Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Avalanche Botnet Comes Tumbling Down In Largest-Ever Sinkholing Operation
Oldest First  |  Newest First  |  Threaded View
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
12/2/2016 | 3:55:28 AM
How Serious a Blow?
I have to wonder if the blow dealt was as serious as reported.  Don't get me wrong, this is a successful operation regardless and sets the stage for future ones (which there will have to be).  But Avalanche isn't just a small group and when it went "quiet" we were probably watching evolution, not the disappearance of the syndicate; this botnet may even have been an acceptable loss.  What should be happening now is the analysis of the infrastructure to understand how Avalanche evolved and into what.  You don't accomplish as much as this syndicate did and simply go belly up after a raid like this.  It's also worth noting timelines in terms of how many years this threat existed before this large raid hit.  Something's wrong with your security offensive procedures when you're stuck with a series of "legal" raids that either go nowhere or pull small fish from the pond, and you need to pull together a global task force to get anywhere ("legally").  We just can't assume the threat is completely contained from this group.     
Crypt0L0cker
100%
0%
Crypt0L0cker,
User Rank: Strategist
12/2/2016 | 2:01:33 PM
Re: How Serious a Blow?
I guess it's pretty serious  - they got organiser, Hennadiy Kapkanov. He was armed with Kalashnikov, dangerous and had different shoes :)
Dan Euritt
50%
50%
Dan Euritt,
User Rank: Apprentice
12/4/2016 | 11:13:14 AM
It surely must have helped, but...
Only five people stealing millions of dollars? I wonder how many criminals got away.

Thanks for the article.
francois999
50%
50%
francois999,
User Rank: Apprentice
12/4/2016 | 1:47:07 PM
Thank you for the info
I really thank you for the valuable info on this great subject and look forward to more great posts. Thanks a lot for enjoying this beauty article with me. I am appreciating it very much! Looking forward to another great article. Good.

FRANCOIS
ClaireEllison
50%
50%
ClaireEllison,
User Rank: Apprentice
12/4/2016 | 3:52:44 PM
Re: Industry
Excellent article plus its information and I positively bookmark to this site because here I always get an amazing knowledge as I expect.
kbannan100
50%
50%
kbannan100,
User Rank: Moderator
12/4/2016 | 8:53:51 PM
Re: How Serious a Blow?
Totally agree! If they are truly out of the picture a new gang of criminals is going to pop up -- and soon. If they haven't already! And there are still some pretty nasty malware instances out there. (For instance, the one that took down Dyn using the IoT devices. Read more about that here: bit.ly/2ewIBtW)



People are going to need to be more careful and concentrate on shoring up network security and endpoints -- everything from printers to thermostats to mobile devices.


--Karen Bannan for IDG and HP
Nanireko
50%
50%
Nanireko,
User Rank: Apprentice
12/5/2016 | 3:38:21 AM
Avalanche
I do see fewer spam messages with malicious attachments this December. It looks like this operation was really successful. Does anybody else see the decrease in spam emails these days?
Crypt0L0cker
50%
50%
Crypt0L0cker,
User Rank: Strategist
12/5/2016 | 5:06:12 AM
Re: Crypt0L0cker
And as I can see from his driver license (probably fake, but anyway) his origin is Russia.


Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26895
PUBLISHED: 2020-10-21
Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation (e.g., routing node, payment-receiver,...
CVE-2020-26896
PUBLISHED: 2020-10-21
Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount collis...
CVE-2020-5790
PUBLISHED: 2020-10-20
Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVE-2020-5791
PUBLISHED: 2020-10-20
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.
CVE-2020-5792
PUBLISHED: 2020-10-20
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.