Operation b49 OPERATED_BY Microsoft

“Microsoft’s Digital Crimes Unit Senior Attorney Richard Boscovich explains it pretty well. RICHARD: [MUSIC] You could open up your e-mail account and you’ll have tons of advertisements and things of that sort that you just don’t want. But spam is much more than that. It’s kind of like if you had junk mail come to your house, and when you open the envelope, a white powder exploded on you and somehow you become infected with something. Literally, that’s what happens in the cyber world. JACK: Then you’ve got a lot of porn e-mails, the ones telling you that somebody is nearby and wants to hook up, and what websites to visit to see an exclusive show. Next to porn, it’s pills, and Viagra was the leading one. The little blue pill was sold in e-mails telling you how your sex life will be enhanced beyond your wildest imagination. See, back in 2007, e-mail spam filters weren’t that sophisticated yet. They would look for keywords or phrases and block them. Spammers figured out how to get around filters and were doing so pretty easily. So, people would see e-mails show up with the subject ‘want to be rock hard?’ with links to where they can buy Viagra without a prescription and for much cheaper. Now, e-mail spam laws did come in, eventually making it harder for spammers to send these kind of unsolicited e-mails, and the e-mail clients got way better at catching them and sticking them into dedicated spam folders. But the shadier businesses still did it because, well, spam was working like, really well. The more spam that went out meant more people were visiting the porn and pharmacy websites, and profits for both the spammers and the website owners. Spammers are like the middle men when it comes to shady online pharmacies. They might have a background in computers, IT, or hacking, but then got involved with sending spam because they can make more money from that. Damon McCoy is from George Mason University in Virginia. He was a lead author of a big study in the partnerships between spammers and the online pharmacies. This is him giving a talk ‘PharmaLeaks’ in the 21st USENIX Security Symposium in 2012 in Bellevue, Washington. DAMON: So, there’s three main players in this economy; there’s the user, which is the potential customer, there’s the affiliate marketer, which is typically a spammer, and there’s the affiliate program. Let me go into a concrete example of a business interaction between these three parties. So, initially what happens is that the affiliate marketer perhaps gets the user to see some kind of spam advertisement that includes some kind of link, that includes some kind of enticement of cheap drugs, no prescriptions required, to get the user to click on this. If the user is actually interested in perhaps buying these pharmaceuticals, clicks on it, they’ll be delivered that template that I showed you in the original slide. The user can interact with this template just as with a normal e-commerce site. There’s a wide selection of drugs there. They can select their drugs if they indeed want to purchase some drugs from the site. Then at this point in time, the relationship switches from the affiliate whose job it is to track customers, to the affiliate program, whose job it is to actually monetize the customer and turn them into money. So at this point in time, the spammer fades out, the affiliate program steps in, and if the user decides to purchase this – typically purchases happen with credits cards – the user give their credit card details to the affiliate program – actually operates much like a business, and their job is to process these credit cards. Then they’ll actually deliver some product that you ordered, so this isn’t a complete scam. These pharmacy affiliate programs that I’ll show you operate much like a business, and they’re very interested in keeping their customers happy and satisfied, because these customers are paying with credit cards. If they’re not satisfied customers, they’re gonna charge back. These affiliate programs will be shortly out of business. I’ll show you from the economics, these affiliate programs are in it for the long haul and they want to scale their business to large, millions of dollars. So, it’s not in their interest to have dissatisfied customers. JACK: For a good spammer, this is a great deal. The more spam they send, the more money they can make. They knew if they could scale up, it would mean they could really scale up; their commissions could just go through the roof. This is what one guy figured out while he was earning himself some money with Glavmed and SpamIt. He called himself ‘Google’. Yeah I know, it’s confusing ‘cause it’s the name of the search engine, but that was the name he went by. So, this guy Google started spamming and he saw that it was pretty effective, and he tried thinking of ways that he could make more people visit the online pharmacy. Sending mass amounts of e-mail is not so easy. [MUSIC] Every e-mail that’s sent has an IP address of where it’s from, and if you send enough spam e-mail from a single IP address, that IP address gets added to an abuse or block list and e-mail providers will stop accepting e-mails from it. So, spammers would need to change their IP frequently, which can be a hassle. So, the hacker named Google thought if he could control of hundreds of different computers and send e-mails from them, then it would be harder for e-mail providers to block that many IPs. Taking control of a bunch of different computers like this and putting them all to work together, that’s called a botnet. When you combine spam with a botnet, you get an incredible working machine. So, you can think of a botnet like a big network of computers that someone has full control over all of them. So, from a single workstation, they can tell all the computers to carry out a task, and these computers would be people’s home computers or laptops, or even work computers in the office, and they can be located all over the world. But these people didn’t sign up for their computer to be used like this. So, because nobody would opt into this, it meant people running the botnets would have to stay hidden from the user and not let their presence be known. In 2007, Vint Cerf, he’s the guy who co-developed the TCP/IP protocols, he said of the 600 million computers connected to the internet, between 100 and [MUSIC] 150 million of them were already part of a botnet. Here’s Kaspersky talking about how they work. CLIP: Malicious software, or malware, can harm your computer in a variety of ways, and sometimes the effects are not known until it’s too late. What’s worse, your computer can become one of many infected with malware, creating a botnet, short for robot and network. Cyber criminals use special malware, usually a Trojan Horse, to breach the security of several users’ computers. These take control of each computer and organize all of the infected machines into a network of bots, which are unwitting tools that the cyber criminal can remotely manage. The infected system may act completely normal with no warning signs. A bot can be a PC, Mac, or even a smart phone. Oftentimes, the cyber criminal will seek to infect and control thousands, tens of thousands, or even millions of computers so that they can act as the master of a large zombie network or bot network. JACK: [MUSIC] Once infected, computers are hooked into a botnet, and they sit there quietly waiting for instructions. It’s like hundreds of thousands of obedient little puppies just sitting in silence, ears pricked up, and waiting to be told what to do next. They’re obedient and will follow the instructions they’re given. Computers in a botnet are the most loyal machines you’ll ever find. But all botnets are created by someone, and that someone is called a botmaster or botherder, and Google wanted to become a botmaster. A botmaster sits behind their computer, controlling it all. It’s all done remotely and it’s all done anonymously. These guys don’t reveal their identities. In fact, one of the biggest problems in trying to fight a botnet is not knowing who the botmaster is, or where in the world they’re even located. Botnets are controlled through a command and control server, which I like to call C&C. Some people call them C2s. This has to be set up and maintained by the botmaster. Even hackers need to host their stuff, and C&C is like the nucleus of a cell. All the key information, instructions, and communication with the zombie bots in the network go through here. Once the bots have carried out their specified task, they send feedback back to the C&C. They like to report back on how well they did and any problems they hit. They’re very well-trained bots. Botnets have been used for all sorts of things in the past. I mean, think about it, you’ve got all these computers at your command. The combined computing power is insane. You set that thing loose and you can cause some serious damage. DDoS attacks are a favourite for botmasters and their botnets. But bots can also steal personal information and banking information. But the one thing botnets are really good at is sending out mass volumes of spam e-mails. [MUSIC] So, Google had sat and thought about ways he could gain access to hundreds of computers. He needed to infect them somehow with malware, and would bring them under his control. He decided to use a Trojan to be the installer for his own spam botnet, but this really wasn’t easy. Getting all this just right was something Google puzzled over, and so, he ended up accepting some help. Igor Vishnevsky was another spammer that Google met years before in Moscow, and he came on board to help protect it all. By the time they were done, hacker Google and Igor Vishnevsky had built a botnet and called it Cutwail. Cutwail was designed as a centralized botnet. That meant the C&C server would communicate directly with each infected computer. They designed it well, but now they needed to populate it by infecting hundreds of computers to get them to join this botnet. Google used a Trojan called Pushdo to infiltrate Windows computers and get the Cutwail spam engine running on them. I don’t know who built Pushdo, or even if Google had something to do with it himself. But Pushdo and Cutwail went hand-in-hand in their interoperability. They were a pair that was rarely seen without the other, but it did happen occasionally. Pushdo would infect machines through phishing e-mails; like, the e-mail might say, ‘Someone just sent you an eCard. Click here to see it!’, and other methods were drive-by downloads. But that was just a dropper, a tiny program whose job was to install Pushdo. The dropper scans computers, hunting for gaps in the software. Maybe the operating system hasn’t been updated in a while, or there’s an app that has a vulnerability. Once it finds this, it then installs Pushdo starts the infection. First, it makes a copy of itself and sits quietly in the system directory. It also writes new code for the registry. This enables new malware and updates to be installed every time the computer starts up. Rootkits are installed to hide all this from the user and from any antivirus programs that were installed. When those tasks are done, Pushdo gets on with its real purpose, [MUSIC] downloading more malware, and Cutwail was at the top of the list. Once Cutwail downloads and runs for the first time, the computer is now a zombie machine. It’s a slave and part of the Cutwail botnet. Straight away, Cutwail contacts hardcoded IP addresses to talk to the C&C server controlled by the hacker Google. This is the new bot asking for instructions on what it should do now, like an obedient puppy that it is. The C&C server sends back a full spam creation pack for the bot to use. So, the zombie machine gets a list of active e-mail addresses to send spam to, and there’s a heap of e-mail templates with content already written and ready to go. This was already written and tested that it could pass through spam filters. The bots put all this together and starts sending the e-mails out in different spam campaigns. It’s important to mention a little bit about how e-mails work here. It’s incredibly easy to spoof where an e-mail is from. That little From: field in the e-mail? Yeah, you can write whatever you want in there. In the early days of the internet, there were no checks to see if an e-mail came from where it says it came from. But now, a lot of companies have added checks to verify that From: field is where the e-mail actually came from, it matches. But when Cutwail was going around, that feature wasn’t implemented very well, so you could put whatever you wanted from the From: field. So, this was all going very well for hacker Google. He was getting Cutwail into computers and collecting his zombie bots. The numbers were adding up fast, and he didn’t want to just stop there. He started to offer Cutwail out to rent. He was advertising his botnet on SpamIt underground’s web forums called spamdot.biz. Now, this is a place where hackers and spammers would go to share information, hire software, or sell malware, all illegal and dodgy. There are loads of reasons why a ready-made botnet would appeal to some cyber criminals, but mainly it was because they wanted their own malware installed on as many machines as possible and to send out crazy amounts of spam. [MUSIC] There were some standard prices for botnet hires. Like, to use a botnet that has 10,000 installations, that would go for like, $300 or $800. Machines in the US were more valuable targets; they had better internet connection, so they were up to $125 for 1,000 machines infected. The computers in Asia and Europe, they were cheaper, at about $13-$35 per 1,000 infections. Some were even paying as high as $10,000 a month to use a botnet which could send 100 million e-mails every day. These services often came with free trials to prove how effective they are. There was another Trojan or botnet called the Gameover ZeuS Trojan, and that stole personal information and banking information. It was installed on millions of computers using Pushdo and the Cutwail botnet. This ZeuS Trojan is so fascinating to me, that’s actually going to be the subject of the entire next episode, so make sure to tune into that. [MUSIC] So, Cutwail was a roaring success and was growing fast. This was all going in 2007. In case you’re curious where Google got all the e-mail addresses from, underground hacker marketplaces. You can buy a million e-mails addresses for like, twenty-five or fifty bucks, and Cutwail was amassing hundreds of millions of addresses this way. The Cutwail botnet eventually became a self-service tool. Once you purchased the usage of the botnet, you were given a URL which let you login and send your e-mail from. There, you were given multiple support contacts in case you needed help. Even the botnet creators knew that a satisfied customer would mean a repeat customer, so they wanted to do what they could to make the user experience enjoyable. Cutwail soon passed 100,000 infected computers and was growing in size. Remember, this botnet was sending spam e-mails from each of the infected computers. The more computers they had in their botnet, the harder it would be to block this botnet from sending spam, because it wasn’t sending spam from one place; it was sending spam from 100,000 different places. The Cutwail botnet just kept growing, and soon, it had over one million infected computers at its control. At its highest point, the botnet was sending out 51 million spam e-mails every minute. 51 million e-mails a minute. Hacker Google could send 74 billion spam e-mails a day through Cutwail. Google used his own botnet to send pharmacy spam using Glavmed and SpamIt affiliates. From that alone, he was earning $1,000 a day from affiliate commissions. [MUSIC] Just months after Cutwail launched on September 2, 2007, there was a big car accident in Moscow that shook up the world of spam botnets. Nikolai McColo was twenty-three years old and he was the owner of McColo Corp, which was a web hosting provider, and its headquarters were in San Jose, California. Now, Google knew McColo, and hosted his C&C servers at McColo Corp, because when you’re running a massive, shady, illegal operation like this, you want to host your servers at a place you know and trust. Nikolai and McColo Corp were known for turning a blind eye to what their clients were doing with their servers. So, the McColo hosting provider was a safe haven for spammers, and criminals were happy to use the service. There was a lot of criminal activity on McColo’s servers; from hosting big spam botnets to clients involved in spamming for fake goods, fake drugs, and a lot of shady pornography. McColo Corp had a good reputation for hosting bad things. So, on September 2, 2007, Nikolai McColo was riding in a BMW through Moscow. The driver was a guy named Jaks, a known Russian spammer. When they got to an intersection in the middle of Moscow city, a Porsche drove up beside them. Jaks and Nikolai looked over at the Porsche. Both cars came to a red light and stopped side by side. One of them revved the engine; the other revved back. A race was about to begin. When the lights turned green, both cars roared off at high speed, but it all went wrong. Jaks lost control of his car. The BMW went into a spin and clipped the corner of the Porsche. Both cars went screaming off the road, and the BMW went straight into a lamppost. It totally destroyed the car, and Nikolai was killed instantly at the age of twenty-three. Jaks and the guy driving the Porsche walked away with minor injuries. This was big news across the spammer community. At Nikolai’s funeral, Igor and Dmitry-Stupin from Glavmed were there, and Google was, too. They knew the importance of Nikolai’s McColo Corp for the spamming world and its hosting services, and they were fairly close to him. So, they were wondering how Nikolai’s death was going to impact McColo and the hosting. The McColo group assured them that hosting would still be fine and all was good. So, Google went with it and left his Cutwail servers with them. Now, Cutwail wasn’t the only successful spam botnet on the go at the time. No, there were others; Google wasn’t the only one who spotted this opportunity. [MUSIC] Other guys with existing botnets saw this and wanted to monetize and earn some serious money, too. One spammer had multiple affiliate accounts with SpamIt, and they called themselves Cosma. Now, Cosma had signed up as an affiliate spammer soon after SpamIt set up in 2006. He generally used the handle ‘Cosma2k’ on his affiliate accounts, but there were others, too. He had an idea to propel himself to be one of the most successful spammers ever. Cosma built a botnet called Rustock, and he had some of his command and control servers hosted with McColo Corp, too. He’d been toying with the idea of doing some kind of stock manipulation scam, but once he got involved with SpamIt, he saw he could really make some money. In 2007, Cosma switched Rustock to be a pharmacy-spamming botnet. Rustock was a little bit different than Cutwail; Windows machines were still the targets, and computers were infected in a similar way through malware download, but Rustock malware didn’t launch straightaway. No, Cosma programmed Rustock to just sit quietly, do absolutely nothing for five days after infecting a computer, which is kinda crafty. This helped it hide from antivirus scans. Rustock used some custom encryption techniques so when it downloaded, it just looked like a .rar file, a compressed archive file. It ran complicated rootkits to embed itself into the infected machine. Debugging programs were automatically disabled, and Rustock would hide its tracks so that it couldn’t be discovered. Once Rustock infected a machine, that computer would contact Cosma’s C&C servers, just like Cutwail, but Cosma had things set up a little differently here, too. He had more than one command server, and communication from these servers to his bots were done in more like a relay at different levels. So, Cosma would send communication to a secondary command and control server, and that one would then talk to another set of C&C servers lower down, and they would be the one who passed on the information to the bots making up the botnet. One reason for having so many C&C servers is it makes it harder to stop a botnet. If a huge botnet has one C&C server and you take down that C&C server, you might lose complete control of the botnet. So, Cosma programmed it this way in order to keep it up longer. [MUSIC] The same kind of feedback went on for the bots; when they needed to tell Cosma something, they would go down the chain and relay messages all the way back to Cosma somehow. So, while Cutwail was centralized, which is one computer talking to many bots, Rustock was decentralized, where thousands of systems would issue commands to infected machines. Cosma had something like 2,500 domains in place for Rustock. The botnet used DNS for the bots to connect to. But Cosma had also coded in some specific IP addresses as backup systems. It was contingency planning. If some of his C&C servers got taken down, the botnet would just reach out to the hardcoded IP addresses and get an update on which new IP addresses to communicate with, and it would just carry on after that. Rustock also used TLS encryption when sending spam to conceal what it was doing. Cosma’s C&C servers were dotted all over the US, and he was paying a fair whack for them too, about $10,000 each month. These were servers with dodgy ISPs, known for offering hosting to shady services. Cosma did have some of his servers with McColo, yeah, but he rented servers from straight-up legitimate ISPs, too. These ISPs had no idea what Cosma was using them for. This was a spam botnet hiding in plain sight. Rustock grew into an enormous powerful botnet. Cosma had collected between 850,000 to 2.4 million bots on his network. It became so big that some estimate that Rustock botnet was responsible for 41% of the total spam in the world. Each individual bot was sending over 192 spam e-mails per minute. That put the collective Rustock output at 32 million e-mails per minute. That’s 46 billion e-mails a day. That’s just insane. In November 2008, Cosma got twitchy about hosting at McColo Corp, so he started moving his Rustock servers to different providers based in Russia instead. Cosma, it seems, wasn’t taking any chances with his botnet. [MUSIC] As Cosma was seeing huge success with Rustock as a spam botnet, Pavel was reappearing on the scene. He was the guy who created ChronoPay with Igor, and then Igor went off to make Glavmed. Pavel was still running ChronoPay, but he wanted to get in on some of this other action, too. That year, he launched his own rogue online pharmacy, RX-Promotion, which would be a direct competitor to Glavmed, Igor’s company. But he didn’t launch it on his own; he had a new partner, Yuri Kabayenkov, who did all the tech stuff for him. So now, Igor and Pavel were going head-to-head in a battle to secure more of the online pharmacy market than their rival. Pavel, though, decided to appeal to a different part of the online medicine market demand. Igor and Dmitry Stupin were pushing erectile dysfunction drugs as their top seller. They were selling their knock-off versions for a mark-up of twenty-five times what they bought them for. Pavel instead went on to highly addictive medicines that people often abused, like opiates. So, he was selling Oxycodone and Valium, and others like Adderall and Ritalin. These would be his top medicines, and all for really cheap prices. Pavel opened RX-Partners not long after, using the same model that Glavmed and SpamIt used. RX-Partners was the affiliate program for RX-Promotion. Spammers that were signed up with SpamIt happily opened up accounts on RX-Partners, too. They didn’t care who they were promoting, as long as it made money for them. Some of the figures that the top spammer affiliates were earning in commissions was pretty mind-blowing. Here’s Damon McCoy again talking about the data he analyzed when drilling this down. DAMON: Let’s look at some of the schemes that these high – that these top-earning affiliates use to be successful spammers. So, an obvious one to think of is, right, run a large bot network and spew out a whole bunch of spam. So, in fact, the operator Rustock, we identified him within the SpamIt data set and in fact, he made close to $2 million by operating Rustock and sending out spam shilling for the Glavmed-SpamIt program. So, that indeed is a very good way of becoming a successful marketer, is run a large bot network. So, as you could see, these top earners, they earn quite a bit of money, and they in fact earn the largest share of each individual sale. However, the affiliate programs, if the affiliate programs are very successful, they in fact can earn more by taking a smaller portion of each sale over all the sales from their affiliate program than the individual affiliates. JACK: It must be exciting for the spamming botmaster. Think about it; you’ve worked really hard, made this big botnet, infected all these hosts, launched your campaign, and sent out a ton of e-mails, and now you’re looking at the dashboards on Glavmed and SpamIt and you’re just watching your numbers grow, seeing the rewards pay out in real-time, and watching the earnings get higher and higher. That must have been a pretty big kick for these botmasters. [MUSIC] 2008 turned out to be a busy year for spam botnets, and this next botnet was probably the most complex of them all. The Waledac botnet was started by a guy named Severa. He was known on the spamdot.biz forum, but just like the other botmasters, he kept himself totally in the shadows. Waledac used similar methods as the others to get computers infected and part of its network. Social engineering trickery, innocent looking e-mails that had an attachment of malware or a link to malware, and once you clicked on it, Waledac would unleash itself into the machine, turning it into a spamming bot. Once a machine had been infected, Waledac binaries were let loose. It was coded in C++. The executables were just under 1MB in size. As all the other botnets did, the first task of the malware was to amend the machines registry so that each time the computer starts up, Waledac would be run to check for updates and keep the machine as an active spam bot. Waledac was designed to be a spamming machine. It was crafted to collect bots, grow in size, and distribute mass spam e-mail campaigns. In the core binaries of the malware was an SMTP engine which could communicate with an SMTP server and send e-mails. The malware can deal with two types of HTTP traffic; the control message to the C&C servers, and the normal HTTP traffic to and between the Waledac bots. [MUSIC] Waledac was structured in a different way compared to Rustock and Cutwail. It was a custom-written, peer-to-peer structured botnet with a maze of layers for its infected machines. It had categories for its bots and different communication routes. The C&C servers did not communicate directly with the infected machines. It was all designed for resiliency and to protect itself and to hide from anyone who was trying to find it. Over in Canada, there’s an engineering school connected to Montreal University. It’s called Polytechnique Montreal. Two security researchers there, Joan Calvet and Carlton Davis, and Pierre-Marc Bureau who was from US internet security company ESET, well, they got ahold of these binaries from Waledac and started reverse-engineering them. What they found revealed a complicated botnet. Waledac didn’t miss an opportunity to steal data that it could use. It would scan the hard drives of infected machines and sniff their network traffic. It was hunting for e-mail addresses and passwords that it could steal and send it up the communication chain back to the command and control servers, straight into the hands of Severa. When thinking about how Waledac was structured, imagine a big pyramid. The base layer, the biggest layer, were the spam bots, the infected Windows machines, and they were the worker bees, the ones who were actually sending out spam e-mails. These spam bot machines couldn’t talk to each other, only to the layer above them, who the researchers called the repeaters. This layer were infected Windows machines that had public IP addresses. But these didn’t send out any spam; their job was to pass information between the worker bots and the communicator bots. They could talk to each other and to the layer above in this pyramid. The third layer was the protector group. They were the Linux servers, which the researchers thought acted as proxies for the core C&C servers. They were the protection layer, hiding the valuable servers from sight. The five of these servers that researchers identified were scattered across the globe in locations like Germany, the US, Netherlands, and Russia, and all had at least one protector server. The only layer above them and sitting at the top of the pyramid was the actual C&C server for Waledac. [MUSIC] Waledac also used this layered system of lists in its structures, too. So, all the spammer bots had their own hardcoded list of repeater bots that they’d have to deal with, like, 200 of them, all communicating through .xml files using encrypted registry keys. Now, they would contact a random set of these repeaters to get updates, and they would also send the repeater another list of repeater bots taken from the original list of 200. It’s confusing just for me to try to figure out what’s going on here, but that’s a lot of lists, and there’s a lot of different layers here and a lot of different bots that you have to juggle as the botmaster. But all this worked in harmony and was acting pretty smoothly. The Waledac botnet was pretty successful, and it kept its botmaster earning some pretty good money. [MUSIC] Before that year was out though, the other spam botnets would take a hit. The McColo web host provider was forcibly taken down on November 11, 2008. Their not-so-ethical practices had finally caught up with them. After a number of reports highlighting the shady nature of what McColo was doing, their two US-based internet providers, Global Crossing and Hurricane Electric, pulled the plug on them. Suddenly, a big chunk of these botnets lost their hosting provider, and the spam volume across the world just took a huge drop. Like, suddenly something around 80% of all spam worldwide just stopped. Cosma had already moved some of his servers from McColo, but not all. Google had most of his servers for Cutwail there. This was enough to make both botnets stunned and immobile, but the effect was short-lived. A few days later, McColo reactivated one of their servers in the exact same location where it was before, in San Jose, California. When that server came online, the Rustock botnet came online again, too. But within weeks, that botnet found a new hosting provider. C&C servers were reconfigured to send new sever information to all the bots, and the spamming machines got rolling again. Spam volumes once again began to climb. [MUSIC] By the middle of 2009, pharma e-mail spam was dominating the global spam market. 74% of all spam e-mails were pushing for dodgy online pharmacies. 67% of all that spam was promoting the Canadian Pharmacy brands like Glavmed and SpamIt. That year, spam botnets were sending an average of 150 billion spam messages a day. Cutwail was riding high again, but it took another big hit in June that year, when again it lost the hosting of its master C&C servers. Another hosting provider based in California was called 3FN, and hacker Google had loads of his servers there, especially after the McColo takedown a year before. 3FN was like a repeat of McColo. It was sort of known for hosting things that were dodgy or crime-ridden, like child pornography websites. The FTC stepped in and shut it down on June 4, 2009. When that happened, there was a noticeable drop in e-mail spams being sent as a result, but nowhere near as big as the one after the McColo takedown. But a few months after that, the Cutwail botnet was back at it and just as strong as ever. The botnets were once again at full steam, but they were also in the crosshairs of some determined people who wanted to take them down. Security analysts, academics, and software companies, and big brand pharmaceutical companies like Pfizer were all getting pretty frustrated with these botnets and rogue pharmacies, because these online pharmacies were selling fake Viagra, which Pfizer made, and at the time, there was no generic available, so Pfizer was losing a bunch of money from these botnets. But by this time, the botnet spamming empire and the Russian affiliate networks were all starting to show cracks in their operations. [MUSIC] The Waledac botnet was the first to fall. At 1.5 billion spam e-mails a day, Waledac was a big part of the pharma e-mail spam problem. Severa brought the online pharmacies an extra $438,000 in revenue, and his cut from that was about $145,000. Software giant Microsoft was getting especially annoyed with Waledac. In December of 2009, they found 651 million e-mails going from Waledac through their customers’ Hotmail accounts alone. They decided to fight back; they realized to take down Waledac, they were going to have to do something pretty unusual. Successfully taking down a botnet is as much about tactics and strategy than anything else. Researchers need to bide their time, do their homework, and identify the botnet’s weakest points. Most of the time, that’s their C&C servers. It’s not a game of chess where authorities have to make a move or wait for the botmaster to make theirs. It’s the opposite, because the best attack is a coordinated worldwide sudden strike on multiple levels to cut the botnet away from the botmaster. By February 2010, Microsoft’s Digital Crimes Unit, their Malware Protection Center, and their Active Response to Security guys were building a takedown team to knock out Waledac.”