How Facebook Took Down Koobface Malware

Facebook revealed Tuesday how over the past year it has been fighting the infamous Koobface malware that spreads via social networks and builds out a botnet: It knocked one of the gang's command-and-control (C&C) servers offline, which has resulted in more than nine months of no Koobface infections on the massive social network.

Security researchers worldwide have been putting the screws to the brazen Koobface malware gang of late in hopes of derailing their operations. Names have been named, their photos posted online, but they continue to operate freely in Russia. Sophos Labs, which revealed Tuesday a detailed account of how it followed the trail to the alleged gang members, also released the names of the alleged perpetrators: Anton Korotchenko, Alexander Koltyshev, Roman Koturbach, Syvatoslav Polinchuk, and Stanislav Avdeiko.

Koobface, which is an anagram for Facebook, had dogged the social network since 2008. The gang made money via pay-per-click and traffic referral schemes: Once a user got infected, his or her machine was redirected and, at times, duped into fake antivirus scams. The Koobface gang's central C&C server was at the heart of the operation.

But Facebook said that it killed that server back in March of last year: "... Facebook Security was able to perform a technical takedown of this 'Command & Control' mothership. And since then we have had no new sightings of Koobface for over nine months and our teams are working hard to keep it that way" according to post by Facebook's security group.

That takedown apparently came with the help of researchers including indie researcher Jan Droemer, who worked with SophosLabs' Dirk Kollberg.

Facebook says it will share the information and intelligence it discovered about the game with others in the security industry.

Read the rest of this article on Dark Reading.

Please join us on Feb. 15 for the InformationWeek & Dark Reading virtual event Clouds, Outsourcing, And Security Services: Making Providers Part of Your IT Security Strategy. When you attend, you will be able to access live and on-demand webcast presentations as well as virtual booths packed with free resources, and you can also be eligible to win great prizes! (Free registration required.)