DIY satirical Sality takedown posted to Full Disclosure

Powered by SC Magazine
 

Don't try this at home.

An internet user has posted what they say are instructions and exploit code to takedown or hijack the Sality botnet.

The author, writing on the Full Disclosure mailing list under the alias 'Law Abiding Citizen', said it was “easy” to takedown the botnet by exploiting a vulnerable version of the malware using exploit code uploaded and since removed from a file sharing site.

The instructions claimed the botnet could be cleansed by uploading an encrypted version of AVG's Sailty removal tool to a compromised web site. It also provided a Python script claimed to reveal an updated list of compromised machines.

“You should under no circumstance laugh maniacally as you watch a sizeable botnet disintegrate before your eyes,” the post read.

The attack targeted a vulnerable version three of the botnet but this was already superseded with version four, which may not be vulnerable to the attack.

The Sality botnet was considered large in terms of the number of compromised machines but precise infection numbers varied. It was capable of pumping out spam, stealing data and cracking Voice over IP systems.

Attacking the botnet even with the objective to cleanse infected machines was dangerous because such action could have unintended consequences on victims. 

Running the removal tool could potentially destabilise machines operated by enterprises, governments or individuals.

Such action was also widely illegal, meaning efforts to destroy botnets often focused on commandeering command and control servers.

Last year security organisations and law enforcement nabbed command and control severs used in the DNSChanger and Rustock botnets, cutting lines of communication with infected machines.

Internet providers were then tasked with contacting users with machines infected with DNSChanger to help them remove the malware.

The poster acknowledged taking down Sality would be illegal.

“It has come to my attention that it is not only possible but easy to seize control of version three of the botnet, and, more importantly, take it down. Sadly, doing so would require breaking the law.”

“It is unfortunate that I am unable to do so now due to these legal issues, but, as I'm sure you all know, it is more important to respect the law than to fix anything.”

The uploaded files were not malicious, the author claimed.

Copyright © SC Magazine, Australia


DIY satirical Sality takedown posted to Full Disclosure
 
 
 
Top Stories
Change is the only constant at iiNet
iiNet's Matthew Toohey is trialling IBM's Watson - between preparing for an acquisition and making sure Netflix doesn't swamp the network.
 
Why straight-through processing is the holy grail for banks
Big benefits from stripping away human intervention and digitising processes.
 
CBA sued over frozen millions in IT bribery scandal
Eric Pulier's not-for profit lodges lawsuit in US.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Should Optus make a bid for iiNet?

   |   View results
Yes
  44%
 
No
  56%
TOTAL VOTES: 665

Vote