The Coreflood botnet was one of the longest-running cyber threats, active from 2002 and responsible for DDoS attacks, bank fraud, and data theft. With over 2.3 million infected computers, including government agencies, financial institutions, hospitals, and universities, its full financial impact remains unknown.
Operation and Legal Intervention
In response to the cyber threat, five command-and-control (C&C) servers and 29 domain names were seized under a court order. The operation involved:
- Issuing a remote "exit" command to stop the malware.
- Sending 19,000 uninstall commands to infected computers.
- Coordinating with ISPs and antivirus vendors to mitigate further infections.
Legal and Ethical Considerations
The case raised critical legal questions about government intervention in cybersecurity:
- Actions were limited to stopping, notifying, and seeking consent from affected users.
- Courts justified the operation by citing continuing harm to users if the malware remained active.
- The case highlighted the tension between privacy rights and public security in a digital landscape.
Conclusion
The Coreflood case illustrates the challenges of combating cyber threats within legal frameworks. It underscores the need for clear regulations on government-led cybersecurity interventions while ensuring both privacy protection and public safety.
- Published in
- International Botnets Fighting Alliance (Botconf 2013), Nantes
- Date
- 5–6 December 2013
- Language
- English