The last movie of the virtual world is of fear and it has all the ingredients to terrify us: zombies, infected, three evil ones manipulating machines to achieve his intentions, a widespread virus on a global scale and, the worst thing of everything, who is possible that one of the victims it is you who are.
When in May, 2009 Defence Intelligence (company of Canadian safety) called Butterfly announced the detection of a massive botnet in Internet, the whole device was started to eliminate this network that supposed a threat for servants, companies and particular users of Internet: the MWG (Butterfly Working Group). This project was formed by proper Defence Intelligence, the Georgia Institute of Technology, Bulging Security and experts in safety of diverse countries. The target was to annul the influence of the botnet and to identify those that were after her only known up to this moment by his pseudonymic ones (Netkairo, Jonyloleante and Ostiator) and that were shaping the group Días De Pesadilla (DDP Team). After 8 months of intense work, finally, during an intervention, they listed the approximate number of computers infected by the malware that were shaping the said network and the astonishment it was capital: Butterfly was counting with more than 12 million zombies along the whole planet that they were already particular users or companies, what was turning it into one of the biggest botnets of the history. To infect a team was relatively easy since simply the installation of a program was necessary malware in the computer to be enslaved and this could come across networks P2P, devices USB, linkage MSN and, finally, any method across which it was possible to introduce information in the system. Once infected, the user could keep on working with normality without noticing anything while behind his hardware and software could be utilizándo for any self-interest intention.
In short, M ariposa was a gigantic beast of more than 12 million ip's controlled by only one user who could have them at his{your} pleasure. This slaves' immense mesh was divide in several subnetworks to be able to control them in a more effective way and be able to carry the pertinent operations out with major simplicity. These could be spam (appearance of pop-ups, alterations in the results of the engines of search), I steal of information (numbers of credit cards, passwords), attack servants (DDos) as well as any another illegal activity that was capable of being realized. But if something demonstrates the character exclusively lucratively of all his movements, it is the fact that the creators of the network were renting it for fragments to other delinquents in exchange for an economic sum so that these realized their own misconducts.
Despite having the well identified Butterfly structure and knowing all his movements, the trailing of the persons producing it was turning out to be practically impossible because the connection was realized from a VPN and this was erasing any track of the direction IP that it was using. This was like that until December 23, 2009, date in which the MWG managed to be done momentarily under control of the botnet by means of a movement organized to world scale being provided, between others, with the help of the FBI and the Spanish Civil Guard. Happened this, Netkairo, leader of the group DDP, tried anyway possibly to control the network again but, in a moment of nervousness and tension, he forgot to get connected across one of the VPN. This error annulled the obstacles that were reinforcing him facing the location on the part of the MWG and then the track was clear and definite. They were already provided with his IP and it was only a question of time that was identified from the records of his local provider of Internet. Nevertheless, in revenge for credit trying to steal the control of the network from him, an attack DDos was thrown from big part of the computers controlled by Netkairo towards Defence Intelligence that there blocked an important provider of access to Internet leaving without service for several hours many clients, Canadian university and administrative centers.
Structure of an attack DDoS
Anyhow, from here there was known the real place from which it was occurring and, hence, his identity. The detention on the part of the authorities does not make be waited. On February 3 the Civil Guard carried this movement out and seized computer material that took to the detention of others two members of the group, Jonyloleante and Ostiator. Two information to be highlighted, is that none of three arrested were professional and at least they had designed the botnet, if not that had bought it on the black market and that in Spain take into account approximately 200.000 infected computers. This fact wakes up many doubts. Have I been infected by the malware? Is it my ordering report of Butterfly? Will they have my bank and/or personal information? Panda Security has given the answer to this announcing that it has given samples of the bots all the companies of antivirus so that they add them to his database and, after a new update, they could be capable of identifying them and of erasing them.
Next this so nice lad will do a summary of everything to us and will comment to us on some additional detail. Please, an applause for Luis Corrons of Panda Security.
Lexicon
- Malware: It is a program of computer that infiltrates into the system without the proprietary user knowing it with the principal intention of damaging it. If the malware serves to gain access to the control of the above mentioned computer, this one takes the name of zombie.
- Zombie: There is called this way a computer that has been infected by a malware program and is handled by an external user.
- Bot: It is a software installed in a zombie that serves to execute routine tasks.
- Botnet: It is a word composed for bot and net (“network“ in English) and it is used it refers to a heap of computers zombies that they execute bots that they are connected between themselves forming a private network.
- VPN: There are the initials for “virtual private network”. It is a technology that allows a network deprived of local origin to spread across Internet and to have the possibility of being connected from remote teams and, physically, out of the above mentioned network.
- DDoS: Again more initials. In this case they mean “distributed attack of refusal of service”. This attack is realized saturating a certain servant by means of the massive mailing of requests that block the available band and this way to provoke the inaccessibility this service.
- Spam: Spread information of a viral and repeated way announcing any type of article or intention by means of massive mails bombing, posts in forums or bots. It usually distribute by means of general deliveries electronic facilitated by pages webs specializing in compiling these without knowledge or assent on the part of the owner.
- IP: The only number of identification in Internet. Every computer connected to the network obtains an IP that can be a favorite (always the same one) or dynamics (it changes with every new access). The companies that give connection services to Internet have the IP assigned to every user striped so that it could be identified in case of need.
- The head image was created by Shiho Hoshino
- Another Side
- PandaLabs
- Silicon News
- Cioal
- Wikipedia
- Saturday Ilustrations (illustration)
No comments:
Post a Comment