Botnet Shutdown Success Story: How Kaspersky Lab Disabled the Hlux/Kelihos Botnet

[A. 876]

Как я и обещал вот в этой теме

http://www.anti-malware.ru/forum/index.php?showtopic=19722

Лаборатория Касперского рассказывает правду о том кто, что и как сделал для закрытия ботнета Hlux.

Kaspersky Lab played a critical role in this botnet takedown initiative, leading the way to reverse-engineer the bot malware, cracking the communication protocol and developing tools to attack the peer-to-peer infrastructure. We worked closely with Microsoft’s Digital Crimes Unit (DCU), sharing the relevant information and providing them with access to our live botnet tracking system.

A key part of this effort is the sinkholing of the botnet. It’s important to understand that the botnet still exists – but it’s being controlled by Kaspersky Lab. In tandem with Microsoft’s move to the U.S. court system to disable the domains, we started to sinkhole the botnet. Right now we have 3,000 hosts connecting to our sinkhole every minute. This post describes the inner workings of the botnet and the work we did to prevent it from further operation.

Дальнейшие технические детали по ссылке:

http://www.securelist.com/en/blog/20819313..._Kelihos_Botnet

P.S. Заодно прошу считать это нашим ответом на упреки некоторых местных, в том что якобы антивирусные компании специально не борятся с киберпреступностью.

Ага.

[sergey ulasen 200]

Здорово!

И расставили точки над i.

[Umnik 997]

A.

Когда будет на русском, чтобы утянуть в бложик?

[rkhunter 150]

Здорово!

И расставили точки над i.

Еще вычищать компьютеры нужно, это был только первый этап.

[sergey ulasen 200]

Невзирая на 2:39, я дошел до раздела What now?

[OlegAndr 236]

Думаю на эти надо компы закачивать MSRT, вроде как утилита MS, меньше будет легальных вопросов чем если туда запузырить что нить от Касперского.

[A. 876]

Kaspersky Lab, Kyrus Tech and Microsoft Disable the Hlux/Kelihos Botnet

In their ongoing assault against botnet operators and the hosting companies that allow anonymous domain registrations which facilitate them, Kaspersky Lab, Microsoft and Kyrus Tech have successfully worked together to take out the Kelihos botnet, originally named Hlux by Kaspersky Lab. Kelihos was used for delivering billions of spam messages, stealing personal data, performing DDoS attacks and many other criminal activities, via an estimated 40,000 computers. Microsoft has also taken legal action against 24 individuals in connection with the infrastructure behind the botnet in a civil case that enabled the takedown of the domains being used to command and control the botnet. Microsoft’s legal action included declarations submitted to court to which contributions were made by Kaspersky Lab, and also a direct declaration from Kyrus Tech providing detailed information and evidence regarding the Kelihos botnet.

Kaspersky Lab has played a pivotal role in taking down the botnet, tracking it since the beginning of 2011, when it started collaborating with Microsoft in tackling Kelihos, including sharing its live botnet tracking system with the US company. Kaspersky Lab has also taken care that the botnet cannot be controlled anymore, and continues to make sure that this is the case. Its specialists reversed-engineered the code used in the bot, cracked the communication protocol, discovered the weaknesses in the peer-to-peer infrastructure, and developed the corresponding tools to counteract it. What’s more, since the offending domains used in the botnet have gone offline via court orders Microsoft had secured, Kaspersky Lab has been “sinkholing” the botnet - where one of its computers has gotten inside the botnet’s complex internal communications to bring it under its control.

Acknowledging Kaspersky Lab’s active involvement in taking down the botnet, Richard Boscovich, senior attorney with the Microsoft Digital Crimes Unit, said: "Kaspersky Lab played a key role in this operation by providing us with unique and in-depth insight based upon their technical analysis and understanding of the Kelihos botnet. This contributed to both a successful takedown and as evidence for declarations made about the analysis and structure of the botnet. We are grateful for their support in this matter and their determination to make the Internet safer."

Speaking of the continuing role Kaspersky Lab is playing in controlling Kelihos, Tillmann Werner, senior malware analyst of Kaspersky Lab Germany, said: “Since Kaspersky Lab’s sinkholing operation began on September 26, the botnet has been inoperable. And since the bots are communicating with our machine now, data mining can be conducted to track infections per country, for example. So far, Kaspersky Lab has counted 61,463 infected IP addresses, and is working with the respective ISPs to inform the network owners about the infections.”

Kelihos is a peer-to-peer botnet. It consists of layers of different kinds of nodes: controllers, routers and workers. Controllers are machines presumably operated by the gang behind the botnet. They distribute commands to the bots and supervise the peer-to-peer network's dynamic structure. Routers are infected machines with public IP addresses. They run the bot for sending out spam, collecting email addresses, sniffing out user credentials from the network stream, etc.

Microsoft has announced that its Malware Protection Center has added detection for the Kelihos malware to its Malicious Software Removal Tool. Since this tool is well-distributed the number of infections that have already been cleaned up is significant.

Cooperation between Kaspersky Lab and Microsoft has been ongoing now for some time. Notable recent collaboration includes that on the infamous Stuxnet worm, which hacked industrial control systems like those used in Iran’s nuclear programs.

Kaspersky Lab would like to thank SURFnet for its support in the operation, and especially for providing the perfect infrastructure to run the sinkhole.

[rkhunter 150]

Почему взялись именно за Hlux/Kelihos?

[A. 876]

Почему взялись именно за Hlux/Kelihos?

cz.cc что нибудь говорит ?

это одна из причин.

Он мощно начал, еще в начале года

http://www.shadowserver.org/wiki/pmwiki.ph...lendar/20101230

Именно тогда, с январе и началась операция по его исследованию.

http://www.securelist.com/en/blog/11114/Ne..._Botnet_Arising

http://www.securelist.com/en/blog/11116/A_...the_HLux_botnet

А когда потом с него повалили и фейк-ав и блокеры (это помимо спама) - ну такой "прекрасный" вирусный супермаркет нельзя было оставить нетронутым. Да и провернуть первый в истории угон P2P-ботнета тоже интересно.

[KIS_fan 17]

На русском:

http://www.securelist.com/ru/blog/40767/Ka...et_Hlux_Kelihos

На сайте Microsoft:

https://blogs.technet.com/b/microsoft_blog/...nt-in-case.aspx

Ни слова о ЛК ... почему ?

[Mr. Justice 771]

На русском:

http://www.securelist.com/ru/blog/40767/Ka...et_Hlux_Kelihos

На сайте Microsoft:

https://blogs.technet.com/b/microsoft_blog/...nt-in-case.aspx

Ни слова о ЛК ... почему ?

Тоже читал материалы от Microsoft, не увидел упоминания ЛК. Странно.

[rkhunter 150]

Это всего лишь запись в блоге; упоминание о Kaspersky Lab есть в официальных документах, которые были приобщены к делу и появились сразу после публикации новости.

[rkhunter 150]

Microsoft заключила внесудебное соглашение с двумя ответчиками по делу о криминальном ботнете Kelihos/Hlux и отказалась от исковых претензий к этим лицам.

Ссылка