The FBI has requested and received a preliminary injunction from a U.S. district judge to continuing issuing “stop” commands to the zombie machines infected with the Coreflood botnet. It is an essential step that is part of the agency’s dramatic takedown of the botnet’s command-and-control system earlier this month, an agent said in written testimony.
In mid-April, the FBI seized five command-and-control servers and 29 domain names registered in the United States and then obtained a temporary restraining order to intercept signals — that is, issue stop commands — from any other C&C servers handling the botnet. It was the first time the agency took such steps against a botnet.
That was only meant to be a temporary measure to keep Coreflood from reconstituting itself elsewhere. Toward that end, the FBI proposed another radical move in its court plea: tracking down the individual owners of the zombie PCs that have been hijacked by Coreflood and uninstalling the malware, with their permission.
“Removing Coreflood in this manner could be used to delete Coreflood from infected computers and to ‘undo’ certain changes made by Coreflood to the Windows operating system when Coreflood was first installed,” special agent Briana Neumiller wrote. “The process does not affect any user files on an infected computer, nor does it require physical access to the infected computer or access to any data on the infected computer.”
via Technology News: Malware: FBI May Hunt Down and Destroy Botnets in Zombie PCs.
