Dutch police, FBI rein in large botnet

The botnet created by a teenager who was arrested by Dutch police in an outdoor sting is most notable for its total reliance on social engineering to spread.

The botnet created by a teenager who was arrested by Dutch police in a sting operation is most notable for its total reliance on social engineering to spread, computer security experts said Thursday.

The 19-year-old Dutch man was caught July 29 with his 16-year-old brother trying to sell a botnet to a 35-year-old Brazilian man, according to Dutch prosecutors. All were arrested by the Dutch High-Tech Crime Unit, with assistance from the U.S. Federal Bureau of Investigation.

As is customary in the Netherlands, Dutch police have not released the names of those arrested. Few other details, such as how authorities became cued into the case, have been released. U.S. authorities are seeking the extradition of the Brazilian man.

But experts from Russian security vendor Kaspersky Lab were called on by Dutch police to write up instructions for how to remove the botnet code from infected PCs, as well as aid in the continuing investigation, said Eddy Willems, one of Kaspersky's security evangelists.

A botnet is a group of PCs that is infected with malicious code and controlled by a hacker. This particular botnet, which at one time had as many as 150,000 machines worldwide, is called "Shadow," the name bestowed on it by its creator.

The code that enabled Shadow to work was distributed on Microsoft's Windows Live Messenger instant messaging network. Victims would typically get a message from someone who appeared to be one of their contacts. The message would contain a link to another Web site, where the victim was asked to download a file.

If the file was executed on a PC, Shadow would collect other instant messaging contacts and send out more messages trying to enlarge the botnet. It appeared that Shadow was particularly successful in the Netherlands, since some messages were sent out in Dutch.

The distribution method relied entirely on victims willingly downloading the code rather than trying to exploit a software vulnerability, which could result in an infection regardless of what the user does.

It means that Internet surfers are just as susceptible to fall victim to scammy tricks. "Social engineering seems just as effective as it was 10 years ago," said Roel Schouwenberg, senior antivirus researcher.

Shadow could also download other malicious code and may have been used to download advertising software and spyware programs, Schouwenberg said. The teenager who created Shadow appears to use bits of malware code already circulating on the Internet, as well writing his own code.

The result was a fairly run-of-the-mill botnet, but one that could be considered large, Willems said. When the bust occurred, the 19-year-old was attempting to sell the botnet for Euro 25,000 (AUD$42,500), a price Willems said is way too high in proportion to how botnets are currently priced.

People who control a group of computers, called botnet herders, have been known to rent time to other scammers, who use the computers to send spam or conduct other malicious activity. The use of remote computers helps disguise who is actually using those machines to carry out crime.

Dutch prosecutors could not immediately be reached for comment.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments



Sansai 6-Outlet Power Board + 4-Port USB Charging Station

Learn more >



Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?