Feds move to uninstall bot that hit banks, airports, cops

Drainage of Coreflood continues

The notorious Coreflood botnet has penetrated a veritable who's who of sensitive organizations, including banks, state and local governments, airports, defense contractors, and a police department, an FBI agent said in sworn testimony.

An executive of one compromised hospital healthcare network found that 2,000 of its 14,000 computers were infected with malware, which sniffs out banking passwords and other sensitive data and sends them to servers controlled by thieves. The agent said some 35 colleges and universities and hundreds of businesses have been hit by the decade-old Coreflood, which government investigators estimate infects more than 413,000 computers.

The written testimony from Special Agent Briana Neumiller was submitted in the FBI's unprecedented legal effort to dismantle Coreflood by taking over the servers and hundreds of domain names it uses to send commands to infected PCs under its control. Neumiller's declaration came in the government's request for a preliminary injunction extending the government's authority to issue “stop” commands to the zombie machines that disable the Coreflood malware until the next reboot.

US District Judge Vanessa Bryant of Connecticut granted the motion on Monday.

The stop commands are intended to be an interim step designed to prevent Coreflood from regrouping until a permanent fix can be put in place. It involves taking down the botnet's command-and-control system that doles out instructions and malware updates when infected machines report to it. In its place, the government has installed two substitute servers that respond with the stop commands.

It is the first time government authorities have ever issued commands to infected PCs in an attempt to take down a botnet. They are intended to prevent the Coreflood operators from regaining control of the infected machines by sending their own set of commands that instruct them to report to a new set of command-and-control servers.

So far, the maneuver appears to be working, Neumiller said. Within 72 hours of the Coreflood seizure, beacons sent from infected computers fell from almost 800,000 per day to some 150,000, and by Friday, that number sank below 100,000 for the first time since the operation began.

With the issuance of the preliminary injunction allowing the operation to continue, the government can now move to its second step, which is intended to permanently remove the Coreflood malware from the hundreds of thousands of computers it has infected. The disinfection involves tracking down the individual owners and getting their permission to issue an “uninstall” command from the substitute servers.

“Removing Coreflood in this manner could be used to delete Coreflood from infected computers and to 'undo' certain changes made by Coreflood to the Windows operating system when Coreflood was first installed,” Neumiller wrote. “The process does not affect any user files on an infected computer, nor does it require physical access to the infected computer or access to any data on the infected computer.”

FBI researchers have successfully used the procedure on test computers, but a waiver that infected machine owners are asked to sign releases the feds from any legal liability should things go wrong.

The government is now in the process of sifting through what is likely millions of IP addresses and correlating them to public and ISP records to identify and contact the US-based owners of the infected machines. It is also collecting the IP addresses of owners believed to be located outside US borders and referring them to authorities in foreign countries.

At no point do federal authorities have any control over infected computers or access to personal data residing on them, and owners who want to opt out of the disinfection routine may do so. ®