Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Botnet Crime Security News

Mariposa Botnet Beheaded 177

Posted by kdawson
from the sting-like-a-butterfly dept.
northernboy and many other readers sent news of the beheading of the Mariposa botnet with three arrests in Spain. "Defense Intelligence of Ottawa working with ISPs and Spanish authorities have taken down yet another > 12M PC botnet, called Mariposa. The three top-level operators are in custody, but remain anonymous under Spanish law (how quaint: apparently in Spain, the accused have some right to privacy). AP is claiming that the botnet included systems in roughly half of the Fortune 1000 companies, scattered over 190 countries. Interesting details: none of the three principals has a prior criminal record. Although apparently hardworking, they are not uber-hackers, but rather had connections to the Spanish mafia, which apparently helped to equip them. At the time of arrest, they were not showing signs of their significant new income level. From the article: 'Chris Davis, CEO of Ottawa-based Defence Intelligence, said he noticed the infections when they appeared on networks of some of his firm's clients, including pharmaceutical companies and banks. It wasn't until several months later that he realized the infections were part of something much bigger. After seeing that some of the servers used to control computers in the botnet were located in Spain, Davis and researchers from the Georgia Tech Information Security Center joined with software firm Panda Security, which is headquartered in Bilbao, Spain. The investigators caught a few lucky breaks. For one, the suspects used Internet services that wound up cooperating with investigators. That isn't always the case.'"
This discussion has been archived. No new comments can be posted.

Mariposa Botnet Beheaded

Comments Filter:
  • Another... (Score:2, Funny)

    by zmaragdus (1686342)

    Another one bites the dust...

    Good for them, but I still don't see a noticeable reduction in my spam mail. Gotta keep working at it, guys.

    • by someone1234 (830754) on Wednesday March 03, 2010 @08:29AM (#31344362)

      This was done much better than the previous one done by Microsoft. Catching the human masters and putting them in "federal pound me in the ass prison" is the right solution to this problem.

      • Re: (Score:3, Funny)

        ...putting them in "federal pound me in the ass prison"...

        This isn't Riyadh. You know they're not gonna saw your hands off here, alright? The worst they would ever do is they would put you for a couple of months into a white-collar, minimum-security resort! Shit, we should be so lucky! Do you know, they have conjugal visits there?

    • by stiggle (649614)

      You won't see a reduction until the ISPs start to be accountable for their users.
      ISP should be pro-active in managing connections - only open up certain ports where the users have requested it.
      eg. SMTP - home users should only be able to connect to port 25 on their ISPs mail server.
      Do home users need remote access to Windows Filesharing? I don't think so, so the ISPs could block those ports by default too.

      The old days of only clueful people connected to the net are long gone (by about 20 years).

      • SMTP - home users should only be able to connect to port 25 on their ISPs mail server.

        I don't really understand why egress filtering like this isn't being done as a routine course of business these days.
        • Re:Another... (Score:5, Insightful)

          by entrigant (233266) on Wednesday March 03, 2010 @09:31AM (#31345148)

          What the hell is wrong with you two? The only situation I can find this even remotely acceptable is in response to verified abuse complaints, and even then the appropriate resolution is attempt to contact the customer then disable the entire connection if the customer is unable to resolve the issue. Depending on the severity you don't necessarily need to do it in that order.

          I'm leasing an internet connection. You route IP packets destined for my address directly to me, and you route any and every IP packet I send to the appropriate next hop. The end. No if's, and's or but's. No blocked, ports, no traffic shaping, no injected tcp resets... nothing. Just route the damn traffic.

        • SMTP - home users should only be able to connect to port 25 on their ISPs mail server.

          I don't really understand why egress filtering like this isn't being done as a routine course of business these days.

          Er, what if I want to send an email through my work mail server, or one provided by someone that isnt my ISP? You two have just locked me out of securely authenticating to any other mail servers ...

        • Re: (Score:3, Insightful)

          SMTP - home users should only be able to connect to port 25 on their ISPs mail server. I don't really understand why egress filtering like this isn't being done as a routine course of business these days.

          Probably because of a large number of other email options out there, which offer SMTP and POP3 and aren't connected to the ISP. GMail for example...

        • by rdnetto (955205)

          My ISP (iiNet*) does this - they filter a bunch of commonly exploited ports by default. If you want to enable them, it's as simple as going to their website and ticking a checkbox. This seems to be the optimal solution, since anyone who actually needs those ports can manually enable them, while the more ignorant users are still protected.

          * You might remember them from the iiNet vs. AFACT case.

      • You won't see a reduction until the ISPs start to be accountable for their users.

        You're quite right, but I assume you aren't positioning that as a good idea (I will give you the benefit of a doubt).

        The more we consider and treat ISPs as common carriers - and yes, I know this is a grey area - the safer we users of content will be. If ISPs become accountable for their users, then the regulators will step in and determine just exactly how those accounts should be drawn up. And I, for one, would not salute our new robotic overlords.

  • by Daryen (1138567)
    I know it's just one botnet of many, but stories like this make me smile anyway.
  • by captainpanic (1173915) on Wednesday March 03, 2010 @08:30AM (#31344370)

    From TFA:

    how quaint: apparently in Spain, the accused have some right to privacy

    That's because in Spain you're not guilty until proven guilty by a court of law. The days of the Spanish inquisition are over.

    What country doesn't protect its accused in the 21st century?

    • Re: (Score:3, Insightful)

      by bsDaemon (87307)
      In the US at least, the names of the accused are only withheld in the case where the perp is a minor. Of course, we are talking about botnet script-kiddies after all, so whose to say these upstanding individuals aren't actually minors as well?
    • by realityimpaired (1668397) on Wednesday March 03, 2010 @08:35AM (#31344430)

      In both the USA and Canada, you're allowed to publish the names of the accused as long as they're adults. The accused need to request that the court protect their anonymity by ordering that their names not be published until after the trial, and the court maintains the right to deny that request.

      For juvenile offenders, it's a different story... young offenders must always be referred to by pseudonym to protect their anonymity, and their records are expunged when they turn 18. Unless, of course, they're tried as adults, which has been known to happen in cases of violent crime.

      • Re: (Score:2, Interesting)

        by Anonymous Coward

        In both the USA and Canada, you're allowed to publish the names of the accused as long as they're adults.

        Which is done, of course, with the understanding that these people are again innocent as they have not been proven otherwise. Since they are innocent, there is nothing for them to be embarrassed about, and no reason not to publish their names.

        Also, the publication of names can have the effect of bringing forth witnesses.

        Unfortunately, the court of public opinion has no presumption of innocence.

      • Their records can be sealed when they turn 18, not expunged. An expunged record means that it never happened in the eyes of the court, no exceptions. A sealed record means that it legally never happened, though there are exceptions. A petition must be made to the court (at least in some states) to seal the records, and they are then available only in very limited circumstances. The court may deny the petition, and certain serious crimes (murder, arson, carjacking, etc.) are not eligible for seal.

      • Re: (Score:3, Interesting)

        by nanoakron (234907)

        I always loved the US idea of declaring someone to be a juvenile, yet trying them as an adult in order to get a harsher punishment.

        Either someone is a juvenile or they aren't...and if you try a 16 year-old as an adult and they are acquitted, does that mean they can now drink and drive like an adult as well?

        • by yukk (638002)

          I always loved the US idea of declaring someone to be a juvenile, yet trying them as an adult in order to get a harsher punishment.

          Either someone is a juvenile or they aren't...and if you try a 16 year-old as an adult and they are acquitted, does that mean they can now drink and drive like an adult as well?

          Chances are, if their crime was deemed brutal enough for them to be tried as an adult, they already were drinking and/or driving like one. Mind you, in the U.S. Kids can legally drive at 16 or something so that may not be any big deal. Binge drinking at 16 however is likely to be relevant.

    • by bhamlin (986048) on Wednesday March 03, 2010 @08:42AM (#31344520) Homepage

      The days of the Spanish inquisition are over.

      I wasn't expecting that...

    • by Archon-X (264195) on Wednesday March 03, 2010 @09:01AM (#31344752)

      'How quaint' that you're innocent until proven guilty?
      Am I the only one that is getting tired more and more frequently by juvenile editorial quips?

      I used to come here for impartial, to the minute news - neither of which seem to exist in any great quantity anymore.

      • by Ltap (1572175)
        If the editors are juvenile, then you're naive to think that Slashdot even pretends to be impartial.
      • by metlin (258108)

        Well, it is kdawson -- what were you expecting? Just be thankful that he's better than jon katz or michael.

        Anyway, back to the topic at hand -- all these creators of botnets and worms need deterring sentences. Having had to just replace a hard drive and having lost a lot of data because of a recent infection (despite backups), I have the overwhelming urge to shove these bastards into the electric chair. But since we're civilized, we'll settle for hours of lost productivity and psychological damage, and give

      • by BlueParrot (965239) on Wednesday March 03, 2010 @02:45PM (#31349344)

        I used to come here for impartial, to the minute news

        When you find a source of that, will you ask them if they can give me a pony unicorn? Preferably a pink one that flies.

    • by Culture20 (968837) on Wednesday March 03, 2010 @09:04AM (#31344774)
      In the U.S. press, it would be portrayed as:
      "Three alleged EVIL HACKERS were arrested today for allegedly HACKING MILLIONS OF COMPUTERS! ZOMG!" And then they'd go to the person's home, and knock on the door. If no one answered, that would be taken as damning evidence by the reporter. If a family member came to the door but said the accused wasn't there, that would be taken as damning evidence by the reporter. If the accused were seen and questioned, but said they couldn't comment on the case, that would be taken as damning evidence by the reporter. If a dog farted, that would be taken as damning evidence by the reporter...
      allegedly
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      So you prefer being arrested and imprisoned without the public or anyone else being aware of it. Law enforcement transparency is the first defense against tyranny.

      • by pe1rxq (141710)

        There is a difference between pulic records and huge bold letters on the front page of a newspaper......

        • It's a necessary evil that goes along with a free press. Besides, most arrests don't go reported in the newspaper.

    • This does nothing for transparency of government, though. I like to know what my government is doing and that means publishing information. It seems scary to me that the government could arrest you and not have to tell anyone about it. I think Bush and Cheney would have loved that to be accepted in general.

      If you want a transparent government, then you have to accept that a certain amount of information is going to be revealed. I think that is a reasonable price considering the amount of power that a go

    • Unfortunately, that's not always the case. There was a recent nasty episode [typicallyspanish.com] when this guy was falsely accused of abusing and murdering his stepdaughter. It turned out in a previous hospital visit doctors had ignored evidence of severe injuries from a playground accident from which she ultimately died. Of course, nobody dared mention the negligent doctors' names, but the stepfather's face and full name were front page of some major newspapers [blogspot.com]. Truly disgusting in many ways. I'm glad at least sometimes they b

    • by Neoprofin (871029)
      Remember, in Germany you're not even allowed to use someones name in relation to the crime they committed once they've served their time. What country doesn't protect its proven guilty in the 21st century?
  • isp's cooperating (Score:4, Insightful)

    by grapeape (137008) <mpope7 AT kc DOT rr DOT com> on Wednesday March 03, 2010 @08:32AM (#31344400) Homepage

    Great that another one went down, but the line about catching a lucky break was disturbing. ISP's dont normally cooperate when told they are harboring botnets? Isnt not cooperating pretty much the same as supporting it? Why not just publicly list them and black hole them? I would imagine it wouldnt take much of that to get them to want to cooperate.

    • by js3 (319268)

      how do companies have so many computers that can be remotely controlled?

      • by Calinous (985536)

        It's in the interest of the corporation to have all computers able to be remotely controlled (pushing software to computers, by example). They don't want to have the computers controlled by anybody else, though.

              As for "how", maybe they used some IE6-only internal sites, so they were open to exploits, maybe it was social engineering, and so on.

    • Re: (Score:3, Insightful)

      by Nos. (179609)

      Its called privacy. I for one am glad that both major ISPs in the area have publicly stated that they don't give out any information without a warrant.

  • Like the drug war (Score:3, Insightful)

    by tjstork (137384) <(todd.bandrowsky) (at) (gmail.com)> on Wednesday March 03, 2010 @08:34AM (#31344406) Homepage Journal

    All these stories remind me of the war on drugs. Every so often, the government nabs a big drug gang, and they have some impressive sounding stats and a PR photo with as much loot spread out as possible "this cache had a street value of 8 billion dollars", with of course all the guns and other stuff lined up, and, yet, the price of drugs on the street continues to fall, people are still running out of emergency rooms with iv's inserted so they can mainline... this whole sorry truth is that you can't expect the gov't to really defend your computer any more than it can defend your house.

  • W32.Pilleuz (Score:5, Informative)

    by sleekware (1109351) on Wednesday March 03, 2010 @08:37AM (#31344454)

    Discovered: September 29, 2009
    Updated: September 30, 2009 8:32:32 AM
    Also Known As: W32/Autorun.worm!a758e0e7 [McAfee], W32/Rimecud [McAfee], W32/Autorun-AUP [Sophos], ButterflyBot.A [Panda Software]
    Type: Worm
    Infection Length: 109,056 bytes
    Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

    W32.Pilleuz is a worm that spreads through file-sharing programs, Microsoft instant messaging clients and removable drives. It also opens a back door on the compromised computer.

    Currently, W32.Pilleuz has been most commonly referred to as the Mariposa or Butterfly botnet.

    Source: http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-093006-0442-99 [symantec.com]

  • "The Mariposa botnet, which has been dismantled, was easily one of the world's biggest. It spread to more than 190 countries, according to researchers. It also appears to be far more sophisticated than the botnet that was used to hack into Google Inc. and other companies in the attack that led Google to threaten to pull out of China." ----- Wait, what? This was written by the AP's "technology writer". I guess he doesn't read /.? The Google attack was not a botnet.
  • Why is it so hard? (Score:4, Insightful)

    by JustNiz (692889) on Wednesday March 03, 2010 @09:25AM (#31345058)

    Why is it so hard to dismantle a botnet? Rather than find the botnet owners by technical means, surely all they need to do is determine who are the businesses being advertised via spam from the botnet, and get them to spill who they did their advertising deal with.
    I mean the advert always has to specify somewhere to send your money right?

    It seems to me that if they made it as illegal to be an 'spamvertiser' as it is to be a botnet operator, and actually enforced it with presecutions, I bet the whole botnet and spam thing generally would stop happening due to a lack of businesses willing to pay to use that method for advertising.

    • by Teun (17872)
      Yes that sounds so logic.

      But it isn't that simple.

      Years ago we had some pirate TV stations that would come on late at night with porn.
      They were paid in cash by advertisers so you'd go to them to stop the financing right?

      Wrong, these pirate stations would sprinkle in adverts for companies that had nothing to do with them, just to muddy the waters.

    • Re: (Score:3, Informative)

      by Alioth (221270)

      The spamvertisers are *already* advertising and selling products illegally, such as prescription drugs without a prescription, ripped off merchandise, unauthorized copies of proprietary software etc. You don't need to make any new rules, just prosecute the spamvertisers for the laws they already break. The reason these businesses are using spammers to advertise is precisely because what they are doing is already illegal and therefore they cannot use the normal legal advertising channels to hawk their wares.

    • by CSMatt (1175471)

      And how do you know that the businesses being advertised actually condoned the spamming, much less encouraged it?

    • Re: (Score:3, Interesting)

      by IonOtter (629215)

      This was-in a way-Blue Security's [wikipedia.org] model, and it worked exceptionally well. So well that one spammer fought back on a very large scale, causing much hate and discontent towards Blue Security.

      The problem now is that businesses have learned their lessons and obfuscate their websites better, as well as adding CAPTCHAs to prevent automated scripts like Blue Frog from attacking them.

      And I've encountered a few spams from legitimate businesses who had no clue that they'd hired a spammer to do their email advertisi

  • If ISPs helped... (Score:5, Interesting)

    by Nicopa (87617) <nico.lichtmaier@gmai[ ]om ['l.c' in gap]> on Wednesday March 03, 2010 @09:27AM (#31345094)

    If ISP helped authorities on these things, there wouldn't be botnets, nor spam. Many attempts at preventing spam stop at their refusal to help. It would be nice to force them by lay to cooperate with spam fighting efforts. Sadly laws to force them to cooperate fighting "piracy" seem to pass easier..... =/

  • by guanxi (216397) on Wednesday March 03, 2010 @09:54AM (#31345456)

    Here's one reason botnets thrive: In addition to the fact that the perpetrators are likely to get away with it, per one article [cbsnews.com], They face up to six years in prison if convicted of hacking charges..

    6 years max? For hacking 12 million computers? Ignoring the intrusions, how much did it cost the victims in labor and downtime to fix it? Hundreds of millions? And add to that the damage they did with the botnet; I don't know what this one did, but it could be spam, DDoS attacks, stolen personal info, extortion, etc.

    Also, I still don't understand why the U.S. government doesn't treat these wide-spread, expensive crimes as a priority. Given the scale of these crimes, there should be a large task force pursuing them. I get the sense they are looked on as computer problems, not crimes.

    • by gmuslera (3436)
      You mean death penalty for writting a program? Is not murder, is not physically attack them to steal, its not even looking at pictures of naked children, probably the vast majority of them ever noticed that they had that installed. And the biggest component of the attack was getting thru a floor level big size window that the house maker left open so the owners could feel some air, they were practically invited to get in.
    • Re: (Score:3, Interesting)

      Here's why botnets and, more generally, spam continue to survive - people buy the products advertised!:

      http://www.newscientist.com/article/mg20527491.500-spamdemic-tracking-the-plague-of-junk-mail.html [newscientist.com]

      (From the text in the graphic) An analysis of just 1.5% of one botnet ("Storm") for one month in 2008 showed:

      35 million spams sent
      8.2 million passed filtering software
      10,500 clicked on the link in the email
      28 people actually bought the product

      Although this represents only a 0.000008% conversion rate when scale

    • Here's one reason botnets thrive:

      The F1 key?

    • by Neoprofin (871029)

      I still don't understand why the U.S. government doesn't treat these wide-spread, expensive crimes as a priority.

      When the US investigates or attempts to punish nationals of another country they are generally scorned. Maybe you should ask the Spanish?

  • I've heard of this group before. They are one of the few who actually understand what really needs to be done to make an impact on the spamming epidemic. Rather than building enormous black/white lists or developing ever more CPU-intense filtering algorithms, they are actually going after the sources. They identify where spam is actually originating - that is, the spamvertising domains, not the spamvertised domains - and figure out how to shut it down. They are finding where the botnets and their requisite domains can be targeted and getting the work done. And they are doing it within the confines of a civilized society, rather than the bloodthirsty mercanaries that so many people here are calling for regularly.
    • by drinkypoo (153816)

      I thought the slashdot groupthink was to call for grey-hat botnets to fight the black-hats. Or am I so far out of touch that even my language is outdated, and I only sound faggy and pompous?

      • I thought the slashdot groupthink was to call for grey-hat botnets to fight the black-hats. Or am I so far out of touch that even my language is outdated, and I only sound faggy and pompous?

        I cannot speak for all of slashdot. I can say that whenever spam comes up in conversation the loudest slashdotters are generally the ones calling for blood.

        • by drinkypoo (153816)

          I cannot speak for all of slashdot. I can say that whenever spam comes up in conversation the loudest slashdotters are generally the ones calling for blood.

          I must be living on a particularly well-situated ivory tower, then, because most of the slashdotters with whom I have the privilege to speak to in person on at least an occasional basis are fairly soft-spoken. I'm not that loud, but I do have a tendency to loom.

          • I must be living on a particularly well-situated ivory tower, then, because most of the slashdotters with whom I have the privilege to speak to in person on at least an occasional basis are fairly soft-spoken. I'm not that loud, but I do have a tendency to loom.

            To be more verbose, I do mean discussion on slashdot when I refer to conversation. I have not met any slashdot users in person, or at least not any who I regularly exchange messages with here now.

            Indeed the people who I exchange messages with here may be quiet in person. However when an article on spam is brought up here, one can pretty well count on someone asking to have a spammer murdered. I suspect one could call this a parallel to Godwin's law - a discussion on spam will invariably reach a point

  • It is nice to see a long-standing problem start to get some serious worldwide attention. The absurdity of Higher Ed researchers taking down botnets only to put them back up for fear of lawsuits was getting way too surreal.

    We're finally hearing reports about ISPs, governments and others (hi Microsoft) starting to at least think seriously about not letting botnets rampage unchecked. it is WAY overdue but I'm not one to bitch about something being late--I'm just glad to see it finally happening.
  • The next step is for the ISP's of the world to pull he damn plug.

    Look, I know it might inconvenience the owners of the bots. However it is their negligence which is enabling this and as such they are accessories to criminal activity. They may be an unwitting accessory but they are still an accessory and this is no different than a bar tender who keeps pouring drinks for a patron and then watches the drunk head out to the parking lot and drive away.

    The bar tender in a case like this can claim all the innoc

  • Guilty until proven innocent and all that so let's hear their names right now!

    It's funny how people are quick to abolish basic rights for other people when those people might have done something they don't like. Or is it quaint, rather than funny?

If it happens once, it's a bug. If it happens twice, it's a feature. If it happens more than twice, it's a design philosophy.

Working...