427 Botnet fm qxd

www.syngress.com
Botnets Overview • Chapter 2
57
427_Botnet_02.qxd 1/9/07 9:49 AM Page 57

---

Figure 2.11
Botnet Used to Store and Sell Stolen Movies, Games, and
Software
According to the MPAA, 44 percent of all movie piracy is attributed to
college students.Therefore it makes sense that the Release Groups would try
to use university botnet clients as Topsites.The next groups in the chain are
called Facilitators.They operate Web sites and search engines and act as
Internet directories.These may be Web sites for which you pay a monthly fee
or a fee per download. Finally individuals download the films for their own
use or they list them via Peer-to-Peer sharing applications like Gnutella,
BitTorrent for download.
In part the motivation for Release Groups to begin to use botnets and
universities may be successful law enforcement efforts over the last few years.
Operation Buccaneer (2001), Operation Fastlink (2004-ongoing), Operation
D-Elite (2005-2006), and Operation SiteDown (2005-ongoing) all targeted
Topsite operators. Operation Buccaneer included raids on computers related
to MIT, University of Oregon, UCLA, Purdue, and Duke University.The 
www.syngress.com
58
Chapter 2 • Botnets Overview
427_Botnet_02.qxd 1/9/07 9:49 AM Page 58

---

universities were not considered targets of the criminal investigations.
However, in each case the courts have ordered the seizure and forfeiture of
hundreds of computers owned and operated by the Topsite operators. In order
to limit their losses, I believe that some Topsites have turned to botnets to
store their stolen IP instead of investing in their own equipment that may be
lost if they are caught.