Microsoft Wields Its IP For Good, Cripples Botnet Via Trademark Litigation

from the ends-justifies-the-means? dept

Microsoft developed a bit of a reputation as a trademark bully during the early 00s, going after an Australian pillow manufacturer (for its polyester fiber “Microsoft” quilt) and a 17-year-old Canadian named Mike Rowe (for his MikeRoweSoft website business). It seems to have settled down on the bullying but it still wields its trademarks with considerable heft. Krebs on Security reports Microsoft recently leveraged its trademarks to severely cripple a botnet.

Microsoft Corp. has executed a coordinated legal sneak attack in a bid to disrupt the malware-as-a-service botnet Trickbot, a global menace that has infected millions of computers and is used to spread ransomware. A court in Virginia granted Microsoft control over many Internet servers Trickbot uses to plunder infected systems, based on novel claims that the crime machine abused the software giant’s trademarks. However, it appears the operation has not completely disabled the botnet.

Microsoft’s request for a restraining order (which I haven’t been able to locate yet) pointed out Trickbot infects and alters Microsoft products, which could cause users to believe Microsoft itself has zombiefied their device. This misattribution of source cause has the potential to cause harm to Microsoft’s reputation and brands.

However, it doesn’t appear Trickbot ever co-opts Microsoft’s trademarks to present computer users with seemingly legitimate applications. Instead, it infects Windows systems, causing problems while hiding itself from victims. Microsoft’s trademark argument is novel: there’s no appropriation, just a lot of potential damage to its reputation from people unwittingly operating infected systems.

The order was granted and Microsoft now has control of some of the servers used by the malicious hackers. Others remain online but work has been done to mitigate future damage.

Microsoft’s action comes just days after the U.S. military’s Cyber Command carried out its own attack that sent all infected Trickbot systems a command telling them to disconnect themselves from the Internet servers the Trickbot overlords used to control them. The roughly 10-day operation by Cyber Command also stuffed millions of bogus records about new victims into the Trickbot database in a bid to confuse the botnet’s operators.

Microsoft’s unusual trademark litigation isn’t its only use of IP to battle a botnet. In a post about this operation/litigation, the company is also wielding its copyright in a more questionable manner.

This action also represents a new legal approach that our DCU [Digital Crimes Unit] is using for the first time. Our case includes copyright claims against Trickbot’s malicious use of our software code.

Microsoft probably knows something the rest of us don’t, but using the information available, it’s difficult to see how attacking a system with a malicious script “uses” Microsoft’s software code. If this legal theory is granted credence by a judge, it will make it easier for companies (like… I don’t know… Apple) to shut down hobbyists and enthusiasts who modify devices or programs containing copyrighted code to do things companies don’t approve of. While it’s great Microsoft is stepping up to shut down a botnet, it’s not as great to see it willing to abuse IP law to get it done.

Filed Under: , ,
Companies: microsoft

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Microsoft Wields Its IP For Good, Cripples Botnet Via Trademark Litigation”

Subscribe: RSS Leave a comment
Scary Devil Monastery (profile) says:

That's also a way of putting it.

"Microsoft developed a bit of a reputation as a trademark bully during the early 00s" ????

In much the same manner that Caligula was an eccentric and Hitler a misunderstood artisté?

Honestly this is a bit like seeing a reformed thug with a history of violent disproportional assault suddenly take a swing at someone you don’t really like. Sure, you didn’t like the guy and it’s a good thing someone stopped him…
…and yet you just feel nervous at the sight of that former terror of the sandbox once again swinging his fists.

PaulT (profile) says:

Re: That's also a way of putting it.

Microsoft have undoubtedly gone through a major internal culture change in the last decade or so, and while it’s still good to be wary of them, it would be wrong not to acknowledge its many improvements. The company that tried backing SCO in order to destroy the fundamentals of FOSS and the company that ships Linux and Chromium components in its OS are not necessarily the same beast.

Scary Devil Monastery (profile) says:

Re: Re: That's also a way of putting it.

"…and while it’s still good to be wary of them, it would be wrong not to acknowledge its many improvements…"

Well, that’s the thing about trust, alas. You can easily prove that your trust was misplaced. But it just isn’t possible to prove that someone is trustworthy once more.

MS has been forced to adapt, not by choice, but simply in order to survive a marketplace which was becoming increasingly reliant on Open Source rather than on MS products. So, having failed to ram "Open source is cancer" through every court of the land they instead opted to retool their business model.

That, to me, is as convincing as Dahmer running a butcher shop after rehab. You will keep viewing what he sells with trepidation because you know, for a fact, that he had a deplorable tendency to rape, murder, and eat people in his younger days.

Anonymous Coward says:

This is fine since they’re disrupting a botnet but the same logic could be used to take down ANY site or any software used by a Windows user. Which I think is a bad precedence. I can only hope that whatever judge allows something like this is very, very careful otherwise we’ll end up relying on the beneficence of a corporation for who they attack.

Nick-B says:

Re: Re:

This worries me too. I like the use of this to stop botnets, but I honestly don’t see why the ONLY option was to (ab)use trademark by an OS manufacturer to stop this. If they know where the servers are, it is extremely bizarre to me why Microsoft needs to be involved at all. Something like this seems like it can clearly fall under the CFAA or similar and can be seized by law enforcement alone.

Maybe because I didn’t click through the link to get more info, but I guess I just assumed that specific info on WHY Microsoft had to be involved would not be revealed at this step in the investigation (or at all).

Anonymous Coward says:

Re: Re: Re:

I recall some in the past who thought that was not necessary.

It still isn’t. Microsoft could just as easily push out an update that says all applications running on Windows 10 must have a valid Microsoft signature from the Microsoft Store.

Then MS could enforce that requirement by mandating that Secure Boot, with MS’ key installed as a trusted signer, be enabled to receive all future Windows Updates including security patches. MS could also push manufacturers to issue firmware updates that disables removal of MS’ key, force Secure Boot to be active at all times, and enforce firmware downgrade / upgrade protections with manufacturer signed updates only.

It’s not like there isn’t precedent for these requirements. MS enforces these requirements already with ARM devices. Apple enforces these requirements with iOS devices. Google enforces most of these requirements with Chrome OS devices, and some of them with Android devices. Let alone every modern game console.

All of this can be done without legal intervention. It’s really just MS not wanting to upset the neckbeards too much that prevents MS from doing so. After all it’s the neckbeards that keep MS’ shit working for the general public, and if MS pisses them off too much they’ll start installing other things to break MS’ control or remove it entirely.

PaulT (profile) says:

Re: Re:

" I can only hope that whatever judge allows something like this is very, very careful otherwise we’ll end up relying on the beneficence of a corporation for who they attack."

Fortunately, it’s not the 90s any more. Microsoft have high quality, robust and well supported competitors in every business they operate it, and can be easily bypassed in all sectors if required.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...