Computer security experts blocked the botnet’s command and control servers in the Netherlands and Panama on Tuesday. But later that day, Grum’s architects had already set up seven new command and control centers in Russia and Ukraine. FireEye, a computer security company based in Milpitas, Calif., said it worked with its counterparts in Russia and with SpamHaus, a British organization that tracks and blocks spam, to take down those command and control centers Wednesday morning.
The researchers said they were able to vanquish the botnet by tracing Grum back to its servers and alerting Internet service providers to shut those computers down.
Technologists have taken the lead in combating digital crime rather than waiting for law enforcement authorities to act. Earlier this year, Microsoft employees assisted federal marshals in a raid on botnet servers in Pennsylvania and Illinois. Those servers were used by criminals to run Zeus, a botnet that siphoned people’s personal information, like online bank account passwords and credit card numbers, from infected computers. Almost simultaneously, a separate group of cybersecurity researchers in San Francisco were busy eliminating another botnet, called Kelihos.b, which was used to send spam.
While computer security companies are quick to publicize botnet takedowns, their gains tend to be temporary. The blocking of Kelihos.b lasted less than a week before a modified version of the botnet started infecting computers. Microsoft’s takedown of Waledac, another spam botnet in 2010, lasted only as long as the time it took its creators to modify its architecture slightly and create a new botnet.
So what’s to say Grum’s creators will not just run their botnet from a new command and control center tomorrow?
“It’s not about creating a new server. They’d have to start an entirely new campaign and infect hundreds of thousands of new machines to get something like Grum started again,” said Atif Mushtaq, a computer security specialist at FireEye.”They’d have to build from scratch. Because of how the malware was written for Grum, when the master server is dead, the infected machines can no longer send spam or communicate with a new server.”