2010-11-01
Abstract
Partial success in the takedown of Bredolab; m00p gang member enters guilty plea.
Copyright © 2010 Virus Bulletin
Operating in collaboration with a number of online organizations, the Dutch National Crime Squad’s High Tech Crime Team seized 143 command and control servers of the Bredolab botnet last month.
Also involved in the takedown effort were a Dutch hosting provider, the Dutch Forensic Institute, security company Fox IT and GOVCERT.NL (the Dutch computer emergency response team). The investigation also led to the arrest by Armenian police of an individual suspected to have masterminded the botnet.
Despite the seizure of the command and control servers though, a couple of command nodes were found to still be active a few days later – leading to suspicion that a second group of bot herders have begun to issue new instructions to the botnet. The Dutch authorities have indicated that their investigation of the botnet is ongoing.
Meanwhile, in the UK a joint operation between the Metropolitan Police and Finnish authorities culminated in a Scottish man pleading guilty last month to ‘causing unauthorized modification to the content of computers’ as part of his involvement in the m00p hacking group. The group infected tens of thousands of machines worldwide by sending malware attached to spam messages. Thirty-three-year-old Matthew Anderson’s role was in distributing millions of spam messages.
According to the Metropolitan Police, Anderson took control of the infected computers, on occasion activating their webcams to spy on their owners. During the investigation, screen grabs were found on Anderson’s computers taken from webcams as well as copies of private documents including wills, medical reports, CVs, password lists and private photographs.
Anderson was arrested in 2006 and will be sentenced later this month.
DC Bob Burls of the Police Central e-Crime Unit, who was involved in the m00p investigation, will be detailing what it is that makes botnets the Internet weapon of choice at the VB Seminar on 25 November in London. See http://www.virusbtn.com/seminar/ for details.
