back to article Google launches lawsuit against a blockchain-enabled botnet

Google says it has taken legal and technical action against Russia-based botnet Glupteba. "Botnets are a real threat to internet users, and require the efforts of industry and law enforcement to deter them," wrote Google's vice president of security, Royal Hansen, and general counsel Halimah DeLaine Prado. The ad giant …

  1. claimed

    Blockchain backup?

    So I assume that's something that says: if you see this wallet number in a transaction, get the new C&C domain name from the metadata...?

    So not a backup, but a decentralised recovery for already compromised machines... f*cking Bitcoin (etc al)

    1. Graham Cobb Silver badge

      Re: Blockchain backup?

      It has been fairly obvious for a while that this sort of thing is an obvious use (maybe even the only killer application for) a blockchain.

      For many years I have indulged myself by thinking up all sorts of places to put data which someone needs to be able to easily access over the very long term, update when necessary but be able to deny the existence of. Purely theoretical, of course: I have no data like that but it is fun to think about, and I imagine it could be useful for activists/journalists in totalitarian countries, for example (as well as James Bond, etc).

      There are many, many public places to hide a small amount of data. Some are very easy to use but are not anonymous (domain names are an obvious one) - that might be good enough if the activist has friends outside the country who will maintain the data. There are also a number of other less well known but still well maintained "registries" of various forms (for example, public key lists), some of which are much more anonymous.

      However, very, very few of them are resilient against deletion or modification of the data if your adversary knows where you put it (for example, DNS names can be removed or their information changed). Blockchain, with its visible history, seems to be the ultimate in this. Even if your adversary knows where you have stored it, they can't remove it. If they try to update/replace it, the old values are still visible in the blockchain and, as long as you make sure the data is signed with your key, they can't appear to make a valid update.

      I'm no expert on blockchain, encryption or malware - so if it was obvious to me, presumably malware writers have been using it for ages. And the problem is nothing to do with bitcoin specifically - any blockchain will do, as long as there is a way to include a large enough block of user-specified data (a single DNS name, encrypted and then signed would be enough).

  2. lglethal Silver badge
    Meh

    I would love it if this sort of thing actually had even the slightest effect on the Ransomware Scumbags. But we all know from past experience, nothing will happen. Russia will pretend that nothing is wrong and it's nothing to do with them, the Scumbags wont suffer one bit, except perhaps they wont be able to go on holidays outside of Russia anymore, and they will just keep on doing what they've been doing. And normal people will continue to suffer the plague of Ransomware.

    I really wish I could be more optimistic, but reality is a great driver of cynicism...

    1. Anonymous Coward
      Anonymous Coward

      As for practical effect, it probably makes unwitting Western corporate enablers of the botnet move a little faster to assist in disabling once they know about it, because otherwise they are provably culpable.

      Theoretically and ideally this is something the office of the US Attorney General would prosecute as a criminal case having been informed and assisted by a selfless NSA filled with white hat defensive experts. But no.

      (Question - are Google bringing both a criminal and civil case at the same time? It would seem so, because it is much harder, if not impossible, to win civil without the crime already proven.)

      It's a cross platform botnet, affecting not only (or even mostly) Google. Give credit where it is due - Google is providing a great public service where the government has miserably failed to do so.

  3. Throatwarbler Mangrove Silver badge
    Trollface

    Finally!

    At last, a practical use for blockchain!

  4. Kevin McMurtrie Silver badge
    Holmes

    Obvious but requires effort

    "63 million Google Docs, 1,183 Google accounts, 908 cloud projects, 870 Google ads..."

    Google should focus on making their services less trivial to use for criminal activity. It almost sounds like they're an accomplice.

    1. EnviableOne Silver badge

      Re: Obvious but requires effort

      MS are just as bad, O365 stares far to much Phishing material

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2022