Where Are the Feds on Cybersecurity?
A couple of recent events have shown how purposefully useless the U.S. government is with regard to cybersecurity. Every so often, the FBI parades some success stories through the media. Unfortunately, what's behind them are prosecutions for show rather than true demonstrations of tackling cybercrime.
Mon, February 16, 2009
Computerworld — A couple of recent events have shown how purposefully useless the U.S. government is with regard to cybersecurity. Every so often, the FBI parades some success stories through the media. Unfortunately, what's behind them are prosecutions for show rather than true demonstrations of tackling cybercrime.
For example, U.S. law enforcement had nothing to do with the takedown of McColo, the ISP that was home to major botnet controllers. It's telling that foreign criminal gangs felt comfortable enough to use a U.S.-based service to host their critical servers.
Despite the fact that the crimes enabled by McColo included child pornography, cyberextortion, distribution of malware, identity theft -- really, just about every cybercriminal act known to law enforcement -- the FBI had nothing to do with taking down the hosting service or making any arrests of those profiting from criminal behavior. It was up to independent malware researchers to identify McColo and work with upstream ISPs to cut it off from the Internet. That is despicable.
Before the takedown of McColo, I received more than 300 spams a day. After McColo was taken off the Internet , my spam volume was down to 50 per day. Now, a few days into the spread of the Downadup worm, my spam volume is up to 200 per day.
Judging from my analysis of the new spams I'm receiving, it is clear that this is the work of the same malware purveyors who previously used McColo. Depending on whose statistics you use, Downadup has infected anywhere from 6% to 30% of the PCs on the Internet.
And this time around, it is once again independent researchers who are trying to stem the growth of the new botnets by reverse-engineering the malware and determining the potential domains the infected systems will try to connect to. At their own expense, the researchers are registering hundreds of domains to try to disconnect infected systems from the botnets.
To take a step back and explain the situation as simply as possible, once malware infects a system, it seeks out a controller. The controllers are referred to by Internet domain names.
With Downadup, because the malware writers knew that the domain names would be taken down as they were discovered, they programmed their algorithms to search for thousands of domains.
By reverse-engineering the malware, the researchers determined as many potential domains as possible and attempted to register them away from the botnet controllers. This is very time-intensive and expensive for independent Samaritans.
