Microsoft and Kelihos botnet

I was reading that Microsoft has taken down the Kelihos botnet and actually tracked down the 'coder' behind it. Andrey N. Sabelnikov (Russian) who worked in the IT Security industry. Apparently Sabelnikov had registered over 3000 'cz.cc' subdomains in order to operate the command-n-control of the botnet.

Cudos to you all at Microsoft. And also to their partners Kaspirsky Labs who assisted in the takedown.

One thing though... the infected users pc's are still out there looking to 'phone home'. There's around 41,000 of them with around 10,000 in North America alone, still pumping out spam email at around 4 billion per day. These systems could potentially be prone to other botnets trying to take control of them.

Botnets are tricky things to clean off your own PC. There are very few (if any) anti-virus programs that detect them. I have been looking for years and not found any. The best option is get your data off your PC, format and re-install it from a legal copy of Windows and for God's sake update it immediately with the latest patches.

I am a computer programmer and have been in the computer industry since the mid 1980's and have been battling virus issues with, not only friends PC's, but also in the work environment. In 2010 we battled with the 'conficker' bot and it's friend 'Sality-d' virus. Oh yes, there was also a 'link' virus in the mix as well. How bad was it? A network with 28 servers and over 450 desktop machines on a national WAN. Nearly all the servers had to be taken off-line and all the desktop machines were replaced with ones that had a fresh install of Windows. All but 2 of the servers were also re-installed. The company had intermittent access to computers for almost 6 weeks.

My computer skills have been accumulated in the Microsoft arena since 1985, and up until 2009 I have always had a Windows PC. That changed. Well before the 2010 'melt down' of my work's network I installed Linux Ubuntu 9.04 on my home PC. It could dual boot with Windows. I was totally sold on Ubuntu. In a little while I could do everything on Linux that I could do with Windows. With the exception of updating my iPhone using iTunes. There's another story in that fact alone (for another time).

Now there's not a single PC at home that does not have Ubuntu 10.04 or higher installed on it (even my work PC runs it). My 4 daughters use Apple Mac's. As far as Microsoft view, it's the darkest house on the planet... no Windows at all.

So how does it all work? I have VPN's configured in Linux with RDP clients opening Windows desktops on the Windows servers that I administer. Hell, even my Lenovo K1 Tablet can VPN and RDP into my desktop on a server at work.

Now I am free of the 'background worry' about botnet's and viruses. Plus at work I can feel safe about the fact that my local PC is safe from catching anything from the rest of the 'herd' and vice versa. Still however we need to be vigilant, even with Linux.

So how likely is it that there's a real threat for Linux? Because there are so many variant's within the Linux camp. And they all work differently... that's going to be a difficult thing. Plus the fact that their security works differently to Windows (and better). The updates are frequent, smaller and rarely require a re-boot.

Now... I know there are many die-hard Windows fans out there. I was one of them. I was trained to use Windows and all my experience is in that field. However when you see the damage that can be inflicted on a national network of Windows PC's and Servers it gives you pause. Also all the techniques we (Sophos was used) employed to clean up the mess, involved linux in one shape or form. This fact alone should make you think. Most people are scared of change and will defend what they know to the death. Thank heaven I was open to look at new things.


If you are interested in looking: www.ubuntu.com is a good start.


*The added bonus is that you'll have both Linux and Windows at your disposal*