6 ms·
Microsoft shuts down giant Rustock spamming network
- spoiledtechie 16y agoHuge win for the M Team. Happy to see MSoft is still trying their best to protect their customers. I imagine money spent to do it this way was much cheaper than removing this content from users computers world wide. They probably found it pretty simple after shutting down Waledac earlier. Same team, different target.
- gm 16y agoActually, it was very different. A quote: "However, Rustock’s infrastructure was much more complicated than Waledac’s, relying on hard-coded Internet Protocol addresses rather than domain names and peer-to peer command and control servers to control the botnet." Read the whole thing at http://blogs.technet.com/b/microsoft_on_the_issues/archive/2011/03/18/taking-down-botnets-microsoft-and-the-rustock-botnet.aspx http://blogs.technet.com/b/microsoft_on_the_issues/archive/2...
- deleted 16y ago[deleted]
- pkananen 16y agoBest thing Microsoft has done in years? ;)
- Bud 16y agoBest thing since Kinect, and, before that, DOS 4.0!
- drdaeman 16y agoWeird. I thought modern botnets are P2P, with control nodes disguised as ordinary infected machines. Well, it's nice that this was not the case.
- Locke1689 16y agoMost of the advanced ones are. They're also mostly using overlay network topologies, which can be hard to distinguish from other P2P traffic and forms a considerable amount of resiliency. Just turns out that this was one of the older, more primitive botnets.
- rfolstad 16y agoThe real news here is that while Microsoft is losing the smart phone market they are the market leaders in the bot net market with a clear 100%! Thank you Microsoft for helping to clean up your mess!
- vyrotek 16y agoHow is it their mess?
- JoachimSchipper 16y agoPresumably, because most botnets consist of Windows computers. If Windows security were better, building a botnet would be difficult. That said, most botnets consist of old unpatched Windows computers or spreads via third-party software (e.g. Flash/Acrobat Reader), and MS' market share means that it will be targeted even if it their security is no worse than their competitors'. Windows security still could be better, but I don't think blaming Microsoft is as justified as it was before e.g. XP SP2.
- radicaldreamer 16y agoThe only reason most botnets consist of Windows computers is because Windows is ubiquitous, difficult for the average Windows user to secure, and full of security issues from add-ons and plugins. Look for future malware to be spread using the biggest rarely updated smartphone platform (currently Android).
- rbanffy 16y ago> The only reason most botnets consist of Windows computers is because Windows is ubiquitous, difficult for the average Windows user to secure, and full of security issues from add-ons and plugins. So, the only reason are actually 3?
- nitrogen 16y agoCell carriers really need to realize that they're effectively selling perpetually-connected pocket-sized computers, and that refusing updates because they're "not in the business plan" is going to cause them an inordinate amount of grief due to malware.
- azim 16y agoSenderbase has some interesting spam statistics which are reported from Cisco/IronPort security appliances around the world. After today is over and the stats are calculated, there might be some interesting data. http://www.senderbase.org/home/detail_spam_volume http://www.senderbase.org/home/detail_spam_volume
- rbanffy 16y agoTo be fair, Microsoft made the Rustock spamming botnet possible.
- josephcooney 16y agoIn what way?
- rbanffy 16y agoDo you honestly believe market share is the only reason we don't see malware for other platforms? I can assure you the zillions of Linux servers you see sitting unattended for years on very fat pipes are really attractive targets. Yet, you don't hear about server botnets... There must be a reason for that.
- daeken 16y agoThese "unattended" servers have far, far fewer security mechanisms in place than even XP SP2. If someone wanted to target them, they would. However, it's insanely easy to find Windows machines, which is all that's important for botnets. It's not hard at all to take over either an unpatched Linux machine or an unpatched Windows machine, but volume is all that counts here. You want hundreds of thousands (sometimes millions) of machines to send spam from. Market share is all that matters here, not technology at all.
- alexandros 16y agoYou would expect a badly architected system to have -more- security mechanisms, as it has a more complex surface to defend. You wouldn't expect it to be more secure though.
- rbanffy 16y ago> servers have far, far fewer security mechanisms in place than even XP SP2 According to your reasoning, IE6 is the most secure browser because it has the most security patches. If you have fewer vulnerabilities to start with, you'll end up with fewer, simpler (and thus more reliable) security mechanisms. Windows has improved a lot. I suppose 2008r2 is reasonably secure and should be able to stay secure when exposed to the net, but the internal complexity of its security mechanisms is huge and, therefore, a lot can go wrong.