Attacks/Breaches
4/12/2012
02:41 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

Controversy Erupts Over Microsoft's Recent Takedown Of A Zeus Botnet

Dutch researchers accuse Microsoft of mishandling the recent Zeus botnet takedown and hurting other investigations -- but others defend Microsoft's operation as thorough

The goal of the code of conduct is to take a holistic view of a sinkhole operation that looks at it from a moral, ethical, and legal perspective. Among the questions researchers should answer before a takedown, according to the Honeynet Project: What are the benefits? What are the risks? How do they balance each other? Would it jeopardize law enforcement investigations?

Dave Piscitello, senior security technologist for ICANN, says this issue of "collateral damage" can affect more than the suspension of legit domains, for example, but also other investigations into a botnet. "Absent sufficient information sharing, cooperation, coordination and trust among investigating parties, there is too much room for error or interference, and one party's success can hamper the erstwhile and equally important efforts of others," Piscitello wrote today in a blog post.

He says it makes sense to verify whether domains are actually "harmful" and to "minimize collateral damage" when a botnet is dismantled.

Fox-IT's Sandee alleges that among the domains seized by Microsoft in the Zeus operation were legitimate ones, as well as older, expired ones. Among the legit ones were ones used by security firms and other organizations using sinkholes in search of infected bots they can report to ISPs and others. "So these security companies and NGOs lost a part of their domains and thus a part of their intelligence feed, and were also marked as being potentially a contact for the criminals," Sandee said.

He also contends that the way Microsoft set up its servers allows it to process packet data and gather HTTP requests with full headers and "actually also POST data which will contain sensitive information about the victims, including usernames, email addresses , passwords and personally identifiable information," he said.

Fox-IT also contends that the affidavit contains some of the nicknames, email addresses, and instant messaging handles about the John Does allegedly involved in this cybercrime group that is identical to information it had provided under nondisclosure to a specific mailing list.

"The information therein was 100% identical to information we had supplied to a certain mailing list. This mailing list has the restriction that data being shared can only be used with the permission of the person who supplied that data. The information was in exactly the same order and contained exactly the same amount of information on those john does that we and also a friendly information security company had provided. Since the order and amount of information was 100% identical, and the data then also being used out of context and misinterpreted, meant that the person who interpreted it did not have the right background to fully understand the data," Sandee wrote.

"For us this felt as a major blow as we spent a lot of time in getting this kind of information, while a corporate giant like Microsoft is now using this information without reaching out to the persons who supplied that information, for their own marketing and public relation purposes," he wrote. "From our end we can confirm that this information was never supplied for the purposes that Microsoft used it for. This whole action of Microsoft brings a major blow to the entire information sharing between information security companies on mailing lists and working groups."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1421
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVE-2013-2105
Published: 2014-04-22
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.

CVE-2013-2187
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVE-2013-4116
Published: 2014-04-22
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVE-2013-4472
Published: 2014-04-22
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Best of the Web