June 4th, 2009

FTC shuts down notorious botnet ISP

Posted by Ryan Naraine @ 1:58 pm

Categories: Black Hat, Botnets, Browsers, Data theft, Denial of Service (DoS), Hackers, Locally Running Web Servers, Malware, Microsoft, Passwords, Patch Watch, Rootkits, Viruses and Worms, Zero-day attacks

Tags: Internet Service Provider, Server, Bot, FTC, Internet Service Providers (ISPs), Viruses And Worms, Internet, Security, Ryan Naraine

The Federal Trade Commission (FTC) has shut down a U.S.-based Internet Service Provider for recruiting, hosting and actively participating in the distribution of spam, child pornography, and other harmful electronic content.

Pricewert LLC (also known as 3FN and APS Telecom) was shut down by a district court judge at the FTC’s. The ISP’s upstream providers and data centers have disconnected its servers from the Internet.

The case against Pricewert, via an FTC announcement:

[The ISP} actively recruits and colludes with criminals seeking to distribute illegal, malicious, and harmful electronic content including child pornography, spyware, viruses, trojan horses, phishing, botnet command and control servers, and pornography featuring violence, bestiality, and incest.

The complaint alleged that Pricewert actively shielded its criminal clients by either ignoring take-down requests issued by the online security community, or shifting its criminal elements to other Internet protocol addresses it controlled to evade detection.

The ISP is also accused of participating in the operation of botnets by actively recruting bot herders and hosting the command-and-control servers that sends commands to compromised computers.

Transcripts of instant-message logs filed with the district court show the defendants’ senior employees discussing the configuration of botnets with bot herders. And, in filings with the district court, the FTC alleges that more than 4,500 malicious software programs are controlled by command-and-control servers hosted by 3FN. This malware includes programs capable of keystroke logging, password stealing, and data stealing, programs with hidden backdoor remote control activity, and programs involved in spam distribution.