427 Botnet fm qxd

www.syngress.com
16
Chapter 1 • Botnets: A Call to Action
427_Bot_01.qxd 1/8/07 11:53 AM Page 16

---

million in damage.TK worm exploited a common Unicode vulnerability in
Internet Explorer.
Additional evidence was seized from an address in Illinois through a
simultaneous search warrant.The worm had infected over 18,000 infected
computers.The American member, Raymond Steigerwalt, was sentenced to
21 months in jail and ordered to pay $12,000 in restitution.
Axel Gembe
Axel Gembe is the author of Agobot (aka Gaobot, Nortonbot, Polybot), a 21-
year-old hacker reported by police at the time of his arrest as “Alex G.” He
was arrested May 7, 2004, at his home in Germany (Loerrach or Waldshut,
different reports conflict) in the southwestern state of Baden-Württemberg.
He was charged under Germany’s computer sabotage law for creating mali-
cious computer code. He has admitted responsibility for creating Agobot in
Oct 2002. Five other men have also been charged.
180Solutions Civil Law Suit
Sometime prior to 2004, a Lithuanian mob contacted Dutch hackers and
asked them to create a botnet.The hackers created and delivered the botnet. It
occurred to the hackers that the Lithuanians must be using it in some way to
make money.They reasoned that they could do the same thing for them-
selves.They created their own botnet with 1.5 million zombie clients.
In one venture, they were using the botnet to install software for an
adware company, 180Solutions. 180Solutions had been under pressure from
the public to clean up its act for years. In January 2005, they changed their
policy to exclude paying for software installations that the user did not autho-
rize. In doing so they began to terminate agreements with distributors that
installed their software without the user’s approval. By August, according to
180Solutions, they had terminated 500 distributors.The Dutch hackers then
employed the botnet to extort money by DDoSing 180Solutions until they
paid.The company brought in the FBI who tracked down the hackers. On
August 15, 2005, 180Solutions filed a civil suit against seven hackers involved
in the DDoS attacks: Eric de Vogt of Breda, the Netherlands; Jesse Donohue
of South Melbourne, Australia; Khalil Halel of Beirut; Imran Patel of