It has been announced this week that Microsoft have taken action against the Kelihos botnet, removing the command and control structure and filing a lawsuit against the suspected owner. Details of this can be found on the official Microsoft blog located here.
Interestingly it seems that the reason they have been able to do this eventually comes down to the fact that the top level domains .com and .cc are maintained in Virginia, and therefore they have been able to gain the support of the US courts in authorising a takedown due to the negative effect on Microsoft and their customers. A consideration of this is that if there was no link to the USA, for example if the TLD was located in another country, whether Microsoft could make the same claims and be so successful in shutting down these botnets?
Whilst I support the efforts of Microsoft and think they do a fantastic job in taking down these botnets I don’t believe that the methods in use today are sufficient to stop it. As long as botnets remain a profitable (albeit criminal) business I believe they will find another way to operate, perhaps they will start using non-US domains, ensuring that they operate in countries where the laws are insufficient to deal with this type of crime, or maybe they will move away from domains altogether, and communication using peer-to-peer technology will become more prevalent.
Greater worldwide collaboration is needed or these criminals will simply move out of the reach of those opposing them and find new methods of evading detection. Although in this case Microsoft have been able to raise a civil case against the botnet owners they have been thus far unable to name others who were involved, even if they should do so these people may be beyond the reach of the US legal system. The problems of legislating the internet are not going anywhere and these problems are only going to grow as more and more criminals see cyber crime as a safer way to make a living.
