Ex-anti-virus tech flogged MacDefender malware

Powered by SC Magazine
 

Botnet bloodbath continues.

A former information security engineer had operated the Kelihos botnet, the primary distribution system for the MacDefender malware, Microsoft says.

Microsoft alleged Andrey Sabelnikov, a Russian citizen and former security vendor staffer, was responsible operations of the botnet.

The Redmond giant took down Kelihos in September.

Microsoft Digital Crimes Unit senior attorney Richard Boscovich said it presented to court evidence that Sabelnikov wrote the code for and either created, or participated in creating, the Kelihos malware.

“Further, the complaint alleges that he used the malware to control, operate, maintain and grow the Kelihos botnet. These allegations are based on evidence Microsoft investigators uncovered while analysing the Kelihos malware," Boscovich said.

Microsoft alleged Sabelnikov registered more than 3,700 cz.cc subdomains from Dominique Alexander Piatti and dotFREE Group SRO, and used them to operate Kelihos.

Charges against against Alexander PiattiPiatti and dotFREE Group were settled and dismissed last year. 

It was also revealed that Sabelnikov worked as a software engineer and project manager at Russian anti-virus firm Agnitum, a provider of firewalls, anti-virus and security software.

Microsoft doesn't specify where Sabelnikov worked, but security blogger Brian Krebs pointed out that Sabelnikov's LinkedIn page said he worked at the company from 2005 to 2007.

Krebs said that Sabelnikov's alleged role was discovered after a security researcher obtained a copy of the source code to Kelihos, who noticed it contained debug code that downloaded a Kelihos malware installer from the domain sabelnikov.net, a photography site registered to Sabelnikov's name.

That site currently links to Sabelnikov's profile page at Russian social networking site Vkontakte.ru, which includes the same pictures found in the LinkedIn profile.

Despite the takedown, Boscovich said that thousands of computers remain infected and that the case "is not over".

This article originally appeared at scmagazineuk.com

Copyright © SC Magazine, UK edition


Ex-anti-virus tech flogged MacDefender malware
 
 
 
Top Stories
First look: Microsoft Outlook for iOS
[Update] Office productivity suite for iOS completed with Outlook.
 
NewSat defaults on $26m in overdue Lockheed payments
Jabiru-1 satellite build hits further hurdles.
 
IBM denies plans to cut 112k jobs
But admits to further restructuring.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Franchisees, here's something you should know about
Jan 23, 2015
You need to know the Code if you are a franchisee or franchisor as the penalties are significant.
Xero users rejoice! Quoting has finally arrived
Jan 23, 2015
It has taken years, but Xero has at last added integrated quoting to its online accounting software.
You can now get a no-contract wi-fi tablet from Telstra
Jan 17, 2015
Telstra has began selling wi-fi tablets out of contract without paying extra for cellular ...
Get your business ready for 2015: mobile payments
Jan 2, 2015
These handy apps from MYOB, Xero and others can reduce your administrative load and improve ...
Xero prepares for key feature coming in 2015
Dec 19, 2014
Xero users will be able to track how their business is comparing to other Xero users.
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  36%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  9%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 3067

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 975

Vote