HOME     MENU     SEARCH     NEWSLETTER    
NEWS & INFORMATION FOR TECHNOLOGY PURCHASERS. UPDATED 2 MINUTES AGO.
You are here: Home / Hardware / Microsoft Strikes Massive Botnet
Build Apps 5x Faster
For Half the Cost Enterprise Cloud Computing
On Force.com
Microsoft Leads Strike Against Massive ZeroAccess Botnet
Microsoft Leads Strike Against Massive ZeroAccess Botnet
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
DECEMBER
06
2013


Microsoft is once again flexing its cybercrime-fighting muscles. For the third time this year, Redmond’s Digital Crimes Unit has disrupted a dangerous botnet that has impacted millions of consumers.

Microsoft worked with Europol’s European Cybercrime Centre (EC3), the Federal Bureau of Investigation and technology industry leaders like A10 Networks, to take down the rampant Sirefef botnet. Also known as ZeroAccess, the botnet has infected nearly 2 million computers all over the world and cost online advertisers upwards of $2.7 million each month.

According to Microsoft, ZeroAccess targets all major search engines and browsers, including Google, Bing and Yahoo. Most of the infected machines are in the U.S. and Western Europe. Microsoft is comparing ZeroAccess to the Bamital botnet, which the company and its partners took down in February, in that it is responsible for hijacking search results and directing people to potentially dangerous Web sites that could install malware onto their computer, steal their personal information or fraudulently charge businesses for online advertisement clicks. ZeroAccess also commits click fraud.

Not Completely Dead

“Due to its botnet architecture, ZeroAccess is one of the most robust and durable botnets in operation today, and was built to be resilient to disruption efforts, relying on a peer-to-peer infrastructure that allows cybercriminals to remotely control the botnet from tens of thousands of different computers,” Microsoft wrote in a blog post.

Most often, the company said, computers become infected with ZeroAccess as a result of what are known as drive-by-downloads -- cybercriminals create a Web site that downloads malware onto any unprotected computer that happens to visit that site. Microsoft said computers can also become infected through counterfeit and unlicensed software, where criminals disguise ZeroAccess as legitimate software, tricking a person into downloading the ZeroAccess malware onto their computer.

“Because of the sophistication of the threat, Microsoft and its partners do not expect to fully eliminate the ZeroAccess botnet,” the company said. “However, we do expect this legal and technical action will significantly disrupt the botnet’s operation by disrupting the cybercriminals’ business model and forcing them to rebuild their criminal infrastructure, as well as preventing victims’ computers from committing the fraudulent schemes.”

Cleaning Up Messes

We caught up with Tommy Chin, a technical support engineer at CORE Security, to get his feedback on the operation. He told us Microsoft deserves an A for effort.

“It is not a simple task to take down a decentralized botnet. However, Microsoft's DCU seems to be motivated and their drive to team up with the right law enforcement agencies sounds really promising,” Chin said. (continued...)

1  2  Next Page >

Tell Us What You Think
Comment:

Name:

Dawesi:
Posted: 2013-12-16 @ 4:28pm PT
"but we’d also be better off writing less exploitable operating systems and educating users to avoid building these networks"

Good to see quotes from people who understand security. If you can write it, you can hack it. Period. If it's written, people will find a hole, people are paid to do this everyday (good people that is), then the bad people exploit the known holes.

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
DDoS PROTECTION POWERED BY VERISIGN: The increasing frequency, size and sophistication of DDoS attacks are rapidly changing the face of network security. DDoS Protection Services powered by Verisign provides a comprehensive cloud-based solution from the operator of some of the Internet's largest and most reliable infrastructure. Click here to take a closer look Verisign's DDoS solution.
MORE IN HARDWARE
Product Information and Resources for Technology You Can Use To Boost Your Business

© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.