Department of Justice shuts down Coreflood botnet
'Stop' command sent from replaced command and control servers.
Earlier this week the US Department of Justice (DoJ) obtained an unprecedented
temporary restraining order (TRO) that effectively allowed it to
send 'stop' commands from the command and control servers of
the Coreflood botnet - thus managing to shut it down.
As is the case with most botnets, the controllers of Coreflood have the ability to remotely shut down
botnet agents installed on the victims' computers.
botnet is quite old and does not possess several of the 'security' features seen in many newer botnets -
where such remote commands need to be
authenticated to ensure that they come from the botnet's controllers rather than anyone else - for example law enforcement
agencies or competing botherders.
Of course, despite the botnet being taken down, computers are still infected with the Coreflood malware. However, at the
the botherders have little to no ability to control these zombies,
so it is a good time for security vendors and ISPs to ensure the malicious software
is removed from the computers altogether. Microsoft has already
shipped an update
for users of the Malicious Software Removal Tool that removes
Coreflood from the infected machines.
Coreflood has a long history, going back to at least 2002. In 2005 it
made the news when Miami businessman Joe Lopez lost over US$90,000. The money had been wired out of his
account to a bank in Latvia - his machine was found to be infected with the Coreflood trojan. Lopez
sued his bank in the first of many lawsuits brought against banks by malware victims.
Last month's takedown of Rustock saw
spam levels take a nose dive, but
Coreflood appears to have been significantly less active in sending spam - since its takedown there have been no signs of
any drop in spam levels.
Industry comments on the takedown can be found at Damballa's The Day Before Zero blog here and at Brian Krebs's
security blog here,
with a longer analysis on the blog of cybercrime expert Gary Warner on
his blog here.
The FBI press release concerning the case can be found here.
botnet, coreflood, doj, fbi, law enforcement, takedown.
Posted on 15 April 2011 by Virus Bulletin.
Leave a comment.
del.icio.us digg this