News

09:08 AM
Connect Directly
RSS
E-Mail
50%
50%

How Facebook Took Down Koobface Malware

Aggressive campaign by the social network to kill the pesky malware included taking down its command-and-control server.

Facebook revealed Tuesday how over the past year it has been fighting the infamous Koobface malware that spreads via social networks and builds out a botnet: It knocked one of the gang's command-and-control (C&C) servers offline, which has resulted in more than nine months of no Koobface infections on the massive social network.

Security researchers worldwide have been putting the screws to the brazen Koobface malware gang of late in hopes of derailing their operations. Names have been named, their photos posted online, but they continue to operate freely in Russia. Sophos Labs, which revealed Tuesday a detailed account of how it followed the trail to the alleged gang members, also released the names of the alleged perpetrators: Anton Korotchenko, Alexander Koltyshev, Roman Koturbach, Syvatoslav Polinchuk, and Stanislav Avdeiko.

Koobface, which is an anagram for Facebook, had dogged the social network since 2008. The gang made money via pay-per-click and traffic referral schemes: Once a user got infected, his or her machine was redirected and, at times, duped into fake antivirus scams. The Koobface gang's central C&C server was at the heart of the operation.

But Facebook said that it killed that server back in March of last year: "... Facebook Security was able to perform a technical takedown of this 'Command & Control' mothership. And since then we have had no new sightings of Koobface for over nine months and our teams are working hard to keep it that way" according to post by Facebook's security group.

That takedown apparently came with the help of researchers including indie researcher Jan Droemer, who worked with SophosLabs' Dirk Kollberg.

Facebook says it will share the information and intelligence it discovered about the game with others in the security industry.

Read the rest of this article on Dark Reading.

Please join us on Feb. 15 for the InformationWeek & Dark Reading virtual event Clouds, Outsourcing, And Security Services: Making Providers Part of Your IT Security Strategy. When you attend, you will be able to access live and on-demand webcast presentations as well as virtual booths packed with free resources, and you can also be eligible to win great prizes! (Free registration required.)

Comment  | 
Print  | 
More Insights
Cartoon
Slideshows
Audio Interviews
Archived Audio Interviews
Jeremy Schulman, founder of Schprockits, a network automation startup operating in stealth mode, joins us to explore whether networking professionals all need to learn programming in order to remain employed.
White Papers
Register for Network Computing Newsletters
Current Issue
2014 State of Unified Communications
2014 State of Unified Communications
If you thought consumerization killed UC, think again: 70% of our 488 respondents have or plan to put systems in place. Of those, 34% will roll UC out to 76% or more of their user base. And there’s some good news for UCaaS providers.
Video
Twitter Feed