Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:41 PM
Connect Directly

Feds Ready To Take Next Step Of Uninstalling Coreflood Malware

Justice Department says it has slashed the botnet's C&C traffic by 90 percent

When the FBI first began dismantling the Coreflood botnet, it did so initially by getting between the botnet's servers and its around 2 million infected bots. But now the feds are preparing to remotely kill the malware on the infected machines as well.

A U.S. District Court judge granted the feds a preliminary injunction this week against the operators of the botnet, which basically buys them more time in their quest to disable and disarm it. They originally had used a restraining order to prevent the botnet's "John Doe's" from operating the botnet. Justice Department officials say so far they have successfully cut the size of the botnet by 90 percent in the United States, from some 800,000 "beacons" -- attempts by infected machines to call home to the botnet's command-and-control (CnC) servers -- on April 13 to less than 100,000 as of late last week.

The feds thus far have been issuing "stop" commands to the bots calling home to the five CnC servers they seized that sent instructions to the infected machines. The case is a precedent-setting one for botnet takedowns given the relatively aggressive involvement by federal authorities.

Now officials say they expect to take the next step and remotely "uninstall" Coreflood malware from identified victim machines, as long as the machines' owners authorize it. This was always an option in the operation, but they appear to be ready to begin that process, experts say.

"The authorization to use the uninstall function is very good," says Gunter Ollmann, vice president of research at Damballa. "There's been a lot of work in very large enterprises, with security consulting firms that are called in to help develop the tools to send those commands to the botnet. If we can do that on a larger scale and clean up some of these botnets out there and on a global scale, the world would be a better place."

Don Jackson, a senior researcher with Dell SecureWorks' Counter Threat Unit, and whose organization has studied the Russia-based Coreflood botnet for years and lent a hand in the DOJ case, notes that the "uninstall" option was on the table all along. "Nothing prohibits anyone -- including agents of the government -- from taking that action with permission of the users," Jackson says. "However close as it may seem to this, we are light years away from 'uninstall without explicit permission,' and I think that's how it needs to be."

But reaching out and touching victim machines comes with risks of its own. Assuming the owner of a victimized machine agrees to letting the feds uninstall the malware, there's always the possibility of the operation triggering other problems, such as the blue screen of death.

Security experts have been debating whether the clean-up process could cause more damage. The worry is that "frailties to the system could cause unintended consequences," Damballa's Ollmann says.

And, of course, some worry that the feds would be overreaching and too invasive with the "uninstall" command. "The debate is going to rage on," Ollmann says. "But there is still more good to be had by actually forcing the uninstall command."

In a supplemental memo that was filed with the request for the preliminary injunction, the feds said, "In order to keep the Court fully apprised of all relevant facts, the Government respectfully advises the Court that the substitute server, or another similar server, will be configured to respond to command and control requests from infected computers by issuing instructions for Coreflood to uninstall itself, but only as to infected computers of Identifiable Victims who have provided written consent to do so."

And that doesn't mean machines wiped of Coreflood malware are safe. "While the use of an 'uninstall' command to remove Coreflood cannot be considered a replacement for the use of properly configured and updated anti-virus software, removing Coreflood from infected computers will at least serve to eliminate a known threat to that victim’s privacy and financial security," the memo said.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-09-22
Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php.
PUBLISHED: 2020-09-22
Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books > New Book , http://<site>/lms/index.php?page=books.
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) from a file. It is possible to upload an executable or .bat file that can be executed with the help of a functionality (E.g. the "Application Star...
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS.
PUBLISHED: 2020-09-22
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailbox feature, (2) OZFORM_GROUPNAME field in the Group configuration of addresses, (3) listname field in the Defining address lists configuratio...