So, is it down yet?
Please do not take down the Sality botnet
51–60 of 148 posts
Re: Please do not take down the Sality botnet
#52Please OP, you obviously have done the work, just go to a library or any free wifi location and run the damn thing.
Re: Please do not take down the Sality botnet
#53Is it just me or did the OP just blow a rare opportunity to be a hero? The power of a zero-day exploit is that you don't announce it and give the target a chance to make a patch.
Re: Please do not take down the Sality botnet
#54would this be completely prevented if the botnet owners signed (with a private key) their payloads?
Yes, I believe that would be very effective.
Re: Please do not take down the Sality botnet
#55The guy takes all the time to put this together, write this up, and is perfectly ok with the outcome, but instead of going to a coffee shop and doing this himself, he spends a lengthy amount of time writing up instructions and giving the criminals a chance to fix their injection problems before someone can take down the botnet. Baffling. Not only that, but this guy seems to know what he's doing and instead of someone…
I also don't understand how he expects that the botnet won't be taken over or hardened based on the results he published before it gets shut.
I did try to download the images linked in the post, not a single one is as I write replaced with his removal utility, so observing just these few links there's no evidence that somebody already decided to follow his recipe.
I'd really like to read some news writeup in a few days.
Re: Please do not take down the Sality botnet
#56The guy takes all the time to put this together, write this up, and is perfectly ok with the outcome, but instead of going to a coffee shop and doing this himself, he spends a lengthy amount of time writing up instructions and giving the criminals a chance to fix their injection problems before someone can take down the botnet. Baffling. Not only that, but this guy seems to know what he's doing and instead of someone…
To prove a point- the current system of law is completely broken when it comes to dealing with malicious software. Law enforcement is a joke, to the point where reporting a botnet c&c located right in the US to the FBI will result in a six week run around before you finally get a phone call from someone in the right department, and this is assuming you've dealt with them enough to be on their quick list. Guess who moved their servers four weeks ago?
Actually taking matters into your own hands, as an individual or a company, opens you up to a ridiculous level of liability and is probably illegal in a number of cases. Hell, even analyzing malicious software itself has the potential to be illegal due to draconian copyright laws (fortunately most malware authors aren't willing to claim owner of their software, so this isn't an active issue). Even once all that is done, more malware will be written, and probably by the same people since it's not like taking the botnet down actually puts people behind bars.
This isn't to say the bad guys are winning- I may be a bit bias (I work for Malwarebytes, although this post is my own rambling mess), but a lot of technological strides are being made. There is still a fair bit of frustration out there with law enforcement though, as they continue to impose draconian and orwellian systems but haven't implemented the low hanging fruit in policy changes for actually dealing with this crap.
Re: Please do not take down the Sality botnet
#57The guy takes all the time to put this together, write this up, and is perfectly ok with the outcome, but instead of going to a coffee shop and doing this himself, he spends a lengthy amount of time writing up instructions and giving the criminals a chance to fix their injection problems before someone can take down the botnet. Baffling. Not only that, but this guy seems to know what he's doing and instead of someone…
I imagine if you do it from a coffee shop or similar public place, then there is a good chance of being caught on CCTV. Whether the authorities will go after someone to that degree, given what they have potentially done, is another matter.
Re: Please do not take down the Sality botnet
#58Earlier quoted context omitted.
I think the issue is that to remove the botnet, it requires having your code be executed on all infected machines. You can't possible get permission from the owners of the millions of infected machines to do this.
Yep. Imagine if it bugged out and broke all the infected machines. Even if the bug that broke the machines wasn't his fault, he'd probably still be in a grey area.
Even a bug that affects just 0.1% of a 1 million big bot net would still leave a 1000 unhappy users with broken setups that might consider themselves to have been better off with the bot net.
Re: Please do not take down the Sality botnet
#59Earlier quoted context omitted.
Messing with other people's computers in any form without their information and consent is usually prohibited by law. A slightly broken analogy would be breaking into a house to remove a hornets nest. Even if you do it carefully and not do any damage and what you do is beneficial for the community as a whole, it's contrary to the law.
If my neighbours hornets nest had killer hornets that were biting all the children in the neighbourhood and the police / council refused to do anything; then it'd be a damned shame if someone neatly removed the hornets nest. Of course that wouldn't make it any more legal; but your defence would have a field day with the prosecution I'd imagine. IANAL but I've watched the first double episode of The Firm, and I reckon…
I'm curious now. What if my neighbours house was on fire? That fire threatens the whole neighbourhood. Surely I can protect my property by attempting to put out the fire. Do firefighters have indeminty for attempting to put out fires? What about volunteer firefighters?
Obviously I consider a house on fire to be analagous to an infected computer, but I do have some protection putting out a fire right? Nobody would sue me for fire damage (as long as I'm reasonable etc).
Re: Please do not take down the Sality botnet
#60The guy takes all the time to put this together, write this up, and is perfectly ok with the outcome, but instead of going to a coffee shop and doing this himself, he spends a lengthy amount of time writing up instructions and giving the criminals a chance to fix their injection problems before someone can take down the botnet. Baffling. Not only that, but this guy seems to know what he's doing and instead of someone…
I apologize in advance for the tone, but as a Russian I have a question - are you racist?
Since Sergey Brin and Mila Yovovich are "russians", do you imply that Google and Hollywood are part of this botnet?
The most famous hacker is Kevin Mitnick [american] and most recent hackers charged/arrested by FBI are also american citizens.
Why don't you change "russians" to "americans"? Or may be "new_zealanders" [Kim dot com]? Or may be "brits" [UK kid, extradicted recently to US on copyright violation charges].
If you would change to "americans", I just wonder whether some people will feel offended and how many?