Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:41 PM
Connect Directly

Controversy Erupts Over Microsoft's Recent Takedown Of A Zeus Botnet

Dutch researchers accuse Microsoft of mishandling the recent Zeus botnet takedown and hurting other investigations -- but others defend Microsoft's operation as thorough

Microsoft's unprecedented aggressive legal strategy in botnet takedowns came under fire from researchers in the Netherlands, charging that the software giant's most recent botnet dismantlement operation has ultimately damaged international law enforcement and private research investigations.

Michael Sandee, principal security expert at Netherlands-based Fox-IT, wrote in a blog post today that rather than truly injuring the Zeus botnet operations last month, Microsoft instead has hampered investigations into these operations by its actions last month of removing and confiscating two of the command-and-control (C&C) servers under a federal court order. With U.S. marshals escorting them, a team from Microsoft, FS-ISAC, which represents 4,400 financial institutions, and NACHA on March 23 physically removed C&C servers used in the operation that were running out of two hosting services centers -- one in Scranton, Pa., and the other in Lombard, Ill. -- which resulted in the takedown of two IP addresses of the C&C infrastructure.

Microsoft acknowledged at the time that the operation would not stop Zeus-based operations, and that the goal was not to permanently kill all of the Zeus botnets targeted in the operation, but instead to disrupt this segment of the operation.

But Fox-IT's Sandee says Microsoft's actions did harm to the good guys. "Microsoft has endangered the success of countless ongoing investigations in both the private as the public sector all over the world from east to west," Sandee said in his post today. "Obviously as most of these folks are located in Russia and Eastern Europe, the cooperation between parties in those regions and in western countries on both public and private sector side has been hurt more than you can expect, and also years of trust building has potentially been lost ... In our discussions with Law Enforcement Officers, private investigators and members of NGOs researching these threats from across the globe we have found nothing but disappointment and disbelief regarding the irresponsible actions executed by Microsoft. Various other researchers have outed their disappointment."

Richard Boscovich, senior attorney for Microsoft's Digital Crimes Unit, said in a statement that Fox-IT's post "is based at least in part on some factual misunderstandings about the operation which we are more than happy to discuss with Fox IT."

Boscovich says he can't comment on details of the case because it's a legal matter, but noted that the details in the court filings are not all of the evidence and intelligence gathered in the operation. "To be clear, information in the legal filings for this case came from Microsoft's independent research as well as information provided by third party partners and researchers with their explicit permission and intent for inclusion, sourced from their own research or what they hold from sources widely exchanged within the security community," he said. "There are times when, for operational security reasons, we cannot provide advance information to all researchers out there monitoring a particular threat and there are, by law, firm restrictions on investigative collaboration between private companies and law enforcement. Despite these limitations, Microsoft's commitment to trustworthy partnership with the research and enforcement community has never wavered."

Microsoft's legal team was conspicuously missing from the most recent takedown of the second-generation Kelihos botnet, a.k.a. Hlux.B or Kelihos.B, which was spearheaded by Kaspersky Lab, CrowdStrike, Dell SecureWorks, and The Honeynet Project. They poisoned the peer-to-peer network-based botnet with their own code, which initially diverted some 110,000 infected machines to their sinkhole server and out of the hands of the botnet operators.

Kelihos/Hlux (a.k.a. Hlux/Kelihos), which was initially taken down in the fall by Microsoft, Kaspersky, and researchers from several other organizations, had been spotted by researchers re-emerging over the past few months with a new version of its malware.

[The shutdown of Waledac 2.0 by Microsoft and Kaspersky aims to send a message, but also raises questions, legal and otherwise. See Microsoft: No Resurrection For Dead Botnets. ]

Fox-IT is one of the first security firms to voice growing concerns about the ramifications of botnet takedowns in general. Previously, other security experts have quietly or carefully voiced their worries about the legal and ethical issues surrounding these operations.

The Honeynet Project has led the industry in helping define proper botnet takedown procedures. Botnet takedowns are complicated and care must be taken not to overstep the legal or other boundaries, according to Honeynet officials.

Christian Seifert, chief communications officer for the Honeynet Project, and Dave Dittrich, chief legal and ethics officer for the Honeynet Project, say that Microsoft was clear up front with the Zeus operation. "Microsoft clearly defined beforehand intention, justification, harm/benefit of their operation and, as such, went beyond what others may do," they said in a statement.

Sandee's points about sources and sharing information, however, were valid, they said. "One should attribute sources, share data and intent if possible, minimize harm to other fellow researchers, etc."

The Honeynet Project recently issued a proposed code of conduct for these operations to ensure that the benefits outweigh the risks. "Again, our hope is that the code of conduct guides researchers in making the risk/benefit assessment in a systematic way and construct their operation in a way that maximizes benefits and minimizes harm. It's not a black/white world though, so there is not going to be a situation where we only have benefits and no harm/risks," they said.

Next Page: A 'Code of Conduct' for botnet takedowns Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio


Recommended Reading:

1 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/4/2020
Data Loss Spikes Under COVID-19 Lockdowns
Seth Rosenblatt, Contributing Writer,  5/28/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-06-04
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attac...
PUBLISHED: 2020-06-04
In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.
PUBLISHED: 2020-06-04
An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Description Area.
PUBLISHED: 2020-06-04
An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path.
PUBLISHED: 2020-06-04
Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow an attacker with access to the local storage or the configuration backup file to decrypt the sensitive data via knowledge of the hard-coded ...