07:33 PM
Connect Directly

Bredolab Botnet Busted

The Dutch High Tech Crime Team has seized 143 servers used to infect an estimated 30 million computers and arrested the alleged mastermind behind the botnet.

Strategic Security Survey: Global Threat, Local Pain
Strategic Security Survey: Global Threat, Local Pain
(click image for larger view and for full slideshow)
The Bredolab botnet has been busted. So said the High Tech Crime Team, part of the National Crime Squad in the Netherlands, on Monday.

According to Dutch authorities, "the botnet network used servers hired in the Netherlands from a reseller of LeaseWeb," one of Europe's largest hosting providers, which is working with investigators. All told, 143 servers were seized and disconnected.

Subsequently, on Tuesday, a 27-year old Armenian was arrested at Armenia's Yerevan Airport at the request of the Dutch prosecutors, according to news reports. Dutch prosecutors allege that he's the mastermind behind the botnet.

The Bredolab botnet was responsible for infecting at least 30 million computers worldwide and spewing massive quantities of malware every day. According to Dutch authorities, "at the end of 2009 it was estimated that 3.6 billion emails with Bredolab virus payloads were sent daily to unsuspecting computer users."

Dutch authorities estimate that the Bredolab botnet, which they discovered late this past summer, could infect about 100,000 new computers per day. Once installed, Bredolab could monitor keystrokes, alter or copy files and steal personal financial information.

"The main intent of Bredolab is to download other malware onto the users' computers. Some of the attacks we have seen distributed this way include fake anti-virus software, also known as scareware," said Graham Cluley, senior technology consultant at Sophos. "Typically, the attacks were spammed out via old-fashioned, but still worryingly successful, spam campaigns as malicious attachments. In other words, no zero day-exploits, no sophisticated new techniques, just effective social engineering to make people run the attachments in the first place."

Users with Bredolab-infected computers will now be redirected to a help page created by Dutch authorities, offering virus-eradication advice.

The takedown of Bredolab follows the recent Zeus cybercrime sting, involving law enforcement agencies in the United States, United Kingdom, the Netherlands, as well as Ukraine.

That followed the arrest in July of a Slovenian citizen who the FBI -- in an investigation that also involved Spanish authorities -- charged with being the brains behind the Mariposa botnet.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-09-29
The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows local users to hide activities it more difficult to conduct forensics activities, as demonstrated by Flame.

Published: 2014-09-29
lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains invalid UTF-8 strings.

Published: 2014-09-29
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Published: 2014-09-29
bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor.

Published: 2014-09-29
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.