Please do not take down the Sality botnet
seclists.org
Please do not take down the Sality botnet
1–10 of 148 posts
Re: Please do not take down the Sality botnet
#2Does anyone know exactly why it's illegal to take down Sality?
Re: Please do not take down the Sality botnet
#3Does anyone know exactly why it's illegal to take down Sality?
The "takedown" technique presented works by exploiting the botnet's functionality to have all the machines remove themselves from the botnet - actually carrying out the removal requires you to hack into at least one third-party server, and it would probably count as gaining unauthorized access to each of the machines in the botnet as well.
Re: Please do not take down the Sality botnet
#4Does anyone know exactly why it's illegal to take down Sality?
the c&c servers are sites hacked by the owners of the botnet. you would have to hack them yourself and upload your own payload to take down peers
Re: Please do not take down the Sality botnet
#5Does anyone know exactly why it's illegal to take down Sality?
Sounds like the author figured out a SQL injection vulnerability in the website the bot downloads logos from, and a way to give the removal tool as the image in a way that infects Sality itself. This would distribute the removal tool very quickly. The hacking of the website seems to be the legal issue here.
Re: Please do not take down the Sality botnet
#6Does anyone know exactly why it's illegal to take down Sality?
Because technically the methods used (i.e. SQL injection) are illegal if you dont own the equipment your using it on.
Also he is a civilian and does not have any power or jurisdiction to do so.
Re: Please do not take down the Sality botnet
#7Does anyone know exactly why it's illegal to take down Sality?
Is that network yours? No? Then it's illegal.
It's an interesting way to have someone do the dirty work. I would love to see a postmortem writeup.
Re: Please do not take down the Sality botnet
#8Does anyone know exactly why it's illegal to take down Sality?
Presumably because it involves exploiting a SQL injection attack on one or more control servers, and then using the control servers to install software on thousands of other people's computers without their knowledge or consent.
Re: Please do not take down the Sality botnet
#9Does anyone know exactly why it's illegal to take down Sality?
It's illegal in a similar manner to robbing a drug cartel--getting arrested is probably the least of your concerns. No one will step forward to law enforcement over it, but organized crime has their own law enforcement.
Re: Please do not take down the Sality botnet
#10Does anyone know exactly why it's illegal to take down Sality?
Messing with other people's computers in any form without their information and consent is usually prohibited by law.
A slightly broken analogy would be breaking into a house to remove a hornets nest. Even if you do it carefully and not do any damage and what you do is beneficial for the community as a whole, it's contrary to the law.