Massive Indestructible Botnet • Hacker News Board

Re: Massive Indestructible Botnet

#11

Post by zitterbewegung » Thu, Jun 30, 2011, 6:50 AM UTC

Indestructable isn't the right word to describe this. More like very resilant or resistant. Title is very linkbait and the reporting looks like its based off of phrases by security researchers.

Re: Massive Indestructible Botnet

#12

Post by fragsworth » Thu, Jun 30, 2011, 6:52 AM UTC

In my opinion, a very poorly written article, but here are some of the main points:

1. estimated 4.5 million infected machines

2. it infects the Master Boot Record

3. it uses the Kad Network (http://en.wikipedia.org/wiki/Kad_network) to issue commands to the clients (No idea how, the article did not explain this)

4. it disables competing malicious software

5. it acts as a malicious software manager; they install software for their "customers" to temporarily use

Re: Massive Indestructible Botnet

#13

Post by noglorp » Thu, Jun 30, 2011, 6:56 AM UTC

Fancy cryptography, p2p networking, with web-based command and control: indestructible 'new' type of botnet, or practically identical to Zues? You decide!

Re: Massive Indestructible Botnet

#14

Post by leon_ » Thu, Jun 30, 2011, 8:02 AM UTC

good old fdisk /fixmbr ;)

Re: Massive Indestructible Botnet

#15

Post by maqr » Thu, Jun 30, 2011, 8:16 AM UTC

kaze wrote: post #4

Wouldn't it help to have a read-only bootup DVD to scan the MBR?

Yeah, I use UBCD4WIN when I need to remove these kind of infections. You simply rebuild the MBR whether it needs it or not.

Re: Massive Indestructible Botnet

#16

Post by JonnieCache » Thu, Jun 30, 2011, 8:29 AM UTC

Anyone got a link to a source with some info that isn't aimed at someone with the technical expertise of the average pensioner? There was no information in this article.

Who are these people that read the front pages of both Hacker News and computerworld.com?

EDIT: This is more like it: http://www.securelist.com/en/analysis/204792157/TDSS_TDL_4

EDIT2: That link was just an initial analysis of the infection vectors, here's a more full analysis of the payload and suchlike http://www.securelist.com/en/analysis/204792180/TDL4_Top_Bot

Re: Massive Indestructible Botnet

#17

Post by JonnieCache » Thu, Jun 30, 2011, 8:33 AM UTC

leon_ wrote: post #14

good old fdisk /fixmbr ;)

Ahhh... memories. Back when trying to dual-boot linux had about 20% chance of not fucking your whole shit up up.

Although that may have been down to my relative inexperience at the time.

EDIT: I have more memories of using the plain ol 'fixmbr' command that you ran from that weird 'recovery console' shell on the windows install CD. Didn't realise fdisk had a /fixmbr switch. Guess it does the same thing.

Re: Massive Indestructible Botnet

#18

Post by sc00ter » Thu, Jun 30, 2011, 9:08 AM UTC

JonnieCache wrote: post #16

Anyone got a link to a source with some info that isn't aimed at someone with the technical expertise of the average pensioner? There was no information in this article. Who are these people that read the front pages of both Hacker News and computerworld.com? EDIT: This is more like it: http://www.securelist.com/en/analysis/204792157/TDSS_TDL_4 EDIT2: That link was just an initial analysis of the infection vectors, h…

Amongst others no doubt: http://www.symantec.com/security_response/writeup.jsp?docid=...