FBI Hacks Infected Computers to Stop Coreflood Botnet

The Coreflood botnet is a group of infected computers, controlled and used by criminals to steal money from bank accounts. This piece of malware collects keystroke information such as usernames and passwords, then sends that information back to the controlling servers. Coreflood also allows the controlling server to remotely control infected machines and intercept communications.

This is not the first botnet that has widely infected computers within the United States and the world. This specific botnet, Coreflood, has been infecting computers for several years.

This is the first time that the US government has been allowed to replace the controlling servers with servers of their own, gather IP addresses of infected machines, and remotely send a stop command to the infected computers.

The government promises that they will not collect any information from the infected machines, nor intercept communications. Computers infected with Coreflood will have a stop command sent to them which will temporarily stop the malware until the computer is rebooted. The stop command will need to be resent to infected computers each time they reboot. This is all being done remotely without the knowledge of the computer owner.

The government does plan to provide ISPs the information about infected computers so that the owners can be notified. Once the infected computer owners are contacted, they can remove the malware.

Although these actions are being performed to prevent and limit harm done by the Coreflood botnet, there are mixed feelings within the Information Security community. Computers being remotely controlled without the knowledge of the owner is hacking, regardless of whether it is being done for good or evil. Additionally, this action protects against one threat amongst several, including possibly different flavors of the Coreflood botnet itself.

Sources:

U.S. shutters botnet, can disable malware remotely

With Court Order, FBI Hijacks 'Coreflood' Botnet, Sends Kill Signal