Vulnerabilities / Threats
3/18/2011
01:06 PM
50%
50%

Microsoft, Feds Knock Rustock Botnet Offline

Authorities confiscated equipment from seven Internet hosting facilities used by the botnet, which was responsible for much of the Viagra email spam on the Internet.

Top 10 Security Stories Of 2010
(click image for larger view)
Slideshow: Top 10 Security Stories Of 2010
Microsoft and federal law enforcement authorities confiscated equipment from seven Internet hosting facilities across the United States on Wednesday, resulting in a takedown of the Rustock botnet.

Microsoft had filed a lawsuit in civil court against "John Does … controlling a computer botnet and thereby injuring Microsoft and its customers." The lawsuit was unsealed on Thursday by a federal judge, at Microsoft's request.

Richard Boscovich, senior attorney in the Microsoft Digital Crimes Unit (DCU), said in a blog post on Thursday that "the Rustock botnet was officially taken offline yesterday, after a months-long investigation by DCU and our partners, successful pleading before the U.S. District Court for the Western District of Washington, and a coordinated seizure of command and control servers in multiple hosting locations escorted by the U.S. Marshals Service."

The operation to bust Rustock, which infected an estimated one million computers, built on knowledge Microsoft gained when it took down Waledac last year. "Like the Waledac takedown, this action relied on legal and technical measures to sever the connection between the command and control structure of the botnet and the malware-infected computers operating under its control," said Boscovich.

Security firm FireEye and the University of Washington filed declarations of support for Microsoft's suit, as did drug-maker Pfizer, since the bulk of Rustock's spam purported to sell drugs such as the company's Viagra.

In Pfizer's declaration, Patrick Ford, senior director in the Americas region for Pfizer Global Security, said that investigations conducted by Pfizer in the U.S. and France procured drugs advertised as Viagra via spam emails. In both cases, the spam emails resolved to the same Web site: doctorroe.com. The procured samples, which were tested at Pfizer labs, turned out to be either counterfeit versions from China and Hong Kong, or unapproved, generic versions from India.

Rustock first went dark on Wednesday, a development first reported by security writer Brian Krebs .

While many botnets serve as conduits for enormous quantities of email spam, of late Rustock was the most prolific, at times generating 2,000 messages per second. "For the last year or so, Rustock has been the dominant source of spam in the world, by the end of 2010, accounting for as much as 47.5% of all spam," said Paul Wood, MessageLabs Intelligence senior analyst at Symantec, in a blog post. "At its peak it was responsible for more than half of all global spam."

But unfortunately, according to multiple security firms, Rustock's takedown didn't appear to impact global spam levels, which have remained steady, despite the takedown.

"The takedown of Rustock hasn't had much noticeable effect on the overall amount of spam tracked by MessageLabs Intelligence," said Wood on Thursday. "So far in fact, traffic looks normal."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2188
Published: 2015-02-26
The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connecti...

CVE-2015-0594
Published: 2015-02-26
Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS) and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq54654 and CSCun1...

CVE-2015-0632
Published: 2015-02-26
Race condition in the Neighbor Discovery (ND) protocol implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service via a flood of Router Solicitation messages on the local network, aka Bug ID CSCuo67770.

CVE-2015-0651
Published: 2015-02-26
Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753.

CVE-2015-0882
Published: 2015-02-26
Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/init_includes/init_sanitize.php an...

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.