Estonian ISP plays whack-a-botnet, has Srizbi on the run
The rogue ISP McColo may have officially gone offline nearly three weeks ago, but the battle to kill the massive Srizbi botnet the internet service provider once hosted has turned into a game of cat and mouse. On November 27, Estonian ISP Starline Web Services gave industry white hats an additional event to be thankful for this year when it cut Internet access to the Srizbi botnet's command-and-control (C&C) servers.
Up until November 12, the majority of the Srizbi botnet—estimated to contain at least 450,000 systems—was hosted by McColo. When McColo went offline, the total amount of online spam being sent on a daily basis dropped significantly. Unfortunately, the reprieve was short-lived; McColo (no doubt working in concert with the the Srizbi controllers) activated an emergency backup link several days later, brought the botnet back online, and began pointing the machines to a new set of C&C servers. McColo's efforts to temporarily restore its own Internet access did significant damage to attempts to contain the Srizbi botnet, but it also cast light on how old emergency connection agreements could be exploited by spammers as a means of bringing botnets back online in other locations. Read more...