<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Krebs on Security &#187; john young</title>
	<atom:link href="http://krebsonsecurity.com/tag/john-young/feed/" rel="self" type="application/rss+xml" />
	<link>http://krebsonsecurity.com</link>
	<description>In-depth security news and investigation</description>
	<lastBuildDate>Thu, 09 Feb 2012 22:39:50 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>Microsoft Ambushes Waledac Botnet, Shutters Whistleblower Site</title>
		<link>http://krebsonsecurity.com/2010/02/microsoft-ambushes-waledac-botnet-shutters-whistleblower-site/</link>
		<comments>http://krebsonsecurity.com/2010/02/microsoft-ambushes-waledac-botnet-shutters-whistleblower-site/#comments</comments>
		<pubDate>Thu, 25 Feb 2010 16:33:52 +0000</pubDate>
		<dc:creator>BrianKrebs</dc:creator>
				<category><![CDATA[A Little Sunshine]]></category>
		<category><![CDATA[cryptome]]></category>
		<category><![CDATA[john young]]></category>
		<category><![CDATA[mark rasch]]></category>
		<category><![CDATA[microsoft]]></category>
		<category><![CDATA[waledac]]></category>
		<category><![CDATA[wikileaks]]></category>
		<category><![CDATA[wired]]></category>
		<category><![CDATA[xbox]]></category>

		<guid isPermaLink="false">http://www.krebsonsecurity.com/?p=1321</guid>
		<description><![CDATA[Microsoft's lawyers this week engineered a pair of important takedowns, one laudable and the other highly-charged. The software giant orchestrated a legal sneak attack against the Web servers controlling the Waledac botnet, a major distributor of junk e-mail. In an unrelated and more controversial move, Redmond convinced an ISP to shutter a popular whistleblower Web site for hosting a Microsoft surveillance compliance document.]]></description>
			<content:encoded><![CDATA[
<div class="topsy_widget_data topsy_theme_silver" style="float: left;margin-right: 0.75em; background: url(data:,%7B%20%22url%22%3A%20%22http%253A%252F%252Fkrebsonsecurity.com%252F2010%252F02%252Fmicrosoft-ambushes-waledac-botnet-shutters-whistleblower-site%252F%22%2C%20%22style%22%3A%20%22big%22%2C%20%22title%22%3A%20%22Microsoft%20Ambushes%20Waledac%20Botnet%2C%20Shutters%20Whistleblower%20Site%22%20%7D);"></div>
<p><a rel="attachment wp-att-1323" href="http://www.krebsonsecurity.com/wp-content/uploads/2010/02/waled.jpg"><img class="alignright size-medium wp-image-1323" title="waled" src="http://www.krebsonsecurity.com/wp-content/uploads/2010/02/waled-300x173.jpg" alt="" width="300" height="173" /></a>Microsoft&#8217;s lawyers this week engineered a pair of important takedowns, one laudable and the other highly-charged. The software giant orchestrated a legal sneak attack against the Web servers controlling the<strong> Waledac botnet</strong>, a major distributor of junk e-mail. In an unrelated and more controversial move, Redmond convinced an ISP to shutter a popular whistleblower Web site for hosting a Microsoft surveillance compliance document.</p>
<p>On Feb. 22, a federal judge in Virginia granted a request quietly filed by Microsoft to disconnect 277 Internet domains believed to be responsible for directing the daily activities of the Waledac botnet, estimated to be one of the ten-largest spam botnets in existence today and responsible for sending 1.5 billion junk e-mails per day. Microsoft said it found that between December 3-21, 2009, approximately 651 million spam emails attributable to Waledac were directed to <strong>Hotmail</strong> accounts alone, including offers and scams related to online pharmacies, imitation goods, jobs, penny stocks and more.</p>
<p><span id="more-1321"></span></p>
<p>The takedown, which Microsoft dubbed &#8220;Operation b49,&#8221; has &#8220;quickly and effectively cut off traffic to Waledac at the &#8216;.com&#8217; or domain registry level, severing the connection between the command and control centers of the botnet and most of its thousands of zombie computers around the world,&#8221; the company said. From the <a href="http://blogs.technet.com/microsoft_blog/archive/2010/02/25/cracking-down-on-botnets.aspx" target="_blank">official Microsoft blog</a>:</p>
<blockquote><p>&#8220;Three days into the effort, Operation b49 has effectively shut down connections to the vast majority of Waledac-infected computers, and our goal is to make that disruption permanent.  But the operation hasn’t cleaned the infected computers and is not a silver bullet for undoing all the damage we believe Waledac has caused.  Although the zombies are now largely out of the bot-herders’ control, they are still infected with the original malware.&#8221;</p></blockquote>
<p>What praise and adulation the IT industry might heap on Microsoft for this effort, however, may be drowned out by the growing chorus of criticism over Microsoft&#8217;s legal victory against a popular whistleblower Web site. Alleging copyright infringement, Microsoft went after <strong>Cryptome.org</strong> curator <strong>John Young</strong> on Tuesday after he <a href="http://www.wired.com/threatlevel/2010/02/microsoft-cryptome/" target="_blank">posted a Microsoft compliance document</a> that the company gives to law enforcement agents seeking information on Microsoft users.</p>
<p>On Wednesday, Cryptome was shut down by its hosting provider, Network Solutions. As wired.com&#8217;s <strong>Ryan Singel</strong> writes, the takedown shuttered &#8220;a site that thumbed its nose at the government since 1996 &#8212; posting thousands of documents that the feds would prefer never saw the light of day.&#8221;</p>
<p>Predictably, the document has since shown up on numerous other Web sites, including <a href="http://wikileaks.org/" target="_blank">Wikileaks.org</a>, and <a href="http://www.wired.com/images_blogs/threatlevel/2010/02/microsoft-online-services-global-criminal-compliance-handbook.pdf" target="_blank">Wired.com</a>. It includes information about the various types of customer information available to law enforcement across Microsoft&#8217;s properties, such as Xbox Live. The document, titled &#8220;Global Criminal Compliance Handbook,&#8221; is worth a read for anyone curious about the types of identifying user information that Microsoft may make available to law enforcement upon request</p>
<p>&#8220;On the botnet stuff, Microsoft deserves credit for its strategy and the court deserves kudos for understanding the importance of the case,&#8221; former Justice Department prosecutor <strong>Mark Rasch</strong> said. &#8220;The other takedown, though, is unwinable for Microsoft, because it&#8217;s a little like wrestling with a pig: You&#8217;re just going to make the pig mad.&#8221;</p>
<p><strong>Update, 1:19 p.m. ET:</strong> ReadWriteWeb is reporting that Microsoft has <a href="http://www.readwriteweb.com/archives/microsoft_to_withdraw_copyright_complaint_cryptome.php" target="_blank">decided to withdraw the copyright complaint</a> against Cryptome, and that the site is expected to be back online today.</p>

]]></content:encoded>
			<wfw:commentRss>http://krebsonsecurity.com/2010/02/microsoft-ambushes-waledac-botnet-shutters-whistleblower-site/feed/</wfw:commentRss>
		<slash:comments>23</slash:comments>
		</item>
	</channel>
</rss>

<!-- Performance optimized by W3 Total Cache. Learn more: http://www.w3-edge.com/wordpress-plugins/

Page Caching using memcached (User agent is rejected)
Database Caching 1/13 queries in 0.005 seconds using memcached
Object Caching 318/335 objects using memcached

Served from: krebsonsecurity.com @ 2012-02-11 12:45:16 -->
