Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

7/18/2011
01:33 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Microsoft Offers $250,000 Bounty To ID Rustock Botnet Operators

New tactic in response to evidence found in discovery process, Microsoft says

The effort to unmask and apprehend the criminals behind the massive Rustock botnet heated up today as Microsoft put up a $250,000 reward for new information on the botnet's operators.

Rustock -- which in March was knocked offline by federal authorities and Microsoft -- was able to send some 30 billion spam messages a day, such as for phony Pfizer prescription drugs and fake Microsoft lottery scams. FireEye, researchers at the University of Washington, Pfizer, the Dutch High Tech Crime Unit, and the Chinese CERT all assisted in the operation to take down the botnet, which had an army of some 1.6 million machines worldwide at its peak. And there are still some 700,000 machines infected with the botnet's malware, according to a recent report from Microsoft.

Richard Boscovich, senior attorney for Microsoft's Digital Crimes Unit, announced today that the company had decided to supplement its civil discovery efforts with the cash reward. Last month, Microsoft published notices in two Russian newspapers in an effort to alert the Rustock operators of the civil lawsuit against them. The reward was a way to turn up the "heat as a result of the evidence we have secured during the discovery process," Boscovich said in response to an inquiry from Dark Reading. However, he did not elaborate on just what that evidence might be.

The $250,000 reward is available to anyone offering new information that results in the arrest and conviction of the Rustock operators. Microsoft will be gathering information via email, at [email protected]

"This reward offer stems from Microsoft’s recognition that the Rustock botnet is responsible for a number of criminal activities and serves to underscore our commitment to tracking down those behind it. While the primary goal for our legal and technical operation has been to stop and disrupt the threat that Rustock has posed for everyone affected by it, we also believe the Rustock bot-herders should be held accountable for their actions," Boscovich said in a blog post.

He said the company has gathered "strong evidence" in the case, and that Microsoft continues to help clean up Rustock-infected machines.

Gunter Ollmann, vice president of research at Damballa, says a bounty will put pressure on the botnet operators, and on potential informants. "Offering a bounty increases the pressure on all those involved with the Rustock botnet and hopefully serves as a notice to the other botnet operators who’ve picked up the spam-delivery slack to build up their own businesses," he says. "As a threat to the Rustock operators, I believe that the bounty will increase the pressure on other informants to disclose their information. $250,000 will be tempting to many, especially when there are so many competing factions within the spam botnet industry."

The move also shows how Microsoft isn't afraid to flex some muscle in its fight against botnets. "This continues to show the level of commitment Microsoft has to combat cybercriminals and foster international cooperation on these efforts. This bounty is just one example of what they are willing -- and able -- to do to put a serious dent in the cybercrime landscape," says Alex Lanstein, senior researcher at FireEye, who worked on the Rustock takedown.

A copy of Microsoft's notice of pleadings is available here. It includes summons for 11 "John Doe" plaintiffs associated with Rustock.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-20466
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 is vulnerable to unauthorized access via user_edit_password.php, remote attackers can modify the password of any user.
CVE-2020-20467
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 is vulnerable to sensitive information disclosure via default_task_add.php, remote attackers can exploit the vulnerability to create a task.
CVE-2020-20468
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 is vulnerable to CSRF. Attackers can use the user_edit_password.php file to modify the user password.
CVE-2021-24368
PUBLISHED: 2021-06-20
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This c...
CVE-2021-31664
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.