The botnet takedown announced Wednesday by the U.S. Department of Justice was the biggest in history, according to a security company that worked with authorities to identify the alleged criminals.
Dubbed "DNS Changer," the collection of compromised computers numbered over four million machines, or more than twice the size of the Rustock botnet that Microsoft and U.S. law enforcement officials brought to its knees last March.
About a quarter of the bots were Windows PCs and Macs based in the U.S.
Feike Hacquebord, a senior threat researcher at Trend Micro, called the operation the "biggest cybercriminal takedown in history" in a blog post yesterday.
Trend Micro was one of several companies and organizations credited by the FBI for contributing to the investigation leading to the takedown. Others included Mandiant, Neustar, Spamhaus and the University of Alabama at Birmingham's computer forensics research group.
Preet Bharara, the Manhattan-based U.S. District Attorney in charge of the case, said the fraud conducted with the botnet was "massive and sophisticated."
On Wednesday, the DOJ charged seven men -- six Estonians and one Russian -- with 27 counts of wire fraud, money laundering and illegal computer access, alleging that the group operated a lucrative clickjacking scheme that generated over $14 million during a four-year period.
The malware responsible for hijacking users' clicks -- which were then redirected to hacker-created sites that resembled the real domains -- came in a variety of forms, said researchers and authorities.
According to the Internet Storm Center , some of whose security experts were part of a working group that advised the DOJ, the botnet was created with several malware families, including the pernicious TDSS rootkit -- also known as "Alureon" -- as well as Trojan horses crafted for Mac OS X.
The federal indictment said that the gang infected personal computers by luring users to malicious websites or by duping them into downloading and installing purported video codecs that the scams claimed were necessary to view videos.
Trend Micro, which said it had been tracking the DNS Changer botnet since 2006, added that the alleged criminals updated the malware daily to change the DNS (domain name system) settings of each bot.
The malware also blocked users from updating most installed antivirus software, or receiving operating system patch updates, the indictment alleged.
Along with the arrests in Estonia -- the Russian defendant remained at large -- the U.S. Federal Bureau of Investigation (FBI) shut down over 100 domain and botnet command-and-control (C&C) servers hosted at data centers in New York City and Chicago.
That would have left infected PCs and Macs without a way to connect to the Internet: Seizing the domain servers effectively wiped their road map to the Web's addresses. Instead, a federal judge approved a plan in which clean DNS servers were deployed by the Internet Systems Consortium (ISC), the non-profit group that maintains the popular BIND DNS open-source software.
ISC will operate the replacement DSN servers for 120 days, long enough, authorities said Wednesday, for users and Internet service providers (ISPs) to identify and scrub infected computers of the DNS Changer malware.
Unlike other botnet takedowns, such as the one aimed at Coreflood earlier this year, the DOJ will not remotely clean infected systems.
The FBI has posted instructions ( download PDF ) that people can use to determine whether their DNS records have been scrambled by the alleged hackers.
The agency has also created a tool that checks for DSN settings that may be among those controlled by the gang.
Microsoft, which has assisted in several botnet takedowns this year but did not participate in what authorities yesterday described as "Operation Ghost Click," praised the botnet crippling.
"We commend the FBI and Department of Justice for the arrests, which we see as progress in the ongoing effort to hold cybercriminals accountable for their actions," Microsoft said in a statement late Wednesday.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer , or subscribe to Gregg's RSS feed . His e-mail address is firstname.lastname@example.org .
Read more about security in Computerworld's Security Topic Center.