Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:41 PM
Connect Directly

Feds Ready To Take Next Step Of Uninstalling Coreflood Malware

Justice Department says it has slashed the botnet's C&C traffic by 90 percent

When the FBI first began dismantling the Coreflood botnet, it did so initially by getting between the botnet's servers and its around 2 million infected bots. But now the feds are preparing to remotely kill the malware on the infected machines as well.

A U.S. District Court judge granted the feds a preliminary injunction this week against the operators of the botnet, which basically buys them more time in their quest to disable and disarm it. They originally had used a restraining order to prevent the botnet's "John Doe's" from operating the botnet. Justice Department officials say so far they have successfully cut the size of the botnet by 90 percent in the United States, from some 800,000 "beacons" -- attempts by infected machines to call home to the botnet's command-and-control (CnC) servers -- on April 13 to less than 100,000 as of late last week.

The feds thus far have been issuing "stop" commands to the bots calling home to the five CnC servers they seized that sent instructions to the infected machines. The case is a precedent-setting one for botnet takedowns given the relatively aggressive involvement by federal authorities.

Now officials say they expect to take the next step and remotely "uninstall" Coreflood malware from identified victim machines, as long as the machines' owners authorize it. This was always an option in the operation, but they appear to be ready to begin that process, experts say.

"The authorization to use the uninstall function is very good," says Gunter Ollmann, vice president of research at Damballa. "There's been a lot of work in very large enterprises, with security consulting firms that are called in to help develop the tools to send those commands to the botnet. If we can do that on a larger scale and clean up some of these botnets out there and on a global scale, the world would be a better place."

Don Jackson, a senior researcher with Dell SecureWorks' Counter Threat Unit, and whose organization has studied the Russia-based Coreflood botnet for years and lent a hand in the DOJ case, notes that the "uninstall" option was on the table all along. "Nothing prohibits anyone -- including agents of the government -- from taking that action with permission of the users," Jackson says. "However close as it may seem to this, we are light years away from 'uninstall without explicit permission,' and I think that's how it needs to be."

But reaching out and touching victim machines comes with risks of its own. Assuming the owner of a victimized machine agrees to letting the feds uninstall the malware, there's always the possibility of the operation triggering other problems, such as the blue screen of death.

Security experts have been debating whether the clean-up process could cause more damage. The worry is that "frailties to the system could cause unintended consequences," Damballa's Ollmann says.

And, of course, some worry that the feds would be overreaching and too invasive with the "uninstall" command. "The debate is going to rage on," Ollmann says. "But there is still more good to be had by actually forcing the uninstall command."

In a supplemental memo that was filed with the request for the preliminary injunction, the feds said, "In order to keep the Court fully apprised of all relevant facts, the Government respectfully advises the Court that the substitute server, or another similar server, will be configured to respond to command and control requests from infected computers by issuing instructions for Coreflood to uninstall itself, but only as to infected computers of Identifiable Victims who have provided written consent to do so."

And that doesn't mean machines wiped of Coreflood malware are safe. "While the use of an 'uninstall' command to remove Coreflood cannot be considered a replacement for the use of properly configured and updated anti-virus software, removing Coreflood from infected computers will at least serve to eliminate a known threat to that victim’s privacy and financial security," the memo said.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.