Re: Weird Microsoft logic: kill the messenger
"Kaspersky Lab expert Costin Raiu said the power grab has crippled command-and-control systems for many malware operators."
Your show an epic degree of confusion. No-ip and similar services are used by these crooks for the same function everyone uses DNS: so that they can avoid hard coding raw IP addresses of the C&C server and use a set of names instead. That way if your C&C machine is seized you can simply change the DNS records at no-ip.org and bring up another one somewhere else.
What Microsoft has done is obtained the power to modify the resolution of these names. So if your bot is trying to contact "ownedmachinemaster.no-ip.org" to get commands, it ends up resolving on an IP address belonging to Microsoft's safety infrastructure.
"The vast majority of this type of C&C infrastructure is indeed on hacked / exploited Linux based systems."
You're again confusing things. The C&C master is a computer using an IRC server as a transport for its communication with the bots. But you don't need to hack anything do to that. They use Linux because the people doing these kind of things usually don't like to have conversations about their Windows licensing status with their hosting service providers or with Microsoft. But "hacked"? Not in any way, it is not necessary to hack anything.
Being able to use an IRC client on a Linux machine to control a botnet and saying that the machine is "hacked" is the same level of "hacked" as if someone tells you a password for a Facebook acccount and you use it to log in from a Windows machine. Does not mean the Windows machine you use is "hacked" in any way.
Now I can only hope that you are not a "security consultant" I'm not and I can grasp the basics of all this.
Biting the hand that feeds IT
