Dodgy ISP briefly comes online, updates botnet

Maligned ISP McColo briefly came back online over the weekend before being cut off again, according to security vendors.

An Internet service provider associated with online crime and child pornography briefly came back online over the weekend before being cut off again, according to security vendors.

McColo, whose servers are in San Jose, California, was cut off from the Internet last week by its upstream providers after an investigation by computer security analysts and the Washington Post.

But McColo came back online on Saturday after connecting with Swedish ISP (Internet service provider) TeliaSonera, which has a router in San Jose, according to Ross Thomas, writing on the blog for security vendor Sophos.

After complaints, TeliaSonera quickly moved to cut off McColo again, Thomas wrote. But the brief renewal in connectivity did allow cybercriminals running botnets out of McColo's networks to take steps to preserve their operations.

McColo has been identified as hosting the command-and-control servers for no less than five large botnets that are responsible for the majority of the world's spam. When McColo dropped offline, analysts found that spam levels dropped up to 75 percent.

Spam takes a heavy toll on IT infrastructure, consuming bandwidth and potentially exposing users to malicious software.

When McColo came back online, it appeared the hackers who controlled the command-and-control servers for a botnet called Rustock moved the controls for that botnet to a data center in Russia, according to the blog for security vendor FireEye.

"We believe that the Rustock controllers don't expect McColo to be very stable in the near future, so they are hedging their bets and moving the C&Cs to a different provider," according to FireEye.

Those PCs infected with malicious software that enables the computer to be part of the Rustock botnet were also at least partially updated. The update would allow the computers to report to the new Russian command-and-control server to receive orders.

Since McColo was only online for a short period, "there's no way that the whole botnet was updated, but no doubt they got a good-sized piece," FireEye said.

Security analysts have predicted that spam levels will rise again as hackers who used McColo move their operations to other ISPs that are willing to protect spammers and other criminal enterprises, such as those who sells bogus security software or pharmaceuticals.

"Rustock is estimated to be capable of sending 30 billion spams per day," Thomas wrote. "How big an increase we'll see depends largely on the number of zombie PCs the botnet's controller was able to reach during McColo's temporary resurrection."

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?