Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Avalanche Botnet Comes Tumbling Down In Largest-Ever Sinkholing Operation
Threaded  |  Newest First  |  Oldest First
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
12/2/2016 | 3:55:28 AM
How Serious a Blow?
I have to wonder if the blow dealt was as serious as reported.  Don't get me wrong, this is a successful operation regardless and sets the stage for future ones (which there will have to be).  But Avalanche isn't just a small group and when it went "quiet" we were probably watching evolution, not the disappearance of the syndicate; this botnet may even have been an acceptable loss.  What should be happening now is the analysis of the infrastructure to understand how Avalanche evolved and into what.  You don't accomplish as much as this syndicate did and simply go belly up after a raid like this.  It's also worth noting timelines in terms of how many years this threat existed before this large raid hit.  Something's wrong with your security offensive procedures when you're stuck with a series of "legal" raids that either go nowhere or pull small fish from the pond, and you need to pull together a global task force to get anywhere ("legally").  We just can't assume the threat is completely contained from this group.     
Crypt0L0cker
100%
0%
Crypt0L0cker,
User Rank: Strategist
12/2/2016 | 2:01:33 PM
Re: How Serious a Blow?
I guess it's pretty serious  - they got organiser, Hennadiy Kapkanov. He was armed with Kalashnikov, dangerous and had different shoes :)
kbannan100
50%
50%
kbannan100,
User Rank: Moderator
12/4/2016 | 8:53:51 PM
Re: How Serious a Blow?
Totally agree! If they are truly out of the picture a new gang of criminals is going to pop up -- and soon. If they haven't already! And there are still some pretty nasty malware instances out there. (For instance, the one that took down Dyn using the IoT devices. Read more about that here: bit.ly/2ewIBtW)



People are going to need to be more careful and concentrate on shoring up network security and endpoints -- everything from printers to thermostats to mobile devices.


--Karen Bannan for IDG and HP
Dan Euritt
50%
50%
Dan Euritt,
User Rank: Apprentice
12/4/2016 | 11:13:14 AM
It surely must have helped, but...
Only five people stealing millions of dollars? I wonder how many criminals got away.

Thanks for the article.
ClaireEllison
50%
50%
ClaireEllison,
User Rank: Apprentice
12/4/2016 | 3:52:44 PM
Re: Industry
Excellent article plus its information and I positively bookmark to this site because here I always get an amazing knowledge as I expect.
francois999
50%
50%
francois999,
User Rank: Apprentice
12/4/2016 | 1:47:07 PM
Thank you for the info
I really thank you for the valuable info on this great subject and look forward to more great posts. Thanks a lot for enjoying this beauty article with me. I am appreciating it very much! Looking forward to another great article. Good.

FRANCOIS
Nanireko
50%
50%
Nanireko,
User Rank: Apprentice
12/5/2016 | 3:38:21 AM
Avalanche
I do see fewer spam messages with malicious attachments this December. It looks like this operation was really successful. Does anybody else see the decrease in spam emails these days?
Crypt0L0cker
50%
50%
Crypt0L0cker,
User Rank: Strategist
12/5/2016 | 5:06:12 AM
Re: Crypt0L0cker
And as I can see from his driver license (probably fake, but anyway) his origin is Russia.


How Attackers Could Use Azure Apps to Sneak into Microsoft 365
Kelly Sheridan, Staff Editor, Dark Reading,  3/24/2020
Malicious USB Drive Hides Behind Gift Card Lure
Dark Reading Staff 3/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10940
PUBLISHED: 2020-03-27
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
CVE-2020-10939
PUBLISHED: 2020-03-27
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
CVE-2020-6095
PUBLISHED: 2020-03-27
An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.
CVE-2020-10817
PUBLISHED: 2020-03-27
The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued.
CVE-2020-10952
PUBLISHED: 2020-03-27
GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.