Yesterday, I posted that Microsoft had recently obtained a court order to shut down several *.com’s that were known to host command-and-control centers for the waledac botnet. Working together with some folks at Shadowserver, the University of Washington and Symantec, it represented one of the first times that a group of people from private industry, higher education and the legal arena collaborated to take down a botnet. Microsoft Associate Counsel Tim Cranton blogged recently:
At Microsoft, we don’t accept the idea that botnets are a fact of life. We are a founding member of the Botnet Task Force, a public-private partnership to join industry and government in the fight against bots. Given the recent spread of botnets, we are getting even more creative and aggressive in the fight against botnets and all forms of cybercrime. That’s why I’m proud to announce that through legal action and technical cooperation with industry partners, we have executed a major botnet takedown of Waledac, a large and well-known “spambot.” … Three days into the effort, Operation b49 has effectively shut down connections to the vast majority of Waledac-infected computers, and our goal is to make that disruption permanent. But the operation hasn’t cleaned the infected computers and is not a silver bullet for undoing all the damage we believe Waledac has caused. Although the zombies are now largely out of the bot-herders’ control, they are still infected with the original malware. A map of Waledac infections around the world in a recent 24 hour period
Microsoft does acknowledge, as seen from the quote above by Cranton. The malware is still infecting the affected computers, only the communication channels have been disrupted. Still, it is a significant, if temporary blow to another botnet. This follows a pattern that seems to be emerging over the past 1 1/2 years:
All of these had temporary impacts on each of these botnets and spam activity, but in each case the botnets rebuilt their infrastructure and returned. So yes, perhaps we can be a little jaded about this but we can gain short-lived victories. Here’s The Register’s take:
Criminals running botnets have faced a number of takedown operations over the last year or so, dating back to the McColo shutdown. All normally result in a temporary slowdown in spam volumes. But cybercrooks are getting better at building more resilient networks. Even if that doesn't work, there are always more miscreants in the shadows ready to step in and sell bulk mail services to unethical, unscrupulous or outright criminal marketeers. Microsoft's enforcement action is welcome, but it treats only the symptoms - and not the root cause - of the botnet epidemic. [TZ - emphasis mine]
Criminals running botnets have faced a number of takedown operations over the last year or so, dating back to the McColo shutdown. All normally result in a temporary slowdown in spam volumes. But cybercrooks are getting better at building more resilient networks. Even if that doesn't work, there are always more miscreants in the shadows ready to step in and sell bulk mail services to unethical, unscrupulous or outright criminal marketeers.
Microsoft's enforcement action is welcome, but it treats only the symptoms - and not the root cause - of the botnet epidemic. [TZ - emphasis mine]
We all acknowledge that Microsoft’s actions do not address the root cause of the botnet epidemic. It is only one part of the solution, but it does follow a pattern of shutting down the bot’s command-and-control center. Sometimes you don’t have to completely win the battle, you only have to make it too expensive for the bot controller and spammer to shift the cost/benefit ratio into an unfavorable direction. In other words, disruption of their model is a viable tactic (in my opinion).
And as I said in my previous post, Microsoft has got a multipronged strategy for dealing with the root cause of the botnet epidemic in addition to the action taken above:
Action against bad against requires a multi-faceted approach, and this latest action by Microsoft (and others) is another arrow in the quiver to use in the battle against Internet abuse.