Kelihos Botnet with 110,000 PCs take down finally

       Botnets are particularly insidious, using thousands of virus-infected computers which their owners are unaware are being used for sending out spam, launching denial-of-service attacks and stealing data. But taking down a botnet poses challenges. The main problem is that legitimate security companies can’t use the same type of weapons as criminals.

          A group of malware experts from security companies Kaspersky Lab, CrowdStrike, Dell SecureWorks and the Honeynet Project, have worked together to disable the second version of the Kelihos botnet, which is significantly bigger than the one shut down by Microsoft and its partners.

          Kelihos is used to send spam, carry out DDoS attacks, and steal online currency such as bitcoin wallets. It operates as a so-called "peer-to-peer" bot network, which are more difficult to take down than those with a centralized command and control servers (C&C), according to Tillmann Werner, a senior researcher at CrowdStrike.

          Seculert reports that Kelihos-B, which was distributed as a Facebook worm over recent weeks, is still active and spreading - even after the shutdown attempt by CrowdStrike and Kaspersky Labs this week. The peer-to-peer Kelihos botnet, also known as Hlux, was sucked into a 'sinkhole' by a small group of security experts from Kaspersky Lab, Dell SecureWorks, CrowdStrike Intelligence Team and the Honeynet Project.

          It's unclear who is behind Kelihos, he said. It was created last October after Microsoft used a sinkhole to halt the original Kelihos botnet, which had infected about 41,000 computers. The latest Kelihos used servers with hosts registered in Sweden, Russia and Ukraine that were controlled by a botmaster, according to CrowdStrike.

     The machines are still infected, and the researchers are relying on ISPs to inform affected users. What is to say this botnet won’t just morph itself again? “That is a possibility,” said Crowdstrike’s Mr. Meyers. “But when that happens, we’ll be there to take it back down.”

Read More

A Russian Zeus attacker Sentenced from Million Dollar Fraud

 

       A Russian Hacker, who was part of an elaborate Cyber attack that used Zeus Banking Trojan in U.S. visas to move cash stolen from U.S. businesses out of the country was sentenced on March 23 to two years in U.S. federal prison.

        Nikokay Garifulin received a two-year prison term for his involvement in a global bank fraud scheme that used hundreds of phone bank accounts to steal over $3 million from dozens of U.S.accounts that were compromised by malware attacks.

 

           According to court documents and statements, Garifulin was part of a cyber bank fraud scheme, backed by Eastern European hackers to steal money from the bank accounts of small and mid-sized businesses throughout the U.S. The cyber attacks included Zeus Trojan, would embed itself in victims’ computers and record keystrokes as they logged into their online bank accounts.

          The hackers responsible for the malware then used the account information to take over the victims’ bank accounts and make unauthorized transfers of thousands of dollars at a time to accounts controlled by co-conspirators, including Garifulin, who were members of a money mule organization.

         Garifulin collected money that had been withdrawn by mules from the phony accounts in the United States and, under the direction of the organization’s leader, distributed it to other co-conspirators and transported it back to Eastern Europe. GARIFULIN also arranged for fake passports to be transferred from Eastern Europe to mules in the United States.

         In addition to his prison term, Garifulin, 23, of Volgograd, Russia, was sentenced to three years of supervised release. He was also ordered to forfeit $100,000 and to pay $192,123,122 in restitution.

Read More

Japan orders Google to remove auto-complete function over privacy complaint

          Google has been ordered to disable part of its autocomplete function in Japan after complaints it violates privacy. According to a report by The Japan Times, the court was acting on a petition accusing Google’s autocomplete feature of being defamatory.

          The petition was filed by a Japanese man (name not disclosed) who alleged that some of the autocomplete suggestions accompanying his name were not only defamatory but also breached his privacy. The unnamed petitioner, in fact, claimed that these defamatory search suggestions even cost him his job. The man came to this conclusion after discovering that when people type his name into Google's search engine, words suggesting criminal acts, which he is unfamiliar with, automatically appear. If a computer-suggested term is selected, more than 10,000 items defaming or disparaging him show up in a list, Tomita said.

          Google has so far not carried out the court's request - but said it was "reviewing the order". "A Japanese court issued a provisional order requesting Google to delete specific terms from autocomplete," the Google spokesperson said in a statement. "The judge did not require Google to completely suspend the autocomplete function."

           Google defended the system, arguing that as results were generated mechanically - rather than by an individual it was not an invasion of privacy." These searches are produced by a number of factors including the popularity of search terms," the company said.

          Google has been having a few problems with these sorts of cases. Last year when a British man was falsely accused of being a paedophile in a Google Places review the company had to pull it. The search engine also had to give in to an Indian law directing internet companies to block religiously offensive information from searches.

Read More