FBI Hijacks Botnet, With Court Order... Then Issues Kill Signal To Millions Of Computers

from the good-samirtan-hacking? dept

For years there's been talk about the value of "good samaritan" viruses or botnets, that would go out and try to delete or kill of "bad" viruses or botnets. Lots of computing experts have, reasonably, warned that the unintended consequences of such an action could be large and dangerous. Apparently, the FBI figures, why not test it out anyway? In a rather surprising move, the FBI was able to get a court order that allowed it to effectively hijack a large botnet, involving millions of computers, and send a "stop" command to all of those PCs that would disable the malware (called Coreflood).

While there are obviously good intentions here, and it's definitely a good thing to see a large malicious botnet go dark, there still are really serious concerns about this move, the legality of the move, and the risk of unintended consequences. Do we really want to set a precedent where the FBI can send commands remotely to millions of computers? And how confident are people that the FBI's programming skills won't cause problems, if not this time, at some point in the future? In the filing requesting the right to do this, the FBI even pointed out that a newer version of Coreflood had been released that morning "but that the FBI had tested the kill command against that variant and it had worked successfully." Of course, testing in the lab and deploying to millions of machines in the real world is entirely different. There are also concerns that this is an ongoing effort, since Coreflood apparently reruns every time a machine is rebooted, meaning that the FBI will have to keep sending this kill signal. And while the FBI swears up and down "that this would cause no harm to computers," how confident are you that this is really the case?

Again, I recognize the importance of trying to stop botnets and take them down. Additionally, there don't appear to be any early reports of trouble or unintended consequences from this move. But... when dealing with something like this, where the FBI is sending execution commands to millions of PCs, you have to assume that sooner or later, something bad is going to happen. Does the FBI have a technical support helpdesk to help your grandparents when it kills their computer?
Hide this

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: botnets, coreflood, fbi, hijack


Reader Comments

Subscribe: RSS

View by: Time | Thread


  • icon
    Hephaestus (profile), 14 Apr 2011 @ 7:38am

    Better title Idea ...

    FBI commits several million acts of computer tresspass.

    link to this | view in chronology ]

  • icon
    Skeptical Cynic (profile), 14 Apr 2011 @ 7:48am

    All I can say is Holy Crap!!!

    I'm in IT and the thought of any government agency sending any command to any computer to do what it wants just freaks me out.
    What right do they have to do that?

    I hate bot-net infected computers because they cause all kinds of issues but anyway you look at it the FBI just made all those computers do what it wanted. It issued forced instructions to those computers that were executed.

    Big Brother is all grown up and has just made it to college.

    link to this | view in chronology ]

    • icon
      umccullough (profile), 14 Apr 2011 @ 7:58am

      Re: All I can say is Holy Crap!!!

      The conspiracy theorist in me wants to suggest we'll see more of these botnets now, infecting machines belonging "people of interest" - and th FBI will receive court orders allowing them to "take control" of said botnets and "clean them up" ;)

      link to this | view in chronology ]

      • icon
        Skeptical Cynic (profile), 14 Apr 2011 @ 8:26am

        Re: Re: All I can say is Holy Crap!!!

        That is not a theory. It's just a matter of time. Power always drives them to seek to maintain and increase their power. It's only surprising they have not been able to (legally) take more control of your computer in the interest of "National Security" or other Big Brother reason.

        link to this | view in chronology ]

      • icon
        wvhillbilly (profile), 17 Apr 2011 @ 8:48pm

        Re: Re: All I can say is Holy Crap!!!

        What's really needed is software that will detect such malware on a computer and notify the user of same and give instructions how to remove it. Seems to me like virus protection software would be the ideal medium for this, and could provide the means of both cleaning out the malware and protecting against re-installation/re-infection.

        link to this | view in chronology ]

    • icon
      el_segfaulto (profile), 14 Apr 2011 @ 9:51am

      Re: All I can say is Holy Crap!!!

      In fairness, the likeliest scenario is that the FBI simply sent a predefined kill signal to the infected PCs, probably mimicking a command and control server. It's not as if they can arbitrarily send whatever commands they want to any workstation and take control (this isn't Hollywood). If there isn't software listening for that specific command on that specific port, the packet will simply rebound off into the aether.

      link to this | view in chronology ]

      • icon
        senshikaze (profile), 14 Apr 2011 @ 1:24pm

        Re: Re: All I can say is Holy Crap!!!

        And what if the botnet program (the "virus") has a buffer overflow bug? Bugless code is hard, especially when you have to work with the constraints that malware writers have to deal with. If the FBI had found a bug and sent a formed packet that could cause the buffer overflow, now, since the virus more than likely has kernel level access, you have a Gov't agency with the ability to run arbitrary code on your machine. It isn't Hollywood, it is how damn near every exploit and hack works. All Hollywood does is make it shiny it up and adds stupid terms noone uses.

        But it's cool, I use Linux. :)

        link to this | view in chronology ]

        • icon
          el_segfaulto (profile), 14 Apr 2011 @ 4:19pm

          Re: Re: Re: All I can say is Holy Crap!!!

          I use Linux too (Debian and CentOS lately) and I agree completely that we're at the mercy of the agencies and that if they chose to take advantage of the same vulnerabilities that the original botnets used, we would have no recourse. In fairness though, even the Linux kernel has been shown to have vulnerabilities, though none at the level of Windows or OSX.

          link to this | view in chronology ]

          • icon
            senshikaze (profile), 14 Apr 2011 @ 4:24pm

            Re: Re: Re: Re: All I can say is Holy Crap!!!

            of course, of course.

            Yea, if the FBI/CIA/Whatever have not only the capability but also the backing of the courts we are all screwed.

            link to this | view in chronology ]

      • icon
        aldestrawk (profile), 14 Apr 2011 @ 4:49pm

        Re: Re: All I can say is Holy Crap!!!

        I don't think it is likely that the botnet program is listening for a command that would terminate itself (i.e. terminate all the running processes associated with the botnet on that computer). A software update is one of the available commands to the botnet. The likeliest scenario is that the FBI would be sending an update to the botnet program. That update would either terminate the program directly or listen for a separate termination command.
        If the FBI can update the botnet program then it can write updates that can do anything that is permissible for the owner of the botnet processes. That might well be full administrative permission. This botnet program already has a keylogger component. It is not clear to me if the botnet is sending collected data along with it's beacons or there is simply a command for the C&C server to be send the collected data.
        In the court filing, the FBI says they are not going to collect data from any of the infected computers other than the source IP address contained in the beacon packet.

        link to this | view in chronology ]

  • icon
    RHOPKINS13 (profile), 14 Apr 2011 @ 7:50am

    Thinking about the consequences...

    Don't get me wrong here, I'm all for destroying botnets, but I don't think this was thought out fully. First of all, it's a temporary fix. I'm sure that many if not most of the computers that were infected get rebooted on a regular basis, and it'll only be a small matter of time before they're up and running Coreflood again.

    Second, it sounds like this "stop" command was programmed in by the original writers. If that's the case, the obvious reaction to this is for them to make an update that leaves out this "stop" command.

    Not saying that there's a correct way of stopping a botnet, but I don't think this is it.

    link to this | view in chronology ]

  • identicon
    Jes Lookin, 14 Apr 2011 @ 7:55am

    Is This A 'More Friendly' Problem

    So... there are thousands of computers infected with malicious and annoying botnet software controlled by scum-bags. The FBI wants to see if they can stop it by sending out an application kill command. So what ? I'm surprised some teen hackers don't do this regularly just to screw around. The only problem may be that infected systems crash, like all mismanaged or Microsoft system will anyway - there will just be someone that seems convenient to blame...

    link to this | view in chronology ]

    • icon
      Josh in CharlotteNC (profile), 14 Apr 2011 @ 11:29am

      Re: Is This A 'More Friendly' Problem

      So what ? I'm surprised some teen hackers don't do this regularly just to screw around.

      Probably not 'teen' and not 'just to screw around' but it does happen. There are various types of malware that purposely kills off other competing malware when it gets on a system.

      link to this | view in chronology ]

    • icon
      aldestrawk (profile), 14 Apr 2011 @ 5:14pm

      Re: Is This A 'More Friendly' Problem

      The following is what the FBI, along with ISC, needed to do:

      -Allow a computer to be infected and the analyze the code via reverse engineering and by monitoring all the packets involved in communication.

      -They apparently have actually seized, at least some of the C&C servers. This isn't strictly necessary. They do need to take over the domain names used by the botnet client computers to communicate with the C&C servers. The FBI seized those domain names by court order and now are using them for their own purposes here.

      A lone hacker could have done the first step but not the second. Without having access to a C&C server, a lone hacker cannot even find out the IP addresses of the other botnet clients. There is a remote possibility that a vulnerability in the C&C servers will allow code injection by a botnet client. Otherwise, that teen hacker has no hope.

      link to this | view in chronology ]

  • icon
    umccullough (profile), 14 Apr 2011 @ 7:56am

    This did little to help the owners

    Removed a piece of malware from a bunch of machines - wow... what good samaritans right?

    Not likely. The machines are probably infected with multiple pieces of malware (such is generally the case with machines like this), and the owners have learned nothing from this exercise.

    Notification and Education should be the proper solution - not "let us clean this up for you without your knowlege".

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2011 @ 8:05am

      Re: This did little to help the owners

      Read the original article - they didn't remove the malware, they just issued an already built in command for the malware to stop running. It restarts at reboot. Microsoft added the malware to their malicious software removal tool and those who get it through windows updates will have the software removed.

      Also, notification IS in the works. The ISC is recording IP addresses connecting to their new C&C servers and forwarding those lists onto ISPs, who can then notify their customers.

      link to this | view in chronology ]

      • icon
        Skeptical Cynic (profile), 14 Apr 2011 @ 8:35am

        Re: Re: This did little to help the owners

        Are you not freaked out that the FBI can issue a command to your computer to do what it wants? By whatever means or excuse? I am a die-hard US citizen but no way, no how, should the Gov get away with ever, for any reason, or under any law be able to do anything legally to your computer without a clear and defined legally approved purpose!!!

        link to this | view in chronology ]

        • identicon
          Anonymous Coward, 14 Apr 2011 @ 9:00am

          Re: Re: Re: This did little to help the owners

          They can't issue the command unless your computer is already infected with malware. In that instance the criminals are already controlling your infected machine.

          This was a clear and defined legally approved purpose. They went to court and got a court order to carry this out. It specifically included provisions regarding personal information - they believe the action would not result in the transmission of any personal information and if it did, it would be destroyed upon recognition.

          link to this | view in chronology ]

          • icon
            Any Mouse (profile), 14 Apr 2011 @ 3:40pm

            Re: Re: Re: Re: This did little to help the owners

            And you really trust them to destroy any information they get out of this? Well, I suppose, it /is/ the government, right? After all, they're hired by us to handle these sorts of things, right?

            link to this | view in chronology ]

        • icon
          Mike42 (profile), 14 Apr 2011 @ 9:04am

          Re: Re: Re: This did little to help the owners

          Dude, seriously. I can do it to these computers anytime I want. So can tons of hackers/crackers, white hat or black hat.

          If these systems were secure, the malware wouldn't have gotten there in the first place. Yes, you CAN harden your system and make it secure from these guys AND the feds. It's just that these people didn't.

          Chill. Breathe. No one wants your files anyway.

          link to this | view in chronology ]

          • identicon
            Anonymous Coward, 14 Apr 2011 @ 4:30pm

            Re: Re: Re: Re: This did little to help the owners

            Exactly. Find a rooted box, netstat it and check the IPs. Connect to the server, find the channel, have fun. Most of the time, the botnets have different triggers but same commandsets. Meaning once you find the trigger, you can manually shut down the botnet. It's not that hard to figure out, even without a 'reverse engineered' source/code to work off.

            link to this | view in chronology ]

  • icon
    Jay (profile), 14 Apr 2011 @ 7:58am

    Orrin Hatch

    So Orrin Hatch just got his wish to blow up a pirate's computer. Judges actually saying this was legal or to "test it out" really need to be smacked when they don't know what the implications could be...

    link to this | view in chronology ]

    • icon
      harbingerofdoom (profile), 14 Apr 2011 @ 10:16am

      Re: Orrin Hatch

      its unlikely that there were many actual pirates infected with this bot. the type of person that is savvy enough to fall into the category of pirate is usually savvy enough to not have bots roots bloatware crapware and the like.
      its pretty much only affects the clueless general public.

      not that your average politician would actually understand the ramifications of what i actually just said, but still....

      link to this | view in chronology ]

      • icon
        aldestrawk (profile), 14 Apr 2011 @ 5:26pm

        Re: Re: Orrin Hatch

        I don't know the Orrin Hatch pirate reference but one type of pirate is likely to be infected with malware and be part of a botnet. The pirate who isn't running a legal copy of Windows.

        link to this | view in chronology ]

  • identicon
    Mike, 14 Apr 2011 @ 7:58am

    Frankly, the kill command should DISABLE all infected computers, preferably with a boot-time blue screen telling the owner to call their IT dept or have the computer professionally virus-scanned and cleaned.

    These people need a heads-up, not coddling and excuses.

    link to this | view in chronology ]

    • icon
      Chuck Norris' Enemy (deceased) (profile), 14 Apr 2011 @ 9:15am

      Re:

      screen telling the owner to call their IT dept or have the computer professionally virus-scanned and cleaned

      Do you know how many scammers are already following this scheme? Except they recommend you call them for the "professional virus-scan".

      link to this | view in chronology ]

    • identicon
      JH, 14 Apr 2011 @ 11:03am

      Re:

      Frankly, the kill command should DISABLE all infected computers, preferably with a boot-time blue screen telling the owner to call their IT dept or have the computer professionally virus-scanned and cleaned.

      These people need a heads-up, not coddling and excuses.

      --

      Yeah...and when your car fails inspection the mechanic should pour sugar in the gas tank immediately.

      link to this | view in chronology ]

      • identicon
        Mike, 15 Apr 2011 @ 7:03am

        Re: Re:

        If my car is off attacking pedestrians without my knowledge, yes, please disable it in any manner you need to.

        The issue is not that their computers failed inspection, but that they have been hacked, owned, and are being remotely controlled to attack other people. This is indeed just cause to at the very least prevent them from booting, preferably in some manner that can be easily reversed by someone with the know-how.

        link to this | view in chronology ]

  • identicon
    Anonymous Coward, 14 Apr 2011 @ 7:59am

    Hitting the self destruct button on a built botnet isn't really the same as say, amazon deleteing things from your computer. Even if it caused problems for someone, guess what, they know there's a problem now, when there was one all along, and it prevents them from far worse things such as maybe identity theft that these things are great for.

    link to this | view in chronology ]

  • identicon
    Anonymous Coward, 14 Apr 2011 @ 7:59am

    Uh... First, it wasn't the FBI, it was the ISC. Second, they didn't "kill the computers", they issued a kill order to the malware.

    link to this | view in chronology ]

  • identicon
    Anonymous Coward, 14 Apr 2011 @ 8:02am

    We all want botnets and other assorted malware to get squashed, but this just doesn't fly with me. FBI - set up your command servers, record the IP addresses of infected machines, then forward that info to the respective ISPs to deal with it in a phone call or letter to the individual subscriber.

    If this sort of thing begins to take off, then how long will it be before some paid-for Senator decides to get P2P software classified as "malware" so the FBI can hack into your machine to shut it down?

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2011 @ 9:04am

      Re:

      So.. have them police your computers instead of take care of the treat? Great.

      link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2011 @ 12:25pm

      Re:

      Legislations is already being written for it i'm sure. Probably being read for one final check before introducing it tomorrow.

      link to this | view in chronology ]

  • identicon
    Gryphonn, 14 Apr 2011 @ 8:03am

    The Untested kill signal

    One day a gung-ho FBI hack(er) will send out an untested kill command. Maybe that could be the day that the coreflood (or future bot) coder has written code to either kill the systems or spread further malware to other systems.
    We should all hope this court order is a one off and not a precedent.

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2011 @ 8:09am

      Re: The Untested kill signal

      Especially now that the hackers know the FBI is involved with this sort of thing. If I was a vindictive malware author, I'd make sure all my future software had a very well-documented kill command that didn't just kill the malware, but also wiped the bios of the machine it's installed on.

      link to this | view in chronology ]

      • identicon
        Anonymous Coward, 14 Apr 2011 @ 4:08pm

        Re: Re: The Untested kill signal

        There's no money in crashing botnet clients.

        link to this | view in chronology ]

  • identicon
    Anonymous Coward, 14 Apr 2011 @ 8:10am

    "Does the FBI have a technical support helpdesk to help your grandparents when it kills their computer?"

    If your grandparents are having problems with their malware, they should contact the malware's author, not the FBI.

    link to this | view in chronology ]

    • identicon
      MrWilson, 14 Apr 2011 @ 8:42am

      Re:

      That's about as effective a suggestion as telling someone to write their congressman.

      link to this | view in chronology ]

    • icon
      Atkray (profile), 14 Apr 2011 @ 10:58am

      Re:

      You must not have any elderly around you.

      I get calls from elderly neighbors weekly because of problems like this.

      Most of them have multiple antivirus programs installed and expired.

      The grand-kids click on whatever pops up on the screen.

      Frequently they have already taken the computer in to a big box store and spent $250 to repair a $300 computer running Vista basic with insufficient memory.

      All they want to do is email and facebook pictures of their family.

      Somehow I don't think your suggestion that they contact the author of the malware is a viable solution, especially since most of them don't even know they have malware.

      It is easy for those of us that have a little more knowledge of how computers work to say that computer users need to be more responsible, but the truth is as manufactures have made computers easier to use the minimum requirements to be able to use one have gotten pretty low.

      The reality is many people will go through multiple computers without ever seeing a command prompt and will be glad they didn't. Expecting them to do more than turn it on and off is probably an unreasonable expectation at this time.

      link to this | view in chronology ]

      • identicon
        Mike, 14 Apr 2011 @ 1:10pm

        Re: Re:

        "All I want to do is go to the store and pick up some milk, how can I be expected to pay attention to stop signs, traffic lights, pedestrians and carjackers? All these unreasonable expectations..."

        link to this | view in chronology ]

      • icon
        senshikaze (profile), 14 Apr 2011 @ 1:32pm

        Re: Re:

        you don't work in IT.
        Expecting them to be able to turn it off and on IS unreasonable. I have gotten more than one person, from 20 years old to over 60 who didn't know how to turn off the damn machine they sit in front of for 40 hours a week.

        I hate people...

        (oh and your elderly neighbor, try Linux Mint. Might hit the spot.)

        link to this | view in chronology ]

  • identicon
    Anonymous Coward, 14 Apr 2011 @ 8:11am

    It doesn't look like the FBI is doing any programming...

    The FBI isn't writing any new code/applications and distributing it to the infected hosts. With the ISC, they're just issuing a 'stop' command - a command already preprogrammed into the malware running on the compromised systems. Any damage has already been done by the malware itself. Stopping it from running is really a low impact action.

    The real action comes with the microsoft malicious software removal tool. This is distributed via windows update and has been for years.

    I'd be a bit more wary if the FBI was taking some kind of active or invasive action on the compromised systems (e.g. distributing a new program to 'fix' the problem), but they're just issuing a stop command. The ISC is logging the IP addresses of infected system and sending those lists onto ISPs so the owners can be informed. I'm all kinds of wary about the FBI interfering with private systems and concerned about unintended consequences, but this all seems really benign.

    link to this | view in chronology ]

    • icon
      The eejit (profile), 14 Apr 2011 @ 8:18am

      Re: It doesn't look like the FBI is doing any programming...

      Considering recent actions by the US Government, I'd rather keep my tinfoil hat just in case, thank you very much.

      link to this | view in chronology ]

    • icon
      Bruce Ediger (profile), 14 Apr 2011 @ 11:54am

      Re: It doesn't look like the FBI is doing any programming...

      Of course the FBI isn't writing any software. Ever heard of the "Virtual Case File" fiasco? (http://spectrum.ieee.org/computing/software/who-killed-the-virtual-case-file)

      The FBI has traditionally been an all-IBM shop, in particular, an all-mainframe shop. The FBI's first website, way back when, was hosted ON A NASA MACHINE. That's right, the FBI didn't have anything that could run a web server in 1995 or so.

      The internal FBI culture probably prevents them from having anyone tech-savvy enough to do this kind of thing.

      link to this | view in chronology ]

  • icon
    Idobek (profile), 14 Apr 2011 @ 8:12am

    But.. but... cyber-warfare

    Note to the FBI, the DOD, and others demanding more powers to combat cyber-terrorism and cyber-warfare:

    a) The ability of foreign powers to shut down power plants and, other computer based infrastructure, over the internet is not real - and, therefore, this cause of action is safe but your demands for more power are based on lies.

    OR

    b) Whoops - you accidentally disabled the control system of a nuclear power plant because it was infected with a botnet.

    link to this | view in chronology ]

  • identicon
    Anonymous Coward, 14 Apr 2011 @ 8:12am

    DRMs like SONY's CD rootkit, Starforce, and Securom all worked very nicely in the 'lab' too.

    link to this | view in chronology ]

  • icon
    kellythedog (profile), 14 Apr 2011 @ 8:15am

    How long until the FBI or whoever starts turning on the webcams and having a look.
    Seems someone else was doing that and it worked kind of well.
    "Oh Noes...more people eating Mike and Ikes, we definitly have a drug problem" send in the troops"

    link to this | view in chronology ]

  • identicon
    Justin, 14 Apr 2011 @ 8:27am

    jumping to conclusions ....

    I think some folks are jumping to conclusions here. Nothing says they are killing or targeting the computers, just the botnet. As long as that's the case I'm all for it.

    If it is a case of "targeting" the infected machine then we have a problem.

    In other words if my IP gets wrongly targeted and has no code for the botnet and thats the code they are sending, then no harm. If they are sending something to my computer because they THINK the botnet is there, that's an issue.

    link to this | view in chronology ]

  • identicon
    Michial Thompson, 14 Apr 2011 @ 8:27am

    Hard Sale for stopping this activity

    It does kinda suck that the FBI would do this, but your going to have a hard time selling the fact that they shouldn't do it.

    You have Millions of people screaming about SPAM, and malware, and bandwidth consumption etc... Lots are screaming at congress to do something about all this etc...

    A legitimate and secure network and PC is at no risk of the FBI issuing THIS command to stop because you or your IT staff would have already removed the MalWare. So screaming about the FBI issuing this stop order on this malware isn't going to get you far.

    In the end, like it or not your likely to see more and more of this from the Government all in the name of "security."
    ---------
    Personally I have mixed feelings about it. My GMail account's spam filter has 2600+ emails in the SPAM box, that's the highest I have seen it in several years and it's only the past 30 days too. Obviously Google's filter is doing well, but my corporate email server is still bombarded with all this same SPAM, and I cannot afford the $10k/yr that the SPAM Filter Companies want to extort from my company and they still don't do anything to reduce the bandwidth I have to pay for for this crap to attempt to hit my servers.

    It sucks that the FBI did this, but it's obvious that the owners of the PCs in the Bot-Net don't give a rats ass about the damage they are doing because they have done nothing to secure their computers.

    link to this | view in chronology ]

    • icon
      Meek Barbarian (profile), 14 Apr 2011 @ 8:40am

      Re: Hard Sale for stopping this activity


      It sucks that the FBI did this, but it's obvious that the owners of the PCs in the Bot-Net don't give a rats ass about the damage they are doing because they have done nothing to secure their computers.


      I'd amend that a bit. I'm sure some (a lot?) of it is more along the lines of ignorant users (e.g., the computer illiterates) that don't even know their PCs are causing damage. It's not that they don't care - they just don't realize that the toy water gun they keep pointing at the internet has live ammo loaded in it.

      link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2011 @ 8:45am

      Re: Hard Sale for stopping this activity

      10k a year? Whaaa? We spend $300 a year, and have the most awesome spam filter ever. Only ones that ever get thru are people that are on the whitelist, and get their accounts hacked.

      link to this | view in chronology ]

      • icon
        Griff (profile), 14 Apr 2011 @ 9:05am

        Re: Re: Hard Sale for stopping this activity

        Whitelists ain't much use for new customers.

        link to this | view in chronology ]

        • identicon
          Anonymous Coward, 14 Apr 2011 @ 10:24am

          Re: Re: Re: Hard Sale for stopping this activity

          Honestly, nothing beats a good set of human eyes to see what's going on. That's the bigger problem here, IT workers want things so automatic they totally forget the value of a smart IT worker that has a pulse on what goes in and out of the network.

          Bet you didn't know that some of your mail is being routed thru DoD servers......

          link to this | view in chronology ]

        • identicon
          Anonymous Coward, 14 Apr 2011 @ 10:31am

          Re: Re: Re: Hard Sale for stopping this activity

          I would also like to add, that even Yahoo/AOL uses whitelists...

          link to this | view in chronology ]

    • icon
      Griff (profile), 14 Apr 2011 @ 9:08am

      Re: Hard Sale for stopping this activity

      So google goes a great spam filtering job but your corporate spam filter costs $10k.

      Hmm. Why not send corporate email through google ?
      Route it in, pop/IMAP it out. One google user each, free.
      KISS as they say.

      Or even go the whole hog and move to Google corporate email. Saves you running a mail server too.

      link to this | view in chronology ]

      • identicon
        Anonymous Coward, 14 Apr 2011 @ 10:39am

        Re: Re: Hard Sale for stopping this activity

        There are just some businesses that cannot operate 'in the cloud', without breaking a bunch of laws/contracts/rules/regulations.

        Aerospace manufacturing being one of them.

        link to this | view in chronology ]

  • identicon
    Christopher, 14 Apr 2011 @ 8:42am

    Ummm, wow.

    We need to add voting buttons for "RTFA", "Offtopic", "Blundering dope".

    I'm happy the FBI hijacked -- in the truest definition of the word -- the botnets and killed the clients. Did it solve a minor issue? Yep. Is it an invasion? Nope. That conduit already existed. The FBI closed it. Thank them, for Pete's sake.

    Your fears are largely misplaced. Instead of blaming a system that allows shitbirds to run botnets with impunity, you blame a government entity for *possibly* inducing a side-effect to a largely beneficial act. that's like blaming vaccines for the plague.

    -C

    link to this | view in chronology ]

  • identicon
    Anonymous Coward, 14 Apr 2011 @ 8:45am

    Misleading headline

    So basically you've turned a story that actually says "FBI uses the same somewhat risky techniques that have already been used on several occasions by security researchers, but with more oversight" and turned it into a headline that sounds far more like "Court allows FBI to remotely wipe millions of people's computers"... Really?

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2011 @ 9:01am

      Re: Misleading headline

      Exactly. This entire article is completely misleading. It's as if he didn't even read the original post he linked to; and instead created his own conclusions base on no facts or evidence.

      link to this | view in chronology ]

    • icon
      The eejit (profile), 14 Apr 2011 @ 9:04am

      Re: Misleading headline

      Because the FBI have now tipped their hands, yes.

      link to this | view in chronology ]

  • identicon
    W. Banchs, 14 Apr 2011 @ 9:02am

    FBI - crosses ethical lines to cut un-ethical lines

    I can understand the "greater good" mentality that prompted the FBI to seek and, let's not forget from a judge, obtain court approval to commit this act of sanctioned government trespass on private computers.

    Who's to know what else was on the payload of the programming that FBI sent to each computer, even if it was to monitor the life of the bot programming it still would be an unlawful/uninivited seizure of that virtual property of the computer owners whouldn't you think?

    link to this | view in chronology ]

  • identicon
    moe, 14 Apr 2011 @ 9:06am

    A telling detail

    I think it's telling that the FBI/ISC didn't use the same methodology used by the Dutch. When the Dutch did this, they also sent along a message to the computer (I'm guessing a pop-up/windows messaging service message) notifying the user that they were infected with malware.

    Privacy and individual rights vary from country to country. If this was a legitimate use of law enforcement authority in the U.S., why didn't the FBI/ISC pass along a message also? From a technical standpoint, there is no difference between sending this "kill" command to the malware and sending a message via the Windows Messaging Service (or some similar mechanism). The only difference between the two is that one is undetectable.

    What does that tell you?

    link to this | view in chronology ]

  • identicon
    Anonymous Coward, 14 Apr 2011 @ 9:08am

    I'm just shocked they bothered to get a court order this time.

    link to this | view in chronology ]

  • icon
    lavi d (profile), 14 Apr 2011 @ 9:09am

    Unintended Consequences

    But... when dealing with something like this, where the FBI is sending execution commands to millions of PCs, you have to assume that sooner or later, something bad is going to happen.

    Would ... you like ... to play a ... game?

    link to this | view in chronology ]

  • icon
    ServerMonkey (profile), 14 Apr 2011 @ 9:24am

    Really?

    Ok guys... seriously? The FBI found a bot-net that was already in existence. They figured out the ports and ID schema to gain control of it. Rather than have the people "in charge of it" fry the OS's or change the access... they simply shut it down using what was already available as a tool through the bot-net program. This was a safety measure, and nothing more. They didn't hack the machines... they didn't send codes to a computer that wasn't already compromised in some way.

    As someone who does this kind of thing for a living (CEH/CPTE), please learn more before you just fly off the handle and start spouting "big brother" comments. They used a tool someone else maliciously installed in a way that prevented further issues for the time being... if you see something wrong with that, then you have serious trust issues.

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2011 @ 10:48am

      Re: Really?

      Have you learned nothing in the past 10 years. The problem is, they will take it too far. They always do.

      Need I remind you that we went from Profiling at the airport to full on pat downs, all in the name of 'good'.

      Pishaw.

      Are we gonna wait until they go to far to put our foot down?

      The next issue is, I think this is all dog and pony. I think the botnet dudes have just infiltrated and pulled off the biggest social engineering exploit ever.

      Now the botnet dudes know EXACTLY how the government is set up on the inside.

      link to this | view in chronology ]

    • icon
      Any Mouse (profile), 14 Apr 2011 @ 4:54pm

      Re: Really?

      you do this for a living. Nice. Ummm, you know they just shut down the client, right? if your computer reboots? Oops! There it is, again! so, it's not even a 'safety measure.'

      And 'wasn't already compromised in some way' isn't an excuse, either.

      link to this | view in chronology ]

  • identicon
    Michael, 14 Apr 2011 @ 9:31am

    Users

    "Malicious" software or not, who is the FBI to determine that software isn't allowed to run on my computer.

    Talk about unintended consequences - who determines that software is worthy of being killed by the FBI? What if I wanted Coreflood running on one of my machines because I was working on malware detection software?

    If they are allowed to do this, how can we ensure they will not issue a kill command to any other software they deem "Malicious" - sometimes MS Office crashes my machine - are they allowed to kill it?

    At the VERY LEAST, they should be contacting every user of every computer to determine if this is malicious software on the machine they intend to kill it on before being allowed to touch it.

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2011 @ 4:01pm

      Re: Users

      Wow. You are really an idiot.

      If the operators of the botnet had decided to shut it down, are you going to be equally upset?

      If you are working on software to detect malicious software, then take it offline. The code is going to remain on your machine whether it is online or not.

      They didn't hack into your computer and run 'pkill -9 coreflood', they issued a command though the botnet to shut it down.

      link to this | view in chronology ]

  • icon
    Rob (profile), 14 Apr 2011 @ 9:57am

    I felt a great disturbance in the Force, as if millions of voices suddenly cried out in terror, and were suddenly silenced...... no, hang on....they're back

    link to this | view in chronology ]

  • identicon
    Anonymous Coward, 14 Apr 2011 @ 10:03am

    It's a great experiment. All governments want to control "their" people.

    link to this | view in chronology ]

  • icon
    AndyD273 (profile), 14 Apr 2011 @ 11:12am

    FUD storm

    It's not like they are actually targeting these computers.
    "Next computer: 153.54.23.123 -kill. One down, three million to go."

    It's likely just an untargeted broadcast, using the same way that the virus writers issue commands to it.
    Which is worse, a federal agency sending a stop command to the malware on my computer, or a malicious group of thugs sending commands to my computer to do who knows what, possibly stealing private data.

    Honestly, this is semi encouraging just because they went through proper legal channels to get the court order, instead of just doing it under their own authority, like all those wiretaps.

    It's just to bad they cant put a message up on the screen warning people they are infected and advising them to run windows update to fix the problem.

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2011 @ 12:34pm

      Re: FUD storm

      honestly If I had a alert message pop up on my screen telling me my computer's been infected and gave me a link or instructions on how to repair it... i'd disregard it like every other spammy website out there trying to tell me "Your antivirus is out of date, download the new version here"

      link to this | view in chronology ]

    • icon
      aldestrawk (profile), 14 Apr 2011 @ 5:37pm

      Re: FUD storm

      The C&C could possibly use multicast addressing for the control of a botnet. I am not aware this has ever been done. A problem is that not all ISPs support multicast routing. There really isn't much of a problem having a single server control a large botnet using just unicast. I am sure the FBI is just using the same mechanism.

      link to this | view in chronology ]

  • identicon
    Elder-Geek, 14 Apr 2011 @ 11:14am

    Its not your computer

    At the point your computer is compromised by a botnet, it is not really your computer anymore. The botnet owns it and allows you as a patsy to continue to use it. This is about the same as someone making a copy of your car keys and borrowing your car every night to commit crimes and gases it back up and leaves it for you in the morning.

    I am not sure how a compromised PC should be treated. But I do not think you have the same rights as with an uncompromised PC. If you don't want the FBI poking around on your computer. Then you need to make sure it does not get infected. Because once it is infected, it is a threat and danger to the public and yourself. Spewing out spam, being used to crack passwords, serve up illegal porn and as a playground for stealing your online identity and accounts.

    The minute your computer is compromised it is like going to a bad neighborhood and leaving an unlocked car with a pile of cash, a machine gun, ammo, and drugs laying around in the front seat. You have encouraged something bad to happen.

    Should the FBI have just traced the IP address and filed suit against these individuals as spamers? Should they send you a letter telling you your computer is infected and you need to spend $200 or more taking it to someone who knows what their doing to backup your data and reinstall your OS and software?

    I think sending the kill signal is the best thing they could have done. Otherwise there is a good chance some hacker would be able to re-acquire these machines.

    link to this | view in chronology ]

  • identicon
    Anonymous Coward, 14 Apr 2011 @ 11:19am

    Don't know if this question has been asked already, but did the FBI limit this kill command to computers only inside the US?

    link to this | view in chronology ]

    • identicon
      moe, 14 Apr 2011 @ 1:56pm

      Re:

      Yes, they only sent the kill command to computers with IP addresses in the US.

      link to this | view in chronology ]

  • identicon
    New Mexico Mark, 14 Apr 2011 @ 11:33am

    Wow, what a difference!

    Last week my computer was acting funny. Now it's serious all the time, and wearing a dark suit and shades.

    NMM

    link to this | view in chronology ]

  • identicon
    Steve Jobs, 14 Apr 2011 @ 12:29pm

    Botnet

    Maybe you should by a iMac, if you don't want to be hassled by botnet or the FBI

    link to this | view in chronology ]

  • icon
    Charles (profile), 14 Apr 2011 @ 1:46pm

    probably already posted but my time online is short today:

    I'm sure it has been mentioned already, but who is to say that one of the computers that was sent the kill command is not part of some system critical piece of machinery, say a control computer for a nuclear reactor, or a computer that checks to see if the engines on a nuclear missile are non-operating? I'm half sure that the FBI thought of this, but we have definitely seen other cases of the govt doing things that have consequences beyond what they thing is "possible."

    link to this | view in chronology ]

    • identicon
      Anonymous Coward, 14 Apr 2011 @ 3:45pm

      Re: probably already posted but my time online is short today:

      Just so I'm clear, you are perfectly happy that people running the botnet has their code on some critical piece of machinery and can do anything they want, but you are concerned about the govt shutting down said botnet?

      Just how much testing and care do you think the botnet creators of done to ensure critical computer systems don't fail in some horrific way because of their botnet?

      link to this | view in chronology ]

    • icon
      aldestrawk (profile), 14 Apr 2011 @ 5:43pm

      Re: probably already posted but my time online is short today:

      The FBI could have made an attempt to clean the system of the malware completely. That can be risky since it may include system files and Registry entries for WIndows. Killing a process or processes is fairly safe considering they were designed to serve the purposes of a botnet.
      I agree with anonymous coward better the FBI does this with a critical system than letting the botnet owners maintain control.

      link to this | view in chronology ]

  • identicon
    Anonymous Coward, 14 Apr 2011 @ 4:46pm

    What if it were your car

    If a person's car was leaving oil spills, lots of blue exhaust, and was unroadworthy, would you support the government ie. the police to get that dangerous car off the road? Would you really defend the car owner's right to drive? How would you respond to the driver's pleas that they need to get places in their car? Or can't afford to, or know how to fix it?

    link to this | view in chronology ]

  • identicon
    David, 15 Apr 2011 @ 11:21am

    From across the pond

    Looking from my UK viewpoint; although I think that the sooner botnets are smashed, the better, I would certainly be uneasy about our "authorities" doing a similar thing. I'm glad to see that there was, at least, some sort of due process through a court, unlike (so I understand) the domain seizures carried out by your Homeland Security people but I still remain unconvinced that this is the best way of dismantling a botnet, in case there were unintended consequences. Perhaps there should be a specialised government department for such affairs, manned by REAL I.T. experts who know exactly what they are doing and, hopefully, can foresee any problems.

    link to this | view in chronology ]

  • icon
    Bob Webster (profile), 15 Apr 2011 @ 3:29pm

    If I can't or won't be secure, I would rather the FBI have control of my computer than a spammer.

    link to this | view in chronology ]


Follow Techdirt
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Discord

The latest chatter on the Techdirt Insider Discord channel...

Loading...
Recent Stories

This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it
Close

Email This

This feature is only available to registered users. Register or sign in to use it.