Microsoft Disrupts Botnet Spreading through Unsecured Supply Chains

The efficiency of the Internet could multiply if companies didn’t have to fight of destructive forces every second. In the past the threat to an organization could be seen and contingency controls could be put in place to provide relative safety. These days, however, the attack can come from any location around the world.

Botnet attacks are well coordinated and designed to bring the operations of an organization down. By infecting the supply chain, hackers are building an army of PCs available at their disposal for their next attack.

The revelation Microsoft (News - Alert) has disrupted another botnet attack points out to the importance of a collaborative effort amongst all tech companies in stopping these attacks before they cause serious damage. The Digital Crimes Unit at Microsoft was given permission to disrupt more than 500 different strains of malware. “Operation b70” was the legal action resulting from a study the company concluded in which cybercriminals were infiltrating unsecure supply chains with counterfeit software embedded with malware.


Image via Shutterstock

The ingenious plot gives criminals access to computers to initiate their attacks without the knowledge of the person who purchased the hardware. This disruption stopped the developing of the Nitol botnet, the second disruption by Microsoft in the past six months.

According to Microsoft, Nitol was being hosted on a domain responsible for malicious activity for the past four years. The host3322.org contained an additional 500 different strains of malware hosted in more than 70,000 sub-domains. The Chinese owner of 3322.org made a statement claiming he knew nothing of the allegations brought by Microsoft and that his company does not tolerate illegal activity on the domain.

The finding further revealed the malware was capable of turning on the infected computer and accessing audio, video and key stroke. What this means is any information you enter on your computer will have the potential of being accessed. The malware is also capable of infecting everyone who uses the infected device when USB flash drives are used to share pictures and other information between friends, family members and business associates.

Outsourcing the manufacturing of parts to different companies means the potential for sabotage is very real. The study found “the software embedded with the malware could have entered the chain at any point as a computer travels among companies that transport and resell the computer.”

This action was the result of Microsoft’s Project MARS (Microsoft Active Response for Security) Program. It combines technical and legal expertise to stop criminal enterprises around the world by seizing the infrastructure and domains. Recently, the program was responsible for taking down Waledac, Rustock, Kelihos, and the Zeus disruption.

The efforts of Microsoft have to be commended but more has to be done by legislators to implement policies that ensure the protection of its citizens from these types of attacks. The prevalence of smartphones, tablets and PCs means everyone is susceptible.

In March of 2012 the Whitehouse announced a Public-Private Partnership Initiative to Combat Botnets between the Whitehouse Cyber Security Office, the U.S Departments of Commerce, Homeland Security and Industry Botnet Group (IBG), a group of industry associations. In a statement, Whitehouse Cybersecurity Coordinator Howard Schmidt said, “The issue of botnets is larger than any one industry or country…” let’s hope those words are heeded.

Want to learn more about the latest in communications and technology? Then be sure to attend ITEXPO West 2012, taking place Oct. 2-5, in Austin, TX. Stay in touch with everything happening at ITEXPO (News - Alert). Follow us on Twitter.