Dutch police, FBI rein in large botnet

The botnet created by a teenager who was arrested by Dutch police in an outdoor sting is most notable for its total reliance on social engineering to spread.

The botnet created by a teenager who was arrested by Dutch police in a sting operation is most notable for its total reliance on social engineering to spread, computer security experts said Thursday.

The 19-year-old Dutch man was caught July 29 with his 16-year-old brother trying to sell a botnet to a 35-year-old Brazilian man, according to Dutch prosecutors. All were arrested by the Dutch High-Tech Crime Unit, with assistance from the U.S. Federal Bureau of Investigation.

As is customary in the Netherlands, Dutch police have not released the names of those arrested. Few other details, such as how authorities became cued into the case, have been released. U.S. authorities are seeking the extradition of the Brazilian man.

But experts from Russian security vendor Kaspersky Lab were called on by Dutch police to write up instructions for how to remove the botnet code from infected PCs, as well as aid in the continuing investigation, said Eddy Willems, one of Kaspersky's security evangelists.

A botnet is a group of PCs that is infected with malicious code and controlled by a hacker. This particular botnet, which at one time had as many as 150,000 machines worldwide, is called "Shadow," the name bestowed on it by its creator.

The code that enabled Shadow to work was distributed on Microsoft's Windows Live Messenger instant messaging network. Victims would typically get a message from someone who appeared to be one of their contacts. The message would contain a link to another Web site, where the victim was asked to download a file.

If the file was executed on a PC, Shadow would collect other instant messaging contacts and send out more messages trying to enlarge the botnet. It appeared that Shadow was particularly successful in the Netherlands, since some messages were sent out in Dutch.

The distribution method relied entirely on victims willingly downloading the code rather than trying to exploit a software vulnerability, which could result in an infection regardless of what the user does.

It means that Internet surfers are just as susceptible to fall victim to scammy tricks. "Social engineering seems just as effective as it was 10 years ago," said Roel Schouwenberg, senior antivirus researcher.

Shadow could also download other malicious code and may have been used to download advertising software and spyware programs, Schouwenberg said. The teenager who created Shadow appears to use bits of malware code already circulating on the Internet, as well writing his own code.

The result was a fairly run-of-the-mill botnet, but one that could be considered large, Willems said. When the bust occurred, the 19-year-old was attempting to sell the botnet for Euro 25,000 (AUD$42,500), a price Willems said is way too high in proportion to how botnets are currently priced.

People who control a group of computers, called botnet herders, have been known to rent time to other scammers, who use the computers to send spam or conduct other malicious activity. The use of remote computers helps disguise who is actually using those machines to carry out crime.

Dutch prosecutors could not immediately be reached for comment.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?