Last December, we pointed out that the Fbi’s Bot Roast II would lead to more arrests and lots of activity in cyber-law enforcement. In January, we pointed out that the ChaseNet forums’ shutdown coincided with the arrest of long-time member “Digerati” (Ryan Brett Goldstein), who was indicted as a result of the same Fbi operation at the time as 21 year old “SilenZ” (Gregory King).
While these developments expose past botnet activity and its disruption in definite terms, we also pointed out advertisements posted in underground forums by rogueware distributors looking to partner with these botnet herders, which we continue to see en masse:
“We upload adware, which in turn actively advertises antispyware! Our adware does not conflict with the botnets, or trojans, and it does not affect your own bots.”

Unfortunately, this underground and international industry is growing and evolving. Despite these arrests and drama, our Ruben will not escape suddenly into the eternal chill of crisp autumn air.

This new tool, the Goolag Scanner, is a stab at using Google’s technologies for security research (open to definitions of white, grey, or black hat), and a part of the cDc hacktivist response “to Google’s decision to comply with China’s Internet censorship policy and censor search results in the mainland-Chinese version of its search engine.” Its interface is similar to the popular Nessus vulnerability scanner. While use of the scanner most likely violates every contractual licensing agreement in the Google’s terms of service, it provides an automated method of evaluating web sites for vulnerabilities using “Google Hacks”, or “Dorks” that were popularized by “Johnny Hack” and his “Google Hacking Database“.

In line with their generally dark humor, this version of the scanner is being released as the “Stanley Kowalski” version, most likely in reference to an awful character from Tennessee Williams’ “Streetcar Named Desire”, along with a tough love usage statement:
“If this software does something bad to your computer or network or provides information that you have no legal right to see, then that’s your problem. In some countries this software might be illegal. Don’t be stupid, and don’t come whining to us if you get into trouble. You’ve been warned.”

Discussions on various security mailing lists wager on how long the site will remain up. It seems that the cDc presents the site as a parody of the google site itself:
“It isn’t even a particularly good parody. As such, it is protected by the First Amendment.” It most likely will be up for a while:

Web admins should be sure to attend to the security needs of their servers.

Monday, the British legislature published guidelines for the application of a 1990 Computer Misuse Act that makes it illegal to distribute “hacking tools”. A perfect example of tools that this new application might apply to would be the ChaseNET projects. While these RATs could be argued as tools comparable to PCAnywhere or GoToMyPC, they include stealth and information stealing functionality that is designed to evade security solutions for effective system compromise, control and theft of sensitive user data. These sorts of tools certainly fit under the description of “dual-use” tools, and I suppose the British law was developed with the intent to take down this sort of site.

We’ll take a look from a low level technical perspective at some of these RATs’ bad behaviors and provide some details in a later post.

He also points out that the trojan scene has steadily been replacing the activity of vx writers:
“We are striving to put them out of business. Once they’re all gone, those Trojans will keep us in business for a long time. Not that we want them, either.”

Even those trojan groups are beginning to disappear. The ChaseNET forums, a major international source of “Remote Administration Tool” (RAT for short, otherwise known as “Trojan Horse”) activity since 2004, are closing down as well. This shutdown curiously coincides with the Fbi arrest of longtime ChaseNET member “Digerati”. He faces up to five years in prison and a $250,000 fine if convicted of conspiracy to commit computer fraud, as we posted previously last year.
While the oldest of the groups might be drying up, unfortunately there are more growing to replace the vxers in different parts of the world. Recently released “Zines” from these newer groups publish technically sophisticated source details of password stealing, advanced rootkitting techniques, and more. These zines follow the trend away from virus writing for reputation to password stealer writing for profit. Plug in the slow cooker, cuz we’ll see more “Bot Roast” style arrests in 2008.

Unfortunately, we are also seeing more posts overseas from individuals seeking bot herding partners, looking to install more adware on victims’ systems and raise revenues for those involved. This sort of collaboration and malware should also continue throughout 2008, as we have been seeing a high level of this activity at the end of 2007.
Some of the most prevalent malware ThreatFire currently is seeing comes from the Zlob or Popuper families that are distributed in this manner. And here is one of the requests that we are seeing on an overseas forum regarding rogueware installs:
“We upload adware, which in turn actively advertises antispyware! Our adware does not conflict with the botnets, or trojans, and it does not affect your own bots.”

Update: Bot Roast II resulted in another guilty plea. This time from Gregory King, indicted at the same time as “Digerati”. His deal includes a two year prison term.