Feds Ready To Take Next Step Of Uninstalling Coreflood Malware

When the FBI first began dismantling the Coreflood botnet, it did so initially by getting between the botnet's servers and its around 2 million infected bots. But now the feds are preparing to remotely kill the malware on the infected machines as well.

A U.S. District Court judge granted the feds a preliminary injunction this week against the operators of the botnet, which basically buys them more time in their quest to disable and disarm it. They originally had used a restraining order to prevent the botnet's "John Doe's" from operating the botnet. Justice Department officials say so far they have successfully cut the size of the botnet by 90 percent in the United States, from some 800,000 "beacons" -- attempts by infected machines to call home to the botnet's command-and-control (CnC) servers -- on April 13 to less than 100,000 as of late last week.

The feds thus far have been issuing "stop" commands to the bots calling home to the five CnC servers they seized that sent instructions to the infected machines. The case is a precedent-setting one for botnet takedowns given the relatively aggressive involvement by federal authorities.

Now officials say they expect to take the next step and remotely "uninstall" Coreflood malware from identified victim machines, as long as the machines' owners authorize it. This was always an option in the operation, but they appear to be ready to begin that process, experts say.

"The authorization to use the uninstall function is very good," says Gunter Ollmann, vice president of research at Damballa. "There's been a lot of work in very large enterprises, with security consulting firms that are called in to help develop the tools to send those commands to the botnet. If we can do that on a larger scale and clean up some of these botnets out there and on a global scale, the world would be a better place."

Don Jackson, a senior researcher with Dell SecureWorks' Counter Threat Unit, and whose organization has studied the Russia-based Coreflood botnet for years and lent a hand in the DOJ case, notes that the "uninstall" option was on the table all along. "Nothing prohibits anyone -- including agents of the government -- from taking that action with permission of the users," Jackson says. "However close as it may seem to this, we are light years away from 'uninstall without explicit permission,' and I think that's how it needs to be."

But reaching out and touching victim machines comes with risks of its own. Assuming the owner of a victimized machine agrees to letting the feds uninstall the malware, there's always the possibility of the operation triggering other problems, such as the blue screen of death.

Security experts have been debating whether the clean-up process could cause more damage. The worry is that "frailties to the system could cause unintended consequences," Damballa's Ollmann says.

And, of course, some worry that the feds would be overreaching and too invasive with the "uninstall" command. "The debate is going to rage on," Ollmann says. "But there is still more good to be had by actually forcing the uninstall command."

In a supplemental memo that was filed with the request for the preliminary injunction, the feds said, "In order to keep the Court fully apprised of all relevant facts, the Government respectfully advises the Court that the substitute server, or another similar server, will be configured to respond to command and control requests from infected computers by issuing instructions for Coreflood to uninstall itself, but only as to infected computers of Identifiable Victims who have provided written consent to do so."

And that doesn't mean machines wiped of Coreflood malware are safe. "While the use of an 'uninstall' command to remove Coreflood cannot be considered a replacement for the use of properly configured and updated anti-virus software, removing Coreflood from infected computers will at least serve to eliminate a known threat to that victim’s privacy and financial security," the memo said.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.