Botnets aren’t just dangerous because they can steal massive amounts of personal data and launch denial-of-service attacks. They can also self-destruct, leaving the owners of affected machines in the dust.
The controllers of one such botnet recently hit the kill switch for one reason or another, taking down some 100,000 infected computers with it.
KOS – kill operating system
The bot was mostly in Poland and Spain and the bot software is “Zeus” which specializes in stealing passwords and other valuable data from systems. Zeus contains a “kos” or “kill operating system” command which nukes key parts of the registry.
The Washington Post recently profiled the case of Zeus/Zbot?a software kit that sprung up in March that harvests financial and personal data from PCs through the use of a Trojan. Zeus, unlike many other malware programs, managed to make each installation appear different to virus trackers so that it would be more difficult to remove. But Zeus had another interesting feature?one that isn’t terribly uncommon among botnet software, it turns out. A command was built into the software to kos?or “kill operating system”?and it was apparently executed some time last month.
According to the analyses by S21sec specialists, a drone deletes the HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE\Software and HKEY_LOCAL_MACHINE\System Windows registry paths as soon as it receives a kill command from the server. The drone then overwrites the virtual memory of Windows with zeros. This makes the operating system inoperable.
Take the case of a cyber criminal from Russia with a code name A-Z.
Apparently he is a highly skilled coder who creates viruses & botnets that he then rents out to other cyber criminals for a fee.
His most famous creation is a Botnet code called ZeuS
Take a peek at a recent CHANGELOG, and a future TO-DO list from one of the third-party developers. Zeus version a.b.c.d means that change in A stands for a complete change in the bot, B stands for major changes that make previous bot versions incompatible, C stands for modifications and performance boosting, and D is a prophylactic change in order to avoid antivirus solutions from detecting it.
If you have a Trojan and you want this computer to be infected with your Trojan, you want only your Trojan to be on this computer because you dont want to compete with the other fraudsters on the same resource, A-Z told eWEEK. So if you want an exclusive, it costs you much more because they cant sell your computer to other bad guys.
Click here to read the rest of this article
No related articles.
