WireX DDoS botnet takedown shows the best side of the security industry

Posted by   Martijn Grooten on   Aug 29, 2017

It is easy to be cynical about the security industry and its tendency to make ever bigger mountains out of molehills, but behind a thin layer of marketing, there are a great many people who really care about making the world a more secure place.

We have seen many examples of researchers from competitor companies working together in botnet takedowns, law enforcement actions against malicious actors, and the writing of more secure standards. The latest example of such a collaboration is the combined effort that led to the takedown of the WireX Android DDoS botnet.

wirex_unique_ips.png

The number of unique IP addresses active in the WireX botnet every hour.

 

As DDoS botnets go, WireX wasn't particularly powerful, though still powerful enough to make many a website unavailable, thus making the associated ransom notes rather credible. It also wasn't particularly hard to detect, since it used random 26-character strings for the User-Agent header. Of course, this is something that could easily have been changed.

What made WireX rather unique though, was that it ran on Android devices and was made up of some 300 apps available on Google's official Play Store. These apps have since been removed both from the Play Store and from all infected devices.

The takedown effort was a combined effort from several companies, four of which — Akamai, Cloudflare, Flashpoint and RiskIQ — published the very same post-mortem blog post earlier this week. This is really the security industry at its best.

Virus Bulletin is always happy to help facilitate industry-wide collaboration, for example during the upcoming VB2017 conference. Don't hesitate to contact me (martijn.grooten@virusbulletin.com) if you think we can be of help! And don't forget to register for the conference for a chance to meet with other researchers and build the connections that are essential for a more secure world!

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Test your technical and mental limits in the VB2017 foosball tournament

As has become tradition, VB2017 will once again see a security industry table football tournament. Register your team now for some great fun and adrenaline-filled matches in between sessions in Madrid!

The case against running Windows XP is more subtle than we think it is

Greater Manchester Police is one of many organizations still running Windows XP on some of its systems. This is bad practice, but the case against running XP is far more subtle than we often pretend it is.

Hot FinSpy research completes VB2017 programme

Researchers from ESET have found a new way in which the FinSpy/FinFisher 'government spyware' can infect users, details of which they will present at VB2017 in Madrid.

Transparency is essential when monitoring your users' activities

Activity monitoring by security products in general, and HTTPS traffic inspection in particular, are sensitive issues in the security community. There is a time and a place for them, VB's Martijn Grooten argues, but only when they are done right.

VB2017 preview: Android reverse engineering tools: not the usual suspects

We preview the VB2017 paper by Fortinet researcher Axelle Apvrille, in which she looks at some less obvious tools for reverse engineering Android malware.