9 ms·

Has Microsoft gained from this fiasco, or lost? Not sure.

by z92 12y ago

Guvante 12y ago
I haven't seen heavy technical details on what the seizure involved, but if in theory they got a hold of some control domains they could have sent out kill commands to stop the malware from working or alternatively sent them to a static "do nothing" host.
- ntakasaki 12y ago
  According to one researcher who reports malware to hosts, the bad guys keep adding hundreds of new subdomains every hour. http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-botnet-of-zombie-web-servers/ http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-b... >However since hackers add new domain names every hour, 100+ new hostnames need to be blocked. I’ve sent a few updates to both services, but they haven’t yet responded and I guess we’ll need to wait until Monday when they get back to work.
  - dublinben 12y ago
    Is there a reason why they are relying on DDNS to resolve IP addresses, instead of simply using the resulting IP addresses themselves? It seems like relying on No-IP here was a clear weak point in the design of this malware.
    - justsomedood 12y ago
      I'm sure they're using compromised hosts for the servers, which would change pretty often
    - nucleardog 12y ago
      How do you distribute the new IP address to members of the botnet even in the face of an unclean disconnection of a current C&C server? You could maintain a list of backup C&C servers on every node and see what happens, but you risk a netsplit causing your botnet to fragment. Or, you just have a centralized place to list the authoritative address of the current master. But you don't want to host that yourself - that's a link back to you. Another commenter mentioned the botnet was creating hundreds of new subdomains every hour. Obviously they had found a way to automatically register new accounts, and they had tens or hundreds of thousands of IP addresses to register from... By hosting it on a well-known and well-used service, they created a situation where someone is basically forced to take the entire service offline or take other drastic measures in order to counter-act them.
      - dublinben 12y ago
        Good point. I just figured they might have preferred to run their own DDNS service, or use p2p, since as we've seen, a service as large as No-IP can be completely shut down in a situation like this.
        nucleardog 12y ago
        It can be shutdown, but with a lot more difficulty than just getting some random server somewhere used only for the botnet pulled offline, which was probably the point, really. If I were a malware author I would never have assumed anyone could have gotten a court order to take an entire service offline.
    - superuser2 12y ago
      Maybe because the C&C servers were not (all) servers, but hosted on people's residential connections?
Alupis 12y ago
Microsoft seized the domains in order to discover command-and-control servers of a few botnets. Now... whether or not Microsoft seizing another legitimate company's property without any notice is legal/ethical is another question (one that probably should get more attention).
- joe_the_user 12y ago
  What is the justification of this post being pretty severely downvoted? It's not intemperate or off-topic as far as I can tell. Go ahead and downvote me too for metacommenting but it seems like slaps being handed out so freely just degrades community by making people reluctant to comment.
  - deleted 12y ago
    [deleted]
  - wfjackson 12y ago
    Your parent poster did a :s/M$/Microsoft on that comment before you read it. Edit: They then replied to your post with "I was wondering the same thing", before reading my post and deleting that comment.
    - deleted 12y ago
      [deleted]
      - jabits 12y ago
        "M$" is a shorthand for "Microsoft" - is not just shorthand, it's a sophomoric statement with commentary. If you don't know that, use words and phrases you understand.
- icebraining 12y ago
  Microsoft seized them by court order, I don't see how was it without notice or how could they have done it illegally.
tdicola 12y ago
They've certainly lost trust from the thousands of folks they broke who weren't involved with the botnet at all.
- shmerl 12y ago
  Never trust MS.
mikelat 12y ago
It's not like they had much of a reputation with the tech savvy crowd to begin with, with their frivolous patent litigation and business practices. The kind of crowd that uses a service like no-ip is the kind of crowd that likely isn't a big microsoft customer. The typical computer user will be ignorant to this and enterprise users don't care. The only way they'll really lose from this fiasco is if no-ip sues and wins in court.

Has Microsoft gained from this fiasco, or lost? Not sure.

by z92 12y ago

Has Microsoft gained from this fiasco, or lost? Not sure.

I haven't seen heavy technical details on what the seizure involved, but if in theory they got a hold of some control domains they could have sent out kill commands to stop the malware from working or alternatively sent them to a static "do nothing" host.

ntakasaki 12y ago
According to one researcher who reports malware to hosts, the bad guys keep adding hundreds of new subdomains every hour. http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-botnet-of-zombie-web-servers/ http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-b... >However since hackers add new domain names every hour, 100+ new hostnames need to be blocked. I’ve sent a few updates to both services, but they haven’t yet responded and I guess we’ll need to wait until Monday when they get back to work.
- dublinben 12y ago
  Is there a reason why they are relying on DDNS to resolve IP addresses, instead of simply using the resulting IP addresses themselves? It seems like relying on No-IP here was a clear weak point in the design of this malware.
  - justsomedood 12y ago
    I'm sure they're using compromised hosts for the servers, which would change pretty often
  - nucleardog 12y ago
    How do you distribute the new IP address to members of the botnet even in the face of an unclean disconnection of a current C&C server? You could maintain a list of backup C&C servers on every node and see what happens, but you risk a netsplit causing your botnet to fragment. Or, you just have a centralized place to list the authoritative address of the current master. But you don't want to host that yourself - that's a link back to you. Another commenter mentioned the botnet was creating hundreds of new subdomains every hour. Obviously they had found a way to automatically register new accounts, and they had tens or hundreds of thousands of IP addresses to register from... By hosting it on a well-known and well-used service, they created a situation where someone is basically forced to take the entire service offline or take other drastic measures in order to counter-act them.
    - dublinben 12y ago
      Good point. I just figured they might have preferred to run their own DDNS service, or use p2p, since as we've seen, a service as large as No-IP can be completely shut down in a situation like this.
      - nucleardog 12y ago
        It can be shutdown, but with a lot more difficulty than just getting some random server somewhere used only for the botnet pulled offline, which was probably the point, really. If I were a malware author I would never have assumed anyone could have gotten a court order to take an entire service offline.
  - superuser2 12y ago
    Maybe because the C&C servers were not (all) servers, but hosted on people's residential connections?

Alupis 12y ago

Microsoft seized the domains in order to discover command-and-control servers of a few botnets. Now... whether or not Microsoft seizing another legitimate company's property without any notice is legal/ethical is another question (one that probably should get more attention).

joe_the_user 12y ago
What is the justification of this post being pretty severely downvoted? It's not intemperate or off-topic as far as I can tell. Go ahead and downvote me too for metacommenting but it seems like slaps being handed out so freely just degrades community by making people reluctant to comment.
- deleted 12y ago
  [deleted]
- wfjackson 12y ago
  Your parent poster did a :s/M$/Microsoft on that comment before you read it. Edit: They then replied to your post with "I was wondering the same thing", before reading my post and deleting that comment.
  - deleted 12y ago
    [deleted]
    - jabits 12y ago
      "M$" is a shorthand for "Microsoft" - is not just shorthand, it's a sophomoric statement with commentary. If you don't know that, use words and phrases you understand.
icebraining 12y ago
Microsoft seized them by court order, I don't see how was it without notice or how could they have done it illegally.

tdicola 12y ago

They've certainly lost trust from the thousands of folks they broke who weren't involved with the botnet at all.

shmerl 12y ago
Never trust MS.

mikelat 12y ago

It's not like they had much of a reputation with the tech savvy crowd to begin with, with their frivolous patent litigation and business practices. The kind of crowd that uses a service like no-ip is the kind of crowd that likely isn't a big microsoft customer. The typical computer user will be ignorant to this and enterprise users don't care. The only way they'll really lose from this fiasco is if no-ip sues and wins in court.