Tightening the Screws

Look out, Waledac botnet. Microsoft isn't done with you yet.

Not content with merely disabling the botnet's lines of communications, Microsoft this week asked a federal court for permission to serve subpoenas on Internet service providers and set up a system to capture IP addresses that contact the domains formerly used by the botnet.

The purpose: to locate the botnet's unknown human operators. "Microsoft has good reason to believe that it will be able to identify, name, and serve the 'John Doe' defendants if granted authority to conduct formal discovery for 90 days," the company told the court in a March 9 request.

Microsoft has located one of the John Does in Beaverton, Ore., and has decided that his domain was being used by an unknown third party. He apparently is cooperating with the company. The other 26 defendants, however, are thought to be in China. The judge is expected to rule on Microsoft's request next week. -- TL