How the FBI took down the Qakbot botnet

[SeanAnderson]

It's surprising how much publicity this is getting without making any arrests. I would've thought they'd have arrested people before publishing anything. I wonder if they've been able to identify the people, or if they were just able to undo the technical maliciousness?

[dralley]

If it's like the last half a dozen botnets that the FBI has taken down, it's being managed from China or Russia, and thus their chances of arresting anyone are close to nil.

[dang]

Recent and related:

FBI, partners dismantle Qakbot infrastructure - https://news.ycombinator.com/item?id=37310772 - Aug 2023 (171 comments)

[JohnMakin]

I don't really see from this explanation what prevents a new wave of infected machines from contacting the Tier 2 layer. It seems like they just cut off Tier 1 access of existing infections. Yes, they took over the cloud account, but I don't see what's really stopping the bad actors from starting over (with lessons learned probably as to what got them caught the first time).

[intrasight]

Great article. Also I just gotta share this. The story, if transported back in time a few decades and written as a sci-fi book would make a great read. Truth is stranger than fiction.

[charcircuit]

Did the FBI get permission to run their software on all those machines? This seems illegal.

[ipython]

You should read through the search warrant to see the lengths that they went through to get permission from the courts to do so.

Regardless I think it’s an interesting question as well but my position is that if these machines are already compromised I’d rather have them run the “uninstaller” than the victims continue to receive commands from the botnet controller and cause additional collateral damage.

[flextheruler]

There is a link in the article to the multiple warrants the FBI were able to get. I’m guessing that most likely has the answer.

[shmatt]

They did, though they really shouldn't need to

If an autonomous driving car is taken over by a hacker, and starts running people over, how fast would you expect the police to block it/shoot its tires?

[yieldcrv]

The FBI has broad authority from Congress to engage in cyberwarfare extraterritoriality , and they also got a broad warrant for anything that happened to be in the United States

You could probably challenge the warrant in court, fortunately that won’t reinstall the botnet but if you also feel this causes you damages, you can further aim to get paid for those damages

Good luck with that if you were an operator

[mavamaarten]

In my younger years I was very fascinated by malware, it's what got me into IT eventually. Back then I was active on some forums with marketplaces where one could easily buy and sell such services. I didn't do anything serious besides some slightly gray area stuff, but never sold or bought anything or compromised any unwilling victim. I did know some people who were later caught by the FBI and spent a long time in prison though.

In hindsight it's super crazy that this was a thing and probably still is.

About these operations, I honestly think they're not that spectacular even though they make it seem so. Anyone can buy a license for a random botnet for a couple of bucks and reverse engineer what's going on on compromised systems. I'm sure most of these botnets are hacked together pieces of junk code, which gathered a lot of installs through sheer luck and the fact that the FBI was looking away for a while.

[nahsra]

The FBI took control of the botnet and re-purposed it to patch the vulnerable machines. This sounds like a novel practice addition to me?

I've done some limited consulting in this space in my career, and I agree that the code (and architecture) I've seen is pretty brittle junk. It's on par with the worst enterprise code I've seen. It's a numbers game for them. And, it's just a different work experience and skill tree that drives people to create "great code" (as it would be measured in professional software development circles.)

[coldcode]

200,000 Windows PCs in the US among the 600,000 total worldwide. Are there really that many Windows PCs still running vulnerable old OS versions, or were they zero-days in more modern OS versions? These articles never say much about the details.

[Archelaos]

There seem to be no detailled numbers of Windows installations by region available, only percentages. The current percentages for the USA according to this Website: https://gs.statcounter.com/windows-version-market-share/desk... are:

  Win10 69.46%
  Win11 26.74%
  Win7   2.42%
  Win8.1 0.72%
  Win8   0.35%
  WinXP  0.18% 

This means 3.67% run an unsupported Windows OS.

If we estimate one Windows computer per person in the USA on average (~ 331.9 mil.), this means that more than 12 mil. computers run an unsupported Windows OS. (Or use your own estimate.)

[master_crab]

I read this as Quakebot and thought “The government is finally getting serious about these Quake hackers and cheaters.”

[boredumb]

I was using a browser earlier this week that didn't have ad block on (testing things). I was inundated with ads for a job at FBI. Weird coincidence but sure is a lot of FBI related marketing all of a sudden.

[playday]

Due to some recently revealed corruption issues in the USA that the fbi was covering up, there’s more drama than usual regarding funding. Expect to see lots of fbi fluff pieces until their funding is secured.