DIY satirical Sality takedown posted to Full Disclosure

Powered by SC Magazine
 

Don't try this at home.

An internet user has posted what they say are instructions and exploit code to takedown or hijack the Sality botnet.

The author, writing on the Full Disclosure mailing list under the alias 'Law Abiding Citizen', said it was “easy” to takedown the botnet by exploiting a vulnerable version of the malware using exploit code uploaded and since removed from a file sharing site.

The instructions claimed the botnet could be cleansed by uploading an encrypted version of AVG's Sailty removal tool to a compromised web site. It also provided a Python script claimed to reveal an updated list of compromised machines.

“You should under no circumstance laugh maniacally as you watch a sizeable botnet disintegrate before your eyes,” the post read.

The attack targeted a vulnerable version three of the botnet but this was already superseded with version four, which may not be vulnerable to the attack.

The Sality botnet was considered large in terms of the number of compromised machines but precise infection numbers varied. It was capable of pumping out spam, stealing data and cracking Voice over IP systems.

Attacking the botnet even with the objective to cleanse infected machines was dangerous because such action could have unintended consequences on victims. 

Running the removal tool could potentially destabilise machines operated by enterprises, governments or individuals.

Such action was also widely illegal, meaning efforts to destroy botnets often focused on commandeering command and control servers.

Last year security organisations and law enforcement nabbed command and control severs used in the DNSChanger and Rustock botnets, cutting lines of communication with infected machines.

Internet providers were then tasked with contacting users with machines infected with DNSChanger to help them remove the malware.

The poster acknowledged taking down Sality would be illegal.

“It has come to my attention that it is not only possible but easy to seize control of version three of the botnet, and, more importantly, take it down. Sadly, doing so would require breaking the law.”

“It is unfortunate that I am unable to do so now due to these legal issues, but, as I'm sure you all know, it is more important to respect the law than to fix anything.”

The uploaded files were not malicious, the author claimed.

Copyright © SC Magazine, Australia


DIY satirical Sality takedown posted to Full Disclosure
 
 
 
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
 
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  26%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  22%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  25%
TOTAL VOTES: 346

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  58%
 
No
  42%
TOTAL VOTES: 144

Vote