Good Guys Hijack Botnet, Score 56,000 Passwords in One Hour

So how safe are you really when it comes to doing things online? As it turns out, not very.

Researchers from the University of California Santa Barbara have published a paper outlining how they managed to hijack a botnet earlier this year for about 10 days.

In that time, the good guys were able to snag about 70GB of personal data that was stolen from web users. Among that data: 56,000 passwords which were collected within about 60 minutes.

The botnet in question is controlled by Torpig (also known as Sinowal). The researchers gained control of the Torpig botnet, a malware program that snags personal data from Windows users, by taking advantage of a vulnerability in how the bots attempt to locate their commands and control servers. The bots would create a range of domain names that they planned to hit next, but not all of those domains had been created yet.

The researchers, of course, decided to then register those domain names and then establish servers where the bots could connect to find their commands. This tactic went on for about ten days before the botnet creator pulled the plug.

So what can you do to protect yourself? Keep your operating system updated with all of the latest updates and be sure to create passwords that are difficult to guess. Make full use of numbers, special symbols (ie: %, $, !), etc. to make your passwords as hard to guess as possible.

Then at least you'll stand a fighting chance.