14 ms·
FBI, partners dismantle Qakbot infrastructure
- bdcp 3y agoIs this the ransomware as a service that was hitting hospitals and multiple companies?
- AugustoCAS 3y agoThis is huge. Yesterday The Register published an article [1] mentioning that Qakbot was responsible for 30% of recorded intrusion attempts since the start of 2023. [1]: https://www.theregister.com/2023/08/28/top_malware_loaders/ https://www.theregister.com/2023/08/28/top_malware_loaders/
- autoexec 3y agoIf it's really finally fully down that's great, but it took forever and replacements can be churned out and new networks grown in a very short amount of time. I'm glad the FBI invested 15+ years and who knows how much money to rid the world of QBot, but this isn't a scalable solution to the botnet problem.
- ryukoposting 3y agoI don't think it's the FBI's job to figure out a scalable solution to botnets. That's our job.
- 1970-01-01 3y agoQbot/Qakbot/Pinkslip/Whateveritsnowcalled has been morphing since the very beginning, 2007/08: https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/qakbot https://www.blackberry.com/us/en/solutions/endpoint-security... https://www.youtube.com/watch?v=DN9m27nhA00 https://www.youtube.com/watch?v=DN9m27nhA00 https://en.wikipedia.org/wiki/BASHLITE https://en.wikipedia.org/wiki/BASHLITE
- costco 3y agoIs that the same Qakbot? I thought BASHLITE was just the IoT botnet that powered LizardStresser. It was amateurish but effective: https://github.com/hammerzeit/BASHLITE/blob/master/client.c https://github.com/hammerzeit/BASHLITE/blob/master/client.c
- cynicalsecurity 3y ago[flagged]
- mvdwoord 3y ago[flagged]
- codeslave13 3y agoPersonal attacks arent really called for. I disagree with op but really?
- Madmallard 3y agohe's right in that windows is horrible spyware cancer made continually worse by an insanely anti-consumer corporation and would be better off gone at this point had it not won the capitalism game
- capableweb 3y agoHe's also wrong thinking that malware is more possible on Windows than other OSes, rather than that Windows is a more popular target because it's the most popular OS in the world.
- psd1 3y agoThat's valid, but the thrust of the top-level comment is that the computers are infected because they were windows (sounds plausible) with the implication that if windows were not the dominant desktop OS, malware would not exist (which is improbable). Malware is only rare for MacOS and Linux because those are niche OSes, not because of inherently higher resistance.
- nickthegreek 3y agoAhhh yes, there is no way windows could be targeted because it is the most popular OS (especially in Business). Removing Windows would allow us to live a malware free utopia...
- 3y ago
- firesteelrain 3y ago"To disrupt the botnet, the FBI redirected Qakbot traffic to Bureau-controlled servers that instructed infected computers to download an uninstaller file. This uninstaller—created to remove the Qakbot malware—untethered infected computers from the botnet and prevented the installation of any additional malware. " That's pretty sweet that they healed hundreds of thousands of computers
- pbronez 3y agoPretty interesting. I bet there were a LOT of lawyer conversations about that.
- nickthegreek 3y agoFBI's been doing this for awhile now. So far no one has taken them to court. I do wonder how that would end.
- tw04 3y agoGiven the infected folks in question likely had their machines involved in illegal activity, I'm not sure I'd want to test it. If someone starts running a meth lab out of your unlocked cellar, at what point do you become culpable for not knowing? And are you really going to try to sue the police for shutting down the lab and locking the door on their way out?
- anonym29 3y ago>If someone starts running a meth lab out of your unlocked cellar, at what point do you become culpable for not knowing? Are you implying that the property owner is liable because they neglected to lock the cellar, or because they weren't aware a crime was taking place there? If the former, isn't that as clear an example of victim blaming as telling people to carry firearms/protection if they don't want to be sexually assaulted? In a civil society, it is not the responsibility or duty of the victim to set up security measures to prevent themselves from being victimized. It is the responsibility and duty of the culprit to not commit those unlawful crimes in the first place. Bringing the analogy back to security - who is guilty of a crime when a ransomware attack happens, the victim, or the criminal (who obtained unauthorized access, and used that access to perform extortion)?
- coldblues 3y ago> To disrupt the botnet, the FBI redirected Qakbot traffic to Bureau-controlled servers that instructed infected computers to download an uninstaller file. This uninstaller—created to remove the Qakbot malware—untethered infected computers from the botnet and prevented the installation of any additional malware. So the FBI used unauthorized access to the computers to uninstall the malware? Scary if you think about it. I'm sure they could have used that access any way they wanted.
- Angostura 3y agoWhat would have been a better alternative?
- nicechianti 3y ago[dead]
- acdha 3y agoSay I left my car unlocked and it starts spewing smoke – is it scary if the fire department break in to put it out? Or if my abandoned building is housing rats, is it okay for the city to break in and deal with them? The FBI is far from perfect but this is the kind of thing they _should_ be doing, using their unique privileges to help with public menaces. Anyone on the internet could compromise them, too, so I’d prefer a public cleanup.
- cool_dude85 3y agoIt's context dependent. If I'm filming a movie and want to get a scene where a car is spewing smoke, and the FD runs up while I'm filming to put it out, that is troublesome to me. It seems like this might be the case here where some minuscule portion of the botnet base is security research firms / etc. who have a reason to have the botnet software installed and don't want it deleted; in fact, it may even affect their livelihood to delete it.
- Teever 3y ago
- _8j50 3y agoI wouldn't make a big deal out of this, unlike worms, "bots" like this will come back after weeks/months because of the number of people involved and the spread of the malware "kit" (including server side stuff). They are constantly adapting anyways, there isn't a fixed set if domains and IPs you can block to stop it permanently. They took down emotet as well but it's had a resurgence. Qakbot in recent years has shifted to a initial access broker monetization scheme where it sells access (cobaltrsike,etc...) to more serious actors who will pay the access fee instead of hiring talent themselves to do the hacking. So they have a strong community of customers. They will need to arrest a lot of people at once and hope they got all the people needed to revive it.
- r3trohack3r 3y agoThe warrant application is one of the coolest, cyberpunk, warrants I've read in my lifetime: https://www.justice.gov/d9/2023-08/23mj4244_application_redacted.pdf https://www.justice.gov/d9/2023-08/23mj4244_application_reda... Feels like one of those "in world messages" you find in games like Cyberpunk 2077. Could have been written by NetWatch. We live in amazing times.
- skilled 3y agoNot going to lie, it felt pretty boring. When I read your comment I thought it was going to be a GFX designed warrant with an image of Morpheus offering Neo to take either of the pills, while The Silence of the Lambs was playing in the background.
- r3trohack3r 3y agoEven in cyberpunk dystopias, I imagine bureaucracies are still bureaucracies. This just seems very cool to me: > a. First, the FBI will identify the current Tier 1 servers (which are also Qakbot infected victim computers) based on information collected by the FBI. > b. Second, an FBI-controlled computer will contact each of those Tier 1 servers using commands built into the Qakbot malware and Qakbot encryption keys known to the FBI. The FBI will instruct each Tier 1 server to download and install an FBI-created module that replaces the “supernode” module in the already-installed Qakbot malware (“FBI Supernode Module”). The FBI Supernode Module contains a new encryption key that will make it impossible for the Qakbot administrators to communicate with the Tier 1 servers. The proposed warrant would authorize replacement of the “supernode” module to allow the FBI to communicate with and search infected computers that make up the botnet. The proposed warrant therefore also authorizes law enforcement officers to seize or copy from the infected computers electronically stored information related to the Qakbot malware, including encryption keys and server lists used by the Qakbot administrators to communicate with computers that are part of the Qakbot infrastructure. > c. Third, the FBI will contact each of those Tier 1 servers using commands built into the Qakbot malware. The FBI will instruct those Tier 1 servers to communicate with an FBI- controlled server (the “FBI Server”) instead of the Qakbot Tier 2 servers. At this point all communications from infected botnet computers will be routed through the Tier 1 servers to the FBI Server, rather than to the Qakbot Tier 2 and Tier 3 servers. > d. Fourth, infected computers subject to this warrant that make up the botnet would then communicate with the FBI Server instead of the Tier 3 server. As noted above, the Qakbot malware instructs the infected computers to contact the Tier 3 server every one to four minutes. When those infected computers contact the FBI Server, the server will instruct them to download a second file created by law enforcement (“the Qakbot Uninstaller”). This warrant would authorize this action, with the intent that computers in the United States that are infected with the Qakbot malware will download the Qakbot Uninstaller from the FBI Server via the FBI-controlled Tier 1 servers. The proposed warrant therefore authorizes law enforcement officers to seize or copy from the infected computers electronically stored information related to the Qakbot malware, including IP addresses and routing information necessary to determine whether the infected computer continues to be controlled by the Qakbot botnet.
- yafbum 3y agoCool use of the botnet's capabilities against itself But no arrests announced? I wish the people responsible for this were made an example of, as opposed to being basically free to start over (it seems).
- whimsicalism 3y agoThey are probably outside of US jursidiction and also seizing servers is much easier than catching a cybercriminal who actually knows how to cover their tracks.
- hnburnsy 3y agoThis feels like the fire department congratulating it self for putting out fires instead of capturing the arsonist.
- simpleuser27 3y agoIsn't that exactly what the fire department should be doing? I don't understand the criticism, could you explain why you view this in a negative light?
- rurp 3y agoArresting people is a pretty core part of the FBI's job.
- simpleuser27 3y agoThis seems needlessly critical. If the fire department puts out a fire, it seems like most people would consider that a good use of resources. In this case, the comments seem irrationally critical, to the point of being unconstructive.
- I_Am_Nous 3y agoI think the point they are trying to make is that there will still be fires started by the arsonist, so celebrating a single fire being put out while the arsonist is likely busy trying to start another fire looks bad. Even though, as you point out, the Fire Department isn't going to be making any arrests for arson, that's the Police Department's job. I'm not sure the analogy applies perfectly anyway, since it was "only" a single "fire" in which "only" 700,000 victims were affected.
- dcow 3y agoTwo questions: 1. if someone installed Qakbot willingly, does the warrant apply (the warrant has what looks to me like specific language limiting it to unaware victim’s machines)? 2. if the FBI’s justice.exe damaged data on a victim machine because of an unexpected configuration, are they liable for damages?
- ipaddr 3y agoIf they breakdown your door by mistake who pays the repair damages? You do.
- dcow 3y agoDo you have a citation for that? AFAIU breaking down the door is only allowed with a knock-less warrant, in which case it’s not a mistake. > An aggrieved citizen might also have a claim for civil liability against the officer or the law enforcement agency for certain unreasonable actions taken in the search. The basis for such claims could include invasion of privacy, trespass, or property damage.
- masfuerte 3y agoA web search turns up loads of cases where the police bashed in the wrong door simply because they are morons. Here's one that was expensive for them (for the city anyway): https://www.boston.com/news/local-news/2021/01/13/brighton-family-settlement-mistaken-no-knock-warrant/ https://www.boston.com/news/local-news/2021/01/13/brighton-f...
- fnord77 3y agothat came out of taxpayer's / insurance budget that did not come out of the police budget
- m4jor 3y agoSource: history of law enforcement being stupid - https://ij.org/press-release/after-a-swat-team-destroyed-a-texas-home-it-refused-to-pay-for-the-damage-now-the-homeowner-is-fighting-back/ https://ij.org/press-release/after-a-swat-team-destroyed-a-t... - https://www.kiro7.com/news/trending-now/court-rules-homeowner-owed-nothing-after-swat-team-destroys-his-house/1003656331/ https://www.kiro7.com/news/trending-now/court-rules-homeowne... - https://reason.com/2023/07/27/a-swat-team-destroyed-an-innocent-mans-shop-then-the-city-left-him-with-the-bill/ https://reason.com/2023/07/27/a-swat-team-destroyed-an-innoc... - etc etc etc thousands of times
- jordana36 3y ago[flagged]
- jordana36 3y ago[flagged]
- jordana36 3y ago[flagged]
- jordana36 3y ago[flagged]
- jordana36 3y ago[flagged]
- kiddico 3y agoA 3 letter did a thing I like? Quick, someone pinch me.
- michaelaiello 3y agoSome more technical details on what we observed here. https://www.secureworks.com/blog/law-enforcement-takes-down-qakbot https://www.secureworks.com/blog/law-enforcement-takes-down-... https://www.secureworks.com/blog/qakbot-campaign-delivered-black-basta-ransomware https://www.secureworks.com/blog/qakbot-campaign-delivered-b...
- jscipione 3y agoIf the FBI doesn’t like them, Qakbot can’t be that bad.
- behindai 3y agoFaced a "wtf" that damages your subjects? Name it "Russian" backed. ???? PROFIT