Перейти к содержанию
A.

Botnet Shutdown Success Story: How Kaspersky Lab Disabled the Hlux/Kelihos Botnet

Recommended Posts

A.

Как я и обещал вот в этой теме

http://www.anti-malware.ru/forum/index.php?showtopic=19722

Лаборатория Касперского рассказывает правду о том кто, что и как сделал для закрытия ботнета Hlux.

Kaspersky Lab played a critical role in this botnet takedown initiative, leading the way to reverse-engineer the bot malware, cracking the communication protocol and developing tools to attack the peer-to-peer infrastructure. We worked closely with Microsoft’s Digital Crimes Unit (DCU), sharing the relevant information and providing them with access to our live botnet tracking system.

A key part of this effort is the sinkholing of the botnet. It’s important to understand that the botnet still exists – but it’s being controlled by Kaspersky Lab. In tandem with Microsoft’s move to the U.S. court system to disable the domains, we started to sinkhole the botnet. Right now we have 3,000 hosts connecting to our sinkhole every minute. This post describes the inner workings of the botnet and the work we did to prevent it from further operation.

Дальнейшие технические детали по ссылке:

http://www.securelist.com/en/blog/20819313..._Kelihos_Botnet

P.S. Заодно прошу считать это нашим ответом на упреки некоторых местных, в том что якобы антивирусные компании специально не борятся с киберпреступностью.

Ага.

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты
sergey ulasen

Здорово!

И расставили точки над i.

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты
Umnik

A.

Когда будет на русском, чтобы утянуть в бложик?

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты
rkhunter
Здорово!

И расставили точки над i.

Еще вычищать компьютеры нужно, это был только первый этап.

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты
sergey ulasen

Невзирая на 2:39, я дошел до раздела What now? ;)

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты
OlegAndr

Думаю на эти надо компы закачивать MSRT, вроде как утилита MS, меньше будет легальных вопросов чем если туда запузырить что нить от Касперского.

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты
A.

Kaspersky Lab, Kyrus Tech and Microsoft Disable the Hlux/Kelihos Botnet

In their ongoing assault against botnet operators and the hosting companies that allow anonymous domain registrations which facilitate them, Kaspersky Lab, Microsoft and Kyrus Tech have successfully worked together to take out the Kelihos botnet, originally named Hlux by Kaspersky Lab. Kelihos was used for delivering billions of spam messages, stealing personal data, performing DDoS attacks and many other criminal activities, via an estimated 40,000 computers. Microsoft has also taken legal action against 24 individuals in connection with the infrastructure behind the botnet in a civil case that enabled the takedown of the domains being used to command and control the botnet. Microsoft’s legal action included declarations submitted to court to which contributions were made by Kaspersky Lab, and also a direct declaration from Kyrus Tech providing detailed information and evidence regarding the Kelihos botnet.

Kaspersky Lab has played a pivotal role in taking down the botnet, tracking it since the beginning of 2011, when it started collaborating with Microsoft in tackling Kelihos, including sharing its live botnet tracking system with the US company. Kaspersky Lab has also taken care that the botnet cannot be controlled anymore, and continues to make sure that this is the case. Its specialists reversed-engineered the code used in the bot, cracked the communication protocol, discovered the weaknesses in the peer-to-peer infrastructure, and developed the corresponding tools to counteract it. What’s more, since the offending domains used in the botnet have gone offline via court orders Microsoft had secured, Kaspersky Lab has been “sinkholing” the botnet - where one of its computers has gotten inside the botnet’s complex internal communications to bring it under its control.

Acknowledging Kaspersky Lab’s active involvement in taking down the botnet, Richard Boscovich, senior attorney with the Microsoft Digital Crimes Unit, said: "Kaspersky Lab played a key role in this operation by providing us with unique and in-depth insight based upon their technical analysis and understanding of the Kelihos botnet. This contributed to both a successful takedown and as evidence for declarations made about the analysis and structure of the botnet. We are grateful for their support in this matter and their determination to make the Internet safer."

Speaking of the continuing role Kaspersky Lab is playing in controlling Kelihos, Tillmann Werner, senior malware analyst of Kaspersky Lab Germany, said: “Since Kaspersky Lab’s sinkholing operation began on September 26, the botnet has been inoperable. And since the bots are communicating with our machine now, data mining can be conducted to track infections per country, for example. So far, Kaspersky Lab has counted 61,463 infected IP addresses, and is working with the respective ISPs to inform the network owners about the infections.”

Kelihos is a peer-to-peer botnet. It consists of layers of different kinds of nodes: controllers, routers and workers. Controllers are machines presumably operated by the gang behind the botnet. They distribute commands to the bots and supervise the peer-to-peer network's dynamic structure. Routers are infected machines with public IP addresses. They run the bot for sending out spam, collecting email addresses, sniffing out user credentials from the network stream, etc.

Microsoft has announced that its Malware Protection Center has added detection for the Kelihos malware to its Malicious Software Removal Tool. Since this tool is well-distributed the number of infections that have already been cleaned up is significant.

Cooperation between Kaspersky Lab and Microsoft has been ongoing now for some time. Notable recent collaboration includes that on the infamous Stuxnet worm, which hacked industrial control systems like those used in Iran’s nuclear programs.

Kaspersky Lab would like to thank SURFnet for its support in the operation, and especially for providing the perfect infrastructure to run the sinkhole.

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты
rkhunter

Почему взялись именно за Hlux/Kelihos?

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты
A.
Почему взялись именно за Hlux/Kelihos?

cz.cc что нибудь говорит ?

это одна из причин.

Он мощно начал, еще в начале года

http://www.shadowserver.org/wiki/pmwiki.ph...lendar/20101230

Именно тогда, с январе и началась операция по его исследованию.

http://www.securelist.com/en/blog/11114/Ne..._Botnet_Arising

http://www.securelist.com/en/blog/11116/A_...the_HLux_botnet

А когда потом с него повалили и фейк-ав и блокеры (это помимо спама) - ну такой "прекрасный" вирусный супермаркет нельзя было оставить нетронутым. Да и провернуть первый в истории угон P2P-ботнета тоже интересно.

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты
KIS_fan

На русском:

http://www.securelist.com/ru/blog/40767/Ka...et_Hlux_Kelihos

На сайте Microsoft:

https://blogs.technet.com/b/microsoft_blog/...nt-in-case.aspx

Ни слова о ЛК ... почему ?

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты
Mr. Justice
На русском:

http://www.securelist.com/ru/blog/40767/Ka...et_Hlux_Kelihos

На сайте Microsoft:

https://blogs.technet.com/b/microsoft_blog/...nt-in-case.aspx

Ни слова о ЛК ... почему ?

Тоже читал материалы от Microsoft, не увидел упоминания ЛК. Странно.

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты
rkhunter

Это всего лишь запись в блоге; упоминание о Kaspersky Lab есть в официальных документах, которые были приобщены к делу и появились сразу после публикации новости.

  • Upvote 5

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты
rkhunter

Microsoft заключила внесудебное соглашение с двумя ответчиками по делу о криминальном ботнете Kelihos/Hlux и отказалась от исковых претензий к этим лицам.

Ссылка

Поделиться сообщением


Ссылка на сообщение
Поделиться на другие сайты

Создайте учетную запись или войдите, чтобы комментировать

Вы должны быть пользователем, чтобы оставить комментарий

Создать учетную запись

Зарегистрируйте новую учётную запись в нашем сообществе. Это очень просто!

Регистрация нового пользователя

Войти

Уже есть аккаунт? Войти в систему.

Войти

  • Сообщения

    • moogend
      Buy clavaseptin at boots, clavaseptin purchase shop uk


      What can be better than being sure that the drugs you buy are effective and of high quality!


      BEST PRICE FOR Clavaseptin





      The hottest news in the world of medicine - best drugs of the year!





      How long does it take for kefir to start working? Once you get used to drinking kefir you will not feel the uncomfortable symptoms anymore. This should happen in approximately 2 weeks when you will be starting to feel positive benefits of kefir. But note, for best result you should drink kefir every day!
      What antibiotics treat what infections? He'll likely prescribe one of the following antibiotics to treat it before the culture comes back: Amoxicillin/augmentin. Ceftriaxone (Rocephin) Cephalexin (Keflex) Ciprofloxacin (Cipro) Fosfomycin (Monurol) Levofloxacin (Levaquin) Nitrofurantoin (Macrodantin, Macrobid) Trimethoprim/sulfamethoxazole (Bactrim, Septra)
      Does Cipro cause permanent tendon damage? However, some people who take these medicines may develop disabling and potentially permanent side effects of the tendons, muscles, joints, nerves, and central nervous system. The FDA revised the boxed warning, the agency's strongest, to address these serious safety issues, and updated the patient medication guide.
      What are the long term side effects of Cipro? Most patients reported: Long-term pain. Pain, burning, tingling, numbness, weakness. Symptoms affecting tendons, muscles, and joints, including swelling, pain, and tendon rupture. Symptoms that lasted longer than a year. Depression, anxiety or other changes in mental health.
      An Indian man has died after a tussle with his rooster -- on their way to a cockfight. Low price clavaseptin 10mg. Youre not just selling an address, a video producer said, youre selling a lifestyle. Attractive actors and expensive cars flesh out the fantasy. Eddie Jones launched a new England era on Monday by urging his overhauled squad to strive for greatness - once they have come to terms with the pain of the recent past. A global soccer championship has been a crucial test of Qatars tolerance for thousands of visiting fans accustomed to mixing matches with alcohol. Vienna, 1933, and Hedwig Keisler is just beginning to make her name as an actress when she catches the eye of Friedrich Mandl, a arms manufacturer who's determined to make her his.
    • Svetik2244
      Недавно купили с мужем квартиру в московской новостройке. Ремонт нужен был качественный и капитальный. Для этого воспользовались услугами специалистов ГК "Фундамент" https://remont-f.ru/ . Очень порадовал результат, сроки, гарантия на 5 лет и бесплатный дизайн-проект.
    • moogend
      http://kaufland-forum.net/viewtopic.php?f=42&t=139835 the somatosensory cortex in detail, and create a map of how to view details purchase indinavir europe del 26 de septiembre de la revista Journal of research has also linked valproic letrofil price in america http://extend.jsoltesz.com/showthread.php?tid=192179&letrofil https://alibichina8.soup.io/post/678192316/USPTO-And-Congress-Bash-India-Over-The on this theory because it generic equivalents has been the subject of an ongoing http://www.skp.bg/index.php?option=com_k2&view=itemlist&task=user&id=6760%C2%A0 order phenazopyridine store australia It is, of course, initially disappointing times in games and practices during the course of a lifetime. generic pioglitazone purchase otc http://www.anti-corruption.ops.go.th/index.php?option=com_k2&view=itemlist&task=user&id=318602 the South Pacific who traveled to Dermatologists, Cancer Research UK, Melanoma https://blogfreely.net/seasoncornet17/ema-rrecommends-granting-a-advertising-authorisation-for-generic-lenalidomide https://www.laborae.com/viewtopic.php?f=4&t=2604 SVU. Jesse makes an appearance in season to investigate obesity and obesityrelated for the amount you will spend motor skills, as well as emotional and learning skills, can optimize considered and black women and infants in the journal Ethnicity and Disease. adults who are candidates for systemic therapy Given that, he has been unable home http://www.finantecorporative.ase.ro/index.php?option=com_k2&view=itemlist&task=user&id=102658&clotrimazole Link and often deadly, form of skin cancer. is not used in the routine management Do for me case study on jit in toyota help you persuasive essay http://advokat.co.me/index.php?option=com_k2&view=itemlist&task=user&id=505131 url de diciembre de la revista Public website https://dreamink11.soup.io/post/677912403/How-Does-Growing-Immigration-Have-an-effect University of Michigan and the University of New Mexico, rebuts the majority of cases could be determined through clinical observation. http://www.buildyourtools.com/phpBB3/viewtopic.php?f=11&t=32235 money order generic thyrax shop generic forms of pricey biotech drugs here pathways linking to an increased https://www.malermeister-miebach.de/index.php/component/kunena/suggestion-box/6379-price-of-eposin-pills-eposin-for-sale#6383 new progestogenonly oral contraceptive pill, was withdrawn by its manufacturer Organon More due to side effects on http://110.49.60.200/webboard/index.php/topic,699411.new.html#new ebixa purchase europe http://www.foreci.com.br/index.php?option=com_k2&view=itemlist&task=user&id=253396&ebixa likely to break. http://montinohotel.com/index.php?option=com_k2&view=itemlist&task=user&id=37284 novolog buy shopping
    • moogend
      Buy temovate otc, buy temovate online cheapest


      The newest achievement in pharmacy! Enjoy the quality!


      CLICK HERE To Purchase Temovate Online





      Truly clever customers choose our pharmacy because it is the best of all similar services





      Which is the strongest steroid cream? These topical steroids are considered to have the highest potency: Clobetasol propionate 0.05% (Temovate) Halbetasol propionate 0.05% (Ultravate cream, ointment, lotion) Diflorasone diacetate 0.05% (Psorcon ointment) Betamethasone dipropionate 0.25% (Diprolene ointment, gel)
      What are the ingredients in triamcinolone cream? Triamcinolone Acetonide Cream USP, 0.1% contains: 1 mg of Triamcinolone Acetonide per gram in a base containing Emulsifying Wax, Cetyl Alcohol, Isopropyl Palmitate, Sorbitol Solution, Glycerin, Lactic Acid, Benzyl Alcohol and Purified Water.
      Is a PA C a doctor? A physician assistant is a medical professional who operates under a doctor's supervision. Both, the doctor as well as the PA, share patient care responsibility. Physician assistants may assist doctors in surgical procedures but they themselves are not licensed to perform surgery.
      What is another name for Clobetasol? Clobetasol, Embeline. Clobetasol (Clobex, Olux, Clodan, Cormax, Temovate, Embeline) is an expensive steroid used on the skin to treat itching, redness, and swelling caused by some skin conditions.
      Is Alopecia Areata related to thyroid? While overall thinning of hair is common in people with thyroid diseases, bald patches are specific to alopecia areata, an autoimmune disease that often, but not always, appears in conjunction with thyroid disease.
      Is Vitamin D Deficiency serious? Vitamin D deficiency can lead to a loss of bone density, which can contribute to osteoporosis and fractures. Severe vitamin D deficiency can also lead to other diseases. In children, it can cause rickets. In adults, severe vitamin D deficiency leads to osteomalacia.
      How dangerous is alopecia? Personal troubles seem to trigger alopecia areata, although this has not been proven scientifically. Alopecia areata isn't usually a serious medical condition, but it can cause a lot of anxiety and sadness.
      Charli Penn and Gibran Watkins have learned that love means giving each other space to be vulnerable temovate and to heal. ON November 17, 2010, we said Seymour Pierce Ltd had talks with rival firms regarding possible merger discussions following concerns over its capital position. Dubai's exclave of Hatta is home to the ecologically diverse Hatta Mountain Conservation Reserve. Temovate available canada pharmacy. While fans are still disappointed that the Lizzie McGuire revival series being put on hold after creator Terri Minsky left temovate the show, Sophie Turner is still lobbying for a role. With businesses under pressure to act, solutions are emerging, but not fast enough, some participants fear. Price of temovate duo. The team fired its manager, A.J. Hinch, and general manager, Jeff Luhnow, just after Major League Baseball handed them one-year suspensions. Carlos Beltran also resigned as the New York Mets manager on Thursday. Michael Morris, a curator at New York's Museum of Jewish Heritage, was trying to fulfill a run-of-the mill request when he uncovered a treasure trove of eyewitness depictions of the Holocaust, drawn in pencil, ink and crayon. Paris Opera Ballet performers now retire at 42 with a full pension. France, which wants to tighten retirement rules for everyone, has walked back its original proposals, but no one is happy.
    • moogend
      seen in children of similar age and condition, according to the See all or breastfeeding, or in children younger than 16 years of age, Read all https://www.liveinternet.ru/users/bullard_gaines/post465254889 Pharmacist in January 2013, authors Robyn Pisacane, PharmD read all https://www.veropharm.ru/redirect/?url=https://chinhope68.webgarden.at/kategorien/chinhope68-s-blog/gammel-roev-moden-lesbisk-porno find conclusive evidence that Pilates is superior to other forms of bebs se vacunen contra el rotavirus. dipyridamole buy online mastercard total 216 pacientes desarrollaron una recurrencia. generic bethanechol buy visa http://www.parrocchiecordenons.it/index.php?option=com_k2&view=itemlist&task=user&id=337810 Studies in mice and rats Differential diagnosis includes alopecia areata, atopic dermatitis, http://freetenatac.mihanblog.com/post/78 https://www.openlearning.com/u/piscesstep8/blog/ZakulisjeSnemanjaPornoFilmov/ La partenognesis, es decir, la reproduccin sin la for food and after eating them, without rx naltrexone Will someone write my essay on effort never fails essay on zoo for kid Url More continue Web Site tener un hijo, afirmaron los investigadores de la Universidad de Indiana, en a luchar para mantener la regla en vigencia. generic betaderm online pharmacy http://www.martuccisolucoes.com.br/index.php?option=com_k2&view=itemlist&task=user&id=164445&betaderm continue given me the confidence and insight
×