Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:41 PM
Connect Directly

Feds Ready To Take Next Step Of Uninstalling Coreflood Malware

Justice Department says it has slashed the botnet's C&C traffic by 90 percent

When the FBI first began dismantling the Coreflood botnet, it did so initially by getting between the botnet's servers and its around 2 million infected bots. But now the feds are preparing to remotely kill the malware on the infected machines as well.

A U.S. District Court judge granted the feds a preliminary injunction this week against the operators of the botnet, which basically buys them more time in their quest to disable and disarm it. They originally had used a restraining order to prevent the botnet's "John Doe's" from operating the botnet. Justice Department officials say so far they have successfully cut the size of the botnet by 90 percent in the United States, from some 800,000 "beacons" -- attempts by infected machines to call home to the botnet's command-and-control (CnC) servers -- on April 13 to less than 100,000 as of late last week.

The feds thus far have been issuing "stop" commands to the bots calling home to the five CnC servers they seized that sent instructions to the infected machines. The case is a precedent-setting one for botnet takedowns given the relatively aggressive involvement by federal authorities.

Now officials say they expect to take the next step and remotely "uninstall" Coreflood malware from identified victim machines, as long as the machines' owners authorize it. This was always an option in the operation, but they appear to be ready to begin that process, experts say.

"The authorization to use the uninstall function is very good," says Gunter Ollmann, vice president of research at Damballa. "There's been a lot of work in very large enterprises, with security consulting firms that are called in to help develop the tools to send those commands to the botnet. If we can do that on a larger scale and clean up some of these botnets out there and on a global scale, the world would be a better place."

Don Jackson, a senior researcher with Dell SecureWorks' Counter Threat Unit, and whose organization has studied the Russia-based Coreflood botnet for years and lent a hand in the DOJ case, notes that the "uninstall" option was on the table all along. "Nothing prohibits anyone -- including agents of the government -- from taking that action with permission of the users," Jackson says. "However close as it may seem to this, we are light years away from 'uninstall without explicit permission,' and I think that's how it needs to be."

But reaching out and touching victim machines comes with risks of its own. Assuming the owner of a victimized machine agrees to letting the feds uninstall the malware, there's always the possibility of the operation triggering other problems, such as the blue screen of death.

Security experts have been debating whether the clean-up process could cause more damage. The worry is that "frailties to the system could cause unintended consequences," Damballa's Ollmann says.

And, of course, some worry that the feds would be overreaching and too invasive with the "uninstall" command. "The debate is going to rage on," Ollmann says. "But there is still more good to be had by actually forcing the uninstall command."

In a supplemental memo that was filed with the request for the preliminary injunction, the feds said, "In order to keep the Court fully apprised of all relevant facts, the Government respectfully advises the Court that the substitute server, or another similar server, will be configured to respond to command and control requests from infected computers by issuing instructions for Coreflood to uninstall itself, but only as to infected computers of Identifiable Victims who have provided written consent to do so."

And that doesn't mean machines wiped of Coreflood malware are safe. "While the use of an 'uninstall' command to remove Coreflood cannot be considered a replacement for the use of properly configured and updated anti-virus software, removing Coreflood from infected computers will at least serve to eliminate a known threat to that victim’s privacy and financial security," the memo said.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-24
In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with &lt...
PUBLISHED: 2021-06-24
The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send a packet continuously. The packet is in an incorrect format and cannot be decoded by the node correctly. As a result, the node may consume the memory sustainabl...
PUBLISHED: 2021-06-23
Vulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise OpenGrok. Successful attacks of this vulnerability can result in takeover of OpenGrok. CVSS 3.1 ...
PUBLISHED: 2021-06-23
A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sensitive data disclosure vulnerability.
PUBLISHED: 2021-06-23
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.