Creators of Massive Botnet Arrested

DigitumDei writes "Dutch police has nabbed 3 men (aged 19,22, & 27) who alledgedly used the toxbot trojan to create a botnet of over 100000 machines. The trio conducted a DDOS attack against an unnamed US company in an extortion attempt, as well as using phishing tactics to hijack PayPal and eBay accounts. From the article: 'Police seized computers, cash, a sports car, and bank accounts at the three men's residences, and additional arrests are expected. The three were to be taken before a magistrate in Breda, a city approximately 25 miles south of Rotterdam, on Friday. The botnet was dismantled, prosecutors said, with help from the Dutch National High Tech Crime Center; GOVCERT.NL, the Netherlands' Computer Emergency Response Team; and several Internet service providers, including the Amsterdam-based XS4ALL.'"

Extortion?

Dat's a nice website ya got dere. SHAME if sumtin happened to it.

/Godfather music in background

Re:Extortion?

The motivation behind this kind of extortion is (obviously) money. It definitely happens and companies definitely do pay. It doesn't usually happen to the largest and best connected firms, and not that much to US based firms as compared to the rest of the world, but it's going on all the time. It doesn't get a lot of press because victims that pay are very unlikely to publicize the event. It is mostly focused on business that do most or all of their revenue over the net.

You greatly underestimate the trouble an extremely large DDOS network can cause via sheer packet volume. It might make you reboot your server or pay more in bandwidth for the month? First off the targets of these things are using pretty substantial server farms, not your debian server you have your cat's pictures on. The servers may or may not crash but they certainly wont handle the load. And neither will your load balancers, database servers, routers, firewalls, IDS's, the list goes on and on. Not only that but your ISP won;t handle the load either, all of their stuff starts to break. And depending on how far down the food chain you are maybe your ISP's ISP. All the way up to the tier 1 who can handle it but certainly doesnt want to.

The short answer is is even if all of your technology works flawlessly and isn't crashing left and right (which it most certainly will be), you've never bought a pipe nearly big enough to handle the traffic you're getting so your real customer's traffic is taking forever or just getting dropped on the floor. After 6-24 hours of your DDOS problems impacting all their other customers, your ISP gets their providers to null route your IP space, putting you in the dead calm of the eye of the storm. Everything works again now, except your customers can't reach you. If you measure your earnings based on people connecting to your shop or services that is obviously a very big deal.

If you fight, the fight is going to be very tough. First you need a sympathetic ISP that will let you fight and help you fight - that probably isn't your existing ISP and ones that will are in short supply. Basically a tier 1 or major colos that are very undersold so they have the bandwidth to burn without taking out the rest of their customers. Next you need someone who understands what needs to be done and fast and will work around the clock to do it - realistically you're probably looking at maybe hundreds of people total in the US that have a very strong background in such things and would be available - and maybe dozens of people that have actual direct experience (on that scale). They will obviously cost money. So will building a completely brand new intelligent filtering network over night - in addition to the hardware costs of the new boxes and the connection costs for the new ISP - this isnt off the shelf software either, at least probably not.

Maybe you can start seeing why it's a bit more of a big deal than maybe rebooting your software - why people choose to pay - and that's why it's profitable.

a botnet of over 100000 machines

I hereby declare a new metric for measuring the size of botnets: The MegaBot. 1 MegaBot==10E6 Bots.

Re:a botnet of over 100000 machines

My math is a bit rusty, but isn't 100000 == 10e5? It should be a 100 kilobot instead....

Re:a botnet of over 100000 machines

There you go, ruining a perfectly good idea with your "math" and "logic"!

Re:a botnet of over 100000 machines

>1 MegaBot==10E6 Bots.

No no no no no. How many times to we have to tell you?

1MegaBot == 1024*1024 bots.

Dammed marketing bots.

Re:a botnet of over 100000 machines

No no no no no. How many times to we have to tell you?
1MegaBot == 1024*1024 bots.

No!! You're talking about a MebiBot!

// Random Mebi [wikipedia.org] Enforcement Zealot

If only i had my own 100k computer matrix...

Id never lose another ebay auction. 100k snipes every nanosec!

Re:If only i had my own 100k computer matrix...

What's the point when you can just put in your maximum bid and eBay raises your active bid as the bidding warrants?

Wow.

A city-wide Thieves Guild is understandable, but a National Crime Center is just going too far.

mmm

the creators of the slashdot network are still at large tho :)

Good!

I'm happy these guys were arrested. Things like this scare companies and people away from technology. Not to imply that modern companies will survive without computers, but will your boss think long and hard before approving tech budgets? You bet. I've never heard of a bunch of crackers extorting a company.

This will also give them pause when hiring former hackers. They might think "Is this guy going to give extortionists inside info?"

On the other hand, security folks may have a budget windfall thrown their way. Considering '"Each time the Trojan was stopped by anti-virus defenses, they made a new version," he said. "This was not just a one-off. The sheer number of variants shows this wasn't a crime they committed just once."' Those security people better get to it.

Re:Good!

"I've never heard of a bunch of crackers extorting a company."

You serious? That's the whole problem. These guys will email a company demanding $30,000 USD, or they will DOS their website business and make them loose even more. Most companies pay. Here is a glorified story [csoonline.com] about some company that refused to pay. Ended up costing them a lot more, but they got through it.

About time

I get so many of these zombie machines trying things everyday and never hear about anyone getting caught. Hope they get sentenced to ten years of Windows XP.

Re:About time

Because we all know that 10 years of WinME would result in cruel and unusual punishment, even for them.

Why?

...who alledgedly used the toxbot trojan to create a botnet of over 100000 machines.

It seems a little harsh to get arrested for only infecting 32 machines.....

Re:Why?

You're thinking of a bitnet.

Related concepts: the batnet and the butnet.

And then, there's also the botnut (three of which got arrested), the bitnut (such as yourself), the butnut (erm...), the botknit (a network of 100000 computers strung together by my grandma), the botNAT, and the bitenight (Buffy the movie).

Awesome, Totally Awesome!

With the stereotypical tech-ignorant law enforcement of today, it's refreshing to see some crime fighters not only understand that this is a serious enough crime to warrant the manpower to investigate, but then to actually pull off catching them. Hats off to the Dutch law enforcement agencies involved. Good work.

Crime is organized

So should it's resistance be.

My hat's off to them that they nabbed 3 guys, but there must be other botnets out there. And I think an effective way to stop it would be at the user level. It would be like taking away all the soil and water from coca farmers. Sure, have your plants, but can you grow them?

Disclaimer: I am not equating botnets to drugs.

How do you dismantle a botnet?

Surely those computers are still vulnerable to the toxbot trojan at best, or just waiting for somebody to give the right commands at worst.
Unless you use the trojan to patch the system of course, but that would be illegal.

RE: How to dismantle a botnet!!

OK I'm a bit late on this story, but maybe some mods will be late too ;)

As an IRC admin for few years, I saw many botnet channels. The botnet masters enjoy putting their bots on IRC (on a secret channel) because it's a third party who provides the communication support, IRC is a good message demultiplexer, and they think it's safe since they only log on IRC with a proxy.

They can identify themselves with a given bot by going private (PRIVMSG .ident ) or just on the channel, the PRIVMSG will be sent to every bot. Now 100k bots in a channel is a lot but I have seen 30k already.

The bots had random nicks so we just put a bot of ours with a random nick in the channel, logged everything and then get the login/pass (I guess in this case Dutch police had the login/pass pair from the PCs they seized). Then we looked out for the bot version, looked on the web for commands (usually, the bot masters are script kiddies and just build the bot from an "automatic" builder they download on the web... they wouldn't even build from the sources).

All of the bots I encountered disposed of attacks commands et al, but also a clean removal command. That's what we used.

Now I don't know about the bot in this story, but most likely the botnet masters HAD a mean to contact them all (now is it IRC-like with a big channel, or distributed among the bots à la DNS, I don't know... But even if the removal command isn't here, there's still a way to tell the bot to execute a given binary they download from a given URL).

And I don't think that would really be illegal, remember, the PC owners rarely know they are infected or don't care. They won't know or won't care either if someone removes the bot for them. And if they say something, just sue them since it means they were part of the attack knowingly ;). Who would want to be part of the botnet ? :)

Anyway I hope we could shut down more of these networks (and MS should pay for their dismantle since nearly all zombies networks are running Windows).

Sure, this will solve the problem...

The lesson for these guys is: next time you try to profit off of your computer crime, make sure that you have strong connections with organized crime, or live in a country with lax computer crime laws and have a tight financial relationship with the police. I'm glad to hear about this sort of thing, but I don't think it's going to do anything to actually reduce the number of bots out there. Rather, it'll just ensure that future botnets are run by nastier, better-protected individuals and organizations.

I wonder what it would take to convince the world that these unsecured machines are an actual security threat, rather than an annoyance?

What a great idea...

The botnet was dismantled, prosecutors said, with help from...

Why didn't I think of that! That's 100,000 lusers that won't be getting infected again soon, unless they learn enough to reassemble their boxen, by which point...*sigh* What am I thinking? They'll probably just buy new systems and throw the piles of parts out. They'll be back on bot nets by this weekend.

What they need to do is dismantal the owners!

--MarkusQ

Bank accounts!

and bank accounts at the three men's residences

Ahaha, who keeps bank accounts at their residence, of all places?!

And, eventually, they got caught...

Police seized computers, cash, a sports car, and bank accounts at the three men's residences, and additional arrests are expected. The three were to be taken before a magistrate in Breda, a city approximately 25 miles south of Rotterdam, on Friday.

What kind of computers? How much cash? What kind of car? What were the residences like?
Come on, we need better details for the upcoming movie & tv special.

These guys had to know they were going to get busted, someone probably was bragging about how many PCs they zombified.

So stupid...

How do criminals think they'll get away with something like this? I just don't get it really. Even if you successfully set up the botnet and the company decides they do want to pay you off, how do they think they're going to remain anonymous, collect the money, and fade into oblivion (or fade into bolivian if you're Mike Tyson [tripod.com]). Perhaps I just don't have the cunning mind of a criminal but the logic really escapes me.

Environmental problem

It seems to me that unpatched Windows boxes are becoming an environmental problem ;-)

Limited time

I forsee the day when bot nets are a thing of the past. While I admit that currently most police forces couldn't catch a virus by opening infected email things seem to be changing.

The scale of setting up a useful botnet is such that there are thousands of tiny ways that you could screw up and leave a drity great big flag pointing out your location / identity. Even the most carefully created botnet will contain some useful information to track down it's owner. In fact the very nature of the beast means that at some point you will have to contact it which potentially gives away your location. Ok you can run through proxies and use other methods to hide you identity but it only takes one slip up which someone technical is watching. Of course you also have the problem of collecting you payments. While you might be able to hide in the online world hiding from the banking world is much harder. At some point you have to collect you money.

All in all I think it would be easier to just go into kidnapping or drug dealing. The profit margin has got to be higher.

Re:Limited time

Kidnapping for money (in the US, at least) is completely dead, for a couple of reasons. First, the FBI has long considered every incident of kidnapping to be a personal vendetta against them and they play for keeps -- unless you're the pedophile who kidnaps a kid and kills them within 24 hours, they WILL catch you. And they will, likely as not, kill you in the attempt and when the guy who does gets back to the office his hand will be sore from all the high-fives. We're not nearly so effective at taking care of drug dealers, but drug dealers are -- they've got a mortality rate of about 10-25% a year in some cities, and most of them only clear minimum wage (see Freakonomics -- excellent book, by the way). Computer crimes, by contrast, are punished relatively leniently, investigated seldomly, have zero physical risk, and pay better. Whats not to like for the unscrupulous type, aside from having a higher barrier to entry than kidnapping/drug dealing?

get your facts right

Rotterdam - > Breda Total Est. Distance: 30.09 miles (roughly 51.15 Km)

Why Europe?

Why is it that these arrests always seem to be made in Europe? Is it because the legal climate is different, or is the incidence of criminal extortion over the internet higher there? Is Europe the locus of the crime? I always thought Eastern Europe (e.g. Russia, baltic states) and the east were worse. Is it that they don't enforce in those places so you never hear about it?

---
tjc

I wonder...

...how many extortion attempts such as this are successful? We (obviously) wouldn't hear about them as a company wouldn't want to air their dirty laundry. I would imagine that any small Internet company without the resources to fight something like this would either have to pay up or close shop. Scary.

Creators of Massive Botnet Arrested

Whew, I thought they were taking Nick at Nite off the air!

And next on news...

Three enterprizing Security Guru's setup a Security Firm to help assist EU against virus attacks! :-)

Better the Devil you know

If past history is anything to go by, they'll probably all end up getting highly paid security jobs.

Who is this XS4ALL?

What is the real identity of this Dutch ISP XS4ALL? Fighting spammers [slashdot.org] (though losing appeal [slashdot.org]), defending the rights [slashdot.org] of clients to hyperlink [slashdot.org] and refusing to be bullied by court orders, and now taking down BotNets. Apparently the founders sold out for millions [slashdot.org], but they seem to go well beyond the Google "do no evil" philosophy to pro-actively defending the rights of their customers at considerable risk to themselves. It's the kind of company the deserves to win an awful lot of business.

Phillip.

Re:Who is this XS4ALL?

XS4ALL [xs4all.nl] was founded in '93 as the Dutch version of Demon [demon.net], the UK ISP. In spite of the KPN (ex government-controlled/monopoly telco) buy-out, they have maintained their philosophy of protecting the interests of their customers and doing the Right Thing(tm).

Strong ties with Bits for Freedom [www.bof.nl] (our version of the EFF), best Dutch ISP year after year, support for *nix systems, frequent new experimental services. Only pain is that they're also one of the more expensive ISP's. You get what you pay for, and with XS4ALL they give you the works.

(for the record, I'm a long-time customer so I am rather biased. But these guys aren't your average ISP)

Mistake in headline

Should have read :'potnet dismantled'. After all, it's Holland, right?

Darn

Just as I was getting ready to use it to mailbomb Congress in opposition to the Broadcast Flag.

Instead

Why don't they arrest M$ directors for promoting the development of an insecure, vulnerable OS through unrealistic release deadlines and abusive market practices?

Because lets face it, its not the Windows developers' fault, because most developers would rather spend more time on a project and make it better, and the creaters of trojans would have a much harder time of it if there weren't such huge flaws in the market-dominating OS.

Suddenly, the botnet ads are gone

SpecialHam [specialham.com], the spammer forum, usually is full of ads for botnets. But not today. There are far fewer ads for "proxies" today. And there are notes like "hey, watch yourself" and worries about "spamhaus honeypots".

So there's been some effect. The spammers are becoming afraid. Not very afraid. Yet. But afraid. It's becoming hard to spam without committing multiple felonies. Those felonies are leading to a few arrests and jail sentences. Not many, but enough to scare off many spammers. The remaining spammers look more and more like traditional crooks.

There's plenty of stuff on SpecialHam for law enforcement to go after. "Special Hurricane Katrina Promotions". "Offshore bank accounts for sale". Anyone active against spam should be looking there.

they were legitimate bankers!

Police seized computers, cash, a sports car, and bank accounts at the three men's residences.

I want to know whose bank accounts they seized.

A Word From the Dude

Were these guys Germans who drive scooters and brandish weasels?

I just want my rug back.

The botnet was dismantled, prosecutors said...

Of course it was!

Er, wouldn't that involve uninstalling the bots from the computers of 100,000 clueless people?

Reminds me of the sequal-ready ending to a cheesy horror flick.

I caught one, once

The T1 line at a place I admin got saturated once with upstream traffic. Took a bit of poking.

Turns out:

1) It was a script that infected a vulnerability in a well-known image manipulation system written in perl CGI.

2) User never got root, and didn't seem to care.

3) System was participating in a botnet of about 200 systems, (if I remember this correctly) all managed via an IRC chat.

4) All the exploits were downloaded from a web server located somewhere in Brazil. Telnets that happened were also from another IP address in Brazil. Home address? dunno. [e-mail] was notified of everything, but no reply was ever received.

Here's how it all happened:

1) The exploit used a vuln that allows the attacker to run wget, download a hacked telnetd, and then open a telnetd on a high port. Telnet to the port and get a shell account on the system as user "nobody".

2) This telnet shell was used to load in an IRC client, also written in perl. This was fairly easy to detect because the IRC client was very inefficient, and used almost 50% of the CPU resources, even when it wasn't doing much. "top" showed this thing like a flashing red light.

3) I logged into the IRC chatroom with a username similar to the machine-generated hostnames, and watched for a while. He'd issue a command (I think it was "lookat [ip address]" and then all the machines would ping flood whatever the address was.

I cleared everything out of the system, got rid of the scripts (after squirreling away a copy, just in case) and upgraded the CGI image manager with a newer version that wasn't vulnerable. I haven't seen/heard from "senior brasillia" ever since.

But, take 1.5 Mb*200=300 Mb, and that'd take out most small-mid sized servers handily. My best connection is about 70 Mb upstream!

The New Yorker: Zombie Hunters

The October 10 New Yorker magazine has a nice companion piece to this story, "The Zombie Hunters: On the trail of cyberextortionists" by Evan Ratliff. The article describes the tactics of the extortionists and those who track them down or thwart their attacks. Probably nothing new to the /. crowd, but a good read nonetheless. Here's a link.

http://www.newyorker.com/fact/content/articles/051 010fa_fact [newyorker.com]

Re:25 miles south of Rotterdam?

It is close to Jabbeke -- the city where I live. HA! Sais it all.

Re:Good, but...

When I was in uni, we had a guy from the Belgian Computer Crime Unit (CCU) come and talk to us about computer criminality. We asked a load of questions, including whether they actually actively went after casual downloaders. Basically they said they were so swamped going after child pornography sites, they did not have any resources at all for those kind of activities.

Most police "cybercrime" units are still very underfunded.

Re:Good, but...

Since the last A in both those abbreviations stands for 'America', it's probably not a heck of a lot... We've got Stichting Brein here who claims to represent copyright holders, but aside from the occasional high-profile bust that is intended to show they're still at it, they aren't doing that much. If they are, they're managing to keep their activities well hidden.

Re:Good, but...

That's 'cos cops like helping kids. Very few cops are shot by 8-year-olds who can't find their mommy.

Re:Good, but...

Well, just like the marijuana laws on the books (forced by other countries), it's public policy not to enforce things that are considered a waste of law enforcements time.

The government said themselves that making file sharing a criminal offence just turns a large portion of the population into criminals for no real benefit. This is similar to the drugs policy. From Wikipedia [wikipedia.org]:

However, a policy of non-enforcement has led to a situation where reliance upon non-enforcement has become common, and because of this the courts have ruled against the government when individual cases were prosecuted.

This is because the Dutch Ministry of Justice applies a gedoogbeleid (policy of tolerance) with regard to soft drugs: an official set of guidelines telling public prosecutors under which circumstances offenders should not be prosecuted. This is a more official version of the common practice in other countries, in which law enforcement sets priorities as to which offenses are important enough to spend limited resources on.

Proponents of gedoogbeleid argue that such a policy offers more consistency in legal protection in practice, than without it. Opponents of the Dutch drug policy either call for full legalization, or argue that laws should penalize morally wrong or decadent behavior, whether this is enforceable or not.

So no, the government tends to go after real criminals, rather than waste time on teenagers with too much free time.

Re:25 miles south of Rotterdam?

I always thought that Americans were just plain ignorant about European geography. Now I know it's because you've been going round telling them that Madrid is close to London.

Re:25 miles south of Rotterdam?

Does this info really help? How many Americans know Rotterdam?

Rotterdamn....that sounds vaguely familar.. Oh yeah now I remember it was one of my options for music in Ridge Racer for Play Station.

As to not be marked off-topic, the question really becomes not what to do with those behind the botnet, but what to do with the botnet itself. One could patch the entire network via the use of the very trojan that created it (which we know is illegal), but I think this might be a good change to get some extra cycles for SETI. I can just see Team Dutch National High Tech Crime Center moving up the rankings now.

Re:Let the punishment fit the crime

Because real studies have shown that stiff sentences do wonders besides making the pitchfork carying mob happy?

Linux not being used enough?

...or use Linux.

Are Linux boxes invulnerable? Is the gauntlet being thrown at our feet? (lol)

I'm happy they did get nabbed though. There are plenty of fun things to do in life instead of extortion.

Re:Oh crap. Here they come...

slap on a howl from beyond (when you've confirmed that he is going to get through) and then he can get truly ugly...