Page 1 of 3 123 LastLast
Results 1 to 25 of 51

Thread: Microsoft Shuts Down Global Spam Network

  1. #1
    Royal Administrator
    Join Date
    Jul 2005
    Location
    New York City
    Posts
    3,434

    Microsoft Shuts Down Global Spam Network

    Microsoft has won court approval to shut down a global network of computers which it says is responsible for more than 1.5bn spam messages every day.

    A US judge granted the firm's request to shut down 277 internet domains, which it said were used to "command and control" the so-called Waledac botnet.

    A botnet is a network of infected computers under the control of hackers.

    The firm said that closing the domains would mean that up to 90,000 PCs would stop receiving orders to send out spam.

    A recent analysis by the firm found that between 3-21 December "approximately 651 million spam e-mails attributable to Waledac were directed to Hotmail accounts alone".

    It said it was one of the 10 largest botnets in the US.

    Machines in a botnet have usually been infected by a computer virus or worm. Typically, users do not know their machine has been hijacked.

    Microsoft said that although it had effectively shut down the network, thousands of computers would still be infected with malware and advised people to run anti-virus software.

    The court order was part of what was called "Operation b49".

    Along with intelligence organisation Shadowserver, the University of Washington and security firm Symantec, Microsoft managed to get a court in Alexandria, Virginia, to force Verisign, which manages the .com domain, to temporarily switch off the domains.

    Microsoft said it was the result of months of investigation and described it as a legal first.

    "This action has quickly and effectively cut off traffic to Waledac at the .com or domain registry level, severing the connection between the command and control centres of the botnet and most of its thousands of zombie computers around the world."

    Source: BBC News

  2. #2
    Xtreme Member
    Join Date
    Oct 2007
    Posts
    311
    How does Microsoft benefit from this? That is, closing a bot network?

  3. #3
    Xtreme Member
    Join Date
    Jul 2008
    Posts
    218
    They were probably using it to DDoS their servers or something, and it finally got annoying enough to throw lawyers at.

    Then again, maybe M$ actually did something constructive for people that wasn't oriented around profits... Who knows? Stranger things have happened.
    Asus P6T SE || 965 XE @ 4.0GHz [currently OCing]|| OCz DDR3 Plat 3x2Gb 1600 7-7-7-20
    2x Sapphire HD4850 CrossfireX || WD VelociRaptor 300GB || Antec Quattro 1kW PSU

    -------------------------------------------------
    Cooling:
    D-Tek FuZion v2 || Swiftech MCR320 || MCP355 w\ XSPC Res Top || Scythe S-Flexes

  4. #4
    Xtreme Addict
    Join Date
    Sep 2008
    Location
    Downunder
    Posts
    1,313
    Quote Originally Posted by krogen View Post
    How does Microsoft benefit from this? That is, closing a bot network?
    Publicity stunt.

  5. #5
    Xtreme Addict
    Join Date
    Apr 2007
    Location
    canada
    Posts
    1,886
    who cares if ms did it for their own agenda or not... botnets etc.. arent legal so ms did something good for the web community so it equals all of us.... TY bill

  6. #6
    Wanna look under my kilt?
    Join Date
    Jun 2005
    Location
    Glasgow-ish U.K.
    Posts
    4,396
    It'll weigh down their servers, wont it? I can see why it would hack them off. (No pun intended)
    Quote Originally Posted by T_M View Post
    Not sure i totally follow anything you said, but regardless of that you helped me come up with a very good idea....
    Quote Originally Posted by soundood View Post
    you sigged that?

    why?
    ______

    Sometimes, it's not your time. Sometimes, you have to make it your time. Sometimes, it can ONLY be your time.

  7. #7
    Xtreme Addict
    Join Date
    Apr 2008
    Location
    Ottawa, Canada
    Posts
    2,443
    Thanx Bill!

  8. #8
    I am Xtreme
    Join Date
    Dec 2008
    Location
    France
    Posts
    9,060
    Quote Originally Posted by Sn0wm@n View Post
    who cares if ms did it for their own agenda or not... botnets etc.. arent legal so ms did something good for the web community so it equals all of us.... TY bill
    +1
    Burn the spammers!
    Hope MS will sue whoever was behind the 'command centre' for a few millions of $$$.
    Machines in a botnet have usually been infected by a computer virus or worm. Typically, users do not know their machine has been hijacked.
    These are probably Windows based computers, too. So MS is responsible for this in a way.
    Donate to XS forums
    Quote Originally Posted by jayhall0315 View Post
    If you are really extreme, you never let informed facts or the scientific method hold you back from your journey to the wrong answer.

  9. #9
    I am Xtreme
    Join Date
    Jul 2007
    Location
    Austria
    Posts
    5,485
    If the guy behind the bot network was smart he had some backup urls for "emergency use" use so he could update the malware with new sites.... well at least i would have done it that way.

    Imho its only a temporary solution that may lats a few weeks (maybe even less)

    Quote Originally Posted by zalbard View Post
    These are probably Windows based computers, too. So MS is responsible for this in a way.
    Yeah cause ms is repsonsible for people klick on every god dman link they see on the screen... i bet if you would make a website with only one simple text lin: "get malware here" and spread it on a popular website, dozen if not hundret of people would klick it.
    Last edited by Hornet331; 02-25-2010 at 03:53 PM.

  10. #10
    I am Xtreme
    Join Date
    Dec 2008
    Location
    France
    Posts
    9,060
    Hey, I said "in a way", not "totally"! It could've been prevented if OS had some kind of built in sandbox or malicious code checker mechanism.
    Donate to XS forums
    Quote Originally Posted by jayhall0315 View Post
    If you are really extreme, you never let informed facts or the scientific method hold you back from your journey to the wrong answer.

  11. #11
    Xtreme X.I.P.
    Join Date
    Nov 2002
    Location
    Shipai
    Posts
    31,147
    Quote Originally Posted by randomizer View Post
    Publicity stunt.
    yeah, definately... one of the ten largest botnets... pff...
    and they broke it by shutting down domains... what a useless patch... i wonder how little time it takes those guys to get everything working again...

  12. #12
    Xtreme Addict
    Join Date
    Jan 2009
    Posts
    1,445
    Quote Originally Posted by Hornet331 View Post
    If the guy behind the bot network was smart he had some backup urls for "emergency use" use so he could update the malware with new sites.... well at least i would have done it that way.

    Imho its only a temporary solution that may lats a few weeks (maybe even less)



    Yeah cause ms is repsonsible for people klick on every god dman link they see on the screen... i bet if you would make a website with only one simple text lin: "get malware here" and spread it on a popular website, dozen if not hundret of people would klick it.

    lol i happen to agree with you here, but the masses will believe that they have no responsibility in the matter, and will blame MS or others for their mistakes. oh and its "click", not "klick".
    [MOBO] Asus CrossHair Formula 5 AM3+
    [GPU] ATI 6970 x2 Crossfire 2Gb
    [RAM] G.SKILL Ripjaws X Series 16GB (4 x 4GB) 240-Pin DDR3 1600
    [CPU] AMD FX-8120 @ 4.8 ghz
    [COOLER] XSPC Rasa 750 RS360 WaterCooling
    [OS] Windows 8 x64 Enterprise
    [HDD] OCZ Vertex 3 120GB SSD
    [AUDIO] Logitech S-220 17 Watts 2.1

  13. #13
    Xtreme Addict
    Join Date
    Aug 2007
    Location
    Istantinople
    Posts
    1,574
    my second thanks to billie

    (the first is getting game companies who want to make x360 games to publish those games also for the pc, even when it's barely profitable)
    Has anyone really been far even as decided to use even go want to do look more like?
    INTEL Core i7 920 // ASUS P6T Deluxe V2 // OCZ 3G1600 6GB // POWERCOLOR HD5970 // Cooler Master HAF 932 // Thermalright Ultra 120 Extreme // SAMSUNG T260 26"

  14. #14
    Xtreme Addict
    Join Date
    Sep 2005
    Location
    UK
    Posts
    1,696
    Quote Originally Posted by Zigosity View Post
    M$
    Workstation:
    3960X | 32GB G.Skill 2133 | Asus Rampage IV Extreme
    3*EVGA GTX580 HC2 3GB | 3*Dell U3011
    4*Crucial M4 256GB R0 | 6*3TB WD Green R6
    Areca 1680ix-24 + 4GB | 2*Pioneer BDR-205 | Enermax Plat 1500W
    Internal W/C | PC-P80 | G19 | G700 | G27
    Destop Audio:
    Squeezebox Duet | Beresford TC-7520 Caiman modded | NAD M3 | MA RX8 | HD650 | ATH-ES7
    Man Cave:
    PT-AT5000E | TXP65VT30 | PR-SC5509 | PA-MC5500 | MA GX300*2, GXFX*4, GXC350 | 2*BK Monolith+
    Gaming on the go:
    Alienware M18x
    i7 2920XM | 16GB DDR3 1600
    2*6990 | WLED 1080P
    2*Crucial M4 256GB | BD-RW
    BT 375 | Intel 6300 | 330W PSU

    2011 Audi R8 V10 Ibis White ABT Tuned - 600HP

  15. #15
    Registered User
    Join Date
    Jul 2007
    Location
    Wisconsin
    Posts
    957
    WAT, NO MORE VIAGRA DEALS



  16. #16
    Xtreme Member
    Join Date
    Mar 2008
    Location
    Canada
    Posts
    356
    Quote Originally Posted by saaya View Post
    yeah, definately... one of the ten largest botnets... pff...
    and they broke it by shutting down domains... what a useless patch... i wonder how little time it takes those guys to get everything working again...
    Just the time to get a new domain and infect some few hundreds newbe computer user who in trn will infect their friends.

    2 days

  17. #17
    Xtreme X.I.P.
    Join Date
    Nov 2002
    Location
    Shipai
    Posts
    31,147
    Quote Originally Posted by The_Beast View Post
    WAT, NO MORE VIAGRA DEALS


    hahaha

    Quote Originally Posted by Sn@ke:~ View Post
    Just the time to get a new domain and infect some few hundreds newbe computer user who in trn will infect their friends.

    2 days
    heh, yeah, just rip some popular pc games, bundle a modified trojan with it and spread it on p2p networks like crazy and a few days later theyll be up and running like nothing ever happened...

    they only emptied one of the many buckets they put under their leaky roof...

  18. #18
    Xtreme Mentor
    Join Date
    Jan 2009
    Location
    Oslo - Norway
    Posts
    2,879
    The news says: "Microsoft has won court approval to shut down a global network ... ", it means they have permission to do something , but it doest mean they can actually shut it down.

    Nobody can shut down a botnet. It will be up and running in no time, just in a different cycle. But good attempt, anyways.

    EDIT:
    When i think about it, nobody needs a "court approval" for stopping hackers. But hey, maybe M$ needs court approval to shut down the infected clients remotely to stop those nasty DDoS attacks?
    Last edited by Sam_oslo; 02-25-2010 at 05:39 PM.

    ASUS P8P67 Deluxe (BIOS 1305)
    2600K @4.5GHz 1.27v , 1 hour Prime
    Silver Arrow , push/pull
    2x2GB Crucial 1066MHz CL7 ECC @1600MHz CL9 1.51v
    GTX560 GB OC @910/2400 0.987v
    Crucial C300 v006 64GB OS-disk + F3 1TB + 400MB RAMDisk
    CM Storm Scout + Corsair HX 1000W
    +
    EVGA SR-2 , A50
    2 x Xeon X5650 @3.86GHz(203x19) 1.20v
    Megahalem + Silver Arrow , push/pull
    3x2GB Corsair XMS3 1600 CL7 + 3x4GB G.SKILL Trident 1600 CL7 = 18GB @1624 7-8-7-20 1.65v
    XFX GTX 295 @650/1200/1402
    Crucial C300 v006 64GB OS-disk + F3 1TB + 2GB RAMDisk
    SilverStone Fortress FT01 + Corsair AX 1200W

  19. #19
    Xtreme Enthusiast
    Join Date
    Jun 2007
    Location
    Finland
    Posts
    831
    Quote Originally Posted by Sam_oslo;4260299 begin_of_the_skype_highlighting:banana::banana::ba nana::banana::banana::banana::banana::banana::bana na::banana::banana::banana::banana::banana:4260299 :banana::banana::banana::banana::banana::banana:en d_of_the_skype_highlighting
    The news says: "Microsoft has won court approval to shut down a global network ... ", it means they have permission to do something , but it doest mean they can actually shut it down.

    Nobody can shut down a botnet. It will be up and running in no time, just in a different cycle. But good attempt, anyways.

    EDIT:
    When i think about it, nobody needs a "court approval" for stopping hackers. But hey, maybe M$ needs court approval to shut down the infected clients remotely to stop those nasty DDoS attacks?
    Shutting down infected clients remotely is like them saying "Yes we have intentional backdoor's in Windows operating system"

    ::: Desktop's - Intel *** Intel 2
    2 x Xeon E5-2687W *** Intel i7 3930k
    EVGA SR-X *** Asus Rampage IV Extreme
    96Gb (12x8Gb) G.Skill Trident X DDR3-2400MHz 10-12-12-2N *** 32Gb (8x4Gb) G.Skill Trident X DDR3-2666 10-12-12-2N
    3 x Zotac GTX 680 4Gb + EK-FC680 GTX Acetal *** 3 x EVGA GeForce GTX780 + EK Titan XXL Edition waterblocks.
    OCZ RevoDrive 3 x4 960Gb *** 4 x Samsung 840 Pro 512Gb
    Avermedia LiveGamer HD capture card
    Caselabs TX10-D
    14 x 4 TB WD RE4 in RAID10+2Spare
    4 x Corsair AX1200

    ::: Basement DataCenter :::
    [*] Fibreoptic connection from operators core network
    [*] Dell PowerConnect 2848 Ethernet Switch [*] Network Security Devices by Cisco
    [*] Dell EqualLogic PS6500E 96Tb iSCSI SAN (40 2Tb Drives + 8 Spare Drives, Raid10+Spare Configuration, 40Tb fail safe storage)
    [*] Additional SAN machines with FusionIO ioDrive Octal's (4 total Octals).
    [*] 10 x Dual Xeon X5680, 12Gb DDR3, 2x100Gb Vertex 2 Pro Raid1 [*] 4 x Quad Xeon E7-4870, 96Gb DDR3, 2x100Gb Vertex 2 Pro Raid1

    [*] Monster UPS unit incase power grid failure backed up by diesel powered generator.

  20. #20
    Xtreme CCIE
    Join Date
    Dec 2004
    Location
    Atlanta, GA
    Posts
    3,842
    Microsoft does more for general security than most people realize. They have transformed dramatically from the times when they were somewhat lazily fixing security bugs. They now have a large and quickly growing security force and engage in battles like this regularly. For example, recall a few years back when they put the huge bounty on the guy who wrote the MS Blaster virus?

    Quote Originally Posted by rintamarotta View Post
    Shutting down infected clients remotely is like them saying "Yes we have intentional backdoor's in Windows operating system"
    No... it's like saying "we can't patch already infected systems because the virus is designed not to allow that".

    Edit: Actually, I guess I could read this another way. MS is not shutting down the clients, they are shutting down the command and control center for the clients and they are not doing it through a back door, they are having the domain holders turn off the taps. Hopefully for them they can get that done before the people controlling these viruses can redirect them (the part that makes this an almost futile effort). The clients will remain infected, but without the ability to direct them the viruses will effectively not be able to do anything (in theory).
    Last edited by Serra; 02-26-2010 at 06:47 AM.
    Dual CCIE (Route\Switch and Security) at your disposal. Have a Cisco-related or other network question? My PM box is always open.

    Xtreme Network:
    - Cisco 3560X-24P PoE Switch
    - Cisco ASA 5505 Firewall
    - Cisco 4402 Wireless LAN Controller
    - Cisco 3502i Access Point

  21. #21
    Xtreme Addict
    Join Date
    Aug 2005
    Location
    Germany
    Posts
    2,247
    Quote Originally Posted by krogen View Post
    How does Microsoft benefit from this? That is, closing a bot network?
    it's in the article:

    A recent analysis by the firm found that between 3-21 December "approximately 651 million spam e-mails attributable to Waledac were directed to Hotmail accounts alone".
    hotmail is run by microsoft. spam wastes a lot bandwidth and ressources.

    even if it's for ms own benefit it's a good thing for everyone. however, people who got infected by these kinds of viruses are likely to get new versions of it with a fresh list of new working domains as well
    so it won't take long for the botnet to be up and running again i guess.
    1. Asus P5Q-E / Intel Core 2 Quad Q9550 @~3612 MHz (8,5x425) / 2x2GB OCZ Platinum XTC (PC2-8000U, CL5) / EVGA GeForce GTX 570 / Crucial M4 128GB, WD Caviar Blue 640GB, WD Caviar SE16 320GB, WD Caviar SE 160GB / be quiet! Dark Power Pro P7 550W / Thermaltake Tsunami VA3000BWA / LG L227WT / Teufel Concept E Magnum 5.1 // SysProfile


    2. Asus A8N-SLI / AMD Athlon 64 4000+ @~2640 MHz (12x220) / 1024 MB Corsair CMX TwinX 3200C2, 2.5-3-3-6 1T / Club3D GeForce 7800GT @463/1120 MHz / Crucial M4 64GB, Hitachi Deskstar 40GB / be quiet! Blackline P5 470W

  22. #22
    Xtreme X.I.P.
    Join Date
    Nov 2002
    Location
    Shipai
    Posts
    31,147
    Quote Originally Posted by Serra View Post
    Microsoft does more for general security than most people realize. They have transformed dramatically from the times when they were somewhat lazily fixing security bugs. They now have a large and quickly growing security force and engage in battles like this regularly. For example, recall a few years back when they put the huge bounty on the guy who wrote the MS Blaster virus?
    thats funny, cause imo shutting down domains to try and stop a botnet is the laziest approach to solving the problem i can think of... what was their first attempt? emailing them and asking them to please please stop?
    how about actually fixing the vulnerabilities?

    and putting out a bounty is another perfect example of an easy way out... if you just put out a big enough bounty SOMEBODy SOMEWHERE will most likely solve your problem one way or the other...
    and there is a HUGE vulnerability in IE6 7 AND 8 that microsoft has been made aware of how many months ago and they havent done a single thing?
    sorry, but adobe, linux, ubuntu, suse, sun/oracle, sap, ibm, firefox, google chrome, gmail, yahoo, apple... they all fix their vulnerabilities in acceptable to short periods of time, its only microsoft that takes forever to even acknowledge a problem, and then even more time to actually fix it...

    im not saying thats the truth, im just saying from all i read and see and hear going on, thats how it looks to me...
    Last edited by saaya; 02-26-2010 at 07:30 AM.

  23. #23
    Xtreme CCIE
    Join Date
    Dec 2004
    Location
    Atlanta, GA
    Posts
    3,842
    Quote Originally Posted by saaya View Post
    thats funny, cause imo shutting down domains to try and stop a botnet is the laziest approach to solving the problem i can think of... what was their first attempt? emailing them and asking them to please please stop?
    how about actually fixing the vulnerabilities?
    Shutting down the botnet domains is not the laziest approach, it's by far the most time- and money-intensive one. Many viruses prevent automatic updates, and hence MS had no alternative for stopping the viruses except to shut down the domains. Doing so required significant (and precedent setting) litigation, which does not come cheap.

    This is the step you take after fixing the technical hole with updates, and it's actually very interesting that it has been done as no-one else has ever done this (consider, for example, that Norton/Symmantec/etc have never done this type of thing, they exist solely to fight viruses).



    Quote Originally Posted by saaya View Post
    and putting out a bounty is another perfect example of an easy way out... if you just put out a big enough bounty SOMEBODy SOMEWHERE will most likely solve your problem one way or the other...
    I don't believe anyone ever collected the bounty, or at least that was the case for year(s) after. And the bounty was for $250,000, really quite a substantial amount of money - especially when you consider the culprit was believed to have been in a 'third-world' country iirc where it tends to go further.


    Quote Originally Posted by saaya View Post
    and there is a HUGE vulnerability in IE6 7 AND 8 that microsoft has been made aware of how many months ago and they havent done a single thing?
    sorry, but adobe, linux, ubuntu, suse, sun/oracle, sap, ibm, firefox, google chrome, gmail, yahoo, apple... they all fix their vulnerabilities in acceptable to short periods of time, its only microsoft that takes forever to even acknowledge a problem, and then even more time to actually fix it...

    im not saying thats the truth, im just saying from all i read and see and hear going on, thats how it looks to me...
    Ummmm... you can pretty well cross Adobe, Linux (including Ubuntu/Suse), Sun, IBM, and Apple off your list there. Probably chrome and gmail too. Adobe had one of the longest running farces in security until quite recently, Linux's average response time from a security bug report to resolution is higher than Microsoft's, IBM and Sun take forever to update because every change needs such a ridiculous amount of validation, and Apple...well, then run on Linux.

    It may seem like Microsoft is slow, but among the giants they are actually quite responsive these days. Proactive even, when you consider their relatively new security essentials software that is offered for free and does a bang-up job providing a service that people really should have been going to an antivirus company for in the first place.
    Dual CCIE (Route\Switch and Security) at your disposal. Have a Cisco-related or other network question? My PM box is always open.

    Xtreme Network:
    - Cisco 3560X-24P PoE Switch
    - Cisco ASA 5505 Firewall
    - Cisco 4402 Wireless LAN Controller
    - Cisco 3502i Access Point

  24. #24
    Worlds Fastest F5
    Join Date
    Aug 2006
    Location
    Room 101, Ministry of Truth
    Posts
    1,615
    Not sure if your machine is pwned?

    DU meter is your friend
    X5670 B1 @175x24=4.2GHz @1.24v LLC on
    Rampage III Extreme Bios 0003
    G.skill Eco @1600 (7-7-7-20 1T) @1.4v
    EVGA GTX 580 1.5GB
    Auzen X-FI Prelude
    Seasonic X-650 PSU
    Intel X25-E SLC RAID 0
    Samsung F3 1TB
    Corsair H70 with dual 1600 rpm fan
    Corsair 800D
    3008WFP A00



  25. #25
    Xtreme Addict
    Join Date
    Apr 2008
    Location
    Ottawa, Canada
    Posts
    2,443
    Well to cut off a botnet you have to cut off it's many heads. They needed the legal ground to cut off one of the heads and I am sure they are already set to cut the rest in their own way. Heck they can turn around and steal the botnet away from the hacker and use their own servers to keep it under control and use it for spidering sites for 'Bing'. Who knows what else they are going to do.

Page 1 of 3 123 LastLast

Bookmarks

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •