In a rare feat, French police have hijacked and neutralized a massive cryptocurrency mining botnet controlling close to a million infected computers.
The notorious Retadup malware infects computers and starts mining cryptocurrency by sapping power from a computer’s processor. Although the malware was used to generate money, the malware operators easily could have run other malicious code, like spyware or ransomware. The malware also has wormable properties, allowing it to spread from computer to computer.
Since its first appearance, the cryptocurrency mining malware has spread across the world, including the U.S., Russia, and Central and South America.
According to a blog post announcing the bust, security firm Avast confirmed the operation was successful.
The security firm got involved after it discovered a design flaw in the malware’s command and control server. That flaw, if properly exploited, would have “allowed us to remove the malware from its victims’ computers” without pushing any code to victims’ computers, the researchers said.
The exploit would have dismantled the operation, but the researchers lacked the legal authority to push ahead. Because most of the malware’s infrastructure was located in France, Avast contacted French police. After receiving the go-ahead from prosecutors in July, the police went ahead with the operation to take control of the server and disinfect affected computers.
The French police called the botnet “one of the largest networks” of hijacked computers in the world.
The operation worked by secretly obtaining a snapshot of the malware’s command and control server with cooperation from its web host. The researchers said they had to work carefully as to not be noticed by the malware operators, fearing the malware operators could retaliate.
“The malware authors were mostly distributing cryptocurrency miners, making for a very good passive income,” the security company said. “But if they realized that we were about to take down Retadup in its entirety, they might’ve pushed ransomware to hundreds of thousands of computers while trying to milk their malware for some last profits.”
With a copy of the malicious command and control server in hand, the researchers built their own replica, which disinfected victim computers instead of causing infections.
“[The police] replaced the malicious [command and control] server with a prepared disinfection server that made connected instances of Retadup self-destruct,” said Avast in a blog post. “In the very first second of its activity, several thousand bots connected to it in order to fetch commands from the server. The disinfection server responded to them and disinfected them, abusing the protocol design flaw.”
In doing so, the company was able to stop the malware from operating and remove the malicious code to over 850,000 infected computers.
Jean-Dominique Nollet, head of the French police’s cyber unit, said the malware operators generated several million euros worth of cryptocurrency.
Remotely shutting down a malware botnet is a rare achievement — but difficult to carry out.
Several years ago the U.S. government revoked Rule 41, which now allows judges to issue search and seizure warrants outside of their jurisdiction. Many saw the move as an effort by the FBI to conduct remote hacking operations without being hindered by the locality of a judge’s jurisdiction. Critics argued it would set a dangerous precedent to hack into countless number of computers on a single warrant from a friendly judge.
Since then the amended rule has been used to dismantle at least one major malware operation, the so-called Joanap botnet, linked to hackers working for the North Korean regime.
Source: TechCrunch
Photographer Cody Cobb created the images during long solo camping trips across America.
Source: Wired
A new paper tracked possible bias among scientists awarding prestigious research positions.
Source: Wired
The answer, dear reader, is no. Plus: Amazon on fire, Hong Kong in turmoil, genes for queerness, and more.
Source: Wired
Plus: A California bill takes aim at Uber drivers, and a cargo drone flies itself
Source: Wired
Apple is sending out invites for its annual September event, which is expected to feature the new iPhones and Apple Watch. It will be held September 10 in Cupertino, California.
Source: Digital trends
If you want improved Wi-Fi performance inside your home, the right wireless router or routers can make a major difference. Amazon discounted wireless routers for different purposes from Netgear, TP-Link, and Linksys in its Labor Day sale.
Source: Digital trends
Hey. This is Week-in-Review, where I give a heavy amount of analysis and/or rambling thoughts on one story while scouring the rest of the hundreds of stories that emerged on TechCrunch this week to surface my favorites for your reading pleasure.
Last week, I talked about Google’s Android naming switch-up.
Like clockwork, sources have been revealing to publications that Siri, Alexa, Google Assistant and Facebook M aren’t just digital assistants, they are portals into the AI workflows of Silicon Valley. Oh, and “AI workflows” means lots of contractors putting in quite a bit of manual work to understand what we want when we ask them questions.
This week, Apple announced that it’s completely changing how it handles reviewing audio from user Siri requests to ensure that users know exactly what they’re getting into privacy-wise.
The big change is that third-party contractors won’t have access to any of the clips for a process called “grading” and there is an explicit opt-in process for users. The company also gave a pretty explicit apology, which is pretty rare for an entity that seems to think its MacBook keyboards are still completely fine.
This whole situation is important for a couple reasons. One, Apple really sets the tone for consumer privacy among the tech giants so making notable changes here is positive and might push others to make similar updates. Two, Apple has the worst consumer-facing digital assistant. Like, Siri is just unquestionably worse than Alexa and Google Assistant so they arguably have the most to lose here and this is a decision that means less data for the company to hone its tech on.
Together, all of these gaffes really weren’t egregious, they were dealing with data that wasn’t nominally connected to users, but audio files should definitely be treated with a little more respect than anonymous crash reports. The journalism from publications like The Guardian pushing on “common” industry practices seemed to surface some positive change here.
On to the rest of the week’s news.
Here are a few big news items from big companies, with green links to all the sweet, sweet added context:
How did the top tech companies screw up this week? This clearly needs its own section, in order of badness:
Photo by Dinendra Haria/SOPA Images/LightRocket via Getty Images
Our premium subscription service had another week of interesting deep dives. We published a roadmap for entrepreneurs looking to leverage Amazon and other ad platforms to create a direct-to-consumer startup.
How to use Amazon and advertising to build your D2C startup
“…This article focuses on customer acquisition, particularly Amazon and online advertising, for the direct-to-consumer (D2C) CPG venture. Selling on Amazon, specifically third-party (3P), has become an increasingly important component of the D2C playbook. About 46% of product searches start on Amazon, which makes it a compelling source of sales even for early-stage ventures….” (Extra Crunch membership required.)
Here are some of our other top reads this week for premium subscribers. This week, we published some analysis on the latest VMware deal and also looked at how startups should integrate customer success solutions early-on.
Sign up for more newsletters in your inbox (including this one) here.
Source: TechCrunch
Google and Samsung made moving your iPhone data to your new Android phone simple and easy. You can even transfer your iMessage history.
Source: CNET
We round up the phones with the longest battery life. Did yours make the list?
Source: CNET