Attacks/Breaches
7/19/2011
09:36 AM
50%
50%

Microsoft Offers $250,000 For Rustock Botnet Operator Identity

Bounty offered in response to evidence found in discovery process, Microsoft says.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The effort to unmask and apprehend the criminals behind the massive Rustock botnet heated up Monday as Microsoft put up a $250,000 reward for new information on the botnet's operators.

Rustock--which in March was knocked offline by federal authorities and Microsoft--was able to send some 30 billion spam messages a day, such as for phony Pfizer prescription drugs and fake Microsoft lottery scams. FireEye, researchers at the University of Washington, Pfizer, the Dutch High Tech Crime Unit, and the Chinese CERT all assisted in the operation to take down the botnet, which had an army of some 1.6 million machines worldwide at its peak. And there are still some 700,000 machines infected with the botnet's malware, according to a recent report from Microsoft.

Richard Boscovich, senior attorney for Microsoft's digital crimes unit, announced today that the company had decided to supplement its civil discovery efforts with the cash reward. Last month, Microsoft published notices in two Russian newspapers in an effort to alert the Rustock operators of the civil lawsuit against them. The reward was a way to turn up the "heat as a result of the evidence we have secured during the discovery process," Boscovich said in response to an inquiry from Dark Reading. However, he did not elaborate on just what that evidence might be.

The $250,000 reward is available to anyone offering new information that results in the arrest and conviction of the Rustock operators. Microsoft will be gathering information via email, at avreward@microsoft.com.

"This reward offer stems from Microsoft's recognition that the Rustock botnet is responsible for a number of criminal activities and serves to underscore our commitment to tracking down those behind it. While the primary goal for our legal and technical operation has been to stop and disrupt the threat that Rustock has posed for everyone affected by it, we also believe the Rustock bot-herders should be held accountable for their actions," Boscovich said in a blog post.

He said the company has gathered "strong evidence" in the case, and that Microsoft continues to help clean up Rustock-infected machines.

Gunter Ollmann, VP of research at Damballa, says a bounty will put pressure on the botnet operators, and on potential informants.

Read the rest of this article on Dark Reading.

Black Hat USA 2011 presents a unique opportunity for members of the security industry to gather and discuss the latest in cutting-edge research. It happens July 30-Aug. 4 in Las Vegas. Find out more and register.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3407
Published: 2014-11-27
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.

CVE-2014-4829
Published: 2014-11-27
Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allows remote attackers to hijack the authentication of arbitrary users for requests tha...

CVE-2014-4831
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to hijack sessions via unspecified vectors.

CVE-2014-4832
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.

CVE-2014-4883
Published: 2014-11-27
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?