -- sort of a do-it-yourself cybercrime platform that has become extremely popular for its ease of use and advanced functionality. Zeus allows digital thieves and fraudsters to create code to infect computer systems. It has software to control the legions of compromised computers, and it comes with templates to create and manage campaigns of online crime.

Symantec's YourSecurityResource.com

Your Money or Your Data

In the summer of 2008, a particularly nasty piece of code started spreading among computers in Russia and Europe. Known as GPCode, the program was designed for a specific mission: infect the system, find more than 130 different file types on the hard drive, encrypt them and deleted the originals.

In essence, the program kidnapped a victim's data. And like any proficient kidnapper, the program left behind a note.

"Your files are encrypted with RSA-1024 algorithm," read a message on the screen. "To recover your files, you need to buy our decryptor."

YourSecurityResource.com

Zeus Attracts Developer Ecosystem

For the entry-level cybercriminal, the Zeus do-it-yourself botnet creation kit has become the go-to program for getting a modest botnet up and running.

An entire business ecosystem has evolved to serve the needs of would-be cybercriminals. Their draw to Zeus: Ease of use, a competitive marketplace, and lots of customization. The result is that cybercriminal networks based on the Zeus kits account for about one-in-ten botnets, according to security firm Damballa.

And the demand is feeding more development and competition, says Gunter Ollmann, Damballa’s vice president of research.

UnsafeBits