Huge 'botnet' amputated, but criminals reconnect

The sudden takedown of an Internet provider thought to be helping spread one of the most promiscuous pieces of malicious software out there appears to have cut off criminals from potentially millions of personal computers under their control.

But the victory was short-lived. Less than a day after a service known as "AS Troyak" was unplugged from the Internet, security researchers said Wednesday it apparently had found a way to get back online, and criminals were reconnecting with their unmoored machines.



The drama initially raised hopes of a sharp drop-off in fraud, because criminals could no longer communicate with many computers infected with a type of malware known as "ZeuS," which is mostly used to steal online banking usernames and passwords. Hundreds of criminal operations around the world use the malware.



It's unknown how many computers are infected with ZeuS, but it's estimated to be in the millions. Cisco said as many as 25 per cent of the world's ZeuS-infected machines were unplugged from the massive "botnet" overnight with the takedown of AS Troyak.



Botnets are networks of infected PCs that behave like criminals' remote-control robots. They steal identities en masse and are used to attack Web sites.



But instead of a slam-dunk victory, the incident wound up highlighting the whiplash pace at which criminals can resurrect their illicit businesses after what should have been a devastating setback.



RSA, the security division of EMC Corp., said dozens of malicious servers that criminals used to spread ZeuS were connected to the Internet by AS Troyak. The service inexplicably went dark Tuesday, severing the ties between criminals and ZeuS-infected machines under their control.



It's not publicly known who pulled the plug. It could have been law enforcement, security researchers, or even the criminals themselves if they decided to move their operations to other servers.



Shutting down malware operations is a constant cat-and-mouse game.



Some services exist solely to host malicious content, and when their connections to the Internet are severed, it's often relatively easy to find another provider willing to sell them a new connection.



RSA researchers wrote in a note to clients that their experience shows that "these kinds of drastic changes are usually short-lived, as in the long run, criminals tend to restructure their criminal activity and relaunch their online attacks."



That apparently happened - and quickly. By Wednesday, researchers said the servers appeared to be back online, through a new Internet provider.



Cisco researchers said a total of 68 command-and-control servers were brought down, but that it's unknown how many infected computers were connected to each of those.



But they added that the criminals may have known the servers were going to be brought down, because traffic to those servers spiked over the weekend, suggesting they were directing infected computers to point to new servers.



One of the most high-profile takedowns of a malicious Web site hosting service involved a company called McColo Corp. whose Internet service was severed in the winter of 2008 after researchers amassed evidence of the company's wrongdoing.



Worldwide spam volumes almost instantly dropped by half, but within days started climbing again.

ebooks
ebookA delicious collection of 50 meaty main courses
Life and Style
ebookNow available in paperback
Arts and Entertainment
Billie Piper as Brona in Penny Dreadful
tvReview: It’s business as usual in Victorian London. Let’s hope that changes as we get further into the new series spoiler alert
Life and Style
A nurse tends to a recovering patient on a general ward at The Queen Elizabeth Hospital in Birmingham
health
News
Fans take a selfie with Ed Miliband in Kempston, near Bedford, on Tuesday
election 2015
Extras
indybest
Arts and Entertainment
No Offence
tvReview: No Offence has characters who are larger than life and yet somehow completely true to life at the same time spoiler alert
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating
and  

By clicking 'Search' you
are agreeing to our
Terms of Use.

ES Rentals

    iJobs Job Widget
    iJobs Gadgets & Tech

    Ashdown Group: IT Project Coordinator (Software Development) - Kingston

    £45000 - £50000 per annum: Ashdown Group: IT Project Coordinator (Software Dev...

    SThree: Trainee Recruitment Consultant - Bristol

    £18000 - £23000 per annum + Uncapped OTE: SThree: SThree Trainee Recruitment C...

    SThree: Trainee Recruitment Consultant - Birmingham

    £18000 - £23000 per annum + Uncapped OTE: SThree: SThree Trainee Recruitment C...

    Guru Careers: Recruitment Resourcer / Recruitment Account Manager

    £20 - 25k + Bonus: Guru Careers: Are you a Recruitment Consultant looking to m...

    Day In a Page

    General Election 2015: Ed Miliband's unlikely journey from hapless geek to heart-throb

    Miliband's unlikely journey from hapless geek to heart-throb

    He was meant to be Labour's biggest handicap - but has become almost an asset
    General Election 2015: A guide to the smaller parties, from the the National Health Action Party to the Church of the Militant Elvis Party

    On the margins

    From Militant Elvis to Women's Equality: a guide to the underdogs standing in the election
    Amr Darrag: Ex-Muslim Brotherhood minister in exile still believes Egypt's military regime can be replaced with 'moderate' Islamic rule

    'This is the battle of young Egypt for the future of our country'

    Ex-Muslim Brotherhood minister Amr Darrag still believes the opposition can rid Egypt of its military regime and replace it with 'moderate' Islamic rule, he tells Robert Fisk
    Why patients must rely less on doctors: Improving our own health is the 'blockbuster drug of the century'

    Why patients must rely less on doctors

    Improving our own health is the 'blockbuster drug of the century'
    Sarah Lucas is the perfect artist to represent Britain at the Venice Biennale

    Flesh in Venice

    Sarah Lucas has filled the British pavilion at the Venice Biennale with slinky cats and casts of her female friends' private parts. It makes you proud to be a woman, says Karen Wright
    11 best anti-ageing day creams

    11 best anti-ageing day creams

    Slow down the ageing process with one of these high-performance, hardworking anti-agers
    Juventus 2 Real Madrid 1: Five things we learnt, including Iker Casillas is past it and Carlos Tevez remains effective

    Juventus vs Real Madrid

    Five things we learnt from the Italian's Champions League first leg win over the Spanish giants
    Ashes 2015: Test series looks a lost cause for England... whoever takes over as ECB director of cricket

    Ashes series looks a lost cause for England...

    Whoever takes over as ECB director of cricket, says Stephen Brenkley
    Fishing for votes with Nigel Farage: The Ukip leader shows how he can work an audience as he casts his line to the disaffected of Grimsby

    Fishing is on Nigel Farage's mind

    Ukip leader casts a line to the disaffected
    Who is bombing whom in the Middle East? It's amazing they don't all hit each other

    Who is bombing whom in the Middle East?

    Robert Fisk untangles the countries and factions
    China's influence on fashion: At the top of the game both creatively and commercially

    China's influence on fashion

    At the top of the game both creatively and commercially
    Lord O’Donnell: Former cabinet secretary on the election and life away from the levers of power

    The man known as GOD has a reputation for getting the job done

    Lord O'Donnell's three principles of rule
    Rainbow shades: It's all bright on the night

    Rainbow shades

    It's all bright on the night
    'It was first time I had ever tasted chocolate. I kept a piece, and when Amsterdam was liberated, I gave it to the first Allied soldier I saw'

    Bread from heaven

    Dutch survivors thank RAF for World War II drop that saved millions
    Britain will be 'run for the wealthy and powerful' if Tories retain power - Labour

    How 'the Axe' helped Labour

    UK will be 'run for the wealthy and powerful' if Tories retain power