11 ms·

Google Sues Glupteba botnet [pdf]

85 points by shelfchair 5y ago

IceWreck 5y ago
> including an industry-leading two full gigabytes of email storage; email message threading What year is this from ? Doesn't google offer 15 gigs of free storage. Also how is "two full gigabytes" industry leading ?
ipaddr 5y ago
Evil Google at it again
judge2020 5y ago
Reference article: https://blog.google/technology/safety-security/new-action-combat-cyber-crime/ https://blog.google/technology/safety-security/new-action-co...
walrus01 5y ago
I understand they want to set some sort of precedent, but good luck collecting a damages in a civil action judgment from a bunch of people who don't show up to contest a US court case, who are Russian citizens, remain domestically in Russia, and don't travel internationally (unless they're dumb).
- kingcharles 5y ago
  Exactly. Even if you could find the defendants in the first place and somehow subpoena all the evidence and conduct the depositions you would be faced with the even steeper struggle of collecting the damages.
- ArnoVW 5y ago
  While it is true that they will likely not see any money, it does mean that they have effectively banished these people from the US. Perhaps it's not as life altering as jail or fines, but still: no holidays in Florida or Hawaii. No meeting peers at a congres in the US. Not even using flights from American carriers to go to South America, as they will likely pass via a US hub. Worse. If they ignore the whole thing, at some point they will get condemned of contempt of court. That's a criminal offense. That means you can try and get interpol involved. Once you have an interpol Red Notice to your name, international travel to any civilized country becomes complicated.
  - 4gotunameagain 5y ago
    > it does mean that they have effectively banished these people from the US. This is quite irrelevant to the vast majority of Earth's population. I know some Americans consider the US to be the center of the world, but I doubt that sentiment is prevalent in Russia of all places.
    - ghusto 5y ago
      This ^ > Perhaps it's not as life altering as jail or fines, but still: no holidays in Florida or Hawaii. No meeting peers at a congres in the US. Not even using flights from American carriers to go to South America, as they will likely pass via a US hub. This is both telling, and curious. The kind of mental model of the world required to foster this as a concern for most people, is interesting.
      - 55555 5y ago
        Russian cyber criminals and other rich people often vacation globally. I didn’t check the defendant’s facebooks but I would be surprised if they have never visited the US.
        4gotunameagain 5y ago
        Yeah rich people travel all over the place, sure, but equating the inability to visit Florida or Hawaii with jail time?!
        masterof0 5y ago
        Florida? Putting Florida and Hawaii in the same sentence, is funny at best. There are plenty of countries these guys can travel to, if they have enough money, they can get a passport with a different name, etc. People don't care about the US as much as Americans think. Maybe OPs is from some 3rd world country where going to America is the dream of a lifetime.
    - moeris 5y ago
- acomjean 5y ago
  It also seems from reading the complaint those aren’t their real names.
kingcharles 5y ago
"However, the operators of Glupteba are likely to attempt to regain control of the botnet using a backup command and control mechanism that uses data encoded on the Bitcoin blockchain." https://www.bleepingcomputer.com/news/security/google-disrupts-massive-glupteba-botnet-sues-russian-operators/ https://www.bleepingcomputer.com/news/security/google-disrup... I don't see the legal aspect going anywhere. I don't know the technicalities of suing someone in another country, but to get the discovery they need they'll need subpoenas. How do you serve a subpoena in Russia? Is there any treaty which gives a U.S. subpoena any legal power in Russia? I guess there must be something behind it or Google would not have wasted their legal resources to file it.
- darig 5y ago
  Google has a corporate presence in Moscow: https://about.google/intl/ALL_us/locations/?region=europe&office=moscow https://about.google/intl/ALL_us/locations/?region=europe&of...
- dodobirdlord 5y ago
  If Google establishes that the venue they're suing in has jurisdiction (which seems pretty clearly established, since it's where a substantial amount of the damage has happened), then the judge is going to let the case proceed. If at that point the defendants don't bother to show up and don't respond to subpoenas Google will eventually win a default judgement. If the defendants don't comply with the default judgement (why would they?) the judge might hold them in contempt, and then they won't be able to travel internationally to anywhere willing to extradite them or keep assets anywhere that will seize them on behalf of the US government, which is most of the world.
  - kingcharles 5y ago
    I've just downloaded the whole case file from PACER, I'll upload it somewhere in a minute. They served the defendants by FedEx a few days after filing the case. Then somehow Google immediately managed to get a Temporary Restraining Order (TRO) in record time to enjoin the defendants from their tomfoolery. Not sure at this stage how the TRO will be enforced.
audiodude 5y ago
I read most of the filing and it was surprisingly legible and illuminating.
- 1-6 5y ago
  TL;DR?
  - kingcharles 5y ago
    It's difficult to summarize the Complaint, but it contains a fair bit of evidence showing how the botnet works and each of the individual scams that are perpetrated by its operators. It also looks like the operators left a very small fingerprint in a couple of places which has exposed their real identities which Google is using to attach them to the claims.
dmortin 5y ago
Why don't they sue them in a Russian court? There are laws against cybercrime there too.
- walrus01 5y ago
  my internal reaction to this idea: https://www.youtube.com/watch?v=QOKociU8t_Q&t=5s https://www.youtube.com/watch?v=QOKociU8t_Q&t=5s
- ronsor 5y ago
  While Russia technically has laws against cybercrime, it turns a blind eye as long as the criminals aren't hacking other Russian companies/citizens.
  - SXX 5y ago
    This is a myth. Russia is just normal authoritorian country and unless you're literally working for local 3 letter agencies you can get arrested and put in prison. And since it's not Israel and there are no rules this can also apply to someone working for regime too like it's recently happen to owner of local cybersecurity company Group-IB. Of course if you're to stay anonymous then you obviously have better chances to stay off radar in Russia than in US, but again that's only work until someone bribe local authorities to find you.
    - ryanlol 5y ago
      > it's recently happen to owner of local cybersecurity company Group-IB Charged with treason for aiding foreign intelligence agencies, odds are he was working with the FBI and is guilty as charged. Group-IB was kind of famous for causing problems, it’s surprising it took as long as it did for the government to crack down.
      - SXX 5y ago
        Might be he was working with FBI or he wasn't, but it doesnt change the fact that he was very much pro-Putin regime and had connections in local agencies. And he isnt a first one to get imprisoned just higher profile one. So even if you're literally part of their system someone can always come for you and eat you whole. The only "The Untouchable Russian Hackers" who exist are ones who officially work for government, but they are not any different than NSA.
kingcharles 5y ago
The Complaint lacks a case number and says it was filed under seal, but here are the details from PACER: Google LLC v. Dmitry Starovikov, et al. 1:2021cv10260 New York Southern District Court 12/02/2021 They served the defendants already via FedEx. What weight that will carry I don't know. The court might enter a default judgment in a few weeks when the defendants fail to appear.
mikefallen 5y ago
Can anyone link to an article that goes into goes into detail on how the botnet uses blockchain to recover the botnet after they disrupt the c2. This seems interesting.
- codezero 5y ago
  They are hard coded to watch certain wallets for transactions on the chain if their normal c2 servers are offline. The transactions contain their new servers/other instructions.
  - deleted 5y ago
    [deleted]
- vital_beach 5y ago
  this lists the addresses and keys and breaks down how it works https://blog.google/threat-analysis-group/disrupting-glupteba-operation/ https://blog.google/threat-analysis-group/disrupting-glupteb...
vmception 5y ago
> Unlike conventional botnets, the Glupteba botnet does not rely solely on predetermined domains to ensure its survival. > Instead, when the botnet’s C2 server is interrupted, Glupteba malware is hard-coded to “search” the public Bitcoin blockchain for transactions involving three specific Bitcoin addresses that are controlled by the Glupteba Enterprise. >From time to time, the Glupteba Enterprise executes transactions in those addresses, and as part of those transactions, the Glupteba Enterprise leaves in the blockchain the location of the domain for a back- up C2 Server. Nice, the faster people start treating public blockchains as pay-to-write-once, read-for-free, databases and the native cryptocurrency more like fuel for writing, the quicker this “currency” debate ends for something more intelligent and aligned with reality and the market behaviors. In before “they could have used a permissioned database”, I really can’t think of something more reliable and cheaper with assurances of availability like this
- vmception 5y ago
  Another use case for this method is a way for your human users to find you after you’ve been deplatformed or have no status page. Write the messages onchain to an address your users know, or with a signed message your users know to look for
  - throwawaygh 5y ago
    > after you’ve been deplatformed > Write the messages onchain to an address your users know Ah yes, for those fans who are literally too lazy/disinterested to leave YouTube for long enough to tap your name into Google but are motivated enough to grep the blockchain. Deplatforming has never stopped fans from finding content.
    - vmception 5y ago
      UI makes it easier, count at least you as being surprised how much messages are posted onchain and then spread across Crypto Telegram, Crypto Twitter, and then to broader news sources
- seoaeu 5y ago
kingcharles 5y ago
This is the text from a letter from Google to the judge yesterday: First, with respect to Thursday’s hearing, in light of Defendants’ failure to oppose Google’s motion, Google intends to rely on the declarations of Shane Huntley and Elizabeth Bisbee, which fully support the proposed Preliminary Injunction. Should the Court prefer to receive live testimony from one or both of Google’s declarants, Google respectfully requests that they be permitted to appear virtually, as each would be required to travel from out of state (from the West Coast, in Mr. Huntley’s case) to appear in person. Second, as anticipated, following the disruption efforts pursuant to the TRO, Defendants have attempted to reconstitute the botnet by using the Bitcoin blockchain to direct the infected devices to new command-and-control (“C2”) servers and migrated the storefronts used in service of the Enterprise to new name servers. See ECF 5 (Compl.) ¶¶ 47-50, 54-65. Google’s disruption efforts already have identified several new C2 servers, and Google is working with the relevant web-hosting providers to disable them. Case 1:21-cv-10260-DLC Document 14 Filed 12/14/21 Page 1 of 2 December 14, 2021 Page 2 While the TRO provides that Google may move to modify the Order in the event it identifies new domains, see ECF 8 (TRO) at 11 16, Defendants are generating new domains nearly every day in an effort to evade the TRO. Rather than submit repeated requests to the Court to add new domains and IP addresses as they are identified, Google respectfully requests broader injunctive language to cover, for example, any C2 servers identified in blockchain transactions initiated by Defendants and/or the Enterprise, any domains used to host storefronts used in connection with Defendants’ criminal schemes, and any domains identified by Google as hardcoded in the malware or otherwise used to distribute the malware. A proposed Preliminary Injunction Order is attached at Exhibit 1. Finally, the TRO provides that “Google shall post bond in the amount of $75,000 to be paid into the Court registry.” ECF 8 (TRO) at 16. The Clerk has requested that Google instead submit the required bond to the Clerk and seek a modified order directing the Clerk to accept the bond. Accordingly, to accommodate the Clerk’s request, Google respectfully requests that the Court so-order that Google’s submission of the $75,000 to the Clerk satisfies the TRO’s bond requirement. Google’s Proposed Order at Exhibit 1 incorporates this modification.
msravi 5y ago
Technical details: https://news.sophos.com/wp-content/uploads/2020/06/glupteba_final-1.pdf https://news.sophos.com/wp-content/uploads/2020/06/glupteba_... Pages 30-32 describe the command and control server update mechanism using blockchain.
kingcharles 5y ago
OK, I've uploaded all the PDFs from the whole case here so you can see everything that Google filed, including all the stuff that got unsealed: https://kingcharles.one/google-v-dmitry-starovikov-1-2021cv10260 https://kingcharles.one/google-v-dmitry-starovikov-1-2021cv1... (and as an exercise in why PACER sucks so much, I had to pay twice to download them all because even though I opened all the PDFs in my browser my session timed out and when I hit download I just got an error and not the PDF)
johnnyApplePRNG 5y ago
Serious question here: What's the point?
- kingcharles 5y ago
  They need to show their advertisers that they are doing something - anything - to combat all the click-fraud that is sucking dollars from their customers. It's theatre.
- puchatek 5y ago
  See comment of dodobirdlord above
_8j50 5y ago
One of the rare botnets that uses a rootkit
not2b 5y ago
It takes about 10 minutes to add a node to the Bitcoin Blockchain. As soon as it is added, everyone can see it. So DNS servers could ban the new domain almost immediately after it is added. It is a race, of course, as there will be windows in which the bots could successfully phone home.

85 points by shelfchair 5y ago

> including an industry-leading two full gigabytes of email storage; email message threading What year is this from ? Doesn't google offer 15 gigs of free storage. Also how is "two full gigabytes" industry leading ?

ipaddr 5y ago

Evil Google at it again

judge2020 5y ago

Reference article: https://blog.google/technology/safety-security/new-action-combat-cyber-crime/ https://blog.google/technology/safety-security/new-action-co...

walrus01 5y ago

I understand they want to set some sort of precedent, but good luck collecting a damages in a civil action judgment from a bunch of people who don't show up to contest a US court case, who are Russian citizens, remain domestically in Russia, and don't travel internationally (unless they're dumb).

kingcharles 5y ago
Exactly. Even if you could find the defendants in the first place and somehow subpoena all the evidence and conduct the depositions you would be faced with the even steeper struggle of collecting the damages.
ArnoVW 5y ago
While it is true that they will likely not see any money, it does mean that they have effectively banished these people from the US. Perhaps it's not as life altering as jail or fines, but still: no holidays in Florida or Hawaii. No meeting peers at a congres in the US. Not even using flights from American carriers to go to South America, as they will likely pass via a US hub. Worse. If they ignore the whole thing, at some point they will get condemned of contempt of court. That's a criminal offense. That means you can try and get interpol involved. Once you have an interpol Red Notice to your name, international travel to any civilized country becomes complicated.
- 4gotunameagain 5y ago
  > it does mean that they have effectively banished these people from the US. This is quite irrelevant to the vast majority of Earth's population. I know some Americans consider the US to be the center of the world, but I doubt that sentiment is prevalent in Russia of all places.
  - ghusto 5y ago
    This ^ > Perhaps it's not as life altering as jail or fines, but still: no holidays in Florida or Hawaii. No meeting peers at a congres in the US. Not even using flights from American carriers to go to South America, as they will likely pass via a US hub. This is both telling, and curious. The kind of mental model of the world required to foster this as a concern for most people, is interesting.
    - 55555 5y ago
      Russian cyber criminals and other rich people often vacation globally. I didn’t check the defendant’s facebooks but I would be surprised if they have never visited the US.
      - 4gotunameagain 5y ago
        Yeah rich people travel all over the place, sure, but equating the inability to visit Florida or Hawaii with jail time?!
        masterof0 5y ago
        Florida? Putting Florida and Hawaii in the same sentence, is funny at best. There are plenty of countries these guys can travel to, if they have enough money, they can get a passport with a different name, etc. People don't care about the US as much as Americans think. Maybe OPs is from some 3rd world country where going to America is the dream of a lifetime.
  - moeris 5y ago
acomjean 5y ago
It also seems from reading the complaint those aren’t their real names.

kingcharles 5y ago

"However, the operators of Glupteba are likely to attempt to regain control of the botnet using a backup command and control mechanism that uses data encoded on the Bitcoin blockchain." https://www.bleepingcomputer.com/news/security/google-disrupts-massive-glupteba-botnet-sues-russian-operators/ https://www.bleepingcomputer.com/news/security/google-disrup... I don't see the legal aspect going anywhere. I don't know the technicalities of suing someone in another country, but to get the discovery they need they'll need subpoenas. How do you serve a subpoena in Russia? Is there any treaty which gives a U.S. subpoena any legal power in Russia? I guess there must be something behind it or Google would not have wasted their legal resources to file it.

darig 5y ago
Google has a corporate presence in Moscow: https://about.google/intl/ALL_us/locations/?region=europe&office=moscow https://about.google/intl/ALL_us/locations/?region=europe&of...
dodobirdlord 5y ago
If Google establishes that the venue they're suing in has jurisdiction (which seems pretty clearly established, since it's where a substantial amount of the damage has happened), then the judge is going to let the case proceed. If at that point the defendants don't bother to show up and don't respond to subpoenas Google will eventually win a default judgement. If the defendants don't comply with the default judgement (why would they?) the judge might hold them in contempt, and then they won't be able to travel internationally to anywhere willing to extradite them or keep assets anywhere that will seize them on behalf of the US government, which is most of the world.
- kingcharles 5y ago
  I've just downloaded the whole case file from PACER, I'll upload it somewhere in a minute. They served the defendants by FedEx a few days after filing the case. Then somehow Google immediately managed to get a Temporary Restraining Order (TRO) in record time to enjoin the defendants from their tomfoolery. Not sure at this stage how the TRO will be enforced.

audiodude 5y ago

I read most of the filing and it was surprisingly legible and illuminating.

1-6 5y ago
TL;DR?
- kingcharles 5y ago
  It's difficult to summarize the Complaint, but it contains a fair bit of evidence showing how the botnet works and each of the individual scams that are perpetrated by its operators. It also looks like the operators left a very small fingerprint in a couple of places which has exposed their real identities which Google is using to attach them to the claims.

dmortin 5y ago

Why don't they sue them in a Russian court? There are laws against cybercrime there too.

walrus01 5y ago
my internal reaction to this idea: https://www.youtube.com/watch?v=QOKociU8t_Q&t=5s https://www.youtube.com/watch?v=QOKociU8t_Q&t=5s
ronsor 5y ago
While Russia technically has laws against cybercrime, it turns a blind eye as long as the criminals aren't hacking other Russian companies/citizens.
- SXX 5y ago
  This is a myth. Russia is just normal authoritorian country and unless you're literally working for local 3 letter agencies you can get arrested and put in prison. And since it's not Israel and there are no rules this can also apply to someone working for regime too like it's recently happen to owner of local cybersecurity company Group-IB. Of course if you're to stay anonymous then you obviously have better chances to stay off radar in Russia than in US, but again that's only work until someone bribe local authorities to find you.
  - ryanlol 5y ago
    > it's recently happen to owner of local cybersecurity company Group-IB Charged with treason for aiding foreign intelligence agencies, odds are he was working with the FBI and is guilty as charged. Group-IB was kind of famous for causing problems, it’s surprising it took as long as it did for the government to crack down.
    - SXX 5y ago
      Might be he was working with FBI or he wasn't, but it doesnt change the fact that he was very much pro-Putin regime and had connections in local agencies. And he isnt a first one to get imprisoned just higher profile one. So even if you're literally part of their system someone can always come for you and eat you whole. The only "The Untouchable Russian Hackers" who exist are ones who officially work for government, but they are not any different than NSA.

kingcharles 5y ago

The Complaint lacks a case number and says it was filed under seal, but here are the details from PACER: Google LLC v. Dmitry Starovikov, et al. 1:2021cv10260 New York Southern District Court 12/02/2021 They served the defendants already via FedEx. What weight that will carry I don't know. The court might enter a default judgment in a few weeks when the defendants fail to appear.

mikefallen 5y ago

Can anyone link to an article that goes into goes into detail on how the botnet uses blockchain to recover the botnet after they disrupt the c2. This seems interesting.

codezero 5y ago
They are hard coded to watch certain wallets for transactions on the chain if their normal c2 servers are offline. The transactions contain their new servers/other instructions.
- deleted 5y ago
  [deleted]
vital_beach 5y ago
this lists the addresses and keys and breaks down how it works https://blog.google/threat-analysis-group/disrupting-glupteba-operation/ https://blog.google/threat-analysis-group/disrupting-glupteb...

vmception 5y ago

> Unlike conventional botnets, the Glupteba botnet does not rely solely on predetermined domains to ensure its survival. > Instead, when the botnet’s C2 server is interrupted, Glupteba malware is hard-coded to “search” the public Bitcoin blockchain for transactions involving three specific Bitcoin addresses that are controlled by the Glupteba Enterprise. >From time to time, the Glupteba Enterprise executes transactions in those addresses, and as part of those transactions, the Glupteba Enterprise leaves in the blockchain the location of the domain for a back- up C2 Server. Nice, the faster people start treating public blockchains as pay-to-write-once, read-for-free, databases and the native cryptocurrency more like fuel for writing, the quicker this “currency” debate ends for something more intelligent and aligned with reality and the market behaviors. In before “they could have used a permissioned database”, I really can’t think of something more reliable and cheaper with assurances of availability like this

vmception 5y ago
Another use case for this method is a way for your human users to find you after you’ve been deplatformed or have no status page. Write the messages onchain to an address your users know, or with a signed message your users know to look for
- throwawaygh 5y ago
  > after you’ve been deplatformed > Write the messages onchain to an address your users know Ah yes, for those fans who are literally too lazy/disinterested to leave YouTube for long enough to tap your name into Google but are motivated enough to grep the blockchain. Deplatforming has never stopped fans from finding content.
  - vmception 5y ago
    UI makes it easier, count at least you as being surprised how much messages are posted onchain and then spread across Crypto Telegram, Crypto Twitter, and then to broader news sources
seoaeu 5y ago

kingcharles 5y ago

This is the text from a letter from Google to the judge yesterday: First, with respect to Thursday’s hearing, in light of Defendants’ failure to oppose Google’s motion, Google intends to rely on the declarations of Shane Huntley and Elizabeth Bisbee, which fully support the proposed Preliminary Injunction. Should the Court prefer to receive live testimony from one or both of Google’s declarants, Google respectfully requests that they be permitted to appear virtually, as each would be required to travel from out of state (from the West Coast, in Mr. Huntley’s case) to appear in person. Second, as anticipated, following the disruption efforts pursuant to the TRO, Defendants have attempted to reconstitute the botnet by using the Bitcoin blockchain to direct the infected devices to new command-and-control (“C2”) servers and migrated the storefronts used in service of the Enterprise to new name servers. See ECF 5 (Compl.) ¶¶ 47-50, 54-65. Google’s disruption efforts already have identified several new C2 servers, and Google is working with the relevant web-hosting providers to disable them. Case 1:21-cv-10260-DLC Document 14 Filed 12/14/21 Page 1 of 2 December 14, 2021 Page 2 While the TRO provides that Google may move to modify the Order in the event it identifies new domains, see ECF 8 (TRO) at 11 16, Defendants are generating new domains nearly every day in an effort to evade the TRO. Rather than submit repeated requests to the Court to add new domains and IP addresses as they are identified, Google respectfully requests broader injunctive language to cover, for example, any C2 servers identified in blockchain transactions initiated by Defendants and/or the Enterprise, any domains used to host storefronts used in connection with Defendants’ criminal schemes, and any domains identified by Google as hardcoded in the malware or otherwise used to distribute the malware. A proposed Preliminary Injunction Order is attached at Exhibit 1. Finally, the TRO provides that “Google shall post bond in the amount of $75,000 to be paid into the Court registry.” ECF 8 (TRO) at 16. The Clerk has requested that Google instead submit the required bond to the Clerk and seek a modified order directing the Clerk to accept the bond. Accordingly, to accommodate the Clerk’s request, Google respectfully requests that the Court so-order that Google’s submission of the $75,000 to the Clerk satisfies the TRO’s bond requirement. Google’s Proposed Order at Exhibit 1 incorporates this modification.

msravi 5y ago

Technical details: https://news.sophos.com/wp-content/uploads/2020/06/glupteba_final-1.pdf https://news.sophos.com/wp-content/uploads/2020/06/glupteba_... Pages 30-32 describe the command and control server update mechanism using blockchain.

kingcharles 5y ago

OK, I've uploaded all the PDFs from the whole case here so you can see everything that Google filed, including all the stuff that got unsealed: https://kingcharles.one/google-v-dmitry-starovikov-1-2021cv10260 https://kingcharles.one/google-v-dmitry-starovikov-1-2021cv1... (and as an exercise in why PACER sucks so much, I had to pay twice to download them all because even though I opened all the PDFs in my browser my session timed out and when I hit download I just got an error and not the PDF)

johnnyApplePRNG 5y ago

Serious question here: What's the point?

kingcharles 5y ago
They need to show their advertisers that they are doing something - anything - to combat all the click-fraud that is sucking dollars from their customers. It's theatre.
puchatek 5y ago
See comment of dodobirdlord above

_8j50 5y ago

One of the rare botnets that uses a rootkit

not2b 5y ago

It takes about 10 minutes to add a node to the Bitcoin Blockchain. As soon as it is added, everyone can see it. So DNS servers could ban the new domain almost immediately after it is added. It is a race, of course, as there will be windows in which the bots could successfully phone home.